Talking Identity

Like I mentioned last week, this is an interesting time for Identity Services. In that post I talked about some of the reasons why this is relevant to what's going on at Oracle. But this is also relevant to the industry at large.
 
There are lots of small projects going on that at some point could coalesce into a unified vision for Identity Services. However, this bottom-up development has to meet a top-down design at some point for this to play out properly. Otherwise all these projects could end up fulfilling their goals without making our overall identity experience better.

The timing of starting a concentrated effort at defining this top-down design is an ongoing debate happening in various spheres I am involved in, both inside and outside Oracle. Getting going on large scale architecture efforts are always hard, especially when it's impact will be felt way down the line. But we have seen that happen in the area of SOA, so I am hopeful we will figure out a way to make it happen. Some of us have been trying to work out the right forum under which to set up a working group on the topic. But the important thing to do is to get a discussion going on the topic among stakeholders, something I have been trying to do through this blog.

Tomorrow, I will be participating in a panel on "Identity: The Ultimate Solution to SOA Security" at the InfoWorld SOA Executive Forum being held at the Millennium Broadway Hotel in New York. If you happen to be attending the conference, please plan on attending the discussion, which I hope we will be able to make interesting. And I will be more than happy if you come up to chat about this (or anything else) after the panel is over.

Here is what I learnt at the InfoWorld SOA Executive Forum, where (as I mentioned in my previous post) I was participating in a panel on "Identity: The Ultimate Solution to SOA Security". The SOA community is not very clear about what we mean when we talk about Identity, let alone Identity Services.

The panel discussion was pretty good, with all of us on the panel doing a pretty decent job explaining the issues that are being faced in making identity a consistent part of the SOA experience. However, about halfway through the panel, we got some questions from the audience that seemed to indicate that perhaps we were thinking two steps ahead of where the audience was. People struggle to understand the impact identity can have on the way they are thinking about SOA, and their mental map of identity services seems to only go as far as authentication and (to some extent) authorization.

It was encouraging to visibly see the light go on for some people as we talked through the concept of SOA Identity. A number of people came up to the panelists after we finished to discuss their ideas and thoughts. A few even talked to me about trying to figure out a way to link their SOA efforts to their ongoing IdM deployments (that are happening in independent projects).

One of the things that seemed to work for me personally was linking the discussion of identity in SOA to the real challenges we are facing at Oracle in defining Identity Services for Fusion Architecture. The use of concrete examples seemed to illustrate the use cases that they cared about. And it generated a lot of interest.

It will be interesting to see if we can carry this discussion forward. On Monday, I will be presenting at OpenWorld on the topic of Identity Services in Fusion architecture. If you are going to be at OpenWorld, I encourage you to come and attend. The more discussion we have about this topic, the better.

So come by and join in the fun:

Session: S291824
Title: Rationalize, Centralize, Externalize: Detailing Identity Management in Oracle Fusion Architecture   
Time: Monday, 11/12/2007, 4:45 PM - 5:45 PM   
Location: Moscone West  3006 - L3

I'm writing this on a flight from San Francisco to Los Angeles, because an unfortunate scheduling conflict means that this year, Oracle OpenWorld and the Gartner Identity & Access Management Summit overlap for two days in the middle of the week. So I am going to miss the first day at Gartner because I just had to stick around at OpenWorld to hear Larry's keynote.

As usual, OpenWorld was chaotic, massive and entirely overwhelming. Between the claustrophobia induced by the crowds crossing Howard Street or cramming into keynotes, the rush of standing in front of folks to talk about identity management in fusion architecture, the late, late evenings with customers and co-workers, and almost being trampled by a couple of OpenWorld revelers dancing a wild jig at Lefty O'Douls, it's been a crazy couple of days. Oh, and the conference has been interesting too.

OpenWorld always has the production values of a rock concert, and one of the interesting things that the organizing team did this year was incorporate a form of user-generated content into the opening for the Keynotes. Before the keynotes would start, a poll or questions would be posted on the giant screens in the keynote hall, and the audience members would be encouraged to send in their responses by text message, with the results being shown on the screen in real-time. While the poll questions elicited some good feedback from the audience, it was interesting to see some of the responses people sent in to questions like "The next killer app would be...", "What features would you most like to see in Oracle products?" and "What was the first Oracle product you encountered?". Messages ranged from the humorous to the thought-provoking, with a couple of digs at Larry.

Audience Polls before Keynotes

Charles Phillips giving his Keynote

It feels good to come to any conference and hear people talk about concepts and trends that validate the direction we are taking. And the Gartner IAM Summit certainly did that. Steps that we are making in the areas of role management, identity services and the move towards tighter integration of identity into the fabric of applications seemed to resonate with the analysts and customers that were presenting. And the overall tone of the conference seemed to indicate that good times lie ahead.

I missed the first day of the conference because of the overlap with OpenWorld, but I did manage to catch sessions the next day and a half. From what I saw, the sessions at this year's conference were designed to cover the entire gamut of everything that exists today in the IAM space. That meant talks that ranged from authentication to role management to user-centric identity.

Here are some thoughts from my experience at the conference:

• In light of the broad coverage that Gartner was trying to achieve, it was interesting that User Provisioning was not covered in any
  sessions (unless it was discussed on day 1, but the agenda didn't seem to indicate that). Could it be that UP is ubiquitous enough that it is well
  understood, or is it simply too boring a topic?
• Gartner seems to have upgraded Role Management from an interesting but difficult solution to something that is "doable".
• The new darling of the analysts seems to be the line of products that play in the Identity Auditing space.
• I was pleasantly surprised by the amount of coverage that Identity Services received at the conference. Earl Perkins did some good sessions on the topic, providing a good explanation of the concepts to the audience.
  
• Externalized Authorization also received a fair amount of coverage, but it is still being presented as an edge technology due to the revamp it forces on application architectures.
  

This is a little bit of a rant, but read this article in the New York Times and you may understand why. It is difficult to get past the feelings of disbelief, outrage and anger that the tragic story of Megan Meier will stir inside you. But if you somehow manage to move past it and think about the implications, it becomes clear that there are some pretty important things that we (the identity community) need to work out, and fast.

Most of today's social web applications (like MySpace and Facebook) are persona-based, not identity-based. What I mean is that these applications don't really care about who you are, they only care about letting you be what you want to be within their context. So, it is not surprising that a 47 year old woman was able to pose so devastatingly as a 16 year old boy, because in essence that is what MySpace was built to be - a way to express a persona of your choosing.

Why don't these applications, that know the kind of impact they can have (we all understand the threat predators pose online) on a persons life, care about who you really are? Because, bluntly put, they can't. It is not possible for them to do that in a scalable, cost-effective manner. The lack of a solid identity framework for the internet prevents these applications from being truly identity-based. We have seen a push towards heavy-handed identity verification mechanisms (see my earlier post about identity verification in Second Life), but those solutions are so costly (time, infrastructure, cost) as to be impractical for most web applications. This kind of model will effectively curtail the free-wheeling collaborative spirit prevalent in the current generation of internet apps, and throttle innovation. If you had to stand in a line somewhere for 4 hours, and had to show your passport to someone, just so you could sign up for a Twitter account, would you?

A one-size-fits-all approach is not the answer. The correct solutions in life only come from taking a balanced approach to the problem. Nothing is more annoying to me when adding a Facebook app than being
required to check the box agreeing to share my information with the
app, even though I know that it doesn't need any of it, and most likely isn't using it at all. Consequently, I avoid adding those apps unless I really want to.

This is where pieces like Bob Blakely's Identity Oracle, the Identity Services model, Burton's Limited Liability Persona, the IGF and user-centric methodologies have to all fit together. We do need strong identity verification mechanisms, but we shouldn't need to go through that for every single site we want to use. Indirection is the solution to many a problem, and the right identity framework for the internet is the necessary thing to have this identity verification feed into a platform level identity that multiple applications can build on.

This is also needed as a necessary step to support pseudonymity online. The goal of an identity framework is not to prevent people from creating online personae that are
divorced from reality. It is to give applications the ability to create
suitable boundaries within which such a persona can be created. Using this,
an application like MySpace, where the identity consequences can be so
devastating, can choose to, for example, prevent people whose identity
is in the 30+ age group from creating a persona that is in the 10-20
age group.

Like so many things in modern life, we have gotten immune to all the horror stories of online predators. Until a story like this comes along to remind us that these are important things that we are working on, and we need to get it right.