* Just-in-time provisioning can be as useful within the enterprise as it is between two enterprises, or an enterprise and a cloud-based service provider
Last issue we looked at Nishant Kaushik’s vast exploration of federated provisioning for cloud-based services. Like Kaushik, I think “just in time” provisioning is the way to go.
Last issue we looked at Nishant Kaushik’s vast exploration of federated provisioning for cloud-based services. Like Nishant, I think “just-in-time” provisioning is the way to go.
Just-in-time provisioning, typically instituted as attribute-based authorization, can be as useful within the enterprise as it is between two enterprises, or an enterprise and a cloud-based service provider (SP). Where I differ from Nishant, though, is that I believe — at least for the foreseeable future — that there needs to be an existing relationship between the enterprise hosting the user to be provisioned and the enterprise, or SP, that’s providing the service.
Nishant recognizes this when, in discussing the Security Assertion Markup Language (SAML) mechanism called “Attribute Query,” which does provide a so-called “back channel” for the identity provider and the service provider to carry on a conversation (about the user’s attributes) without impeding the “front channel,” typically browser-based workflow. He notes: “However, this does mean that it isn’t truly on-the-fly, since the SAML spec would require that a trust relationship be defined between the two sides ahead of time.”
I contend that this pre-defined trust relationship will always be necessary, but it doesn’t impede just-in-time provisioning, either.
Simply put, very few people within an enterprise are empowered to contract for services entirely on their own. Approvals are needed if only for the expenditure of funds. When talking about what can be seen as “IT services” (which cloud-based services are, just as much as enterprise-server-based services are) even more approvals would be needed since, in most cases, pricing is on a per user basis with discounts for quantity. There’s also the issue of interactivity — if everyone got to choose a different cloud-based word processor, how easily could documents be shared — and how difficult (if at all possible) would collaboration be?
No, cloud services need to be chosen ahead of time, and fees and subscriptions determined before any user can be provisioned to them.
But the provisioning can still be done on a just-in-time (whenever the user needs to use a contracted service) basis using do-it-yourself provisioning. SAML Attribute Query would be an excellent protocol and method for doing this. Each time (beginning with the first time) that a user attempts to access the cloud-based service his attributes are checked to see if he is authorized for that service, or for a particular role in that service.
The attributes themselves are granted, modified and removed in the enterprise’s corporate directory using standard, “old-fashioned” provisioning tools, triggered by HR events, or by requests from line-of-business managers.
Now it’s your turn — is there a flaw in my logic, or have I found the flow in Nishant’s?
