Steve Jobs on Flash

A little off-topic for Identity Management, but once a year or so I post something just for amusement.

In Jobs' open letter on why Apple doesn't support Flash, he makes some valid points. Among them, he states:

We strongly believe that all standards pertaining to the web should be open. Rather than use Flash, Apple has adopted HTML5, CSS and JavaScript – all open standards.

and

HTML5, the new web standard that has been adopted by Apple, Google and many others, lets web developers create advanced graphics, typography, animations and transitions without relying on third party browser plug-ins (like Flash).

So, then, what's wrong with this picture?

Hint: click to enlarge and notice the message:
This website wants to run the following add-on: 'Quick-Time' from 'Apple, Inc.'

Perfect.

IAM in the Cloud - from Verizon and Novell

Interesting newcomer to the Identity in the Cloud space. I look forward to seeing a side-by-side comparison of these solutions. Clearly, when organizations are ready to have their identities managed outside of their own walls (even if just external accounts), there will be a number of options available. I see an opportunity for a few good independent consultants to really understand the intricacies of all these options so they can help customers wade through all the terminology and misconceptions. ...because I don't think it'll be easy.

TEC 2010: Optimal IdM

The third and final TEC 2010 vendor to participate in a video message is OptimalIdM who was at the conference demonstrating their Virtual Directory solution and its ability to simplify deployment of Sharepoint 2010.

TEC 2010: Symplified

This is the second in my TEC 2010 Vendor video series. In this video, Symplified describes their TEC 2010 experience and let's you know how to get 3-D glasses for their upcoming 3-D announcement.

TEC 2010: Imanami

While walking the floor at TEC 2010, I spoke to a few vendors who agreed to provide a quick video message. The first is Imanami who was demonstrating a pretty interesting solution for managing Active Directory group memberships.

Identity Enablement

I just got out of a session led by The Burton Group's Kevin Kampman who made the point that the Identity Management conversation is changing. It can no longer be about technology. It needs to be about business needs. Don't ask what is the tool? Ask what problem are you trying to solve?

During Q&A, somebody made the point that currently, Identity Management is often mandated by the security team who is implementing it as a way to enforce secure practices and restrict access where appropriate. The business owners may not always have the right to choose where they're comfortable with increased risk and where they're not. Valid point.

I think Kampman's point, though, is that in a larger sense, as the industry moves into the cloud and becomes further distributed, Identity tools will be more about enablement rather than restriction. Identity Enablement tools such as Federation solutions will enable conversations and transactions to take place that haven't been possible in past (and current) models. So, the conversation starts with a business team that is looking to expand its capabilities rather than with a technology team who might be focused on specific tool sets.

To me, it's a whole different mindset than traditional enterprise Identity Management. And therefore, it's an entirely different conversation (not just a re-focusing of the existing conversation.)

It will be an interesting decade for identity.

TEC 2010: A few more notes

The Experts Conference is living up to its name. The hallway and lunch conversations are extremely technical - the right approach to move an Exchange mailbox or how to best create a stored procedure that captures some set of information beyond what the native system will do.

A few of the folks I spoke with:

- The DOT NET Factory has a user management (provisioning) solution based on Active Directory. It provides full, highly extensible work flow with full audit trails of all changes. Some customers choose to shut down all access to Active Directory

- Dimension Data is perhaps the largest company you've never heard of. The more than 11,000 employees of this $4 Billion IT services firm serve the world's largest multi-national firms. Through tight partnerships with Microsoft, Cisco, Quest, and others, they're uniquely positioned to provide integration services between those companies' products throughout Africa, EMEA, and now North America as well.

- Optimal IdM and Radiant Logic both report that the experts in the crowd are starting to finally understand the value of virtual directories. A few years ago, the conversations around virtual directories were largely educational - What is it? and Why should I care? Now, the conversations have shifted to practical implementation ideas.

btw, I overheard an interesting customer story on OptimalIdM. An organization who already had licenses for a a well-known Virtual Directory (because it was included in a larger suite) chose to work with OptimalIdM's solution because it provided point-and-click simplicity for object joins whereas the other solution required significant Java and Python code to achieve the same task. It's a nice real-world David & Goliath story.

- Rackspace is here educating people on how to deploy Sharepoint and other applications in the cloud. As with most technology conferences these days, there's a lot of discussion here about the cloud. Rackspace is clearly positioned as a leading cloud service provider. I use Rackspace for personal home file storage through its JungleDisk, which is a very cool solution.

- I also had a conversation with a principal consultant at CSS Security who clearly had a firm understanding of FIM 2010 and how to implement. They're based in Cleveland but serve the entire U.S.

TEC 2010: Active Directory Family

The day one keynote speech this morning was presented by Microsoft's Conrad Bayer. One of the key take-aways from this morning's keynote for me for a consistent theme throughout the talk that Microsoft's Identity & Access solutions are now all part of the same product group. The Identity & Access group's solutions include Active Directory, ADFS federation, RMS rights management, FIM life cycle identity management, PKI/Certificates, identity synchronization, etc.

Bayer also talked about the future of these solutions and briefly discussed that ADFS could evolve to become an authorization server. Specifically, he talked about attributes and claims being the core components of authorization. The idea would be that ADFS could sit in between local and remote directory environments and provide answers to standards-based requests about claims. Bayer was asked later about the challenges around the idea that, for AD, groups are equivalent to roles, but other systems' roles require more than just group memberships. His answer pointed back to attributes and claims as being the way to meet those business requirements and seemed to say that applications would be where you would manage roles. The application would define and manage roles while leveraging the AD infrastructure to answer access-related questions via claims. He didn't say it (or even suggest it), but I wonder if this is a move toward a completely different paradigm than one based on roles. Perhaps roles will never be the right answer since what we've all seen is that in reality, people don't fit nicely into a pre-defined set of business roles.

Another thing that caught my ear was Bayer's point that Smartcards and Certificates are becoming more important as environments move to distributed and cloud-based solutions. Could it finally be the year of PKI? BTW - I see 'the year of PKI' as a modern-day proverb about something that it perpetually about to happen but never really does. Having said that, I'm a fan of PKI as a technology and can see that his point has some validity. The fact that a particular solution is in the cloud is not necessarily the problem. The bigger problem is that there are a variety of apps moving into the cloud each with different security models and underlying security mechanisms. PKI technology might help us figure out how to provide a manageable solution for that complexity.

At the end of the day, I think Microsoft made the right move by bringing these technologies together, but it sounds like it'll be a while before we see a truly unified, native/out-of-the-box set of identity features such as point and click federation, PKI, or rights management.