Blog

What's Your Identity Management Consulting Firm Hiding?

Based on my experience, most Identity and Access Management (IAM) consultancies - even the "Big 4" - tend to keep clients in the dark.  Due to the complexity of IAM projects and multiple stakeholders, it's easier to hide the gory details of a project gone wrong until its too late.  Unfortunately, this approach has given the IAM services industry a black eye. 

As an organization, we are big believers in transparency for our clients. Transparency not only aids teams to work through project curve balls, but it also empowers the teams to spot risks collectively in order to prevent them from ocurring in the first place. 

As I write this post, Identropy is now in its' fourth month of everyday usage of our Project Management Information System (PMIS). When I initially joined the team, we were using a mix of disparate tools: SharePoint for document management, a Time Tracking application, MS Project and Excel files for resource and expense management. Individually considered, our disparate parts did what they were supposed to, although none of these tools really talked to eachother.

In our quest for increasing transparency for both ourselves and our clients, the lack of integration of our various systems caused significant overhead for our PMs.  They had to spend time to create the level of transparency we wanted our clients to have.  In order to address this inefficiency, we decided to look for a better solution: a single place for our customers to have total visibility into our IAM project progress, cost, risks, documents, etc.

Simply stated, Identity & Access Management projects require strong and active project management. And while technology is never a good substitute for solid processes, our experience is that an effective Project Management Information System (PMIS) can put your IAM project on steroids by increasing transparency into the state of the project.

Since I had experience using an Enterprise wide PMIS tool, I led the effort of defining our requirements and identifying likely candidate solutions. In one of my earlier blog postings, I wrote about the importance of a good Requirements Traceability Matrix. So, the first thing I did was begin working with my team to start evaluating just what requirements we really had for a PMIS. I constructed an RTM and began consolidating requirements into various components such as "Financial Tracking" "Scheduling", "Calendars", etc...

Our key criterion boiled down to 3 major points:

1. Proper Task Sequencing: In a typical IDM project, one task must drive another. Without this, you simply have a glorified to-do list, which any IDM PM knows is the kiss-of-death for the project.
2. SaaS Based Solution: Identropy is a zero IT footprint company. That means, unless absolutely necessary, we don't have anything on our premises.
3. Integrated Time Tracking, Doc and Expense Management: By integrating all of these components, we would have greater insight into projects, resource utilization, and how much we were spending.

The fun part in performing requirements assessments is discerning marketing hype from reality. (We have a lot of experience doing this for our clients when selecting an IAM platform!). The finalists demonstrated complete packages in terms of polish, solution feature sets and, to some degree, cost flexibility. Ultimately, Identropy chose Clarizen to partner with to provide our PMIS solution, for pretty much the same reason most organizations select Identropy as a partner. While the Clarizen solution is top-notch, the overriding-factor was and still is the people and their philosophy. From our account rep (Jacqueline, call her if you need a PMIS!) to our product support folks (Gil and Josh), it would be almost impossible to find people who truly care as much about honesty and earning a client's business as they do.

The impact of the overall solution has been great. Our clients have welcomed the increased visibility, which has allowed us to forge a closer partnership with them. It has increased communication between consultants, resulting in fantastic conversations regarding our implementation methodology. Lastly, it has served as a differentiator for us in front of potential clients that shows the practical angle of our corporate philosophy regarding transparency.

Are MSSPs the future of IDaaS?

Or is it the reverse: Is IDaaS the future of MSSPs?  That is the question...

For some time now, I have been talking about Identity as a Service (IDaaS) and discussed a few approaches to IDaaS for Enterprise Identity Management, which truly set a baseline for what we believe is the next paradigm in Identity and Access Management (IAM): the shift towards managed services, away from traditional Enterprise deployment models.

Are we talking about a paradigm shift?

I believe we are.  Let me illustrate with a few questions:

1. Have you been involved in, or responsible for, the deployment of an IAM solution?
2. Has this deployment succeeded in meeting the business objectives and stayed within the timelines and estimated budget?
3. Has your organization needed only one attempt to implement an IAM solution, without re-architecting, replacing technology vendors or system integrators, etc?
4. Is your organization able to measure the return on investment (ROI) on this initiative?
5. Lastly, was your ROI positive?

After over 12 years of experience deploying IAM solutions, large and small, I have seen only a small percentage of people who answered these questions in the affirmative. Even though the number has increased over the years, it is still not as high as most would want or expect, given the availability and maturity of IAM technology.

Why is this so?  Many respondents cite issues with the technology choices underpinning the solution. Others point to a lack of alignment and sponsorship between technology and business stakeholders. Some say that there were no clear business objectives and expectations were not properly managed.  A few venture that IAM solutions are complex and difficult to implement and underestimating their size or complexity proved a recipe for disaster.

All of these are valid reason.  But does this mean that most IAM solutions are doomed to fail?  The answer is not very encouraging if you follow "traditional" deployment approaches. To date, most if not all IAM deployments follow a scenario like this:

Faced with requirements from the business, IT selects a technology vendor, allocates the environment in which it will run (hardware, software, network, and data center), and in most cases engages a system integrator to help design the architecture, map the business requirements and processes, and implement the solution.  Once deployed, IT is then tasked with hiring, retaining, or developing the qualified personnel it needs to operate the infrastructure.  As we discussed in a recent blog post titled "Top 10 Common Pitfalls of an IAM Initiative", this combination of factors causes most projects to run longer and cost more and, in many cases, do not meet the business requirements they were meant to address. The organization is then left with a capital expenditure that needs to be recovered over time.  Therefore, IT embarks on programs looking to integrate more applications and absorb more environments (M&A, intranet, extranet, etc.)-and their success rate increases only marginally.  In many cases, attrition of the internal personnel further complicates the ongoing success of the deployment.

Sound familiar?  The fundamental issue with the "traditional" approach is that the organization's best interest is not well aligned with that of the partners it relies on to undertake the deployment.  The organization is at the center of the storm, looking at mediating and balancing the interests of vendors, system integrators, and, its own staff, who are typically not qualified to deploy an IAM solution or aware of its complexities.

This is why a new approach is needed-one that aligns more closely with the interests of the organization.

 In my view, this paradigm shift is the motivation for IDaaS.  One could also say that the economic conditions of the last two years, combined with the rise of the Software-as-a-Service (SaaS) model have been catalysts for this new direction.

But what is different about IDaaS?

The idea with IDaaS is that rather than having the organization strike a balance among the interests of vendors, system integrators and its own staff, an external entity acts as a trusted provider, entering a long-term relationship that is gauged by measurable results (i.e. SLAs, performance metrics, delivered milestones, etc.)

From the organization's standpoint, this model can alleviate the need for selecting, purchasing, and depreciating IAM technology; building, maintaining, and operating the IAM infrastructure; customizing and integrating various products; and staffing, training, and retaining personnel to manage the IAM environment, all of which will immediately translate in a reduction in costs.

The idea is to engage a trusted provider to build, integrate, deploy, and operate an IAM infrastructure that suits the organization's requirements. This approach should reduce upfront costs (not needing to procure hardware and software and their respective maintenance annuity), which are now blended as part of the managed service.  Likewise, by not having to recruit, train, and retain specialized staff to operate the environment, the model expedites deployment timelines and reduces operational costs and risks to the organization. For the provider, the need to reduce the implementation timeline and create the capability of a repeatable model forces it to streamline the deployment process and ensure that it is done with such quality that its operation after deployment requires minimal involvement. In the end, these elements accelerate time to value.

Under this model, the trusted provider is involved in the delivery of the IAM solution, which is then governed by established parameters and service standards. Whether it is hosted on premises or outsourced (in the "cloud"), in the end the organization sees immediate and measureable value for the services they purchase-in a predictable and simpler manner.

Well, this kind of sounds like an MSSP model?

Bingo. This is precisely our prediction: the IAM deployment model as we know it is already being transformed from a highly complex approach toward a simpler one. It does not mean that IAM technology is simpler; it just means that the deployment model needs to get simpler. 

"Everything should be made as simple as possible, but no simpler." - Albert Einstein

From my standpoint, this is just a natural evolution, and while it will take time for it to pan out, it is already at play, as evidenced by events like these:

• April 27, 2010: Verizon and Novell Unveil Cloud-Based Security Solution - an interesting quote from the announcement grabbed my attention: "Additionally, as part of this agreement, Verizon will be Novell's preferred identity and access management managed service provider."
• December 12, 2009: SecureWorks Expands its Global Operations and Services with the Acquisition of UK-based dns Limited - here are two relevant quotes from the announcement: "For ten years, dns has been delivering a wide range of security services to its clients, including an innovative Identity and Access Management Service"; and "SecureWorks is expanding the scope of its service offerings with the addition of dns' Identity and Access Management Practice which will benefit clients worldwide."
• May 14, 2007: Verizon Business acquires Cybertrust - and the quote: "Cybertrust's services include identity management, managed security services, vulnerability/threat management, security certification programs and a range of professional services..."

Similar events have been taking place for some time, such as IBM Managed Identity Services (part of IBM's Managed Security Services) and BT's Identity Administrations Solutions.

If you follow this logic, you will see that two paths are intersecting:

1. Established MSSPs are adding IAM to their model because they want to differentiate and grow their role as a trusted partner to their clients or are responding to client pressure.
2. IAM solution providers, and even software vendors, are evolving and embracing the SaaS model, and as such are starting to morph into MSSPs with a focus on identity, or as I like to call them: MISPs (for Managed Identity Services Providers)

Our prediction

Over the next three years, IAM will shift from the traditional deployment model (buy, host, deploy and operate) to an IDaaS model, making the latter the default. IAM technology will be mainly designed to enable IDaaS deployment models, and customers will most likely procure IAM via their MISSP of choice.

Approaches to IDaaS for Enterprise Identity Management

Happy New Year 2010 to all. Best wishes in the year that just starts.

I will start this year's first posting by acknowledging Burton Group's (just acquired by Gartner) Bob Blakley September 30^th, 2009 vantage point titled: "2010 Identity and Privacy Strategies Planning Guide: A Market in Transformation", which has been an excellent reference in helping me shape some of my thoughts for this article. I think it is a great document with great insights on current trends in identity management.

My prior blog posting introduced a definition for Identity as a Service (IDaaS), setting the stage for this posting, which discusses models for deploying IDaaS, from the perspective of the entity that consumes the Identity service, in this case an organization (as opposed to an individual). The assumption will be that the entity and the service provider are two separate organizations, and moreover, two separate legal entities. In a way, this perspective is no other than the Enterprise identity management.

In addition, for this discussion, we will try not differentiating the kind of Identity services being provided (provisioning, registration, authentication, etc.), or which user population within the entity it is intended (i.e. employees, contractors, suppliers, customers or business partners). The idea is that the approaches should be applicable to all of them.

Defining Managed IDaaS

In this article's context, Managed IDaaS is an approach to IDaaS in which the entity employs one or more separate legal entities as service providers. The service provider is contractually bound to specific terms that define how the service is performed, and it governs its adherence to these terms through mutually agreed and measurable service level agreements (SLAs). In other words, Managed IDaaS, is the scenario in which an organization consumes Identity services from an external service provider. These services can range from operating a provisioning infrastructure, to verifying the identity of a person, to providing strong authentication or federated authentication credentials, to managing passwords;  and they can be provided both internally (i.e. within the organizations Intranet) or externally (i.e. through an extranet portal), and can physically reside on-premise or in the cloud, or a combination thereof.

Two main variants of Managed IDaaS are common today, and as Gartner forecasted, they should trend upwards in adoption within the next two years. They are mainly determined by who is responsible for and who owns what part of the Identity service infrastructure, which in many cases correlates directly to where the infrastructure component actually resides:

• Cloud IDaaS - where the service provider owns and operates the entire Identity service infrastructure, and provides it to the entity in a pure SaaS manner, without any sort of footprint or backend integration with the entity's IT infrastructure. Identity information is exchanged in an offline (manual or batched) manner.
• Co-sourced IDaaS - using Wikipedia's definition of co-sourcing, this is an approach in which the Identity service interacts directly or through some technical footprint with the entity's IT backend infrastructure (directories, repositories and other target systems). The entity and the service provider have a shared responsibility for building and operating the Identity service, the balance of this responsibility determines distinct scenarios, which we will focus in more detail in this article.

To better understand Managed IDaaS, it is useful to decompose it into building blocks. The diagram on the left provides a high-level structure for an Identity service, made up by three main functional areas:

Consumable Identity Service - this is the end point of the service, which interacts and integrates with the consuming entity, whether an end user interacting through a web UI or an application or repository that exchanges information with the service. This is the area in which the specific logic and functionality provided by the service is actually "wired".

Identity Management Stack - this is the middleware of the service; the software modules that provide the basic functionality to manage and process identity information.  The diagram shows an arbitrary sample of the software components that make up the identity management stack. It is not mean to be an exhaustive list, but rather a representative sample. Nishant Kaushik has done a great job explaining the identity services framework, which instantiate the identity management stack.

IT Platform - this is the technical backbone of the service. The basic IT computing infrastructure that is not specific to identity management, but generic to any IT service.

These three basic functional areas are useful in explaining how variants of a Managed IDaaS come to life, particularly co-sourced IDaaS.

Co-Sourced IDaaS

It is a Managed IDaaS variant in which the Identity service's consumable service interacts directly with backend (or back office) IT infrastructure managed and operated by the entity. And more importantly, one in which the entity and service provider enter into a partnership in which they share some of the responsibility in building, hosting or operating the Identity service.

The diagram below illustrates four common co-sourced IDaaS scenarios, which we'll discuss next. I admit that while I have spent time thinking about these scenarios, I do not think I have articulated them in a way that clearly delineates their boundaries (if any), so I am hopeful that by venting them out, I will get very good thoughts from you.

1. All on-premise, provider operated - when the entity owns the identity management stack used to build the service, as well as the actual IT platform; and the Identity service is hosted on the entity's premise where it integrates directly with the entity's backend IT systems in the Intranet. The service provider is responsible for configuring and operating the consumable Identity service. This model is a more "traditional" Enterprise identity management deployment approach, where an organization procures the entire IT stack, and hires an external integrator to build, and possibly operate the Identity service, according to defined requirements. The organization and the integrator establish service agreements which govern roles, responsibilities, response times, escalation procedures and son on.
2. Provider hosted and operated - where the service provider hosts and runs the entire Identity service, and integrates directly with the entity's consuming backend IT systems. This scenario is seen often at organizations that outsource their IT infrastructure and operations to an IT outsourcing service provider, and the Identity services are collocated and dedicated to the organization. From a connectivity perspective, the Identity services are typically accessed via dedicated lines (private clouds, private VPN). In this scenario, the service provider is often responsible for procuring and operating the consumable Identity service, the identity management stack and the IT platform. The outsourcing service provider and the organization establish service level agreements as well as licensing agreements which ensure that the organization is entitled to use the technology infrastructure require for the Identity service. This scenario is typically single tenant for both the consumable Identity service and the identity management stack functional areas.
3. Hybrid: on-premise and in the cloud - where the service provider hosts and runs the entire Identity service in an environment hosted in the cloud, and requires some technology footprint to be deployed on-premise at the entity's IT environment to effect the integration with its backend IT systems. The scenario is one where the organization "leases" the Identity service from the service provider, which includes the use of the on-premise footprint - say a virtual or physical appliance, and access to the actual Identity service which is hosted in the cloud. From a connectivity standpoint, the appliance provides secure communication through the public Internet, and it may also provide caching and queuing to increase the reliability and responsiveness of the service. The service provider owns and runs the Identity service backbone and may adopt a multi-tenant model. The organization and provider agree to service SLAs, which will also govern how the on-premise footprint is operated.
4. All in the cloud - where the service provider hosts and runs the entire Identity service in an environment hosted in the cloud and it integrates with the entity's backend IT systems without requiring additional technical footprint, leverage secure, open standards-based interfaces over the public Internet. In this case, the organization "leases" the Identity service from the service provider, and configures its backend IT systems to communicate directly with the service. The provider owns and runs the Identity service backbone and will most likely adopt a multi-tenant model. The organization and service provider agree to SLAs under an Application Service Provider model.

In future postings, we will discuss considerations and advantages of the co-sourced IDaaS model. In the meantime, I look forward to your comments.

Defining Identity as a Service

In the midst of the holiday season, and with the anticipation and emotion that comes with the end of the year approaching, I have decided to write my first blog - an early new year's resolution perhaps. I must state that I have resisted the urge to blog for the last three years of my career for two reasons: on one end, I feared starting to blog and then dropping off and being inconsistent (just like I have been every time I started at the gym), on the other end, I dreaded becoming addicted to blogging and seeing it impact other priorities. But let's just say that I am resolved to give this a good try by sticking to some basic rules: keep the content lean but meaty, keep a constant blogging frequency, and try to be as interactive as feasible - sounds simple. Let's see how I fare (maybe I will also get in shape in the process)...

What is Identity as a Service (IDaaS)?

2009 has seen an increased interest and focus in a relatively new topic in identity management "Identity as a Service (IDaaS)", but just like any upcoming trend, it tends to be understood differently, explained differently and used differently depending on context. Burton Group provides a very concrete definition that focuses on the outsourcing of identity management, such as authentication, provisioning and attributes services. Dave Kearns has covered this topic extensively as well, under the context of "Externalizing Identity into the Cloud". My friend Nishant Kaushik defined the term in 2007 as "the notion of making identity management capabilities available as an infrastructure service to all applications in a SOA environment".

In a way, this reminds of the late 90's when the term identity management was making its foray in the world (yes I admit that I was an identity guy back then - lucky me!), and everyone had its own definition and everybody from Dun & Bradstreet to Access360 to Oblix provided identity management. And I think that the term is still misinterpreted today, though not entirely misunderstood, just like any normal teenager at this age.

So, one would wonder: why propose yet another definition for IDaaS? Well, I encourage you to keep on reading, as I think I will make my point clear, and hope to ignite good comments and discussion along the way.

With that: what is IDaaS? It is an approach to digital identity management in which an entity (organization or individual) relies on a service provider to make use of a specific functionality that allows the entity to perform an electronic transaction which requires identity data managed by the service provider. In this context, functionality includes but is not limited to registration, identity verification, authentication, attributes and their lifecycle management, federation, risk and activity monitoring, roles and entitlement management, provisioning and reporting. 

The relevance, or perhaps novelty, of this definition, is that it focuses on the interaction of four elements: the entity, the service provider (which could be the entity in some cases), the specific functionality and the electronic transaction.

The Context of IDaaS

I believe that IDaaS as a concept has seen increased interest and coverage this year, in big part due to the impact of the global economic challenges which are forcing organizations to revisit its models for adopting and implementing IT initiatives that require identity management, as well as an increased emphasis in regulatory compliance and privacy awareness.

In any case, there are some important considerations regarding the definition of IDaaS that I would like to point out:

• It is not meant to be just a technical definition. And while the definition does not conflict (I would hope) with a technical definition or architectural approaches, it is important to think about IDaaS from a legal and jurisdictional standpoint as well. In this context, the definition of ownership, responsibilities and liabilities is significant to all parties involved in IDaaS. Tom Smedinghoff, a well-known contributor to the identity management industry, has created great content and led several initiatives that are bringing the legal aspect of digital identity management at par with its technical evolution, all of which is relevant to adopting IDaaS.
• The strength, rigorousness and thoroughness by which IDaaS is provided, should be measurable in an objective and demonstrable way, such that they can convey a specific level of confidence or assurance to the parties. This in turn will translate to a risk mitigation level that the parties can agree to be sufficient for a specific type of transaction. The Identity Assurance Certification Program run by the Kantara Initiative provides a very concrete vehicle to achieving this measurement.
• IDaaS should not be restricted or misconstrued as only applying to "cloud" based models. While IDaaS is particularly relevant for cloud-based services, IDaaS could also apply to on-premise models. In fact, I argue that it is in this area where the definition is most beneficial, as organizations can view its internally-facing (and possibly internally deployed) identity management infrastructure as identity services, allowing the demarcation of service scope and boundaries that will make outsourced, on-premise, cloud-based models or any combination therein more concrete, and easier valuate in business terms. The intention is not to confuse IDaaS with "Cloud Identity" or with "outsourced identity management", since the term could apply to all these cases.
• The concept should also not be restricted to enterprise IDaaS vs. consumer IDaaS, since the notion is basically the same. Evidently, the actors, the types of transactions, the levels of sensitivity in them, and other elements will vary greatly from enterprise to consumer environments, but the notion of how digital identity management applies to each could be thought of in the context of IDaaS.

Why is this even relevant?

My motivation to introduce this definition at this point is to attempt to set a common understanding of terms, allowing us to better understand the new trends, services and paradigms in identity management that are unraveling before our eyes. As I believe that a significant shift in identity management from a monolithic model to a true services-based infrastructure, has been at play for the past 2 years, with noticeable effects only in the past 6 months.

With this shift has come some degree of confusion in the industry among identity management in the context of cloud-based services (i.e. SaaS, Infrastructure as a service), identity federation (claims or assertion based) and the more traditional enterprise deployment models, to a point where they are at times seen as independent or separate; causing people to think of IDaaS as not relevant to the enterprise facing environment or mystifying it as another "cloud" term. And in some unfortunate instances this confusion has impacted the way an organization looks at implementing an identity management solution (either by limiting the range of options that it could look at or by widening it to include the wrong set of options).

I intend to demystify this concept a bit more in subsequent blogs, and attempt to bring more pragmatism around it by explaining how it applies to concrete scenarios. In the meantime, I appreciate your comments and reactions.

SaaS Provisioning: It's About the Connectors!

Last week, Identropy launched IC2, our Identity Management gateway for the cloud.  We also blogged about the product and how it empowers current User Provisioning Systems to seamlessly connect into IC2 to manage the onboarding, offboarding and orphan account reporting for SaaS applications.

The rationale for Identropy developing IC2 centers around one simple question: What is the easiest way for a corporation to manage the digital identities of users for the multiple hosted applications that are not within their enterprise control? 

Although the move towards SaaS applications is a fundamental paradigm shift from managing enterprise applications, the core identity management problem surrounding user provisioning remains the same.  After conversations with our clients, it was apparent that the same business processes that govern the onboarding and offboarding processes for enterprise applications quite readily map to the same processes for SaaS applications. Similarly, the same role management infrastructure that is utilized for internal applications could easily serve up roles for SaaS applications.  Couple this with the following statistic from Gartner's Magic Quadrant for User Provisioning):

"...as of mid 2008, approximately 20% to 25% of midsize to large enterprises worldwide, across all industries and sectors, have implemented some form of user provisioning. An additional 20% to 25% are evaluating potential solutions..."

Conclusion? SaaS Provisioning for most organizations is all about the "connectors", or the little pieces of software that connect the provisioning workflow engine to enterprise systems like Active Directory, Oracle databases, and all the other applications in your environment.  That's where IC2 (Identity Connector to the Cloud) comes in.  It's a connector gateway that speaks an industry standard known as SPML.  By using SPML, we could connect your existing provisioning server to IC2.  On the backend, IC2 connects to your SaaS applications in the cloud.  The net result is the easiest way (think days, not months) for your organization's existing provisioning server to extend out user management to cloud applications.

More Thoughts on Identity Management Cloud Vendors

Matt Flynn has put together a list of vendors in the Identity & Access Management space who have a "cloud offering," and Identropy was included on the list for our IC2 offering.  Matt described IC2 as:

Identropy IC2 - Identity and Access Management solution for SaaS applications. Leverages existing Identity infrastructure and work flow to provision accounts to cloud applications.

Here are my 2 cents: IC2 has less to do with Access Management (or traditional WAM) and more to do with Provisioning.  In simple terms, it's a way for companies that already have a provisioning system in place that manages users for internal applications, to just plug into IC2 to extend management to SaaS applications (or technically speaking, any web application).  So basically - as of today, IC2 is geared towards customers that already have Identity Management software in place.

Other vendors, such as Conformity (from what I know, Conformity, please keep me honest) have taken a different approach. They have a complete provisioning system in the cloud, including workflow, connectors, policy engine, roles, etc.   So this approach puts them in the position of going head to head with existing IdM vendors, or target SMB clients who are searching for a provisioning system, but don't want the administrative overhead.

Identropy has take a different approach to the problem.  By speaking to our existing customers (who all have provisioning systems in place, so our market research is biased! :), we saw a need for extending out user management (onboarding, offboarding, etc.) to SaaS applications.  These customers would much rather leverage the infrastructure they spent a million dollars building rather than rip and replace the solution for a total cloud offering for Saas Provisioning and User Management.

An SPML gateway to the cloud seemed like the natural solution.  It abstracts the technical details of creating custom connectors from customers.   They also don't have to manage the connector, and it gets them up and running in no time, given that we already have a connector in place for the SaaS application in question.

Identropy Launches an Identity Gateway for SaaS Provisioning

After countless hours of working with a few of our beta customers, I am proud to announce Identropy's launch of IC2 (or IC squared), which stands for Identity Connector for the Cloud.

You can read more about it here, but the basic idea is that it's an SPML gateway (offered in both a hosted and on-premise model) that your existing Provisioning solution can plug into in order to extend provisioning out to your SaaS applications.

The coolest part of it is that as our SaaS connector library grows to cover more and more SaaS applications, all of our clients can leverage the same code base. Service offerings are great that way!

In the following weeks, we'll make sure to continue posting to give you some of the rationale for developing the solution, and a bit of a behind the scenes look into what we are doing here at Identropy. In the meantime, we'd love to hear your feedback.

Identropy's Identity Management Solutions 101 Series

Our goal is to keep you informed and highly educated on identity management solutions, trends and business.

 

Identity Management Solutions 101: User Provisioning 

 

Identity Management Solutions 101: Password Management 

 

Identity Management Solutions 101: Enterprise Single Sign-On 

 

Identity Management Solutions 101: IaaS (Integration as a Service)  

 

Stay tuned for more sessions about topics such as Deprovisioning, Cloud Computing, SOA and others.

Doing It First in Identity Management

I am so amazed when I ask myself "how did that guy do it first?". If you think about it aren't you shocked when you think about the first guy that said to himself I am going to eat that octopus or that oyster...I mean if you have ever seen an octopus or oyster you would say how do you eat that? It really doesn’t look like one of the more edible things out there but guess what it’s a delicacy (of course not for me because I’m allergic…so if you ever take me out to dinner skip the seafood).

 

That brings me to the thought of how many firsts do you get in this day and age and I must say that the list of firsts is getting shorter and shorter. Only the really smart guys are producing those firsts. I guess that Innovators will do things first. SAAS "software as a Service" and Cloud Computing seem to be the last couple of firsts that I have seen and I must say they are exciting and innovative but what’s next and who is going to do it.

 

I don’t think that I will have to go too far to find out who will be the next top innovator. Identropy was mentioned in Gartner’s Magic Quadrant as an Innovator and has consistently produced technology to improve the identity space.

 

What have we done recently to get on this list? IAAS “Integration as a Service” which has been achieved through the inception of iMIS “Identropy Managed Identity Service”.

 

Stays tuned for more briefs or take a look at it on http://www.Identropy.com/Products_iMIS/