Thursday, March 18, 2010

Almost a year...

It has been almost a year since my last post here...  apparently, when you're in the middle of an IdM rollout, you don't get much time for things like blogs.

And sadly enough, this is actually going to be one of my last posts here.  Lots of things have happened over the past year, including me leaving the University to start my own company, doing independent consulting.  All of my posts now will be on my new company's site, www.conklintechnology.com.  I still plan on posting articles about IdM news, but will also branch out to include some other topics, such as Intranets and CMS platforms, like Drupal, Plone and Joomla,  as well as some brand new services that I'm planning to offer, including a cloud-based LDAP server to get you up and running within minutes.

I will plan on posting one final summary of the IdM project at UofR, some thoughts on what went well, what didn't, and things you can learn from our experience.  But for now, you might want to subscribe to my new blog's feed to stay up-to-date.

Wednesday, April 8, 2009

Those crazy Rock Hounds

I got a great response from Deborah Volk at Identigral regarding my little thought exercise on dynamic opt-in/opt-out mailing lists. In this case, a mailing list for Geology majors, as well as anyone else interested in the occasional spelunking field trip.

Her approach is perfectly valid (and truthfully, makes more sense than what I was trying to do...). Basically, her suggestion is to use the various provisioning mechanisms of an identity management package, like OIM, to maintain the membership of a particular mailing list or group. People could be automatically provisioned into a group at time of account creation, or be event-based, such as someone switching majors. By providing other workflows, such as opt-in or opt-out, users could also add or remove themselves from that static group ad hoc.

What I was trying to accomplish was to put the logic of list membership into the list definition itself. Meaning, if I wanted to send out this week's Geologic Times newsletter, the group membership would be dynamically determined as soon as I hit the "Send" button. Anyone, at that point in time, who was either a Geology major, or had opted in to the list, would then be sent the email.

In summary...

The IdM-centric approach:
IdM workflows provision users into a static group for mailing list membership. The triggers for adding users into this group could be event-driven, such as at time of account creation, or manual, such as an end-user opting in or out of the list. The 'dynamic' part of the list is handled by the IdM software.

The mailing list logic approach:
Using advanced LDAP filters, create a mailing list that would dynamically determine membership at the point in time an email was sent to the list. This would most likely be driven off of attributes or roles assigned to the user objects in a directory store, such as Sun Directory Server or Active Directory. There is no 'group' per se -- it is the LDAP query filter that determines list membership.

Like I said earlier, Deborah's approach makes much more sense, if you have the IdM workflow engine already. However, true dynamic opt-in/opt-out lists are still possible without an IdM solution, but would be more difficult to create and maintain.

Wednesday, April 1, 2009

Another use case for good IdM workflows?

While I'm sure UC San Diego will learn all sorts of valuable lessons from this situation, what it should teach everyone else is the importance of establishing proper approval chains for workflows (such as sending out acceptance letters), and a strong business case for some sort of distribution list management tool...

http://www.nbcsandiego.com/news/local/Youre-Out-Youre-In-No-Youre-Out.html?yhp=1

ILM2 delayed until Q1 2010

This news certainly comes as a surprise, considering our Microsoft sales team apparently wasn't even aware of the delay. Architecting a solution around software that might ship sometime in the next 12 months doesn't seem like a wise decision to me though...

Jackson's Identity Management & Active Directory Reality Tour Travelblog: Microsoft's ILM"2" delay hurts