ORLANDO – Microsoft last week said it is planning major upgrades to its identity integration software including self-service capabilities, workflow, provisioning and auditing – and eventually will make those pieces core to the Windows operating system.
Microsoft plans to ship Microsoft Identity Integration Server (MIIS) 2003 Service Pack 2 in the first half of next year and then release a major upgrade, code-named Gemini, in 2007 some three to six months after Longhorn Server ships. Microsoft officials said last year they planned to ship Gemini before Longhorn Server.
The additions to MIIS, which were detailed at the company’s annual TechEd conference, are designed to ease user management, enhance security, streamline integration with business partners and aid in compliance with federal regulations.
MIIS is a system-to-system integration hub built on metadirectory technology that pushes identity changes made in one system out to all other systems connected to the hub in order to keep identity information in sync or to create accounts. It is a key part of the identity management platform Microsoft is building to compete with the likes of Computer Associates, HP, IBM, Novell, Oracle, RSA Security and Sun.
The MIIS upgrades are part of a multi-step plan observers call ambitious that eventually will see the capabilities of MIIS, including password management, self-service capabilities, auditing and workflow, subsumed by the core Windows Server operating system. MIIS eventually will become just a set of connectors for integrating those services with non-Windows applications and systems, according to Microsoft.
But before the transformation of MIIS takes place, Microsoft is beefing up the technology by adding self-service capabilities and improving provisioning. Those two improvements trigger the need to also improve workflow and approval routing capabilities, and add more connectors to other systems, experts say.
This month, the company will ship MIIS connectors for RACF. In the fall, Microsoft will add connectors for ACF2 and Top Secret. In addition, it will ship support for PeopleSoft and SAP that will use the native protocols of those ERP packages, according to Andreas Luther, group program manager for identity and access at Microsoft.
Next, he says, Microsoft would ship in early 2006 end-user self-service password management capabilities as the highlight of MIIS Service Pack 2. The feature lets end users reset their own passwords without help desk intervention. Microsoft also plans to integrate the features with its Speech Server, so users can reset their passwords over the phone and with two-factor identification systems, such as Smart Cards, to reset PINs.
Gemini, the next version of MIIS, will add workflow, centralized auditing, a set of self-service applications and access management based on specific rules and end-user roles.
The integrated workflow capabilities will be based on atechnology called Windows Orchestration Engine (WinOE). Microsoft is developing WinOE for its BizTalk Server, which coordinates process workflow.
Gemini also will include features such as declarative provisioning, which lets users write provisioning rules for how access control is granted. In MIIS today, that requires custom coding. Gemini also includes tight integration with Visual Studio for building XML-based interfaces and self-service applications such as group membership requests. Microsoft also will ship a number of pre-built applications such as AutoGroups, which lets users create their own groups in Active Directory.
But Gemini is really just a step toward a major leap for MIIS, which is both an engine for synchronization, provisioning and workflow, and a set of connectors for linking to other identity stores.
Microsoft plans to move the MIIS engine into the core operating system either in the second version of Longhorn Server called R2, which Microsoft officials said last week is already under development, or the Blackcomb release, which comes after Longhorn. That would make identity integration part of the base Microsoft platform and in essence, Microsoft would be providing it to users free as part of their Windows server licenses.
As a product, MIIS then becomes just a set of connectors users will purchase to extend basic provisioning and workflow beyond the Windows platform.
“MIIS evolves into a process integration service that will become part of the identity and access management platform,” Micro-soft’s Luther says. That platform includes Active Directory, the forthcoming Active Directory Federation Services due to ship at year-end in Windows Server 2003 R2, and authorization and authentication services in Windows Server such as Kerberos.
“Today we have to build custom extensions to MIIS for auditing and compliance and this process integration service would replace that,” says Orryn Sledge, practice director for Ciber, a systems integrator in Pittsburgh. “MIIS is an engine and you have to figure out how to glue together the other pieces.” Sledge says auditing requirements, especially among his health care clients, are forcing the need for these changes.
With Microsoft’s process integration services users, resources and polices all would become identities, according to Luther. Those identities would be aggregated in the central MIIS store, which is Active Directory and eventually SQL Server, and centrally managed either by administrators or through self-service controls. Business policies would then be created to manage relationships between those identities, such as what user has what rights to what resources at what times. Compliance would be added with auditing using synchronization to compare current identity relationships with established policies.
|
