Enterprise IT Identity & Access Management : 4. Solution

Major IAM Vendors

Yale Li — Tue, 01 Apr 2008 14:00:00 GMT

Vendor selection is critical in IT business. I still remember an old story when I joint big blue family last Century: a wise advice was spread among IT decision makers globally: “You will never be fired if you buy from IBM”.

It had worked for a long while. Then, people got fired. Finally, you can not buy PCs from IBM because they are sold to Lenovo. Despite of the result, this phenomenon reflects an enterprise strategy: go with the industry and market leader.

In currently IAM industry and market, a question is “who is the leader?”. My answer is none because no single vendor can provide a complete end to end IAM solution. Near a hundred IAM vendors are fighting a war to become the leader. Mergers and acquisitions happen frequently.

Before you invest on IAM projects, you should be aware of major IAM product vendors. Just like buying a car, you will have more choices if you know all major auto makers. I have gathered most major IAM vendors in following list (in alphabetic order):

A10 Networks - http://www.a10networks.com

Abridean (bought by nCiper) - http://www.abridean.com
ActivIdentity (renamed from ActivCard) - http://www.actividentity.com
Alacris (bought by Microsoft) - http://www.microsoft.com/windowsserversystem/clm
Aladdin - http://www.aladdin.com
ASG - http://www.asg.com
Authentify - http://www.authentify.com
Avatier - http://www.avatier.com
Axalto (see Gemalto) - http://www.axalto.com
Bayshore - http://www.bayshore.com
BEA - http://www.bea.com
Beta Systems - http://www2.betasystems.com/en
BHOLD - http://www.bholdcompany.com
BindView (bought by Symantec) - http://www.bindview.com
BMC - http://www.bmc.com
BNX Systems - http://www.bnx.com
Bridgestream - http://www.bridgestream.com
CA - http://www.ca.com/

Centrify - http://www.centrify.com/

Citrix - http://www.citrix.com
Courion - http://www.courion.com
Credentica - http://www.credentica.com
Datapower (bought by IBM) - http://www.datapower.com
Digital Persona - http://www.digitalpersona.com
Enatel - http://www.enatel.com
Entegrity - http://www.entegrity.com
Entrust - http://www.entrust.com
Epok - http://www.epokinc.com
Eurekify - http://www.eurekify.com
Evidian - http://www.evidian.com

Fastpass - http://www.fastpasscorp.com

Fischer Int’l - http://www.fischerinternational.com
Gemplus (see Gemalto) - http://www.gemplus.com

Gemalto (merger of Gemplus and Axalto) - http://www.gemalto.com
GlobalSign - http://www.globalsign.com

HID - http://www.hidcorp.com

HP - http://www.hp.com

IBM - http://www.ibm.com

Identity Engines - http://www.idengines.com
Imanami - http://www.imanami.com
Imprivata - http://www.imprivata.com
Indala - http://www.indala.com
Jericho Sys Juniper - http://www.jerichosystems.com

LogicTrends - http://www.logictrends.com

Maxware - http://www.maxware.com
Microsoft - http://www.microsoft.com

Mirapoint - www.mirapoint.com

M-Tech - www.mtechit.com

nCipher - http://www.ncipher.com
NetIQ - http://www.netiq.com
NetPro - http://www.netpro.com
NeuStar - http://www.neustar.biz
Novell - http://www.novell.com
Oblix (bought by Oracle) - http://www.oracle.com/oblix
OctetString (bought by Oracle) - http://www.oracle.com/octetstring
Omnikey - http://www.omnikey.com
Oracle - http://www.oracle.com
OSM - http://www.cosuser.com
Paramount Defenses - http://www.paramountdefenses.com

Passlogix - http://www.passlogix.com
Persistent Sys. - http://www.Persistent.com
Philips - http://www.philips.com
Ping Identity - http://www.persistentsys.com
Proginet - http://www.proginet.com
Protocom (bought by ActivIdentity) - http://www.protocom.com
Quest - http://www.quest.com
Radiant Logic - http://www.radiantlogic.com
Red Hat - http://www.redhat.com
RSA Security (bought by EMC) - http://www.rsasecurity.com
SafeStone - http://www.safestone.com
Secured Services - http://www.secured-services.com
Securent - http://www.securent.net

SecurIT - http://www.securIT.biz
Sentillion - http://www.Sentillion.com
Siemens - http://www.siemens.com
Sun - http://www.sun.com
Sxip - http://www.sxip.com
Symantec - http://www.symantec.com
SymLabs - http://www.symlabs.com

Thor (bought by Oracle) - http://www.thortechnologies.com
Trustgenix (bought by HP) - http://www.trustgenix.com
Valicert - http://www.valicert.com

VASCO - http://www.vasco.com
Veridicom - http://www.veridicom.com
Voelcker - http://www.voelcker.com
ZeroKnowledge - http://www.zeroknowledge.com

I understand it is not practical to review every product of every vendor through an individual effort. In order to rate vendors fairly, I encourage you to join the community and post your comment if you have experience with any vendors and their products.

Microsoft Internal Solutions

Yale Li — Thu, 01 Jun 2006 23:00:00 GMT

Micorsoft IT has implemented several internal IAM solutions and here is a list of links.

Enabling Cross-Forest Identity Management with Microsoft Identity Integration Server 2003:

http://www.microsoft.com/technet/itsolutions/msit/deploy/cfimwiis.mspx

Ensuring Identity Consistency at Microsoft:

http://www.microsoft.com/technet/itsolutions/msit/security/ensidcon.mspx

Structured Active Directory Schema Management at Microsoft:

http://www.microsoft.com/technet/itsolutions/msit/deploy/adschemamgmt.mspx

Group Policy Object Infrastructure Management at Microsoft:

http://www.microsoft.com/technet/itsolutions/msit/security/grppolobjectmgmt.mspx

Managing Active Directory at Microsoft:

http://www.microsoft.com/technet/itsolutions/msit/valuecard/managead.mspx

Microsoft Customer Solutions

Yale Li — Thu, 30 Mar 2006 03:00:00 GMT

If no product is available (or satisfies your needs) in the marketplace, you may have to build something yourself. Currenlt, I am unable to post my own custom IT IAM solutions (such as group management, remote access management, smart card management, password mangement etc.) because they are pending patent application. I recommend you check out following links for other customer solutions at Microsoft.

Microsoft - Microsoft Identity and Access Management Series:

http://www.microsoft.com/technet/security/topics/identitymanagement/idmanage/default.mspx?mfr=true

Microsoft Consulting service - Zero Touch Provisioning:

http://www.gotdotnet.com/workspaces/workspace.aspx?id=cba3e1ea-1148-41f6-baf0-8953c68eabf1

Microsoft Identity Integration Server 2003 Enterprise Edition - InfoWorld Test Report

Yale Li — Wed, 29 Mar 2006 01:00:00 GMT

Of all the contenders here, MIIS (Microsoft Identity Integration Server) 2003 stands out in two ways. First, it's by far the cheapest, at least at first glance (more on that later). Second, it's unique in leveraging several features of Windows, as well as other Microsoft tools, to accomplish tasks other identity management servers handle alone.

For example, publishing our corporate white pages took only a few minutes using Windows SharePoint Services and AD. One of our requirements was that only HR personnel be able to see birth dates and Social Security numbers through the intranet directory. As it turned out, Microsoft didn't even need to set up special permissions within the white pages because SharePoint can respect AD permissions.

MIIS was needed here only to provide the self-service password change function. MIIS includes an ASP application that integrates with SharePoint for this, allowing users to change their SSO passwords and have the change pushed out to all of the applications they use. Even cooler, you can link this app not only to the SharePoint white pages but also to Windows desktop-based password changing tools, so users can change the password for all their network resources from Ctrl-Alt-Del or User Accounts in the Control Panel.

The only potential stumbling blocks for Microsoft in our Windows-centric test network were the Linux-based e-HRMS and webERP applications. Microsoft managed SSO the same way for both apps, using neither Windows nor MIIS but a $600 third-party MIIS add-on called Centrify DirectControl.

DirectControl agents turned each Linux system into AD clients that used the Kerberos ticket associated with Harry's AD authentication to manage log-ins to e-HRMS and webERP. The upside is that it worked. The downside is that -- as opposed to Windows apps, which can receive authorizations from MIIS -- the Linux-based applications still needed to be configured with a Harry log-in.

Ironically, Microsoft stumbled a bit during our Fergenschmeir AD migration. Company engineers managed the initial cross-domain trusts easily enough (again using AD tools, not MIIS), but the directory migration itself, which they tackled using ADMT (Active Directory Migration Tools), required several attempts before they figured out the right syntax. This served to illustrate how many different skill sets Microsoft requires versus some of the other vendors in this roundup. Both Novell and Sun, for example, required only experts in their identity management solutions to step through all our scenarios. Microsoft required knowledge of MIIS, AD, Exchange, and a couple of third-party tools as well. And here's were additional costs may arise when implementing Microsoft's solution.

Microsoft used the second third-party tool, NetPro MissionControl for MIIS, in the security portion of our test. Because MIIS continuously monitors all accounts on the network, it had no problems detecting Harry's violation. Microsoft merely configured an MIIS rule to forbid all admin accounts created outside of MIIS. As soon as Harry created his illegal account, MIIS spotted and disabled it. Fast.

But MIIS couldn't easily tell anyone about Harry's faux pas. Using MIIS alone, finding the violation requires sifting through reports. NetPro MissionControl provides the alerts administrators need to take swift action.

Thor XellerateIM 8.0 - InfoWorld Test Report

Yale Li — Thu, 23 Mar 2006 07:00:00 GMT

During the months we spent planning for this test, we had two five-minute phone calls with Thor Technologies. The first was to invite them to the test, and the second was to discuss the test scenarios. Their response after reading the test plan was simply, "OK." This worried us quite a bit, given the numerous lengthy conference calls and level of detail that all the other players demanded. Our concern only grew the first morning of the test, when Thor's lone engineer opened her laptop, downloaded the MySQL Java connector, and began writing all the custom connectors on the fly.

We needn't have worried. Although Thor clearly had done the least preparation, it simply nailed the test, running quickly and confidently through every test scenario without a hitch, and even completing all the extra-credit portions with ease. XellerateIM is simply very well done.

Thor's approach is largely agentless. The company prefers to use external connectors to tie in various systems rather than require agents to be installed on every server, which is quite slick but also requires legwork. The Thor engineer toiled for more than two days to bring together the AD and MySQL-based HR system -- and to create all the necessary connectors to all the managed resources.

The Thor integration tool for creating connectors and managing databases and directories isn't quite as straightforward as IBM Tivoli Directory Integrator, but it offers a similar toolset. As with IBM's tool, Thor's can be used to create one-time or recurring connectors. After all the various data sets had been mapped and the database integration completed, this same tool performed the reconciliation tasks that brought changes from the HR system into play.

The Web GUI is as efficient and intuitive as any identity management interface we've seen -- which isn't saying all that much -- providing a nice portal to corporate directory information as well as administrative and user self-service functions. The JBoss (Profile, Products, Articles) and Oracle back end proved very responsive, even when running on the Dell (Profile, Products, Articles) Inspiron 700m laptop that doubled as the primary workstation for Thor's engineer.

The auditing and reporting functions of Xellerate are also well-designed and well-implemented, and they include the ability to notify admins of aberrations on reconciliation runs. After Xellerate discovered Harry's unauthorized admin account, it not only removed the account but alerted us to the violation. Although Xellerate includes a relatively thorough reporting engine, integration with Crystal Reports is also possible.

Throughout the test, it was obvious that Thor has identity management down pat. The downside is the cost: $250,000 for the solution we tested in the lab for 2,700 users. It's a steep price to pay, but Thor can back it up.

Courion Enterprise Provisioning Suite 7.20 - InfoWorld Test Report

Yale Li — Thu, 23 Mar 2006 06:00:00 GMT

Courion Enterprise Provisioning Suite 7.20 includes ProfileCourier, a user-profile store; PasswordCourier, a metapassword repository; and ComplianceCourier, a policy-control module aimed at tying the other modules together for managed security.

Courion was the only vendor to bring a full partner to the test, namely Citrix and its Citrix Password Manager. On the other hand, this allowed Courion to be the only vendor to demonstrate true SSO (single sign-on), in which global passwords were used to automate log-ins across all systems.

Installation of the Courion suite on our test network began with AccountCourier and Citrix Password Manager. Citrix created a complete log-in credential store across all installed applications and linked up with AccountCourier, which allows administrators to apply policies and rules on the whole.

In practice, users see none of this. We merely saw what turned out to be the most handsome intranet template in the whole review. Courion merely slapped a fake TCPIP Corp. logo on its pages and rolled on.

Courion also demonstrated a wizard-based user startup process -- which is lengthy but editable -- that records all required user information and creates or modifies that user's account. As soon as Harry answered all of these questions and defined his new password, the combination of Citrix and the Courion suite enabled that password for SSO across all of Harry's assigned resources -- desktop, e-mail, and webERP.

SSO happens quickly because Citrix's app is running as a Web service on a dedicated system in the domain. It receives an SPML (Service Provisioning Markup Language) request from the Courion suite -- regarding Harry's log-in credentials -- and responds to that request with the appropriate password. Citrix can be keyed to a directory for this purpose, to a database, or any combination. Some of the other solutions offer this basic functionality, but they're much more rigid about the resources their systems require to complete these tasks, such as directory servers or databases that must be used as credential repositories.

Many of the solutions managed the provisioning workflow process via a Web interface, using e-mail simply as notifiers -- "You've got an approval task waiting; please log in and take care of it." Courion's suite managed everything inside of e-mail with no need to log in to an underlying Web application. This type of integration isn't trivial, however, so expect some programming to take place in real life in order to achieve it.

Courion Enterprise Provisioning Server hit a snag when merging the Fergenschmeir and TCPIP directory information. The product certainly had the necessary tools, but Courion's engineers weren't able to solve a programming problem quickly enough to complete the migration in the time allotted. This served to illustrate one drawback of Courion's ultraflexible solution: complexity.

The suite also stumbled when Harry went bad. In this test, Harry creates an account in AD using a stolen admin password. Other solutions detected and disabled the unauthorized account immediately. Courion Enterprise Provisioning Suite took a more circuitous route to finding the problem: by running a reconciliation process against its directory store and listing policy violations in a report. Sure, you could run reconciliations fairly frequently, but there are system performance issues to consider. Finding Harry's rogue account in real life might take longer than you'd like using Courion's solution.

Overall, Courion Enterprise Provisioning Suite offers impressive flexibility and tight integration with existing infrastructure. Credential stores can be separate databases, existing directories, or combinations. Workflows can integrate with your applications directly using existing APIs.

Novell Identity Manager 2 - InfoWorld Test Report

Yale Li — Thu, 23 Mar 2006 05:00:00 GMT

Novell's identity management solution relies heavily on the company's directory server, eDirectory, which does a fine job as an identity vault. Building on eDirectory to incorporate directory information from across the enterprise, Identity Manager takes care of the rest.

You'll find all the bells and whistles in Identity Manager 2, including password management, role-based provisioning, cross-application user management, user deprovisioning, and corporate white pages functionality. Furthermore, Novell has probably the most intuitive and polished user interface of the bunch.

Running through Harry's ups and downs revealed some clear benefits of the Identity Manager suite. The eDirectory and Identity Manager combo tied all of our disparate data sources together, allowing for as much flexibility and granularity as most enterprises require.

Identity Manager handles these tasks largely with administrator-defined identity policies, which allow admins to manage complex application relationships and workflow. All this information is pumped through a two-lane highway between the Identity Vault and the subordinate applications on the network. All this, of course, depends on Identity Manager Drivers, which are the agents needed to manage all applications. Communication among Vault, Drivers, and Identity Manager is based entirely on XML.

With the exception of Novell's fairly granular workflow capabilities, this is all standard stuff. And though the Identity Manager implementation went smoothly, there wasn't much to differentiate it from the others save Novell's carefully designed, glitzy user interfaces. Defining things such as the corporate white pages or the HR-to-IT workflow that our tests required was done in a slick Web-based administration tool that offered speed and customizability.

We'd seen this before, but Novell had a definite edge in the UI department. In fact, we were already sufficiently impressed, and then they pulled out Designer.

Designer gives the Novell solution a definite ooh-aah factor not found in any of the other products here, but it's important to note that this is an optional add-on. Fortunately, right now it's a free, optional add-on, and if you're using either eDirectory or Identity Manager, we highly recommend you download it ASAP.

Based on the Eclipse framework, Designer allows administrators to lay out almost the entire identity implementation visually and then drill down for configuration. Designer configures the entire Identity Manager front end using portlets, allowing administrators not only to modify the look and feel of each portlet (for easy integration into an existing intranet design) but also to modify each portlet at the field level -- in effect deciding exactly what users do and don't see one field at a time. Even better, Designer allows much of the configuration to be done in a simulated sandbox mode. That means you could design an identity implementation blueprint and play what-if games by altering underlying systems or configuration settings. Novell even added version control to make those games easier.

In the end, Novell conquered our lab scenario with few hiccups and went on to finish all the extra-credit tests, including Lotus Notes and z/OS integration, Web GUI- and e-mail-based workflow provisioning, and populating our e-HRMS database from AD, all handled centrally from the smooth iManager console.

When Harry turned naughty, Identity Manager found his illegal administration account so fast we didn't even have time to fully provision the account. Harry was immediately dumped into the Illegals group, which not only disabled his admin access but also kept a handy record of the attempt. It did not send us an alert, however.

IBM Tivoli Identity Manager 4.6 - InfoWorld Test Report

Yale Li — Thu, 23 Mar 2006 04:00:00 GMT

To reach into the various moving parts of our enterprise, ITIM (IBM Tivoli Identity Manager) 4.6 used custom agents that we installed on every managed resource, including our AD domain controllers, database servers, and so forth. The agents hold a reasonably small footprint and require minimal configuration. IBM says that many of its agents don't need to be installed on managed resources, but can manage multiple resources remotely from a single server.

Before any identity management can occur, existing HR applications and the directory must be integrated. For this task, IBM used TDI (Tivoli Directory Integrator), a Java application that functions as an intersection of identity data, both for initial integration and as a permanent connector when needed. TDI runs on Linux and Windows and offers a clear view of any managed resource. In the test, this tool was primarily used to map data from the HR database to AD -- and vice versa -- providing the IBM engineers with a fluid way to manipulate the data.

By pulling in MySQL Java connectors to the TDI tool and working with AD via LDAP, an IBM engineer was able to quickly map database fields to LDAP fields and create a custom connector to move data between them in whole or in part based on triggers, schedules, or manual intervention. TDI handled all integration tasks with aplomb, providing simple methods to reformat disparate data, such as consistently formatting phone numbers, Social Security numbers, and birth dates. We were quite taken with this tool.

The test scenarios caused IBM some fits and starts. At times their own interface seemed to stymie the IBM engineers, but those moments were brief. Overall, every aspect of the test was completed satisfactorily, including the extra-credit portions of integrating the z/OS and Lotus Notes servers. Then again, those are IBM products.

The relative immaturity of the ITIM Web GUI was notable throughout the test. This interface allows admins to create and modify end-user pages, drawing on a wide array of page layout and functionality choices. For instance, it's relatively simple to declare the database fields a user sees when viewing company directory information or modifying his or her personal data, and whether certain fields may be modified at all.

The overall navigation of the UI, however, isn't so clear. In many places, the only way to construct certain actions is to plug JavaScript code snippets into small text fields in the UI. This provides some power, but it's also significantly more complex and substantially less elegant than we expected. At times it seemed like trying to open a window with a brick. Also, the solution is bereft of any undo capabilities. After you've configured and begun running an action -- say, to reconcile AD data with an HR database -- you can't easily step back to a previous state; you can try to revert only by constructing another action. On the plus side, a simulation feature allows you to try policies before enabling them.

The workflow functions of ITIM are top-notch. A GUI representation of a workflow is presented in a Java applet, allowing users to drag elements around to create approval steps, assign tasks, and so forth.

The reporting engine of ITIM is vast and complex. It's possible to generate reports containing nearly any data present in the system, but again, it's a little challenging to assemble the data in a logical form. Crystal Reports integration is present, however, and Crystal would be our reporting tool of choice in an actual implementation.

Sun Java System Identity Manager 5.5 - InfoWorld Test Report

Yale Li — Thu, 23 Mar 2006 03:00:00 GMT

We didn't see much whizbang innovation in Sun Java System Identity Manager 5.5, but we did find a level of reliability and maturity that's rare for this segment. Sun's entire identity management suite consists of Access Manager, Directory Server Enterprise Edition, Federation Manager, Identity Auditor, Identity Manager, and Identity Manager Service Provider Edition. Our test required only Identity Manager, Identity Auditor, a MySQL database used as the VIM (Virtual ID Manager) repository, and pieces of Access Manager for SSO.

As opposed to the solutions we've discussed thus far, Sun's is completely agentless. Its technology takes full responsibility for monitoring and interacting with existing directory servers and applications without the need to deploy agents. For certain technologies, such as AD or Novell's directory, Sun deploys a black-box style software gateway for data translation, but this is not an agent, nor does it require changes to target systems in order to function.

In practice, this looked very slick. To configure all our test resources, rules, users, and everything else, Sun dumped its Smart Forms technology into a Web-based, wizard-driven configuration tool that maintained the look and feel of our TCPIP intranet. You still need to know what you're doing; several times during our test things didn't work properly because the Sun marketing engineer missed a few system settings, requiring a local Sun engineer to intervene. But if you know what to feed the system, Smart Forms really speed things along.

The first step in a Sun Identity Manager implementation is to populate the VIM that drives the rest of the system. The TCPIP AD migration to the VIM took some configuration time on Sun's part, but it ran properly the first time. After this had been completed, publishing white pages was easy.

Subsequent testing ran smoothly for the most part, beginning with hiring Harry. Sun Identity Manager enabled an ActiveSync feature -- running on a separate Tomcat server -- that acts as a listener on any target app. As soon as Harry was entered in e-HRMS, ActiveSync saw the changes and propagated them to the VIM and all appropriate systems. Keying specific e-HRMS data fields -- home phone number, Social Security number, date of birth -- to specific data values back in the metadirectory, Sun's solution allowed for easy matching through the Smart Forms interface to the same fields in other systems such as AD. Here is also where we saw some pieces of Access Manager, as this product was required to manage Harry's SSO features.

Sun Identity Manager also handled the optional workflow approval process -- PC request, phone extension request, and so on -- based on Harry's hiring, prompting our Exchange server to generate an e-mail notification to the relevant approvers. After the approvers have received their e-mails, they log in to Identity Manager and manage the approval process from there.

Closed systems, such as Courion's and Thor's, also worked their approvals within a Web application interface, relying on e-mails only as alerts. Novell's and Sun's solutions can work either way.

After TCPIP purchased Fergenschmeir, Sun Identity Manager was capable of managing the AD migration without requiring any use of Microsoft's AD tools. Instead, Sun configured an Identity Manager user ID and then kicked off the Fergenschmeir system discovery. This proceeded with a couple of hiccups because Fergenschmeir's tree was protecting administration and similar accounts from being migrated.

When it had been tweaked, all the Fergenschmeir information was translated into the VIM and then dropped into TCPIP's AD tree. The sexy thing is that, after discovery, the whole migration process worked like a big wizard. All told, Sun Identity Manager had little trouble connecting to our disparate systems, and our extra-credit Notes and z/OS integrations posed no trouble at all.

Oracle Identity Provisioning - InfoWorld Test Result

Yale Li — Wed, 22 Mar 2006 18:00:00 GMT

Failed test and no result. However, Oracle bought Thor recently so please see Thor Test Report.