Simpler ID management readied by Microsoft

DENVER — Microsoft is developing a portal-like interface for its identity management platform that will let users self-manage their identity information and provision network services.

The features are part of Gemini, the code name for the next version of Microsoft Identity Integration Server (MIIS). Microsoft officials offered the first peek at Gemini at this week’s Digital ID World conference. Microsoft said Gemini likely would ship at the same time as Longhorn server in 2007, but could be released as early as 2006.

Microsoft says Gemini’s highlight is self-service provisioning features that let users maintain their own identity information and give delegation of authority to managers, department heads and others to create and delete accounts for select user sets.

The intent is to make it easier and more cost-effective for customers to manage user identity and access by pushing out those responsibilities to users with a vested interest in the information.

“This is a self-managing model with constraints as opposed to the manual model of today,” says Kim Cameron, architect of directory services for Microsoft. “For the first time we’ll have a separate provisioning component that’s self-service for identity management.”

MIIS is a system-to-system integration hub built on meta-directory technology that pushes identity changes made in one system out to all other systems connected to the hub to keep identity information in sync or to create accounts. For example, a new employee added to the human resources system could trigger the account creation for that user in other systems based on a set of pre-defined rules. Also, an employee’s job status change could trigger new levels of privileges in current accounts.

Cameron says users can go as far as they want in delegating provisioning authority, including provisioning group memberships within Active Directory. “We have finally finished the wiring [of the identity platform], and now we can do more stuff on top that is valuable,” he said.

Self-service delegation and administration, along with Web-based access controls, have been the most glaring gaps in Microsoft’s identity management strategy, experts say. Microsoft, along with HP, IBM, Novell, Oracle and Sun are building comprehensive identity-management platforms with an eye on Web services and standards-based interoperability.

“A lot of people want to do self-service and provisioning but it takes a lot of work and customization to get the needed workflow and approval routing,” says Jamie Lewis, president of Burton Group.

“It’s good what Microsoft is doing but the question is to what degree can it pre-package that and make it function without a lot of customization,” he adds.

Lewis says Microsoft also will need to increase the number of connectors in MIIS to non-Windows systems.

MIIS shops today must write scripts to delegate any level of provisioning authority to users. In Gemini, users will have a personalized point-and-click portal-like interface that gives privileges that reflect their role and authority level within an organization. The feature will be linked with the Authorization Manager features in Windows Server 2003 and with an audit/reporting module in Gemini based on another technology Microsoft is developing called the Audit Collection System, which is used to track changes made to user identities and access rights.

MIIS is one component of Microsoft’s emerging identity-management platform that also includes Active Directory and Active Directory Application Mode (ADAM). ADAM is based on the Lightweight Directory Access Protocol and is an alternative to the standard, full install of Active Directory.

Microsoft plans to release Service Pack 1 of the current version of MIIS along with Windows Server 2003, code named R2, in the second half of 2005. That MIIS release will include more synchronization connectors as well as upgrades to password management features.