The Identity Cookbook

A common use case within the identity life cycle management world, is what to do with shared and privileged accounts.  Common accounts such as administrator, root, backup operator accounts and other delegated administration accounts, lead to a significant anti-pattern approach when it comes to password management.  For example, many shared service or administration accounts....are just that: shared.  Sharing a password is a very insecure method of account administration.

This generally brings out several security issues:

The password is generally none-complex in order for many users to remember itThe sharing of the password is not tracked - people who shouldn't know the password generally doIt's difficult to track who is actually using an account at any moment in timeWhilst these issues are well known...they are still prevalent, and hence an entire sub industry focused on privileged account management (PAM).
Whilst OpenIDM isn't a PAM product, some basic password checkout ser…

This week I was at the Gartner IAM Conference in London and I had several conversations regarding the different components in the IoT space.  The obvious consistent components are the devices themselves, the people (who either own or operate the device) as well as the data those devices either collector, process or generate.

That isn't a particularly insightful observation.  It does however, have some significant implications. Many existing identity and access management frameworks, products and implementations focus on the P - people.  As the IoT landscape develops, the IAM framework needs to be significantly expanded to accommodate life cycle, authentication and authorization services across a multitude of components, especially data.

For example, device registration and authentication is well understood, but what about the security regarding the data integrity, delivery and correlation of that data?

Do the new identity frameworks now need to accommodate use cases like the followi…

One of the common use cases I've seen recently, is the ability to link statically provisioned objects to one another.  Commonly known as linking or hierarchical linking, this provides a basic parent to child relationship, in an "1-to-many" style relationship.  For example, a literal parent, may have several children in his family, which needs to represented in a permanent or solid format.

If you apply that concept to identity, this could be required for things like production lines (parents) to sensors (children), bill payer (parent) to content subscriber (child) in the media world or perhaps floor manager (parent) and operator (child) in a retail setting.

The main idea being, is that the parent may have different characteristics (different schema, different policy validation, delegated administration rights) from the child, but still has a very permanent relationship with the other object.

OpenIDM has the ability to very quickly create different object types.  This feature…