Better late than never, they say. So first of all Happy New year to you and I wish all the readers of my blog the very best health, happiness and success in managing IAM projects in 2012!

Managing IdM In Uncertain Times 2009

Managing IAM in Uncertain Times

Since I don’t really have a book to sell (yet) I am posting the outline of the book up here and I invite any and all of you who might be interested in reading and giving feedback, whether directly to me via LinkedIn or by leaving a comment here in the blog post. If you are interested in reviewing future drafts of the manuscript please indicate so in your post. As much as work and family keeps me busy at all times, I am excited at the potential that this volume has to address a critical need in our industry, as well as providing guidance and resources specifically to managers and IT professionals looking to take their careers to the next level or simply adding new core skills and experiences. I would be forever grateful and appreciative for any feedback, questions or comments you may wish to offer. I promise in return the collective wisdom and insights from the past 4 years as an IdM leader/engineer/architect at VMware will be presented concisely and in an actionable format that you can put to use immediately, as well as provide case studies and templates available which alone will be extremely valuable resources.

Thanks for reading and best wishes in your endeavors in 2012!

I haven’t blogged here for awhile, and being honest there is extraordinary change happening in our industry that anything I posted here could need to be re-written. In the meanwhile, the business of enterprise software is coming under intense pressure as I imagined it would as cheaper and more robust applications and services come online. Just today, Marc Andreessen takes aim at software giant Oracle and how economic pressure along with lower cost cloud computing alternatives to enterprise software is shaking the very foundations that information systems are built upon and how they are deployed and consumed by start-ups and the SMB market.

Within the Identity Management (IdM) space, this trend could not be more profound. As companies migrate away from enterprise software deployments towards SaaS apps in droves, the justification for enterprise IdM (or WAM) solution does not fit quite as nicely as it once did. In fact, looking at the success of SalesForce.com and availability and support of modern protocols for 3rd party SSO integration (SAML/OAuth, etc…) and many other apps following suit, the options for SaaS apps continues to present viable alternatives and following this logic, more nimble IdM deployments at a fraction of the cost. Looking at Identity & Infrastructure management from VMware perspective there is a comprehensive set of technologies that can be used to build, run, deploy and secure robust business applications. Today, many of these are deployed using a Public Cloud service (somebody else’s infrastructure) but as this technology moves along on the technology adoption curve and some trust/assurance/liability questions are answered, it will gain more momentum and extend its reach into the enterprise space. In certain cases where security or high assurance is needed, an on-premise (Private Cloud) solution that can be tailored to a company’s or government’s specific requirements would be necessary.

Coming back to the Andreessen article and with all due respect to Oracle as a great and mighty successful American company, a lot more folks are taking notice to what I have been saying for some time now. From an investor perspective Oracle might be a good place to keep your assets safe, but with a growing list of compelling alternatives, if Oracle would stop charging prices like it’s 1999 (or 2007) the situation would not seem as dire as they appear they might become. Many of Oracle products are now available through their On-Demand network for more SaaS model services but will that be enough (making them available as a SaaS service) to make good with customers and keep the competition off their heels? Disclaimer: Having never used Oracle On-Demand services I can only venture to guess that even their SaaS model services are priced with premiums.

On the other hand, VMware continues to make interesting strides in virtualizing mobile platforms along with which a user’s identity and entitlements must travel. Access policies, provisioning and compliance must be monitored and controlled across mobile applications and platforms. So with VMware’s Thin App provisioning (the dev team for the latest incarnation being a great group of guys in my neighborhood right up here in Bellevue, Wa) and entitlements around who can access what, the tools available for managing identities across clouds and devices gets even more interesting!

Godspeed, dear innovation! What say you? What do you have to gain or lose with lower cost IdM implementations and more efficient computing platforms?

This week I relished in the announcement here and this Metalink article that Oracle recently made about support for running Oracle on VMware virtualized environments. Then again, for those of us who have been doing the same for awhile now, it’s not *that* big of a deal. Or is it?

Having spent a fair amount of time at the VMware booth at Oracle Open World and witnessed the intense interest in virtualizing everything Oracle, from RAC and Database servers; at the VMware Booth Dave Welch from House Of Brick Technologies attests it has had Tier 1 workloads on VMware since 2006 (and seen $ millions of capex/opex reductions), there were no shortage of folks from the audience taking note; to Middleware and as I have discussed Oracle IdM on VMware as well. Sadly, there are others from various industries who have not even begun to virtualize their Oracle infrastructures due to Oracle’s previous stance on support running their products on VMware.

VMware Snapshot Manager

Beyond the benefits of snapshots and virtualization for the Upgrade scenarios there are the extraordinary stories for consolidation itself to be told. Infrastructure consolidation invariably leads to other interesting possibilities such as cloning (which I talk more about here) for building out new environments, making your infrastructure portable to make building out cloud infrastructure more efficient, to even being the key to your cloud security, as Art Coviello talked about at the RSA conference this week.

So in all honesty, I don’t feel that the announcement from the Evil Empire in Redwood Shores is for me so much as it is for other large companies I know exist out there with sizable physical infrastructures. I have seen success and failures due in large part to the virtualized environment (or lack thereof) so to encourage those of you who have not gone down that path, that now you have an open doorway to bring your support issues and take another hard look across your IT infrastructure of prime opportunities for consolidation and to better realize benefits from this Age of Virtualization, which arguably is already giving way to the Age of Cloud Computing or Agility as VMware executives like to describe it.

With that being said, a huge thanks is due to Oracle, who is now only slightly less evil, for getting out of the way of IT innovations, economic recovery and for giving the power of choice back to the customer.

As always, feel free to leave your comments here in the blog thread. And if you are in need of assistance or want more resources on virtualizing your Oracle environment with VMware, head over to http://www.vmware.com/oracle for more information.

Happy New Year, everyone! It’s been a couple months since my last post, so I thought I’d better get with the program and keep fresh updates coming. In addition to a few other goals of mine for the new year, which I’m sure a lot of you have as well, writing more about IdM and the industry here in my blog is among them. So while I enjoyed reading IdM prognostications here and here, I will take a few moments and make an attempt at giving a few of my own from my tiny perspective on the world of IdM.

It hasn’t been too long since I last gave some predictions about the future of IdM, but since then there have been some interesting developments. First of all I should give the usual disclaimer that I am giving my own opinions in this blog post, and not speaking officially on behalf of VMware. With that said, let’s talk about IdM.

The industry has been abuzz with ideas about “Identity As a Service” or IDaaS for short (as if we needed more acronyms!), with different approaches layed out succinctly by Frank Villavicencio in a blog post back in 2010. However, without taking pain to spell out, it is a trend that can easily be marginalized as another service bus that must be deployed and managed in an enterprise without much thought about leveraging new deployment models such as public or private clouds. In fact, VMware has a lot of API and SOA based (so-called) Identity Services. While they are consumed very much like any Web Service, they are not being managed or deployed differently than any business application.

Latourell Falls, 2003

I remember the first time I heard about an appliance for managed IdM back in 2005 that was pitched by Oblix at a customer meeting. While we will see these technologies like Web Services, Identity APIs and SAML used throughout the organization, I think in 2011 we will see the appliance based IdM implementations accelerating and taking hold nicely and at a much faster pace. Well even if not so new, they will be embraced for sure. With new products from VMware like vCloud Director and the bounty that vCenter will enjoy from the Ionix acquisition in 2010, it will offer architects and IT leaders more robust tools for efficiently deploying and managing their IdM services and infrastructures. This is one of the biggest opportunities in the data center today, I feel, which IdM in a broader sense is positioned incredibly well to benefit from.

Which leads me to how I see the two major forces in play that will profoundly affect the way companies adopt and manage IdM in the coming year.

• Consolidation – (And I’m not talking about acquisitions…) Driven by the desire to reduce costs of managing large data centers,and taking advantage of opportunities to more effectively utilize a disaster recovery zone, cloud models for computing will allow us to achieve re-use and consolidation much more efficiently than previously possible. This will be an essential strategy for Directors and managers to add to their IT playbooks as most companies will begin to move alot of their apps to some form of cloud-based computing model, and we desparately don’t want to migrate server sprawl or VM sprawl practices into the cloud.
• Next Gen IdM – Back in June I keyed into the idea that Identity & Access services will be available in the “drinking water” (just look at Salesforce) and as more partnerships form, trust will be further established and companies will begin to leverage more SaaS and PaaS services where IdM is just one of the services available in that environment. With VMware’s acquisition of Tri-Cipher in 2010, imagine the possibilities of this (or what would become of any 3rd party partnership) when IdM capabilities exist in the platform that you deploy your cloud apps on (Think VMforce, vFabric, or any other vendors (which I could mention but won’t *wink*) who may be using OpenSSO, Shibboleth, Facebook Connect, etc… for their IdAM requirements.

After giving one of my talks at Open World last year, I was approached by (of all people…) a security architect from Microsoft who pressed me with the question about “What makes this any different because at the end of the day, it’s still a Web Service, right?” Well for one thing, maybe the guy attended the wrong conference because we covered a lot of ground at VMworld 2010! On a more serious note, what we are seeing is not just consuming services but the way these services are deployed and managed. Incidentally, I came across a new hash tag today, perhaps this will be the newly recognized trend in 2011 #MSHyperVfail Anybody?

All biases aside, the ways in which you will be able to deploy, manage HA and achieve distributed computing models will be fundamentally different than we have for the most part been able to achieve. But the best thing yet is that when it comes to Identity & Access management, the cost and complexity barriers will be significantly less than we know it today.

It’s been a little over a week since OOW, and finally getting back into the swing of things. I should say up front that while I spoke at Oracle Open World, this was not a general session like VMworld, but instead I spoke from the VMware booth at Oracle Open World. Not only was it great hanging out with some really cool folks from the marketing teams from VMware (which I never get to do) I also had the chance to speak directly with Oracle and VMware partners and customers about the cool things that me and my team at VMware have been working on over the past 18 months. It was a throwback to my consulting days at Oracle, which were great, but with the liberty to share more about doing things with VMware than the ordinary Oracle Consultant does.

My short presentation was focused on helping Oracle IdM customers get a handle on the top pain points that a company might encounter from an operations perspective, and I offered some insights on the challenges one will face and a VMware specific solution to the problem. In essence, if you can build your Oracle IdM foundation on VMware vSphere starting Day 1, it will lend itself to dramatic time/cost savings and speed with regards to building out new environments and horizontally scaling those environments as your business and IT infrastructure evolves.

Also, as an EMC company, VMware employees enjoy a great partnership and access to world-class tools and support for managing the Oracle database, which is the very foundation for Oracle IdM. As such, another of the practices we use at VMware, which I also discussed in the talk at OOW, is not as much VMware focused as it is on the EMC technology, but it has to be included to paint a complete picture for improving efficiency of your operations environment. Of course, some of you were quick to point out that EMC’s SRDF isn’t the only company to provide block level copy of Oracle data, we happen to think it’s a really good one worty of your consideration. For more about this process, you can view my VMworld presentation on managing Oracle data with SRDF, or you can get more from your local DBA or straight from EMC, such as EMC’s own Oracle Storage Guy.

For those of you who didn’t attend either talk or catch the link on my Twitter post, here is my OOW presentation. Being only given 30 minutes I could not go into too much technical detail here, so please forgive me. You can, however, talk with your in-house IdM Architect/Admin or IdM consultant about how you can build your Oracle IdM environment similar to the way I talk about in my presentation.

In addition to presenting at the VMworld booth I also got a chance to talk to a director at Oracle about collaborating on some white papers for publication on OTN on best practices and configuration specs for building and running Oracle IdM on VMware vSphere. There is nothing like this that I am aware of, and if there is (please share your stories with me) then this will just make it an official collaboration between VMware and Oracle. We are just getting started, and I would expect this to be available to the public sometime in Q1 of 2011. You can follow my blog’s RSS feed or my Twitter as that is where I will make the announcement when these papers are available. Another way is to check www.vmware.com/oracle for the latest updates on this collaboration.

On a final note, I received some some sad news last week on the heels of Oracle Open World that Oracle will be losing Rohit Gupta to run another company in the Bay Area. Rohit has been around the Oracle IdM space as long I can remember Oracle being in this business (circa 2005) in field enablement and product management. I got a chance to hear Rohit speak in person at Burton Catalyst this year, as the last speaker to an audience of very thirsty IT guys and a bunch of long winded corporate sponsors, he hit the grand slam with a speed 2 minutes under his allotted time with grace, humor and a technical acumen that’s refreshing coming from a VP. Rohit, you will be missed by many and I’m confident you will succeed famously at BMC as you did at Oracle. And if not, I’m sure there could be an open door for you at VMware.

Have a great week, everybody and feel free to comment here on my blog and get some conversations going about how you’ve put any of these ideas to use in your environment.

Do you want to learn how VMware manages Oracle Data and Oracle Identity Management middleware with EMC and VMware technologies? Are you curious how VMware rapidly builds new Oracle OID and Access Manager environments with it’s own products?

I will be in San Francisco at VMworld next week presenting “Automated Refresh of Oracle Data” during the Oracle Storage Guys session at VMworld. Look for Session ID: EA7061 on the topic of Creating an Internal Oracle Database Cloud Using vSphere in your handbook. I will be sharing how we shaved days off our Environment Refresh processes and significantly reduced error rates using EMC’s SRDF/TimeFinder and custom scripts managed via PPM workflows to achieve greater levels of efficiency and accuracy.

It will be presented twice, so you can catch this session on Monday or Thursday at the following times.

Monday: Moscone South Room 308 @ 12:00-1:00 PM
Tursday: Moscone West Room 2007 @ 10:30-11:30 AM

Also, if you are headed to Oracle Open World in September, look for me at the VMware booth. I will be there to talk about how VMware, in addition to the EMC/SRDF solution described at VMworld for bootstrapping Oracle DB instances, uses vSphere to clone and build out new Oracle Identity Management environment. I blogged about how awesome this is awhile back, but this will give you a chance to hear a 6-month progress update and ask any questions. Stay tuned for more details on which days and times.

See you there!

In response to a few thought provoking questions from a colleague on whether Oracle VM, VMware or IBM would be better prositioned to lead virtualization of Java, I had to form a few responses and decided to share them with everyone, and gather insights and comments from others who read my blog.  So after much rumination on hot technologies (all biases aside as best as I could) I can share what’s been stewing up in my mind for the past few months. 

So, running WebLogic on the hypervisor is compelling, but I doubt many companies will want to migrate to Oracle VM in order to obtain this advantage.  Check out the recent Gartner report that VMware is alone in the Leader Magic Quadrant for virtualization, so this is no slam dunk for Oracle, Microsoft, or any other vendor.   But challenges are ahead for Oracle in virtualization on hypervisor, as one article puts it, “Either they (Oracle) promote VMware, and abandon their own product, or they abandon their customers, but keep their product.”   I haven’t really expressed much of an opinion here, as much as I have doubts about customers reaction to the technology that’s available.  I’m not so much of a virtualization guy as I am an IdM guy, but time will tell, and with any luck Oracle may relax their position of resistance against virtualization from their Palo Alto brethren.

The Big Switch

But going beyond the datacenter, now many customers have the option to run Java apps in the cloud rather than their own infrastructure using VMForce.  My bets are that history will repeat itself, and  this trend will only continue as companies abandon in-house server farms and infrastructure, and as Nicholas Carr aptly describes in The Big Switch: Rewiring the World, from Edison to Google, will opt for deployment to Cloud machines much the same way companies abandoned generating their own power and began using centralized electricity provided by the power grid in the early part of the last century. 

With that said, IdM technology is in for a roller coaster ride as the tidal waves of change come and we look at how to manage and scale IAM services across a broad spectrum from internal IT to private clouds to the public cloud for partners, customers and employees.  It is looking like the cost and complexity of extending Federated SSO across multiple protocols (not all customers will have SAML, WS-Sec) will be a hassle unless you factor in the potential of cloud services and a hub & spoke model.  It makes me wonder if IdM will go the way of the centralized power grid and Cloud Services (IaaS, PaaS, et al) or maybe it’s already happening.   And as Coby Royer points out in a recent blog post, “I can install the old style IAM tools, this is missing a huge opportunity for cost savings—putting standard infrastructure for IAM into the “drinking water” is the wave of the future.”  In an economy like this, that logic is becoming much easier to buy into than say in 2008 before the recession started to hit IT budgets. 

As an old hand at Oracle IdM (going on 10 years now) it is a bit hard for me to digest, but my instinct tells me that survival means adapting to the seas of change rather than trying to run from them.  There is a bright future and a lot of pent up demand in cloud services, where new models will soon overshadow the shortcomings of client/server and internet architectures.   The old school IAM stacks are not going away anytime soon, but the IdM professional will need to learn new models and standards to keep pace with where this industry might be heading.

Anyways, time will tell.  Leave a comment if you think differently.

 

If you have built castles in the air, your work need not be lost; that is where they should be.  Now put the foundations under them.

~ Henry David Thoreau

Burn out, frustration, defeat, misery, helplessness and a host of other career-stunting feelings at one time or another affects us all.  As much as I’d love to acknowledge every individuals situation and assure them that everything will be OK, I have to take a step back and drink a healthy dose of humility and suggest that there are so many factors in your success, career satisfaction and work-life balance than I can possibly give an answer for.  Some success is attained overnight, defying all logic. Yet for others it may take decades, or even a lifetime of patience, determination and commitment. 

Unless you have a monster for a boss who likes to micromanage every minute of your day, then the disciplines and behaviors required for achieving your career goals are largely going to be your own responsibility and doing (as they should be.)  So instead of waiting for opportunity and success to come to you, I think it’s best to take initiative and begin taking actions every day that will help improve your reputation, your career and ultimately your level of income.

Awhile back a colleague asked, “How do you keep yourself motivated?  I see that you are very energetic and working well etc. I would like some advice.”  I didn’t even try to answer in a brief Facebook chat, so I resorted to a mention of anecdotes (it takes time, insights, etc…) and headlines of the day (marriage is beneficial for your health, another security breach), at the same time assuring her that I was inspired by this question and that I wanted to make time to write down my thoughts on the subject and share them in my blog.

The short answer is that I don’t know any shortcuts to success.  Most days I struggle just like everyone else to keep up with deadlines, responding to emails, attending meetings and all the while still managing to get real work done and the like.  However, if you are willing to take the long view of your life and career, then I would offer the following habits and attitudes which have proven to be valuable to me over time. 

The long answer:

1.) Align yourself with a larger-than-life issue that you feel passionate about

I will pass on the horrible clichés which other writers have used here, namely that writing down your goals (on paper) and putting them some place where you can see (near your alarm clock, blah blah blah) and reciting them to yourself is bunk.  I’d wonder most about what if what you write down the wrong things?  Have you put much thought into your life goals?  It doesn’t matter if you write them down, memorize them, blog about them, or scream from a mountain top, they would be useless if they don’t help you look at what you care about most and what you’re personally capable of.    Using the S.M.A.R.T (specific, measurable, achievable, realistic and time based) tool for setting goals is a good way to quickly tell whether you are on the right track or not.  But let’s not stop there.

Many people can too easily get caught up in the aim-to-please mentality, making priorities and setting goals that others expect to hear from them.  But what about you?  What do you want to spend *your* time doing?  Make the time, frequently, to listen to your dreams and aspirations.  Dream big dreams.  Don’t learn from others mistakes, but instead make and learn from your own mistakes and personalize those experiences as your own success stories.  Imagine being the very best in your city, in your state, and in the world at what you do, and then pursue that thing for as long as you can endure it.

As for me? I fantasize almost daily about a time when I wake up and turn on my computer and work to protect national security interests around the globe, and our people from the threats of cyber terror and cyber warfare.  So, every day that I wake up and read blogs and headlines in Google Reader about cyber terror, computer fraud and the like is a renewal of my life’s aspirations.  I don’t have to write it down to remember it.  The context is updated every day by journalists, bloggers and authors all across the country who all work for me, informing me what is happening in business, government and in the world of cyber warfare.  Talk about renewable energy sources!

This brings me to my next suggestion…

2.) Develop your appetite for reading.

I was told very early by a very smart and beautiful lady who I am proud to call my mom that there isn’t much you can’t learn from reading.  I was self-taught in computer programming since the 6th grade and received straight A’s while studying German mostly due to the amount of time I dedicated to reading and self-study.  Reading is important, and in my experience it is the only way to gain a deep understanding of trends in your industry and acquire the perspectives to create value for your employer and its customers and shareholders. 

I have a daily reading schedule where essentially I have a pre-defined reading list of just over 100 blogs that I catch up on (from my mobile phone) every morning while drinking coffee and lying in bed with Cami and Molly.  Blogs are excellent because you can get connected with some of the smartest people in your industry who are willing to share their knowledge and experiences, and who are almost always better trained and more relevant to your day-to-day than newspapers and books.  I use Google Reader and more recently (FeedDemon) to organize, tag, star and share the most valuable posts I come across, and refer to them months if not years. 

3.) Find a Mentor

Mentors help keep me motivated, and help me to learn things about myself (strengths, weaknesses) that my friends and family might be too afraid to share.  Mentors can come from unexpected places, but in every case I think it’s important to identify with someone who you admire and feel you could learn things from or at the very least who can ask challenging (and revealing questions) that get you to see problems from a new perspective.  I sometimes get made fun of by my wife because often after I buy a new book or discover a new blogger I will email them directly, initiating a dialogue to see what may become of it. It doesn’t mean I send emails with a biographical sketch and a dozen of questions, but rather, a quick introductory note with how you are using the knowledge and skills the author writes about, and that may lead to a single question which perplexes you the most.  Chances are the author or blogger may see your question as a challenge and be willing to impart with insights to fuel your innovation.

Once you find a mentor and see your relationships grow, so does the frequency of contact and these should come as a welcome break from being in the trenches as the “technician” in your business. The main thing is to let you spend time thinking about the big picture and receiving feedback and suggestions from somebody who has overcome the same obstacles.  That is to say, it should focus on you and your opportunity for growth and development in your career, not about ways to give more of yourself to your current employer.  As you spend time developing and refining your sense of vision and direction for your career, you will indirectly benefit your employer which can in turn lead to an internal job promotion and pay raise, a well-deserved recognition or bonus pay.

4.) Walk the halls

This and the next suggest are about honing and developing excellent social, verbal and writing skills, without which your career will progress at a much slower pace, preventing you from being as effective as a professional as you can and should be.  Unfortunately the programmer stereotype of a geeky looking guy or gal with glasses, working 15 hour days and sleeping under his or her desk is a poor self-image to nurture of one’s self.  While this might be OK to do occasionally, the path to progress and accomplishment, working on personal and career related goals must go hand-in-hand with communicating clearly with those around you and developing meaningful relationships with peers and managers who can help promote and support your cause.

There is nothing like being greeted with a smile by someone who sees you infrequently, who has positive experiences with you and understands and is willing to support your “great cause” (discussed in my first suggestion) which you no doubt already spend countless hours/days/years of your career working on.  I make appointments with myself to walk the halls through my company twice per week (when I’m at HQ anyways) with the sole purpose of finding hallway conversations that can spark interesting ideas, resulting in a lunch date or a deeper conversation which can greatly help you innovate in your career.

5.) 1500 words at a time

I never really considered myself to be a writer.  In fact, for years I struggled with writing effectively and thought that any form of writing was for English majors and college students working on their thesis.  I constantly had “writers block” and dreaded being responsible for preparing documentation or email correspondence.    But at some point in time I hope you will come to realize the need for and benefits of effective writing as not merely a responsibility but much more of an opportunity for having your ideas heard by your colleagues and helping management make decisions that can have the net result of positive change in your organization.

Now with that said, your writing does not have to be like Tom Cruise in the movie Jerry Maguire writing about a moral epiphany that is going to get you fired.   Unless, of course, you feel compelled to write that way, but to be clear that’s not the style of writing I am recommending in a business context.  Writing in a plain, concise manner that primarily aims to clarify and elaborate on a given topic is a more productive style.  Occasionally there will be a need to write persuasively about something you feel strongly about, but I have found that writing more frequently in a short and informational format is more effective than ranting and complaining once per quarter.

On a final note, have fun with your writing.  I have enjoyed writing 1500 words per month for a column in a popular photography magazine, which has proven to be more beneficial to me in building the discipline and skill of writing than any material benefits it otherwise provides.  It’s a sufficient amount of space to convey ideas, to inform others and increase your influence within your organization.  So borrow from writing editorial style if it helps.  Introduce your subject by making an outrageous claim (as long as it’s true) or rendering your opinion, provide supporting evidence and then go out with a BANG!  It may feel awkward at first, but like anything, it takes practice.  The more you do it, the better you become at not only writing as a way to get work done, but also gaining authoritative expertise as seen by your industry.

So let me know what you think.  Share the love, or leave a comment.

I grew up in a painting family and was raised by a father who was a skilled crafstman, an expert with a lifelong career in painting.  The thing you would expect, that our house would always have a fresh coat each season, or a fresh paint at all, is far from reality.  It’s like the saying cobblers children have no shoes.  As I grew old enough to form my own values and ideals about the future, I vowed to never let my family or my children go without shoes so to speak.  At VMware, we are pursuing the dream of IT As A Service, putting new kicks on our feet, and accelerating the use of virtualization across our own IT landscape.

And virtualize, we did.  I am involved on a crush team who’s objectives include streamlining and automating the build and refresh of environments using VMware virtualization technology, EMC SRDF and BCV technologies.  Since the very beginning Oracle IdM has ran on VMs at VMware except for RAC, but even now that is changing.   In spite of how compelling virtualization is for businesses and IT, it’s not as simple as running IdM on a VM.  Having hard-wired references to hostnames and PKI baked into a cloned copy makes “Instant On” a stretch of the imagination without taking appopriate steps to transform a cloned copy of say Production to make it operate as a completely separate and independent entity.

Cloning OID

VMware worked with some smart consultants at Identigral to create a procedure for reconfiguring a cloned instance of Oracle Internet Directory (OID) which is not exactly a supported and documented feature provided by Oracle, but is in any case effective for the purpose of rapid deployment.  This procedure gave the foundation for executing on my vision of clone automation for Oracle IdM that I shared with Identigral consultants.

Oracle’s OID Product Mgmt team reviewed the solution and suggested (as I would expect) that this is not a procedure to be used for building production instances.  Also, there is the risk that cloning OID will cause some problems with patching and upgrading.  But taking a step back and looking at why we want to rapidly build or refresh an environment in the first place, it’s for testing purposes, not to build a clean or new production environment.  So we have clearance from Oracle on OID cloning methodology, with the usual caveats.

Testing of the procedure proved its effectiveness so far in 2 of 2 exercises.  So now, we have a cloned VM, running a cloned OID, which is setting the table for either cloning OAM or installing it from scratch, or a hybrid of cloning and re-installing.

Cloning OAM

Cloning OAM is not as easy nor as straight forward of an approach.  There are certainly shortcuts for building any new OAM environment, or refreshing an environment (affecting only user data) but for a company whose ambition or need is to build numerous test instances for whatever reason, the argument for taking shortcuts and even automating to a certain extent is compelling. 

To start, as quick as it is to install new servers, and ensuring that there are no corruptions or issues when building the core configuration, the fresh install of OAM servers is a good safe bet.  Once the core foundation is installed, policies and configurations can then be exported from a source, lets say a golden copy from production, and modified to fit the needs of your target environment. 

Here is where the black art of Oracle IdM environment management comes into play.  Attempts by Oracle to offer migration tool set has not been received well, so this creates room for Oracle Consulting, and their partners to add value to IdM customers.  Typically, IdM consultants with years of experiences can have an intuitive knowledge about what should be copied from a source environment, how to massage the data, and then import it into the target environment in a manual approach spanning several days depending on the environment complexity.   This is a valuable, and critical competency that any IdM Administrator should have, and of course the organization who has OAM.  Multiply this exercise of say 40 hours by how many environments you plan to use for testing and development in the coming year and then by $125 or more, and you come up with a figure for annualized maintenance costs just for instance management.

Extreme Cloning

Taking the project to an even more extreme level, a person could justify automating the clone procedures by writing their own scripts to export, transform and deploy on the basis that the one-time development costs are less than the annualized maintenance costs.  The ROI formula I came up with looked something like this:

• Approx. number of hours to build OAM manually = x
• Hourly rate of IdM Admin = y
• Number of environments you will build this year = z

With that you can come up a figure with the following formula:  Annual instance management cost = (x*y)*z

In contrast, lets say that we could develop and deploy scripts to automate a large portion of this work. 

• Approx number of hours to design and build scripts to automate clone activity = x
• Hourly rate of expert programmer who has 3+ IdM experience = y

Then we can perform a basic ROI measure that should allow you to calculate your break even point.  Management will need to know how many environments would need to be built in order for investment in clone automation to pay off.  Depending on how aggressive your IdM initiatives are, it may take more than a year of utilizing your new tool set to see any ROI, not to mention that there are opportunity costs that should be factored in.  (E.g. Your expert programmer is going to be taken off of some other high priority project which can be a setback.)

And to make things even more interesting, recent VMware acquisitions add even more technical capabilities that should ultimately help reduce costs and complexity of  instance management.  I’m looking forward to the assimilation of Spring Source and Ionix into VMware virtualization platform so we can create and share templates for IdM configuration management.  Imagine configurable templates as a feature of your platform that transparently supports duplicating and managing IdM environments without the risk and cost of custom software, including having all of the appropriate monitoring (E.g. Zenoss, EM grid agents) deployed right next to it.

I’d love to hear ways you use VMware to make managing and deploying Oracle IdM easier.  Leave comments here in this blog post or send an email to steve at stevetout dot com.

Authentication and password policies are the bane of my existence.  I really feel sorry for millions of consumers who have no idea whats going on (exactly) with the crazy and absurd requirements that companies put in place for logging in to view account balances or make payments.  As I have a few ideas about whats going on,  the fact that I have to call into a customer service help desk on almost a monthly basis for a password reset can only highlight that neither customers nor businesses are having much fun.   Banks and other online bill-pay sites seem compelled to make remembering passwords so difficult that I could pull my hair out.

Here is the password policy of one very large financial institution… seriously?  I have and use a hand full of passwords for various online accounts which I have used since the beginning of time.  Most people will run out of variations on the common pass*word* that they will begin to form really bad habits, making their online accounts less secure.  Like say, writing passwords down on paper or saving them in a insecure file on my computer (which I do from time to time) undermines the very security that was meant to be in the first place. 

Then there’s my wife’s headaches of working with the online account tools of a local bank in a suburb of Seattle, that forced her to have password reset codes sent to her cell phone repeatedly because the bank’s website no longer recognized the browser or PC that she used to login.  That’s typically a problem when your identity is tightly embedded into the PC or browser via cookies or registry values that is supposed to help prevent unauthorized access.  Over course of several days, using one of several different PCs in our house, she managed to re-verify herself and lock out her account 3 times.  What s dreadful password policy that other smart people undoubtedly have endured….  As if we don’t have enough phone calls to make or things to do in one day. *sigh*

 So what’s the answer?

Listen to your customers!   Balance end-user compassion with account security and privacy mechanisms.  Password policy need not be so complex.  Some solutions, such as Oracle Adaptive Access Manager, work on the back end monitoring login attempts based on signature files and patterns of hacking activity, which in turn can result in a huge boost of compassion for your end-users.

So what are your experiences with insane password policies?  How many passwords do you have?