Connectors for Identity Provisioning

We have an intern working for us before he reports for National Service next month. So we gave him some exploration tasks, one of it being to automate our onboarding process using OpenIDM.

New staff on boarding procedures for our office:
1. Create an AD Account
2. Create Zimbra Email Account
3. Create VPN Account
4. Create SVN Account
5. Create Helpscout Account
6. Create Slack Account
7. Create JIRA User
8. Add user to Google calendar

Simple task. Should be able to finish within a month.

No.

Tasks like creating a Zimbra email account, VPN account and SVN account are command-lines operations, thus we need a SSH connector. Took a quick look at https://forgerock.org/openicf/docs/connectors/. Happy! We thought we can workaround with the Solaris Connector.

But no again... the link was broken.

Raised a ticket with Support and was told a new SSH Connector is going to be released soon for OpenIDM 4.0.

Before that happens, what can we do? Generate a flat file using CSV Connector; Run a script to execute the commands on target systems. Less than ideal.

So sometimes, things like this do happen. When you look back the design after implementation, you would like : "OMG! What the hell? Who did that?" Mostly not asking what was the limitation when a design decision was made.

Side track a bit... So we were looking deep into RSA Via Lifecycle & Governance. One thing we like about their architecture was a Mulesoft engine was embedded, which provides the connectivity to external systems. Mulesoft has tons of connectors out there (https://www.mulesoft.com/exchange#!/?types=connector). Ok, not all are Mulesoft-certified, but I would think if one is certified, it would also mean the cost will be different. :)

So, one of my Identity Specialist went crazy and wanted to integrate OpenIDM with Mulesoft. It has what we want - SSH, Slack, JIRA.

Will try. :)

.

ELK . OpenAM . OpenDJ - Part 3

Today, my customer called to alert me that their SSO infrastructure is "not stable". We had OAuth2 Provider configured for this customer. OAuth2 clients' authentication hit into unauthorized error. A little while later, he called me again telling me the Login Page went into an infinite loop. 

But ... but ... everything went back to normal after a while. 

OpenAM/OpenDJ are very stable products from our experience dated way back to Sun Microsystems. They can't go into crash mode out of the sudden. 

In the end, we found out that the network team is tech-refreshing the network. Wow! During office hours? Yes. Well done!

Anyway, until we found out the root cause, the first tool I used was to quickly go to the ELK which we have set up for this customer. Nothing unusual. 

And I blogged about how my team use ELK platform to monitor ForgeRock Open Identity Stack here and here.

"Invalid Password Server Trend Live" - This tracks the user invalid password events.

In my previous blog, I wrote that we noticed huge Invalid Password spike and subsequently identified that it was due to a malfunction automated application. 

Below is a trend for the past 30 days. It was obvious the application went haywire on 29th April and was subsequently rectified on 11th May.

I went to the same dashboard and selected the trend for past 7 days. As observed, on a normal day, the max Invalid Password should be in the 65 range (per OpenAM server).

This is something we are working on right now. With this threshold on mind, we are building a Notification Service to trigger proactive alert to the Ops team. 

.

ELK . OpenAM . OpenDJ - Part 2

I blogged about how we use ELK to monitor trends, especially abnormal ones, on ForgeRock Identity Stack. 

"Login Failed Server Trend Live" - This tracks the user login failure events. 

Just a few days ago, we observed that the number of Login Failed events had increased.

So, we zoomed in and found out there were many lines of the following errors:

"2016-05-17 00:09:00"   "Login Failed|module_instance|Application"      "Not Available" golfdigest 202.xx.xx.xx   INFO    o=xxx.sg  AUTHENTICATION-268     "cn=dsameuser,ou=DSAME Users,o=xxx.sg"    "Not Available" Application     202.xx.xx.xx"


I know if module_instance is Application, then this is not a user authentication. Most likely, it is a Policy Agent in action. By the way, every Policy Agent will need to authentication with OpenAM in order to pull the policies.

So based on the IP address (202.xx.xx.xx), we found out the owner of the application. Ah! This is a defunct site. The SSO administrator has already removed the Policy Agent "golfdigest" from OpenAM as part of the sunsetting process, but the network team has not disabled/removed the Policy Agent on the Apache web server yet.

We have many more useful dashboard in Kibana, which we use for operational purpose.  I'll share later.


.

Ansible . OpenAM . OpenDJ . OpenIDM

For some of our larger deployment of ForgeRock Identity Stack, we will usually request to install Ansible on the development node.

For pure Linux environment, it works like a charm once SSH keys are exchanged during initial setup. (For Windows, it is supported but slightly more complicated to set up)

What do we use Ansible for? Almost every operational task.

Change configuration files; Update custom codes; Update JSP/UI pages; Deploy patches from ForgeRock; Restart Apache/Tomcat servers ... anything.

We used to make human errors occasionally when we managed a farm of over 10 OpenAM and 6 OpenDJ servers. Now that everything is pushed from development node, there is hardly any human error.


I just saw Ansible Tower on Ansible website.

No urgent need to use this feature. Our current Ansible already has logging/audit in place.

Anyway, once a playbook script is tested, there is hardly any error when it is being executed.

.

OpenAM 12 : Changes & Deprecated Functionality

We kick-started an Open Identity Stack (OpenAM, OpenIdM, OpenDJ) project yesterday. * feeling excited *

So for this project, we intend to use OpenAM 12.0.1 - the latest release to 12 series.


In Additional New Features, I saw the following which my customers asked for:

• Audit Logging to Syslog
• CORS Support for OpenAM APIs
• Session Failover Across Sites
• Whitelist for Custom Login URIs
• Policy Support for Common HTTP Operations

Personally, since I'm very much into the internal working of OpenAM, my favourite will be:

• Reduced Cross-Talk

In OpenAM 12, there are quite a number of important changes which we need to be aware of. Read Chapter 3. OpenAM Changes & Deprecated Functionality.

The Policy Evaluation engine has undergone huge changes, so one has to be careful here when performing an upgrade. Luckily this is a green field project!

There is also a lot of fixes - read 4.1. Key Fixes.


.

ForgeRock Professional Service

These days, when ForgeRock sells subscriptions, it has an option to purchase Professional Service as a bundle. Free or not? I'm not too sure. It's part of price negotiation, I believe. 

The ForgeRock Professional Service can be utilized as follows: 

I think the original intend is to get customers up-to-speed with Open Identity Stack (OIS) deployment. This is especially helpful/applicable to customers who are more technical-savvy and would like to deploy OIS by themselves. High-level Architecture Workshop will be helpful.

Now, what if a SI who is well-trained in OIS is involved?

Customers, being customers, will want to cut cost. Always.

The worst case scenario is for a customer to ask the SI to cut-off a few man-days from implementation cost, since the customer can utilize Product Specialist Field Assistance. Wow! Unbelievable, isn't it? Nay, this should not happen at all and it really doesn't make sense. If customer insists, I think the best way is to walk away.


I think this Professional Service should be best utilized in Production, especially On-Site troubleshooting and Performance Analysis. There will be situations (or there had been?) where a site is badly deployed by a so-so System Integrator (SI) and is now causing production issues. It would be real hard for support engineers to provide remote support. An on-site troubleshooting comes in handy.


.

Open Identity Stack - Common Audit Framework

I'm looking forward to the Common Audit Framework in the next release of Open Identity Stack (OpenAM, OpenIDM, OpenDJ and OpenIG). 

At present, each component is logging in its own format and to different targets (e.g. file-system, database, syslog). Thus making debugging across components tedious.

This is definitely a good move!

.

ForgeRock has set up APJ HQ in Singapore

Finally, it's official. ForgeRock announced that it has set up its Asia-Pacific Japan (APJ) regional headquarters in Singapore. Full press release here.

In fact, we have been working closely with Sumal & team since December 2014. Customers in the Asia region, especially those in Singapore, have been asking for ForgeRock's presence years ago. This has finally become a reality.

In addition, support engineers will also be stationed in Singapore to better serve customers in this region.

This is a great start to the year!


By the way, Singapore Press Holdings is Azimuth's customer. :)

.

OpenIDM 3.1 released

OpenIDM 3.1 was released on 3rd December 2014. The announcement can be found here.

This is an exciting release as the UI for managing connectors and objects has finally arrived! It doesn't matter a lot to hard-core engineers. But believe me, one of the customers' evaluation criteria is a easy-to-use Admin UI. In fact, it is an item that is high up in the evaluation list.

So, I just finished attending ForgeRock Partner Focus Session. Following is a quick highlight of OpenIDM 3.1.

Some marketing stuff below :)

Roadmap for OpenIDM 4.0 below:

Great stuff! Latest version of OpenIDM can be downloaded from here. 

OpenIDM 3.0 . July 2014 . Product Enhancements

It has been confirmed that OpenIDM 3.0 will be released in July 2014. The new release is now undergoing QA - should be ready soon. ( Ok, usually QA will take a while... :> )

I'm still attending the webinar by Anders - "OpenIDM: Identity Administration for Users, Devices and Things".

Quick summary of some of the product enhancements to be expected from this new release.

Of course, the key highlight of this release is Role-Based Provisioning support.


.

ForgeRock Software Not Affected by ‘Heartbleed’

Last week went kind of crazy after the Heartbleed security flaw was uncovered with customers calling to verify if their deployments are affected by the bug.

ForgeRock released a press statement on 11th April 2014.

• ForgeRock’s products (OpenAM, OpenIDM, OpenDJ, OpenIG) do not incorporate openssl. OpenSSL is a commonly used component of open source software and Linux distributions, whereas the vast majority of ForgeRock software runs on the Java platform which uses its own TLS implementation. 

• Some ForgeRock components use the Mozilla Foundation NSS libraries, which are also not vulnerable to Heartbleed. 

In short, ForgeRock software are not affected by Heartbleed.

.

IRM versus IAM - 2 very different worlds!

A picture says it all.

To put it simply, IAM is all about compliance (authentication + identity management + governance) within an enterprise security parameter with a population size usually less than 50,000. In fact, a figure of >30,000 workforce with partners are not usually seen.

IRM goes beyond an enterprise and it's about the Internet of Things. It is usually sized to support a population of more than a million. It's a totally different playing ground.

That's fun! :)

.

Mobile Device Management - Part II

In October, I blogged about Mobile Device Management and I was thinking aloud about how a traditional IDM product can add-on a new feature to provision to a MDM product.

  

The next feature will definitely be able to bridge the gap between identities from enterprise customers (most likely, in-house Microsoft Active Directory) and MDM products. I do not think we should cross the path of building a MDM product from scratch. That would be too far-fetching. 

This would be a one-stop solution.

This morning, an email came from SailPoint announcing the release of IdentityIQ 6.2. 

Dream comes true! Yes, indeed.

Highlights of what’s included in the new release:

• First of its kind integration with mobile device management (MDM) solutions from AirWatch, Good and MobileIron
• Re-styled user interface with crisp, clean look-and-feel
• Expanded scalability support for critical IAM processes
• Enhanced administrative user experience with improvements to workflow and quick link configuration
• Separation-of-duty (SoD) policy simulation
• End user tablet support (iPad)
• Integration support for STEALTHbits, Cyber-Ark and Microsoft FIM
• Expanded healthcare integration with Epic & GE Centricity connectors

These days, any IAMS product will want to get "friendly" with mobile devices. Why not? It's a super huge market in the mobile space.

.

ForgeRock BackStage

I just came back from a 10-day holiday in New Zealand. Amazing place to be in! The scenery is best to none!

And I did a 32-km trail run on a sunny Saturday morning last weekend - The Great Cranleigh Kauri Run. Awesome view when I ran on the ridge!

By the way, I came back last night and received an email from ForgeRock Support. 

The BackStage has gone LIVE! BackStage is the new Customer Portal from ForgeRock. 

BackStage is the first step in providing a new level of service engagement between ForgeRock and our customers. It brings together our key online customer services into a single convenient location so that you will find your downloads, support tickets and product enhancement requests all in one place. The existing download site will be merged into the customer portal and as a subscription customer you will also be able to gain access to maintenance downloads and any critical or security patches available for your products.

  

BackStage also introduces a support ticket wizard to help you create tickets that more accurately reflect the nature of your problem, leading to a more efficient support process and hopefully a speedier conclusion. BackStage will also allow you to view your open support tickets; selecting a ticket will take you directly into the support system allowing you to view and update the ticket as usual.

To my customers, what is most important is Patches! :)

This is what matters to them most and this is exactly what they are paying for - timely patches for their mission-critical 24/7 Identity and Access Management System.

.

Internet of Things

Everyone is talking about "Internet of Things" these days … Today, I came across an article from CA which talks about the same topic. The same article makes reference to ISACA - 2013 IT Risk/Reward Barometer.

The following chart is interesting as it also highlights the consumers' concern ("Not knowing who has access to information collected by connected devices"), which is quite alarming high to me - 44%.

The survey also captures the type of Governance Issues that comes with Internet of Things.

The top 3 are:

1. Increased security threats

2. Data privacy

3. Identity / access management

Yes, IAMS has a room to play in the Internet of Things ….  As I always say,  Cloud, Mobile, Social is not going to go away anytime soon. They will just get bigger, and we should better prepared ourselves for them.

.

ForgeRock Customer Support Services

I have customers asking me what are the types of support they can get from ForgeRock Subscription.

I might as well share it here.

Read Customer Support Data Sheet for detail.


.

Commercial Open Source from ForgeRock

A check with Wikipedia refers Commercial Open Source as follows:

This model primarily involves offering a "core" or feature limited version of a software product as free and open-source software, while offering "commercial" versions or add-ons as proprietary software, or offering other services for the open source version in a similar manner.

In short, potential customers need to understand Commercial Open Source != Open Source.


I do not understand why there is no question asked when customers purchase Linux Operating Systems from RedHat.

However, when it comes to asking for a subscription from any of ForgeRock Open Identity Stack, there will be a long list of questions. :)

The only reason I can think of is the subscription for ForgeRock Open Identity Stack will never be as cheap as that for RedHat Operating System, for the same number of users. Come on, let's compare apple-with-apple. How can one compare an Operating System with a Identity Management software?

Instead, customers should at least ring up the sales from similar Identity Management companies and get quotations from them. Then, sit down and be amazed by how relatively cheaper is the subscription from ForgeRock.  (Well, sometimes it might not be cheaper. Customers need to compare features-by-features as well.) 

The point is to compare an apple with an apple. And then features by features.


Recently, there is this article on the web where the U.S. Department of Defense made their stand on Open Source software.

It is clear that even the organisation that requires the most secured environment in the world does not oppose to using Open Source software. (as long as there is commercial support for the Open Source software, i supposed. Make sense?)


I like to flash the following to potential customers showing them the differences it make when one subscribe to ForgeRock support.

We are now talking about support for Enterprise-ready products  - real Identity Management software for the Enterprise for every day use ... 24x7.

Not forgetting there is this trend of deploying the Open Identity Stack for the Modern Web, which is a huge deployment on the cloud for millions of users. How can one go about deploying the Open Identity Stack without valid subscriptions? :>

Lastly, I like to congratulate ForgeRock on their new WINS which was recently announced in the ForgeRock European Summit!

GEICO, a recent win, has a really huge OpenAM deployment out there. (I will definitely get a case study from my counterpart in ForgeRock for GEICO) 

Thomson Reuters has been a long-time customer of ForgeRock using OpenAM and has recently migrated all their Sun Directory Servers to OpenDJ.

SalesForce - do I need to say much? :>  Read here.

McKesson has deployed various OpenAM/OpenDJ/OpenIdM solutions to the healthcare systems in the United States.


The big names are paying for ForgeRock subscriptions. They do value the support services that ForgRock provides.


So, is Commercial Open Source == Open Source?


Think again!

.

ForgeRock Business Model

This question keeps repeating the ForgeRock user forum. I think I might as well paste it here in case my customers ask me the same.

To be honest, this is fair model. The engineers also need to feed their families. We can't expect every single piece of source code be made publicly available.

.

ForgeRock Product release and EOSL dates

Below is a comprehensive product release and EOSL dates for ForgeRock Open Identity Stack product.

.

Common UI for Open Identity Stack

Moving forward, there will be a common UI for the 3 products from ForgeRock. (Well, 4 if we count Identity Bridge in :> )

The UI is much cleaner, unlike those inherited from Sun/Oracle.

The main emphasis will be on end-user pages. e.g. Login page, Registration page, User Self-Help page. They will be highly customizable without breaking any codes during patches or upgrades. 

And of course, REST is the way moving forward. 

All 3 products will expose REST endpoints. This will be how the UI communicates with the underlying products.


.