* Identity management is bigger than the directory
Among the many discussions in which I participated at last month’s Digital ID World conference in Denver, some of the most interesting centered around the increasing realization among vendors and implementers alike that identity management isn’t necessarily about the directory. Identity information can be integrated across a number of resources, whatever and wherever they may be.
This may sound a bit obvious, but if you, like I, have been involved in an enterprise identity management project in recent years, the directory has more often than not been at the center of your focus. Either implicitly or explicitly, we as implementers have often looked on identity management primarily as a directory deployment project.
Where this has been true (and I’ve been as guilty as anyone), it means that, once again, we have missed the point, focusing on the technology rather than the business and practical implications of IT. The paradox, in the case of identity management, is that it is the growth of enabling technology that is making it possible to integrate “real world,” non-directory-based identity resources, wherever they may be found. From advances in provisioning, database, virtual directory and metadirectory techniques, to the “Holy Grail” of federated Web services, identity management is becoming increasingly more fluid, less bound to specific technologies, and freer to meet real-world requirements for implementing trust across a variety of domains and demands.
This brings with it some specific implications.
For one, it raises policy management to a more central role. If multiple disparate identity information stores can be integrated in a broad, loosely coupled way, then it is the policy under which trust can be communicated across domains that becomes key. This has implications not only for initiatives such as federated provisioning, and the trust issues it raises, but also for policy management systems generally – an area where truly comprehensive implementations are only beginning to emerge, and where the adaptation of identity management techniques may play a role.
For another, it opens up new opportunities for non-directory information stores. ERP and database vendors have long been poised to play a substantial role in identity management. Advances in distributed integration mean that they may soon become even more significant participants in the market. This also has implications for Microsoft, owner of both a widely deployed directory as well as a popular database. Once Windows, Active Directory and SQL Server converge with federation via the XML-enabled world of .Net – but that’s a topic for another newsletter.
Finally, advances in truly decentralized identity management have implications beyond the world of identity itself. In the realm of enterprise management, for example, the integration of a configuration management database is central to initiatives such as ITIL compliance. If the CMDB can more reflect the federated ideal of integrating distributed information wherever it may be found, rather than re-introducing the liabilities of the centralized directory approach, it may be more likely to succeed.
These are just some of the reasons why identity management means far more than authentication, authorization and accounting. From cryptography to compliance, advances in identity management have pointed the way for a number of initiatives for many years. Identity will continue to point the way to the future of management on a number of seemingly unrelated fronts, and it bears watching throughout the enterprise.
