 — Daniel Raskin, senior product line manager, access and federation management, Sun Microsystems
Daniel Raskin, senior product line manager for access and federation management at Sun, joined the company in 2005 after a global business-focused stint at McGraw-Hill. He was product line manager for Sun Java Enterprise System before taking up his current position a year and a half ago. In this interview, Daniel talks about his dedication to simplifying federation and identity management tasks for enterprises and describes the key features of the upcoming Sun Federated Access Manager. Why the Product Merge?
Federated Access Manager results from the integration of two products:
Daniel points out that the goal of the merge is to eliminate confusion and streamline Sun's identity management offerings. "We stick closely to our Java [technology] roots," he emphasizes. "The merged product, written in its entirety in [the] Java [programming language], is self-contained and delivers access management, secure Web services, and federation capabilities in one single deployment. Only one process runs in your environment. All you need to do is deploy the WAR file on your application server and the product will be up and running. No need to integrate anything—integration adds complexity. From then on, you'll have only one product to maintain and monitor." Figure 1 illustrates the benefits and relationships.
Simplicity Is the Theme
"Traditionally, to keep up with the competition, developers of major federation and access products have focused on the next big thing, the next standard, the next acquisition, the next service, and volume" Daniel says. "Soon after assuming my identity product management role at Sun, I discovered that quality, that is, ease of use, was to an extent being overlooked. Volume is important, but let's also think about how to, for example, simplify configurations. Configuring multiple instances of a product is mundane and cumbersome. Any way we can configure only once and automate the process for the other instances? And do the same for the other configurations—SPs [service providers], agents, and so forth?" Often, the people who are tasked with configurations are technologists. "But I'm not one myself," he grins. "My background is mostly business." Also, the security arena is becomingly increasingly complex: Not only must enterprises set up internal access-management infrastructures, but they must also secure external applications and Web services with partners and worry about scalability. Ultimately, with time ever at a premium, "we must build simple and effective solutions that can handle repetitive tasks accurately, efficiently, and seamlessly," Daniel advocates. Capabilities That Offer Simplicity, Speed, and Convenience
Daniel characterizes Federated Access Manager's unique capabilities that deliver simplicity and ease. Fedlets An innovative answer from Federated Access Manager is in the form of Fedlets, which are lightweight ("an 8.5-MByte footprint only"), self-contained ZIP files built with JavaServer Pages (JSP) technology and metadata and which can be deployed fast ("in minutes"). For example, a bank can federate with an SP for check imaging so as to offer the bank's clients the convenience of viewing and printing cancelled checks online. Fedlets ensure that such a federation is repeatable. At the outset, a task flow defines three or four inputs: the SP's name, the destination for the Fedlet, the basic attributes to share among the SPs. All an SP needs to do is add the Fedlet to an application, create a Web archive (WAR) file, and deploy. Note also these benefits:
Virtual Federation "The practical thing to do is to effect multiple sign-ons without attempting to resolve the legacy issues," Daniel continues. "In other words, federate with best practice and deploy federation at every point." Federated Access Manager approaches virtual federation with a centralized hub that contains one major federation instance to which are pointed all the applications, legacy or otherwise. That model works like a single product, simulating federation by storing the information and handling all the applications through only one instance of the product. "That way, we reduce deployment and maintenance overheads and ensure that we implement SSO correctly the first time with no need for consolidation later on," Daniel explains. Federation Validator Security Token Service Furthermore, that service supports many identity standards (SAML, ID-FF, WS-Federation), works well with transactions between protocols, and accepts proprietary tokens, such as those from Oracle Access Manager and CA SiteMinder. You can also deploy the security token service as a stand-alone component in support of third-party access management products. Embedded OpenDS "No such chore with Federated Access Manager," Daniel assures me. "When you deploy, you specify the default user store, OpenDS, or another directory service and then click a button. Two steps and you're done. Definitely, you can configure your own directory service, but why bother when you already get scalability and replication with Federated Access Manager and OpenDS?" Open Source and Sun Support Daniel adds that subsequent to Sun's recent acquisition of MySQL, the industry has been clamoring for support for popular open-source projects like OpenSSO. In response to that demand, Sun will soon announce support for certain certified OpenSSO builds. Stay tuned. Upcoming Workshop at CommunityOne
At 2008 CommunityOne, Sun's free and open developer conference to be held on Monday, May 5, at the Moscone Center in San Francisco, California, Daniel and his colleagues will present the following: He looks forward to your participation. Do sign up soon! References
|
| ||||||||||||||
 | |
| ||||||||||||
Print-friendly Version
