Better late than never, they say. So first of all Happy New year to you and I wish all the readers of my blog the very best health, happiness and success in managing IAM projects in 2012!

Managing IdM In Uncertain Times 2009

Managing IAM in Uncertain Times

Since I don’t really have a book to sell (yet) I am posting the outline of the book up here and I invite any and all of you who might be interested in reading and giving feedback, whether directly to me via LinkedIn or by leaving a comment here in the blog post. If you are interested in reviewing future drafts of the manuscript please indicate so in your post. As much as work and family keeps me busy at all times, I am excited at the potential that this volume has to address a critical need in our industry, as well as providing guidance and resources specifically to managers and IT professionals looking to take their careers to the next level or simply adding new core skills and experiences. I would be forever grateful and appreciative for any feedback, questions or comments you may wish to offer. I promise in return the collective wisdom and insights from the past 4 years as an IdM leader/engineer/architect at VMware will be presented concisely and in an actionable format that you can put to use immediately, as well as provide case studies and templates available which alone will be extremely valuable resources.

Thanks for reading and best wishes in your endeavors in 2012!

I haven’t blogged here for awhile, and being honest there is extraordinary change happening in our industry that anything I posted here could need to be re-written. In the meanwhile, the business of enterprise software is coming under intense pressure as I imagined it would as cheaper and more robust applications and services come online. Just today, Marc Andreessen takes aim at software giant Oracle and how economic pressure along with lower cost cloud computing alternatives to enterprise software is shaking the very foundations that information systems are built upon and how they are deployed and consumed by start-ups and the SMB market.

Within the Identity Management (IdM) space, this trend could not be more profound. As companies migrate away from enterprise software deployments towards SaaS apps in droves, the justification for enterprise IdM (or WAM) solution does not fit quite as nicely as it once did. In fact, looking at the success of SalesForce.com and availability and support of modern protocols for 3rd party SSO integration (SAML/OAuth, etc…) and many other apps following suit, the options for SaaS apps continues to present viable alternatives and following this logic, more nimble IdM deployments at a fraction of the cost. Looking at Identity & Infrastructure management from VMware perspective there is a comprehensive set of technologies that can be used to build, run, deploy and secure robust business applications. Today, many of these are deployed using a Public Cloud service (somebody else’s infrastructure) but as this technology moves along on the technology adoption curve and some trust/assurance/liability questions are answered, it will gain more momentum and extend its reach into the enterprise space. In certain cases where security or high assurance is needed, an on-premise (Private Cloud) solution that can be tailored to a company’s or government’s specific requirements would be necessary.

Coming back to the Andreessen article and with all due respect to Oracle as a great and mighty successful American company, a lot more folks are taking notice to what I have been saying for some time now. From an investor perspective Oracle might be a good place to keep your assets safe, but with a growing list of compelling alternatives, if Oracle would stop charging prices like it’s 1999 (or 2007) the situation would not seem as dire as they appear they might become. Many of Oracle products are now available through their On-Demand network for more SaaS model services but will that be enough (making them available as a SaaS service) to make good with customers and keep the competition off their heels? Disclaimer: Having never used Oracle On-Demand services I can only venture to guess that even their SaaS model services are priced with premiums.

On the other hand, VMware continues to make interesting strides in virtualizing mobile platforms along with which a user’s identity and entitlements must travel. Access policies, provisioning and compliance must be monitored and controlled across mobile applications and platforms. So with VMware’s Thin App provisioning (the dev team for the latest incarnation being a great group of guys in my neighborhood right up here in Bellevue, Wa) and entitlements around who can access what, the tools available for managing identities across clouds and devices gets even more interesting!

Godspeed, dear innovation! What say you? What do you have to gain or lose with lower cost IdM implementations and more efficient computing platforms?

It’s been a little over a week since OOW, and finally getting back into the swing of things. I should say up front that while I spoke at Oracle Open World, this was not a general session like VMworld, but instead I spoke from the VMware booth at Oracle Open World. Not only was it great hanging out with some really cool folks from the marketing teams from VMware (which I never get to do) I also had the chance to speak directly with Oracle and VMware partners and customers about the cool things that me and my team at VMware have been working on over the past 18 months. It was a throwback to my consulting days at Oracle, which were great, but with the liberty to share more about doing things with VMware than the ordinary Oracle Consultant does.

My short presentation was focused on helping Oracle IdM customers get a handle on the top pain points that a company might encounter from an operations perspective, and I offered some insights on the challenges one will face and a VMware specific solution to the problem. In essence, if you can build your Oracle IdM foundation on VMware vSphere starting Day 1, it will lend itself to dramatic time/cost savings and speed with regards to building out new environments and horizontally scaling those environments as your business and IT infrastructure evolves.

Also, as an EMC company, VMware employees enjoy a great partnership and access to world-class tools and support for managing the Oracle database, which is the very foundation for Oracle IdM. As such, another of the practices we use at VMware, which I also discussed in the talk at OOW, is not as much VMware focused as it is on the EMC technology, but it has to be included to paint a complete picture for improving efficiency of your operations environment. Of course, some of you were quick to point out that EMC’s SRDF isn’t the only company to provide block level copy of Oracle data, we happen to think it’s a really good one worty of your consideration. For more about this process, you can view my VMworld presentation on managing Oracle data with SRDF, or you can get more from your local DBA or straight from EMC, such as EMC’s own Oracle Storage Guy.

For those of you who didn’t attend either talk or catch the link on my Twitter post, here is my OOW presentation. Being only given 30 minutes I could not go into too much technical detail here, so please forgive me. You can, however, talk with your in-house IdM Architect/Admin or IdM consultant about how you can build your Oracle IdM environment similar to the way I talk about in my presentation.

In addition to presenting at the VMworld booth I also got a chance to talk to a director at Oracle about collaborating on some white papers for publication on OTN on best practices and configuration specs for building and running Oracle IdM on VMware vSphere. There is nothing like this that I am aware of, and if there is (please share your stories with me) then this will just make it an official collaboration between VMware and Oracle. We are just getting started, and I would expect this to be available to the public sometime in Q1 of 2011. You can follow my blog’s RSS feed or my Twitter as that is where I will make the announcement when these papers are available. Another way is to check www.vmware.com/oracle for the latest updates on this collaboration.

On a final note, I received some some sad news last week on the heels of Oracle Open World that Oracle will be losing Rohit Gupta to run another company in the Bay Area. Rohit has been around the Oracle IdM space as long I can remember Oracle being in this business (circa 2005) in field enablement and product management. I got a chance to hear Rohit speak in person at Burton Catalyst this year, as the last speaker to an audience of very thirsty IT guys and a bunch of long winded corporate sponsors, he hit the grand slam with a speed 2 minutes under his allotted time with grace, humor and a technical acumen that’s refreshing coming from a VP. Rohit, you will be missed by many and I’m confident you will succeed famously at BMC as you did at Oracle. And if not, I’m sure there could be an open door for you at VMware.

Have a great week, everybody and feel free to comment here on my blog and get some conversations going about how you’ve put any of these ideas to use in your environment.

I grew up in a painting family and was raised by a father who was a skilled crafstman, an expert with a lifelong career in painting.  The thing you would expect, that our house would always have a fresh coat each season, or a fresh paint at all, is far from reality.  It’s like the saying cobblers children have no shoes.  As I grew old enough to form my own values and ideals about the future, I vowed to never let my family or my children go without shoes so to speak.  At VMware, we are pursuing the dream of IT As A Service, putting new kicks on our feet, and accelerating the use of virtualization across our own IT landscape.

And virtualize, we did.  I am involved on a crush team who’s objectives include streamlining and automating the build and refresh of environments using VMware virtualization technology, EMC SRDF and BCV technologies.  Since the very beginning Oracle IdM has ran on VMs at VMware except for RAC, but even now that is changing.   In spite of how compelling virtualization is for businesses and IT, it’s not as simple as running IdM on a VM.  Having hard-wired references to hostnames and PKI baked into a cloned copy makes “Instant On” a stretch of the imagination without taking appopriate steps to transform a cloned copy of say Production to make it operate as a completely separate and independent entity.

Cloning OID

VMware worked with some smart consultants at Identigral to create a procedure for reconfiguring a cloned instance of Oracle Internet Directory (OID) which is not exactly a supported and documented feature provided by Oracle, but is in any case effective for the purpose of rapid deployment.  This procedure gave the foundation for executing on my vision of clone automation for Oracle IdM that I shared with Identigral consultants.

Oracle’s OID Product Mgmt team reviewed the solution and suggested (as I would expect) that this is not a procedure to be used for building production instances.  Also, there is the risk that cloning OID will cause some problems with patching and upgrading.  But taking a step back and looking at why we want to rapidly build or refresh an environment in the first place, it’s for testing purposes, not to build a clean or new production environment.  So we have clearance from Oracle on OID cloning methodology, with the usual caveats.

Testing of the procedure proved its effectiveness so far in 2 of 2 exercises.  So now, we have a cloned VM, running a cloned OID, which is setting the table for either cloning OAM or installing it from scratch, or a hybrid of cloning and re-installing.

Cloning OAM

Cloning OAM is not as easy nor as straight forward of an approach.  There are certainly shortcuts for building any new OAM environment, or refreshing an environment (affecting only user data) but for a company whose ambition or need is to build numerous test instances for whatever reason, the argument for taking shortcuts and even automating to a certain extent is compelling. 

To start, as quick as it is to install new servers, and ensuring that there are no corruptions or issues when building the core configuration, the fresh install of OAM servers is a good safe bet.  Once the core foundation is installed, policies and configurations can then be exported from a source, lets say a golden copy from production, and modified to fit the needs of your target environment. 

Here is where the black art of Oracle IdM environment management comes into play.  Attempts by Oracle to offer migration tool set has not been received well, so this creates room for Oracle Consulting, and their partners to add value to IdM customers.  Typically, IdM consultants with years of experiences can have an intuitive knowledge about what should be copied from a source environment, how to massage the data, and then import it into the target environment in a manual approach spanning several days depending on the environment complexity.   This is a valuable, and critical competency that any IdM Administrator should have, and of course the organization who has OAM.  Multiply this exercise of say 40 hours by how many environments you plan to use for testing and development in the coming year and then by $125 or more, and you come up with a figure for annualized maintenance costs just for instance management.

Extreme Cloning

Taking the project to an even more extreme level, a person could justify automating the clone procedures by writing their own scripts to export, transform and deploy on the basis that the one-time development costs are less than the annualized maintenance costs.  The ROI formula I came up with looked something like this:

• Approx. number of hours to build OAM manually = x
• Hourly rate of IdM Admin = y
• Number of environments you will build this year = z

With that you can come up a figure with the following formula:  Annual instance management cost = (x*y)*z

In contrast, lets say that we could develop and deploy scripts to automate a large portion of this work. 

• Approx number of hours to design and build scripts to automate clone activity = x
• Hourly rate of expert programmer who has 3+ IdM experience = y

Then we can perform a basic ROI measure that should allow you to calculate your break even point.  Management will need to know how many environments would need to be built in order for investment in clone automation to pay off.  Depending on how aggressive your IdM initiatives are, it may take more than a year of utilizing your new tool set to see any ROI, not to mention that there are opportunity costs that should be factored in.  (E.g. Your expert programmer is going to be taken off of some other high priority project which can be a setback.)

And to make things even more interesting, recent VMware acquisitions add even more technical capabilities that should ultimately help reduce costs and complexity of  instance management.  I’m looking forward to the assimilation of Spring Source and Ionix into VMware virtualization platform so we can create and share templates for IdM configuration management.  Imagine configurable templates as a feature of your platform that transparently supports duplicating and managing IdM environments without the risk and cost of custom software, including having all of the appropriate monitoring (E.g. Zenoss, EM grid agents) deployed right next to it.

I’d love to hear ways you use VMware to make managing and deploying Oracle IdM easier.  Leave comments here in this blog post or send an email to steve at stevetout dot com.

Oracle IdM by Marlin Pohlman

Oracle Identity Management by Marlin Pohlman. This is IdM & GRC 101 as far as Oracle is concerned, folks. It’s comprehensive in scope and decidedly biased towards the incredible technology from the largest software company in the world. After giving a nice overview of each technology in Oracle’s IdM suite, it gives a comprehensive and accessible reference on governance and compliance for multi-national businesses. A must read for any IdM engineer looking to rise above his or her reputation as IdM Admin, and also for managers looking to get a better grasp of the wide ranging technology in the IdM Suite.

A Subscription to Dr. K’s blog Talking Identity – The Dr. is in and he will see you now. Here’s another wish that shows my Oracle bias. The blog contains architectural gems in the world of IdM, and is blazing trails in security and identity issues for cloud computing. Best of all, it’s free!

LDAP Browser/Editor v2.81 – Here it is. The lightest weight LDAP browser/editor on the planet (that I’m aware of) and it’s yours for free, assuming you can still find it. The internet went silent in early 2009 and the publisher’s original download URL disappeared. Where did our friend Mr. Gawor go, anyone? Any ways, the first and last thing I’d ever need to do in IdM is browse, search and edit basic information like user profile attributes, and the occassional import or export of an ldif file. There are no schema editing capabilities, but how often does one really need that? I’ve been doing this job for 10 years and of all the tools I have used, this is at the top of my list.

Oracle Unified Method – Another one of Dr. Pohlman’s brain children, OUM is the next best thing to working with Oracle Consulting, although you may need to work with OCS to get your hands on a copy. This is a wealth of resources to ensure smooth delivery of your IdM projects. From Detailed Design, to QA, Support and Training, it’s all in there. A more or less Oracle flavor of RUP.

Microsoft OneNote – Every now and then Microsoft works out something very cool. Think Windows 7 and Zune HD for example. Love em or hate em, Microsoft is a part of (most) all our daily lives. OneNote is one tool that helps me take names and kick butt every single day. You want a business justification on the mertis of OAM vs. ESSO? Meeting minutes with in-line commentary? Technical analysis and post mortem of the latest production outage? OneNote is an extension of my brain, a place to capture and share all of that unstructured data that is all around. When it’s time to compare notes, present ideas or persuade others quickly without writing a book, just Send > Email Page As PDF and go on with the rest of your day. It’s easy to use, efficient and just amazing tool! My colleagues rarely (if ever) see anything but PDFs from me, and all by design. It’s a game of knowledge management, sharing, presenting and persuading, and for that Office in General and OneNote in particular is your new best friend.

OpenID – The value proposition for OpenID is teriffic! If you tire of filling out registration forms or challenged by remembering your password for the nth time, then it’s time for you to get your OpenID. Not that this hasn’t been tried before (Passport, anyone?) I can’t seem to think of any other way than this time it’s going to be different. It’s not owned by Microsoft or any one vendor, is already being used by some very big hitters like Google, Yahoo, Flickr, etc… and I’m sure there will be lots more in 2010 that come on board. This nifty tool will not only save you time and headaches, as someone more career minded in the Identity and Security industry, it will help you stay engaged with and supportive of the issues that the industry faces right now.

VMware Workstation 7 – And last but not least, VMware Workstation 7 (and not because I’m an employee either *grin* ) – I can step into nearly any business regardless of size, OS, DB or App version and build a slightly replicated environment to test anything from bug fixes, interoperability issues, enhancements or upgrades. It’s an invaluable tool for anything from development to QA, and can save an insane amount of time and money on your IdM projects. I admire any company who bakes this (or VM ESX or Infrastructure) into their development lifecycle. It’s an amazing technology!

Merry Christmas, everyone!