Burton Group Identity Blog

Catalyst Europe is Coming Up Fast!

Blogger: Bob Blakley

We hit the stage for Catalyst Europe on April 19.  If you haven't already made your plans to join us in Prague, we've got a little treat for you at the end of this post.

We're going to focus this year on the emerging identity architecture.  If you're looking, you can see this identity architecture around you already, in offerings from mainstream identity vendors like Microsoft and Oracle, but also in offerings from smaller firms like Gluu, Unbound ID, Radiant Logic, and others.

The elevator-pitch version of the story is this: licensed provisioning software packages compete in a market for identity management systems.  User-centric identity providers compete in a market for identity providers.  What enterprises need is neither a market for identity management systems nor a market for identity providers - what they need is a market for identities.

Federation technology, directory virtualization, and contextual access control can be combined to create a technical architecture on top of which this market for identities can emerge.  The market for identities has many advantages, but getting there will take time and it will take work.  We'll lay out the roadmap in Prague.

If (like me) you're a last-minute kinda person and you haven't registered yet, here's your reward for waiting: use the promo code "INSIDER" during registration, and you'll get your ticket for the discounted price of only 995 Euro.

Sign up today and we'll see you there!

SPML Is On Life Support ….

Blogger: Mark Diodati

But it (or something like it) is desperately needed.

 

At Burton Group, we closely watch emerging identity standards. In particular, we pay close attention to the development and adoption of the Service Provisioning Markup Language. We have hosted two interoperability events at our Catalyst conference. We issued our first research document on SPML in early 2006—coincident with the release of the SPML v2 standard. The publishing of our second document is imminent, and it is based upon some “hands-on” work with the standard, as well as ongoing discussions with vendors, end-user organizations, and OASIS Provisioning Service Technical Committee members (past and present).

 

The primary goal of SPML is provisioning without the use of proprietary connectors. The reality is that SPML is not currently viable for building useful, standards-based provisioning services because it is too complex and places too much of a performance burden on the connector. For example, the SPML Search capability is required for most viable provisioning services, and its support is infeasible due to complexity and performance concerns. I’ll talk more about these issues (including the Search capability) in my next blog.

 

The SPML standard—like all emerging standards—requires more work. More work is required to harmonize SPML with SAML. An optional “inetorgperson-like” user schema is required to promote greater SPML adoption (the OASIS Provisioning Services Technical Committee tried to create a standard user schema when developing SPML v2, but the members could not agree on one). A simpler “real world” search capability is needed, with a limitation on the number of attributes and filter expressions. The latter two requirements should be combined into a future “SPML Simple” profile.

 

Unfortunately, there appears to be little industry support for SPML enhancements. A vicious cycle exists. Few people are using the standard, so there’s less momentum to enhance it. The IdM vendors’ participation in the OASIS Provisioning Services Technical Committee has been minimal at best since the 2006 approval of the SPML v2 standard. The last meeting of the Committee was in early 2008. None of the major provisioning vendors have developed an SPML v2-conformant product. Many of the vendors who have created commercial SPML connectors tell us that they must create specific SPML implementations for each of the major provisioning products. An SPML reference implementation does not exist, but would surely help.

 

What is the future of standards-based provisioning?

 

SPML may prevail if the industry simplifies the standard and supports it in commercial products. It may be too late to pull it out of the fire, though. Another alternative is a “pull” model—LDAP-based directory services supported by virtual directories. For example, both salesforce.com and Google provide a pull capability via LDAP. The applications query existing enterprise directories for authentication and identity information. Many organizations express concern about exposing a directory (especially Active Directory) to cloud-based applications. Burton group believes that virtual directories can mitigate these concerns. It is worth noting that neither vendor supports SPML. Both salesforce.com and Google expose a relatively simple (compared to SPML) SOAP interface for provisioning. Another path to standards-based provisioning may be SAML.

 

My colleague Bob Blakely will be speaking more about standards-based provisioning in the IdPS Telebriefing “The Future of Identity Management is Pull”.

Microsoft acquires Sentillion

Blogger: Lori Rowland

Today Microsoft announced its plans to acquire Sentillion, Inc., a privately held identity management (IdM) company based in Andover, Massachusetts. Sentillion is exclusively focused on offering identity and access management products for the healthcare industry. Its portfolio of products includes single sign-on, provisioning, context management, advance authentication, and desktop virtualization capabilities. Sentillion is well known for its single sign-on (SSO) and clinical workstation solutions. Through these solutions Sentillion enables various activities including SSO to common health care applications, proximity based authentication, advanced audit capabilities, and streamlined workflow processes. 
According to the announcement, the Sentillion portfolio will be combined with Microsoft Amalga Unified Intelligence System (UIS), a data unification tool that allows health care professionals to aggregate data across multiple patient records.  These products are a component of Microsoft’s growing Health Solutions Group. This move is no surprise as investments in healthcare technologies are expected to grow particularly given that the US recently passed a $38 billion bill designed to make it easier for hospitals to invest in technology. 

The acquisition of Sentillion was initiated through Microsoft’s Health Solutions Group. That said, it may have wider reaching implications on Microsoft’s overall IdM strategy. Microsoft’s IdM portfolio has been lacking an enterprise single sign-on (eSSO) solution; Microsoft has relied on partners for this capability. Obviously with the acquisition of Sentillion, the Microsoft IdM product group may have an opportunity to utilize the capabilities provided by Sentillion’s SSO products. But, Sentillion has designed its products specifically for the healthcare industry and they may be lacking some of the functionality required by enterprise organizations. 

Although Sentillion brings some unique IdM functionality, there is some duplication between Sentillion’s provisioning solution and Microsoft Forefront Identity Manager.  It is not likely that provisioning was the primary focus of this acquisition, but it will be interesting to see what Microsoft does with Sentillion’s provisioning technologies. While Sentillion’s ability to integrate with AD and Microsoft’s identity infrastructure was probably a consideration by the Microsoft Health Solutions Group that sponsored this acquisition, there is no indication (as of yet) from Microsoft that any of the identity technologies offered by Sentillion will be added to the general identity and security portfolio for use outside of the healthcare vertical. Rather, it appears that this solution will be optimized for the healthcare vertical and may not fully leverage the more general provisioning and claims-based access control features available from Microsoft Forefront solutions.

The acquisition of Sentillion is a positive move for the Microsoft Health Solutions Group and may present an opportunity for the Microsoft IdM group. In the short term it does not appear that the acquisition will have an impact on the Microsoft Forefront Identity products, but it remains to be seen what impact it will have on Microsoft’s longer term plans. The company does run the risk of running two separate, but related, IdM strategies if the Microsoft Health Solutions Group continues to develop out its IdM capabilities without coordinating its efforts with the IdM development group. As the acquisition closes, the company must develop a unified IdM solution and message. 

Delayed again, Microsoft to ship ILM “2” in Q1 2010

Bloggers: Kevin Kampman and Gerry Gebel

At The Experts Conference last week, Microsoft disclosed the latest delay in the shipment of Identity Lifecycle Manager “2”. Originally targeted for the second half of 2008, customers will now have to wait until at least the first quarter of 2010 – a year from now.

Microsoft says it needs the extra time to address feedback from early adopters (including Microsoft’s internal deployment) that focus on three key areas:

• Usability improvements for handling Management Policy Rules

• Database performance and scalability improvements

• Implement self-service password reset for Windows XP Service Pack 2 clients (currently only supported to SP 3)

Another Release Candidate is scheduled for this fall, which will include the above updates.
This is a tough balancing act for Microsoft. We applaud their willingness to delay shipment of ILM “2” to address customer concerns, but the wait has been extensive to say the least. Additional delays impact customers and prospective customers in many ways, such as issues with budget allocation, availability of implementation resources, limitations of existing implementations, and so on. Microsoft is also missing a market opportunity as user provisioning remains one of the most active IdM market segments where organizations are continuing to invest, despite current economic conditions.

As Microsoft deploys capabilities that extend to every user, their responsibility to do the right thing, that is, test and verify, grows exponentially. They can't afford to be wrong, that is, test as they go, when it could impact large segments of their user population in a negative way.



The group/role/policy capability enhancements are probably more problematic than they anticipated. There are implications in this area that a number of Microsoft identity management vendors have struggled with; it is unrealistic that Microsoft should expect this one to be easy or straightforward. We might even expect these to be downplayed in the first availability. As we've learned in our current research on roles, retrofitting something to the AD groups that already exist in the field will not be smooth or easy

Is a bad economy good for identity?

Blogger: Lori Rowland

The financial meltdown of 2008-2009 has had a significant impact on the identity management market, but it might not be in the way you expect.  Organizations have undergone significant business transformation including mergers and acquisitions, business closures, restructuring, outsourcing, layoffs, furloughs, and terminations.  These changes have highlighted the need for effective identity management processes. 

One of the most obvious value propositions of identity management given today’s economic conditions is the de-provisioning of users’ and their access rights. The need for timely de-provisioning of access rights was recently exemplified by a situation at Fannie Mae.  Several news outlets have reported on an incident in which a contract employee was allowed to stay on premise for several hours after he was terminated. Worse yet, his network access was not revoked until even later that evening.  This gave him just enough time to place a malicious piece of code on Fannie Mae servers.  Luckily an observant engineer discovered the code before it was executed, otherwise the code would have brought down thousands of servers, most certainly impacting Fannie Mae’s bottom line. 

De-provisioning is not the only identity management benefit that comes to bear in a bad economy. For example, organizations want to ensure that the employees they have acquired (either through a new hire process or acquisition) are up and running on day one.  Others want to physically secure their environment and protect information and other assets– this is particularly true in environments where layoffs have occurred or in which the competition is fierce. Last, but not least, is the ever present need to meet compliance obligations – chances are the demand for stricter controls is only going to be increased due to the economic crisis.

Burton Group is in the process of updating our 2009 Identity Management Market Overview report.  As part of the research for this report we are reaching out to our customers in order to find out what impact the bad economy has had on their identity management (IdM) initiatives and project funding.  It is too early to give a final verdict, but early indications suggest that identity management initiatives are still going strong. As one organization put it “businesses are not willing to sacrifice controls, compliance, or security in order to cut costs.”  This is not to say that some projects are not being cut, we have seen some of that, but we are also seeing organizations move their identity management projects to the forefront and recommit to their success.

Another indication that the identity management market is thriving is the fact that vendors like Courion, Imprivata, Sentillion, and Sun have recently reported year over year growth and, in some cases, record growth for their identity management products.  This is just a sampling of vendors, we are certain that there are others who are also experiencing similar growth in their identity management product lines.

Although we are seeing interest in identity management growing, organizations are demanding alternatives to the traditional identity management suite or delivery model.  Organizations are looking at identity services for SOA based environments, outsourcing, hosted solutions, open source, subscription based licensing, and cloud based solutions all in an effort to reduce costs and simplify deployments.  Burton Group will be discussing this and other identity management trends in our forthcoming Identity Management Market Overview report and the Emerging Identity Services Market report.  We also will be deep diving into these topics at our Catalyst conference in July.

All in all –the bad economy seems to have been good for identity management.  It has not only brought the need for efficient identity management processes to the attention of organizations and subsequently boosted sales in identity management products, but has forced vendors to offer alternatives to the often bloated, identity management product delivery model.

Will the “real” federated provisioning please stand up?

Blogger: Ian Glazer

Nishant has commented on my post about federated provisioning.  He has provided two different examples of federated provisioning.  One of these, the advanced provisioning example, involves a company who manages its employees’ access to a service provider service via provisioning.  In this case, Nishant agrees with me that provisioning of this sort is no different than provisioning the UNIX box down the hall.

But it is Nishant’s second example, the just-in-time provisioning example, which is a bit tougher.  In this case, the enterprise and its service provider have a federation in place.  Using SAML-based authentication, a new user attempts to access the service provider’s service.  The idea (hope?) is that the service provider recognizes the new user request, provisions the user, and authenticates the user in the same conversation. Nishant does add a degree of difficulty in this scenario as he ties the federation service to a provisioning service.  Grabbing attributes from the SAML token, creating a SPML message, and handing that to a provisioning service is possible, but as a commentator points out this sort of interop isn’t spec’ed out so the heavy lifting is left to the service provider.  And even if the service provider doesn’t want to directly link its federation and provisioning services, it still needs to grab that assertion attributes and create the account in the backend system. 

It turns out, to my surprise, that there are people doing this.  Parties in a federation agree to which attributes are needed and send those in their authentication assertions.  A process at relying party uses those attributes to provisioning new accounts.  This is a fairly lightweight and effective approach, but there are some catches to be aware of.

The first catch, as Nishant points out, is if the service provider needs attributes above and beyond what are in the assertion, there’s not an easy way for the service provider to ask for them.  To deal with this, the service provider has to present a registration screen of some sort to the user.  Compared to the first scenario in which the federated account is already waiting for the user, the second scenario is herky-jerky and will annoy/confuse the end user.

The second catch is deprovisioning.  The provisioning process hinges on an authentication event.  Deprovisioning cannot be activated on de-authentication.  This does leave the problem of how to remove accounts when people have left a federation partner.  In the approaches we have seen, when a new account gets built it has an expiration date associated with it that gets updated on every login.  After some period of time without an authentication, the account is suspended or deleted.  Not a bad way to go.

JIT Provision may in fact be “real” federated provisioning, but not provisioning, as a dogmatic, dyed-in-the-wool provisioning guy would immediately recognize.  While I take my dogma for a walk, this quarter Lori and Bob are going to looking into some of the intersection point of identity management and SaaS and I think they’ll have more to say on this type of conversation in the coming months.

The Value of SPML Gateways

Blogger: Mark Diodati

A grateful “thank you” goes out to James McGovern, who steered me to Project Keychain and Jerry Waldorf’s associated blog. Project Keychain is an SPML gateway which leverages Sun’s open source enterprise service bus (fittingly called OpenESB). You can find Project Keychain’s list of supported target platforms (including LDAP, RACF, and salesforce.com) here.

Recently, I was asked if there is any value to using an SPML gateway. I believe there is. A picture is worth a thousand words (a cliché to be sure, but a good one), so here are a few thousand words. This picture describes the provisioning world, pre-SPML. I think we’d all agree that the world would be a better place if provisioning systems did not require connectors or the use of a proprietary API to manage users.

Currently, there are a few target platforms that natively support SPML for provisioning. Cloakware’s Password Manager (a privileged account management product), Imprivata’s OneSign and Citrix’ Password Manager solutions, and SAP NetWeaver come to mind. The list of target platforms which support SPML is slowly growing. With SPML support built into the target platform, organizations can readily integrate the platform into the provisioning environment because they can use the existing, standards-based framework (SPML). Also, a standards-based approach means that component upgrades (either the provisioning system or the target platform) are less likely to “break” the provisioning process. This picture describes the goal of SPML – provisioning users without connectors or proprietary APIs.


So, what are the benefits of the SPML gateway (as personified by Project Keychain)? One benefit is the ability to insulate the complexity of the target platform’s proprietary API from the provisioning system. This insulation means that the creation of a custom provisioning connector is not required, and any changes to the target platform’s API will not break the provisioning process (though it does place the burden on the SPML gateway). Another benefit is a smooth transition once the target platform natively supports SPML in future releases, because the provisioning system can speak directly to the target platform without the gateway. This picture describes a mixed environment with a provisioning system using SPML to manage users.

SPML may fix the plumbing issues with provisioning, but the user attribute schema issue remains. The provisioning system (that is, the SPML requesting authority) and target application (in the simplest architecture, this would be the combined SPML provisioning service point and provisioning service target) must use an agreed-upon set of attributes. The provisioning system must then map the SPML attribute schema to its internal schema. The provisioning system must do this for every target application, as it is likely that each target application will require a separate attribute schema. For what it is worth, SPML v2 made the division of service and attribute schema much easier. Burton Group’s SPML document discusses this issue. You can find the document at http://www.burtongroup.com/Client/Research/Document.aspx?cid=848 (client subscription required).

When Times Get Tough, the Tough Get Provisioning?

Blogger: Lori Rowland   

Provisioning products were introduced to the market almost a decade ago.  At that time, vendors promoted products on the premise of improved security (zero day start and zero day stop), cost reduction (remember those ROI charts demonstrating the cost of a password change through the helpdesk), and operational efficiency (no more messy flow charts). Provisioning was really about automated user account provisioning.  The introduction of the Sarbanes Oxley Act significantly changed the dynamic of the provisioning market.  The business driver for provisioning deployments quickly changed from a security and operational efficiency focus to a compliance focus.  Provisioning products were “flying off the shelf” as organizations scampered to answer the ever probing question “who has access to what?”  Customers began changing their expectations.  No longer was provisioning just about automated user account provisioning, but it was about accountability. Customers (and auditors) wanted to know how access was granted, who approved it, when it was approved, if it was still valid, etc.  Provisioning systems were not originally designed for this functionality; therefore, provisioning vendors began adding new features (both through in-house development and acquisition).  The original, core value proposition of a provisioning solution had succumbed to “compliance.” 

Recent headlines have once again rattled the provisioning market.  Hardly a day goes by that we do not hear of mergers, acquisitions, bankruptcies, businesses closing down, bail outs, job cuts, etc. In these tumultuous times, there is also an increase in security breaches, data loss, and insider threats. This has been somewhat of a perfect storm, highlighting the need for effective identity management systems.  More than ever, it is imperative that organizations control users’ access to sensitive data, terminate access as soon as an employee leaves the organization, absorb identities and credentials obtained through acquisition, and integrate multiple identity systems into a single authoritative source. IT budgets are without a doubt being cut, however early indications show that organizations view security and identity management (and more specifically provisioning) as a high priority and are continuing investments in these technologies. Organizations that have implemented an effective provisioning solution are breathing a sigh of relief, while those who have not are scrambling to do so. 

In these turbulent times, the business justification for provisioning deployments is returning back to its original value proposition: cost reduction, increased security, and improved operational efficiency. This is good news for the provisioning market (for customers and vendors alike).  As provisioning technologies morphed into compliance offerings, the industry abandoned provisioning system fundamentals and traded them for bells and whistles.  For example, vendors have added workflow, self-service, delegated administration, audit, reporting, access review and certification, and role management.  All of these are nice features, but development and investment dollars have been allocated to adding new features rather than on improving the ease of deployment, usability, performance, and scalability of the core provisioning system.  A singular focus on new features is not sustainable as customers continue to report failed deployments and frustration with the usability of products.  This is, however, changing. The feature set of provisioning products has reached a level of maturity. Vendors are now re-focusing on provisioning fundamentals, interoperability, and improving the usability of their products while reducing the total cost of ownership (TCO).  This is good news for customers who, in tough economic times, need to do more with less.

As the saying goes, every dark cloud has a silver lining.  IdM vendors will most certainly feel the effects of the down economy. However, a handful of vendors have seen increased sales in their provisioning products despite the economy.  Burton Group is aware of at least one pure-play provisioning vendor that saw record third and fourth quarter profits in 2008. There is a spike in interest in provisioning technologies as the economy has exposed inefficiencies in business process and IT security systems within some organizations.  There is also an increased interest in on-demand or cloud identity services and managed service provisioning offerings as many organizations are considering outsourcing their provisioning deployments.  This and other market trends and considerations are discussed in detail in the Burton Group, Identity and Privacy Strategies Market Landscape document, Provisioning Market 2009: Divide and Conquer  (note: client login is required for access to this document).

Burton Group consistently encourages our customers to conduct a proof of concept when selecting a provisioning vendor.  As the provisioning market has matured, it is increasingly difficult to compare vendors based on a check list of features.  Product differentiators are found not in if a feature is supported, but how it is supported.  Recently, Burton Group decided to “eat our own dog food” and conducted a competitive analysis of the provisioning market.  As part of this analysis we invited vendors to complete an exhaustive survey, provide reference customers, and conduct a use case-based demo.  This effort confirmed to us the importance of the POC process. 

As analysts, we are continually briefed on vendors’ products, roadmaps, and strategies.  We also regularly talk to customers regarding vendors and their products and we have conducted comprehensive evaluations of provisioning deployments in customer environments. These conversations give us great insight into product strengths and weaknesses.  Still, the demo process allowed us to see a feature to feature comparison of products based on our own set of criteria. Vendors were asked to show us a common set of functions --- not just the functions that made them look good.  This required a great deal of effort on the part of the vendor, as do POC’s in customer environments.  These efforts were, however, validated as we gained a new level of understanding and respect for each of the vendors participating, regardless of how they fared in our analysis.  That said, by conducting an RFP and POC-like process, we were able to identify product strengths and weaknesses as weighted against our criteria. As the market has stabilized and matured, clear market leaders have emerged.  The results of our competitive analysis are detailed in the above mentioned Market Landscape document.

2009 will most certainly prove to be an interesting year for provisioning.  We will likely see continued expansion and growth, albeit at a slower pace than years past.  Microsoft and SAP are set to release much anticipated updates to their provisioning products, more and more vendors will be showcasing their integrated role management and provisioning solutions, and other vendors will be releasing products highlighting improved architecture and usability.  Stay tuned for further developments as this market never ceases to surprise us.

Down with federated provisioning

Blogger: Ian Glazer

There's been a bit of recent blogging activity about federated provisioning and SPML.  Having worked on both federated provisioning and SPML in a past life, it warms my heart to see this discussion.  Jackson, quoting the CIO of Education Testing Services, Daniel Wakeman, restates the observation that SaaS providers are providing when it comes to federated identity management.  This "major shortcoming" leaves service subscribers to fend for themselves in managing user lifecycle events like on-boarding and off-boarding.  Not acceptable.

That got me thinking - there really ought not to be a concept of federated provisioning.  Provisioning an application in the data center must be the same as provisioning an application in the cloud.  However, in the course of the conversation between James, Jackson, and Mark, it seemed SaaS applications and in-house applications were different from a provisioning perspective.

SaaS applications may be harder to provision and de-provision than non-SaaS application, but that doesn't make them fundamentally different animals.  The point was made that SaaS apps lack a standards-based provisioning interface, an SPML interface.  The fact is the vast majority of applications, SaaS or not, lack a standards-based provisioning interface and this makes dealing with them very much the same.

Now there are two reasons that we don't hear the same short of clamor about provisioning non-SaaS applications as we do with SaaS applications:

• We've dealt with it so long that pain isn't as acute
• Provisioning vendors built an array of connectors, shifting the pain up a level, allowing companies to focus on the provisioning technology and not each and every application they want to provision

Provisioning vendors spent lots of time and money to build connectivity to traditional applications.  Lots.  And in doing so provided a bit of absolution for application vendors from their failing to provide a standards-based provisioning interface.  Having gone through all that pain and suffering, vendors are not eager to go through it again with SaaS applications, coding connectors to each one's different web service.  Customers aren't too keen on the idea either.

In providing SPML interfaces to their applications, SaaS vendors would do everyone a service.  Provisioning vendors could use their SPML connectors and not have to build to each SaaS application.  Customers wouldn't have to write custom code to different service interfaces.

You don't want that fired sales guy walking away with your customer list no more than you want him walking out the door with your pricing information.  To that end, there should be no reason why deprovsioning from an application like Salesforce.com is any harder than deprovisioning from LDAP.  Federated provisioning should not exist; there is only provisioning.

The Elephant Parade: Relationships, Role Management, Provisioning, and Identity Services

Blogger: Kevin Kampman

Catalyst 2008 went by so quickly, but that’s always the case when you are having a good time. It started off well, particularly when Bob Blakley couldn’t tell me (Kevin Kampman) apart from Mark Diodati on stage during the Market Overview. It helped that we had “Anonymizer 2008” bags over our heads, but Bob’s confusion is a good sign that lifestyle changes are at hand.

Conference attendees indicated their appreciation for the new presentation format; however, the changes are more than cosmetic. Several perspectives were presented that offer the potential to change the identity industry for the better. In particular, Bob introduced “relationships” as an overarching theme for the establishment and continuity of interactions.

Tim Weil, Vice Chair of the INCITS CS 1.1 Role-Based Access Control (RBAC) Working Group discussed their effort. His group is developing a standard for the implementation and interoperability of RBAC components described in INCITS 359-2004. Widespread adoption of the standard has been impeded by a lack of practical guidance; this effort is an attempt to resolve these issues. A military perspective was provided by Russell Reopell of MITRE, who discussed ABAC, or Attribute-Based Access Control. This approach requires qualitative attributes, such as roles and other characteristics, that can be evaluated singly or in combination by policies to make access decisions in real-time. It is particularly relevant in situations where pre-registration of users is not possible.

A practical need for role interoperability has been expressed by Darran Rolls of Sailpoint, who recently established the Open Role Exchange Forum. This forum was discussed during the Role Management and Provisioning vendor panel (including Rolls, Aveksa’s Jim Ducharme, Sun’s Nick Crowne, Oracle’s Jeff Shukis, and Eurekify’s Ron Rymon). The exchange represents an opportunity for more seamless enterprise role implementations by addressing how to normalize role definitions across multiple platforms. The panel concluded that role management and provisioning represent parallel complementary initiatives that will benefit both the business and administrative communities, respectively.

Ken Anderson, of Burton Group’s Executive Advisory Program, helped me to address a topic of significant interest to the business community: representing the value of role management. In a role play that featured Riley the Cat (a loose metaphor about conversations with executives), Ken and Kevin moved from a technical discussion of administrative trivia to a strategic overview of Return on Organization. The bottom line is that role management is a discipline, one that provides a relationship-driven perspective about the social dynamics of organizations. The point of the role play was how to speak to executives about business transparency and effectiveness, rather than administrative efficiency and compliance. The former is beneficial to the business, the latter to administration.

From a customer-centric perspective, it was standing room only for the Friday presentation and customer panel on identity services. The panel included Gavin Illingworth from Bank of Montreal, Susan Staples-Holt, MassMutual, Chris Harvison, ScotiaBank and Andrew Cameron, representing General Motors. Burton Group facilitated this year’s effort to establish the rationale and requirements for interoperable identity services. The multinational membership has grown to include contributors from financial services, manufacturing, telecommunications, and government agencies; additional interest has also been expressed by health services, pharmaceutical and educational institutions.

The current vendor efforts towards identity services are more project- than community-driven. Customers are challenged to deal with the development and integration of identity services, particularly for cross-platform and legacy purposes. While there is a general perspective about what the services should accomplish, there is no agreement on their demarcation or specifications for how they should do this. In order to develop this guidance, and to prioritize development activities, the participants have agreed to invite vendors and standards community representatives to contribute to the effort.

The area where there has been significant traction has been federation, but it has been challenged by supporting capabilities and agreement on information at the endpoints. Given the breadth of opportunities, one area for investigation includes authentication, authorization, and attribute services. Another is session and context management. Each of these represents an elephant-sized task; by working together we hope to line them up trunk to tail in short order.

Interested parties should contact me at kkampman@burtongroup.com for information on how to become involved. Our goal will be to develop shared requirements, a development plan, and an interoperability schedule to present during a joint customer-vendor panel at Catalyst 2008 in Prague.