New VDS Releases

There have been a couple of announcements in the Virtual Directory World.  I would be remise if I did not make mention of them.

Radiant Logic announced (Jun 23) the release of VDS 5.0. Here are some of links from the announcement. Press Release, Government Computer News, DM Review, Campus Technology

The new VDS offers simplified use of virtual directory technology, turning complicated LDAP operations into simple point and click tools. VDS 5.0 has built in wizards and templates to make the most common deployments even quicker and easier.  The new admin console boasts new scenario-driven wizards, so that users can easily deploy various identity and access management tasks.  Scenarios include web access management, Active Directory object and attribute mapping to SunOne (or other LDAP v3 directory server), and Active Directory forest aggregation.  There has also been support added for role-based delegated administration

They also added a very cool new Web-based remote admin console.  If you get a chance, check it out.  It was built on Abode's new Flex technology and has all the features of the server-based console.

As LDAP ages it is important to see that vendors are automating more of the LDAP functions. The need for hierarchal structures still persists, and LDAP is a perfect fit, applications consuming information from LDAP based repositories are not going away anytime soon. I have already heard this new version of RadiantOne VDS referred to as the "VDS for the rest of us". 

Optimal IdM also announced the release of their new Virtual Directory offering today (June 30th), the Virtual Identity Server for Enterprise Group Management.  This is a specialized release of their VD based on .NET to help with the known cumbersome task of AD group management. 

Their close partnership with Microsoft shows in their product.  Not only it is .NET based, they address AD issues with sharp precision.  Certainly Microsoft centered shops should take notice. I also read a good posting about this release on Jeff Bohren's blog. Jeff relates these new tools that are emerging from the virtual directory vendors as specialized "arrows" designed for use for specific problems.  I could not agree more.  You need a "quiver" of tools at your disposal to solve the unique and changing requirements of your identity environment.  Having a flexible identity infrastructure that virtual directories provide, is in my opinion essential. 

 

 

Single Sign-On

There was an SSO webinar today by Quest Software.  I would like to thank them for actually putting some content into it and actually explaining what their solutions offer.  I have become a bit weary of webinars so laden with marketing message, you really have no idea what the technology is offering you or if it will fit your infrastructure or not. 

The recording is available here.   My big take-away's had a familiar ring to them, as I have repeated some of these points too many times to count at this point.  Quest has an offering of multiple applications for an SSO package.  Also, check out Mr Shaw's white paper on the subject. 

First SSO means different things to different people; enterprise SSO, Federated SSO, Web SSO, Single Password, Reduced SSO, etc.  But I believe that some things are the same regardless of the "type" of SSO you want to deploy.

Shaw had a nice list of the "perfect world" for SSO:

• Standards based
• A single password or login
• A single directory
• Strong Authentication support / multi-factor authentication
• Support for multiple platforms
• Support for multiple applications
• Support for "thick, thin, and web applications"

This week I have been faced with some of the problems in solving SSO integration problems and how to deliver identity information to enable SSO.  A client had previously deployed a SSO solution for 35+ applications, using only two sources that were disjointed. Now they were faced with integrating another data source that contained intersection of identities. Some users in the new source exist in one of the other two sources - now the entire SSO solution collapses because it was based on the idea that they would never face an overlap of identities within the repositories.  Again, the answer was to deploy a virtual directory server as the abstraction layer to simplify the management of identities in these, now jointed data sources.

The lesson is, yes you can deploy an application without building a unified infrastructure, but you take a big risk.  When new data sources need to be incorporated (including acquired applications with their respective user-base), you can expect problems. 

PLAN AHEAD.. if you don't need to solve this integration problem now, YOU WILL at some point if you expect any level of scalability.  YES, it is possible to have one source for all your users, without replication.  By using the features of a virtual directory server to create a true union of identities (identities are correlated appropriately and duplicates are eliminated) and extend those entries with additional attributes from the needed data sources, you provide an identity infrastructure to provide authentication and authorization services to your SSO application. 

 

Using AD within Linuz for authentication

Does Active Directory top Linux authentication options?

http://searchenterpriselinux.techtarget.com/originalContent/0,289142,sid39_gci1279624,00.html

Integration issues between Linux and Active Directory discussed by Enk (Gartner) – metadirectories and other solutions – LDAP and Kerberos are discussed as a disadvantage because most organizations do not have people with LDAP expertise -

“cross-platform authentication market will probably remain in flux until at least 2009”