Identity and Access Management ( IAM )

Overview of Identity and Access Management

Thursday, June 15, 2006

Portal for myself

What it takes to built a portal for myself?
I have been to Google and yahoo portals where I get to choose what news to read, choose the weather informatin for my selected cities, my preferred sports news and much more. yahoo also offers online personal calendar and yahoo mail + messenger buddies on the same page. So far these entities are external bodies, i.e they are not critical to my daily activities.
How about a portal for myself and not my.yahoo?
I would like to see my bank, credit card account status, forth coming bills for my auto, home, insurance, mobile etc. Also available are my spending for this month from various sources. This is like a one stop for all activities i do. This way I will not forget the bills to be paid, and I can watch my spending too.

Tuesday, May 23, 2006

What is Federation? ( Digital)

Digital Federation
What is federation in simple terms

Federation - I compared it with the References in your Resume or References you give to your friends saying this restaurant is good, this place is good etc.
How it is related? Its based on the "Trust". The References in the resume is trusted by the hiring manager, or your friend trusts your suggestions/comments and goes to that particular restaurant/place.

In business & IT terminology, Enterprise Federation is about making two Enterprises come toghether and share their user information/attributes.i.e Enterprise A sends user information/attributes to Enterprise B by asserting (SAML Assertions) that it knows the user. Here, Enterprise B trusts Enterprise A ( there will be a trust relationship already existing) on a certain trust level and accept the user information/attributes sent. Its now upto the Enterprise B to decide what level access it can give to this particular user. The same way your friend might/might not go that particular restaurant/place.

Sunday, April 02, 2006

Identity and Access Management (IAM)


Identity and Access Management (IAM)
In IAM, I is about managing the digital identity of users, applications or any software entities; A is about the user privileges/entitlements to access web-enabled Enterprise resources.
The diagram shows Identity and Access Management in two distinct layers with provisioning at the epicenter of Identity Management Layer (circle).

Identity management lifecycle is the process of creation, maintenance and deletion of digital user accounts. Identity management when complemented with provisioning provides full benefit to an enterprise by efficiently managing the users across heterogeneous platforms.User is provisioned to heterogeneous systems by means of Identity management & User provisioning tools like Sun Identity Manager, CA Identity Minder etc. Access to Web-based applications which are hosted on these backend systems are enforced by means of access control tools - CA Siteminder, Sun Access Manager etc.
Why Identity Management? To understand the need for user identity management in an organization, we need to examine the existing mechanisms by which the user accounts are provisioned. In a typical scenario, when a new hire joins an organization, it take several days for the recruit to get proper access for the systems he/she needs. The manager of the new-recruit is responsible for defining the role to the UNIX admins, NT admins and other ERP, CRM application Admins/or legacy application admins, to successfully create an account with the required privileges. The manager has to call/email the details about the new recruit or, the new-recruit him/herself has to be present at each of these departments to get the account created & activated. Also, the reverse process, i.e. when an employee leaves the organization his/her account has to be deactivated. This is a tedious and cumbersome process unless the employee remembers all the systems he/she has access to during his stint. There was no one stop solution for user creation, maintenance and deletion. Identity management tools allow for automating user creation/maintenance and deletion. It allows for centralized user management through its user interface and account creation/deletion is enabled through exchange of email approvals from account approvers. Provisioning complements identity management by creating/reconciling/deleting accounts in various back-end systems. Most of the identity managemenet suites comes with provisioning and workflow.
Access Management
While Identity management targets user lifecycle, access management is for protecting web-based resources of an organization. So far, every business unit in an organization maintains its own set of user repositories. Access management is a step towards consolidating these user repositories to enable simplified single-signon (SSO) access and enhance end user ease of navigation.