I was at the BMC User World conference in Lisbon last Tuesday, trying to figure ot where BMC is going, specifically in the field of identity management. After all, BMC’s presence in that segment has been surprisingly low-key since several months. Last year, BMC was to be found at every major identity-related conference. Jeff Bohren, BMC’s identity guru was very active in the standardisation efforts around provisioning services and in the identity blogger’s community, and BMC was marked as one of the larger players in the identity space.
Ever since, Jeff Bohren has left BMC to join Sunview Software. From what we at Kuppinger Cole noticed here in Europe was that BMC’s complete identity management pre-sales team in the UK and Germany left around that time frame as well. It didn’t take a conspiracy theorist to figure out that something was up. Had BMC decided to follow HP and quietly discontinue its products, or integrate them in a broader environment? That’s what my colleague Martin asked me to find out, and besides this was in “my turf” – right in Lisbon!
I scheduled a session with BMC’s CTO Tom Bishop and we discussed BMC’s vision and what the outlook for identity management is at BMC.
First of all: BMC is refocusing towards a new strategy around Business Service Management (BSM) and Business Service Automation. Identity plays an important part in a BSM-enabled ecosystem. BSM wasn’t something I was very aware of, but it made a fascinating topic. Therfore, I wanted to share some interesting background information that we received during the keynotes, and especially later in the break-out sessions from Tom himself.
In order to make the case for Business Service Management, an interesting statistic from IDG was presented. With higher complexity of IT systems, the cost of managing these systems also goes up. That should come as no surprise. As virtualisation and SOA becomes more adopted, the amount of systems rise even further and complexity increases even more. What does that mean for enterprises? Well, increased server management and administration costs for one, plus additional power and cooling costs (virtualisation obviously help mitigate the latter two, but again, more system management overhead). So are IT budgets due to increase? That is the last thing enterprises want to hear! So something’s gotta give, or things need to work more efficiently. Can IT run more efficiently? You bet, says BMC’s Tom Bishop. After all, after making every aspect of a business more efficient by automation, the IT departments are usually the largest places of manual labour to be found in any enterprise. Ironic, isn’t it?
BMC believes that there is a huge potential to automate the way that IT departments are being run, and is implementing its vision of Business Service Automation to offer its customers a complete solution to do just that. Business Service Automation, according to BMC’s vision, provides an integration layer to unify the “patchwork” of existing solutions that revolve around the provisioning of systems and software as well as the compliance with internal IT controls. (BTW here the words “provisioning” and “compliance” are used outside of the identity management context). WIth BMC Atrium technology as a central component, and driven by a change management database (CMDB), service support, assurance and automation are integrated, unified and simplified. This drives down maintenance and systems management costs significantly (once you discount the price to pay for the BMC solution, presumably), and allows an enterprise’s IT landscape to grow whilst keeping the management costs at par.
My head was spinning and I was impressed at the same time. I did manage to regain my composure however and had the opportunity to quiz Tom Bishop directly on the future of identity management in BMC’s overall strategy. What is happening with the product line, and why does it seem that BMC has retreated from that space? Tom mentioned that last year, BMC had several business units, out of which Identity Management was one – complete with a presales team. Now that has been reshuffled however, and BMC sees identity as a piece of the overall Business Service Management strategy, and will therefore continue to integrate its identity management products seamlessly within this structure. However, BMC will cease to push “stand-alone” identity management products as it has done before. Customers can still buy the existing products as stand-alone solution, but BMC will focus on the automation and overall integrated approach to service automation.
I tried to prod a bit to see whether there was any indication that BMC might try to fill some of the previous gaps in its “suite”, such as the missing federation piece. Here both Tom and I were caught in the ambiguity trap that opens when the words “federation”, or even “provisioning” are used by people of different technology domains. We identity management folks think about something completely different when we mention “federation”. Tom was thinking on how the change database approach could be used in a federated approach to integrate different services. I later tried to find out whether it was necessary to buy BMC’s identity management components to integrate with the Atrium software and the Business Services Management stack that BMC offers. I did not get a clear answer. Apparently the integrated BSM solution is able to detect when new users join and leave the organisation and an automatic provisioning of software and other services can be configured. Nobody could explain to me however whether or how this could be integrated within a non-BMC identity management – although I am sure that this will be possible, given that it may not be palatable for future customers to install yet another identity provisioning system aside an already running solution that has already been deployed – especially considering the pain and hard work that goes with deploying such systems!
So at least now it’s official! BMC is no longer a player in the traditional identity management market but is instead transforming its offerings to provide an all-integrated approach to automate IT through business service automation and management. Existing customers are still supported, and the products are maintained, but customers will have to look elsewhere for comprehensive identity management solutions, or at least buy the “missing pieces” from other vendors more active in the “pure” identity management sector.
Hewlett-Packard, who recently announced that it would all but retreat from the identity management sector as an independent vendor, has just announced a partnership with Novell. That will settle the many speculations in the industry. As HP had made a significant investment into identity management products, someone would surely be picking up the pieces. And the winner is: Novell!
From the announcement that was made to the analyst community and the subsequent press release, it is pretty clear that HP is looking for an elegant way to divest itself from its product line. Of course, HP cannot and will not leave existing customers hanging, so the previous announcement from HP was to “not actively pursue new customers” for its identity management software anymore. Another way of putting it – but the message is clear: those products are no longer actively pursued, the key employees have long moved on, such as Greg Whitehead who came to HP from Trustgenix, after it was acquired by HP.
If there is any doubt about the future of HP’s product line: Novell is offering a license credit for current HP Identity Center customers and the press release makes frequent use the word “migration”.
HP and Novell will now jointly develop tools to help their respective teams migrate customers away from Identity Center and towards the Novell product offering.
The win for Novell is obvious: a strong influx of new accounts, plus a strong partnership with a key systems player that has just a few days ago announced its intentions to strike it big with services as well – acquiring EDS. On the other side, what is the win for HP, apart from a honourable exit from its products? Surely, after the acquisition of EDS a likely theory would be that there may be some good deals in the pipeline for HP’s new upscaled services division, working closer with Novell. But even though this may be the case, it is very unlikely that the EDS deal and the Novell partnership have had any effect on each other, and although Identity Management is a hot and growing space, it is just a fraction of what EDS did for its customers.
What will be intereting to see however is if and how Novell will take over some of HP’s IdM estate, and how this would be integrated within Novell’s solutions. For example, the Trustgenix federation software, just to note one example, were superior technology at the time of acquisition and still present a formidable stack for the implementation of federation solutions.
A very interesting detail is however not mentioned in the press release: this special partnership is not exclusive at all. This should perhaps be obvious, because HP partners with other companies who also have a significant identity management offering. Curiously also, the press release was not even published in Germany. Although that may seem as an insignificant detail, it has subtle implications: SAP is very strong in the German Identity Management field through its Netweaver offering, and HP makes a lot of money through its partnership with SAP, and will want to keep its options open.
It will be interesting to see the reaction of HP’s Identity Center customers after this announcement. Some have already moved away from Identity Center, or are in the process of doing so. Novell has a well-rounded offering, but it might not always be the right match for existing HP Identity Center customers. Then again, it is likely that some technology gets transfered or licensed to Novell. For most existing Identity Center customers however this is good news, as it lays out a clear path for transitioning over to a solid product line that is established and actively maintained.
Ping Identity recently announced the availability of Version 5.1 of Ping Federate in their blog. What caught my attention was that Ping has now also finally added a feature I (and others) call “auto-provisioning” or “federated provisioning”. In federated environments, when users from other entities visit your site and gain access to services, it is often necessary to store some local data about these users on your system. In very simple cases, this could be user profile data, such as the colour of the background, but there could be much more information that would need to be stored.
So does this mean that by deploying federated environments, you are getting back to the “silo problem” where you have fragments of identity data floating around? Does this mean that as a service provider you must now store identity information, and accounts, and deal with everything that comes with it – including compliance with complex intermingled laws and directives? Ugh!
Don’t panic. In most cases you don’t have to – this can usually be avoided through proper design of the federation scenario. So should you avoid storing any data about external users coming into your system from federated identity providers? Well, this would be nice, but is not always practical. So you often end up having to store something about a user that “arrives” at your site from elsewhere through a federation (or your support of user centric identities).
So here are my recommendations, in no particular order:
Create those “user entries” on the fly – when someone “flies into” your site for the first time through a trusted federated link or an OpenID sign-on, create the user entry then automatically – if it’s not already there. Why? Because the alternative would be setting up a synchronisation service, and you really want to avoid that unless you really, really, REALLY have to…
Avoid storing “personal” data. This will make you resilient against privacy regulations. OK, or at least not expose you any further to them as you already are
In most cases, you already receive some data about the user together with the sign-on token. Try not to store a copy of that data, but instead just keep the data around for the lifetime of the current session. This might not always be practical or even possible. In that case, if you do store it, make sure you update the information when you receive changed data next time in the token.
Don’t turn the stored data into a “live account” by giving a user the option to store a local password, unless you really have a good reason to do so! (I am actually wondering what would be a good reason to do this and can’t think of any!)
If you follow these recommendations, then you can rest assured that you are not creating user accounts. Instead, you are creating “profile entries”. These are not to be counted as “accounts” or “identities” when the auditors arrive, because the profile entries themselves don’t carry any entitlement per se – you are not authenticating user entries. You are instead just keeping track of, say, a user’s preferences. That is a completely different type of animal.
Another good reason, especially for the first recommendation is that you’ll be saving yourself a lot of maintenance if you provision “on the fly” as opposed to manage synchronisation links (including the headaches that come with it). Again, the world is not perfect, and you may find yourself with your back to the wall surrounded by synchronisation links that all cry for constant love and tending.
I could go on and on, but instead I’ll refer to the presentation “How to efficiently manage external identities” that my colleague Stefan Rohr and I held at EIC 2008. Hmm. Somehow I can’t find the link to it. I guess that’ll have to be added tomorrow.
Obviously these recommendations come from the use cases that I’ve been seen or have even been personally involved in. I’d be really interested in YOUR use cases. Do you agree with my recommendations? Did I perhaps overlook anything, or am I just plainly wrong or “not applicable” in some scenarios? Please let me know by either commenting, or if you prefer, email me.
As I already wrote in my last blog, one of my personal highlights at the European Identity Conference was the discussion that I had with Dale Olds, Jackson Shaw, Kim Cameron and Dave Kearns on the concept of the “Identity Bus” of the future. It’s now online! So here you go, enjoy
We’re obviously just at the very beginning, but hopefully we’ve kicked off a good discussion to be continued via our blogs, papers, etc! I think it is very important that we do this and solve many issues around identity. A new type of identity plumbing, indeed. Let’s keep up the momentum that’s been building over the last few weeks – now is the time to do it
Thanks to my colleagues Bernd and Alexei who’ve been working hard to digitalise and cut the videos that we’ve shot at the European Identity Conference 2008. And of course, a big THANK YOU from my side to Dale, Jackson, Kim and Dave!
The European Identity Conference 2008 closed its doors last Friday, and for me it has been a fantastic event in all aspects. Obviously you should take my comments with a grain of salt as I am working for Kuppinger Cole and am therefore part of the organising team. However, I have never before attended a conference that combined such a breadth of topics, number and quality of speakers and depth. Many conferences are either at the “C*O level” or pure “geek conferences”. At the former, the geeks still intermingle since they are brought to the event to do exactly that, or to showcase their solutions. At the latter, it’s mostly tech-talk, pure and deep. EIC 2008 covered the whole range and therefore appealed to everyone as well as offering unique opportunities to learn more about the topics from other points of view.
The agenda was packed, and including BoFs (bird of feather sessions) many days went straight from 7 in the morning to 7 in the evening. I was actually surprised that so many people actually showed up at 7 AM for the integrated breakfast + BoF sessions. And yes – unfortunately having many tracks going on in parallel can be frustrating for those who are interested in multiple topics at once. But I think the track organisation has been done pretty well after a lot of fine-tuning, and besides – we’d all love to meet for two weeks, but nobody in charge would sign off on the travel request!
The identity federation track that I moderated was packed to the brim. Good to know – we definitely need a larger room for next time! Some people were standing, and we had to open the windows. Conor Cahill kicked off the track to give a overview of the technology within the area. He had a lot of ground to cover, and since the agenda was packed, I joked that he had agreed to speak faster in order to keep the presentation to 30 minutes. In fact that’s exactly what he did – finishing with still 5 minutes left for questions. He just emailed me his presentation and it will go online tomorrow to join all the other presentations already downloadable (those who attended the conference will have received the link). We followed with an experts panel discussing the current state of federation technology and where it’s likely to go, and where new technologies such as information cards will fit in. After that we had two user presentations: Anton Shmagin from the United Nations talked about a unique multi-technology and multi-protocol federated circle of trust in three months and how the organisational, political and of course technical challenges were solved. After that, Brian Puhl spoke about Identity Federation tales from the trenches at Microsoft. Brian is a real barnstormer and his presentations are excellent, funny, insightful and offer many nuggets of information that you wouldn’t get anywhere else. He is in Microsoft’s IT department, and in charge of Microsoft’s internal Active Directory systems. He uses the term “dogfooding” to describe what he is often asked to do – use beta versions coming from devlopment and putting them to production use in such a large environment – and then putting out the fires. I’m sure he has many of the developers’mobile phone numbers on speed dial! After the user presentation we had a vendor panel, which gave everybody the chance to exchange jabs and score points, as well as explain their specific vision and value-add. And we could have gone on, but there were only three hours for the track – hardly enough to “cover it all”. Several presentations on federation were also to be found on some of the other tracks and workshops and usually very well attended – an indicator on how important the topic is.
Conferences give a unique opportunity to meet up with peers, and for me this has been the perfect opportunity to network with users, customers, vendors and experts in the field. One of my personal highlights has been a 45 minute talk with Dave Kearns, Kim Cameron, Jackson Shaw and Dave Olds where we discussed the future “identity bus” concept that Microsoft’s Stuart Kwan introduced at the Directory Expert Conference in March. Following that announcement there’s been quite a bit of speculation of what such an “identity bus” might look like, and what it would replace. In my opinion, this “identity bus” would be the future fundament of identity management, like today’s directory services. Our discussion has been videotaped, and our camera man Bernd almost broke down after carrying that heavy camera on his shoulder once the interview was over.
Joerg also sent me out with Bernd the camera man to do several video interviews with some of the important players in the space. These interviews are currently being converted into streamable format and will be posted on this site “real soon now” (TM). Watch this space
