The identity management challenge

See correction at end of review

The benefits of identity management are an easy sell. Of course IT organizations want to automate user provisioning, put an end to "I forgot my password" help desk calls, and bring sanity to access management across the enterprise. Connect these dots to Sarbanes-Oxley, and even CEOs and CFOs are on board.

The question now is, What are the true costs -- in terms of blood, sweat, tears, consultants, and unmet expectations -- of implementing a solution that, one way or another, touches every system in the enterprise? And which solutions are ready for prime time?

These were the questions we set out to answer in InfoWorld's first identity management shootout at the Advanced Network Computing Lab at the University of Hawaii, Manoa. We invited nine vendors: Computer Associates, Courion, Hewlett-Packard, IBM, Microsoft, Novell, Oracle, Sun Microsystems, and Thor Technologies. Six accepted, with CA, HP, and Oracle being the three holdouts that resisted our charms.

The lucky participants sent their solutions and engineers to paradise to do battle, which required each solution we tested -- Courion Enterprise Provisioning Suite 7.20, IBM Tivoli Identity Manager 4.6, Microsoft Identity Integration Server 2003 Enterprise Edition, Novell Identity Manager 2, Sun Java System Identity Manager 5.5, and Thor XellerateIM 8.0 -- to step through a series of identity management tasks based on a common business plot and simulated employee lifecycle.

We built a test network for TCPIP Corp., a fictitious company. The network was based on AD (Active Directory) and was stocked with a Microsoft Exchange 2000 server, a Linux-based HR application called e-HRMS, a Linux-based accounting application called webERP, and a few other systems for good measure. Our vendors needed to integrate their solutions with all of these systems and then tackle certain identity management challenges, including the hiring, firing, and criminal breach of a junior accountant named Harry, as well as TCPIP's acquisition of rival Fergenshmeir Inc. and the resulting directory migration.

To accomplish our required tasks, each identity management solution had to integrate with the e-HRMS system, AD, the webERP system, the Exchange server, and, in some cases, a Windows file server. Each of our six solutions took a slightly different path to achieve this, but the basic procedure was for each vendor to create custom connectors to the MySQL back end of e-HRMS and map various data fields present in the database to the same fields in AD. Various policies had to be created for user-name format, password strength, and so on.

When all this was functional, an initial reconciliation task had to be run to synchronize the data between the identity management server, the e-HRMS database, and AD. Following this, a subsequent reconciliation task would detect changes in the e-HRMS system that then triggered actions within the identity management solution.

We watched each vendor struggle in the lab to some degree, and we played devil's advocate with them all. In the end, only one vendor couldn't complete all of our tests, and this was due more to a lack of additional test time and product complexity than not having the required features.