ian glazer's tuesdaynight

I have spent a fair amount of time recently, ruminating on compliant provisioning and what comes after it. It is a fascinating mental exercise and if it remained as such, it would be useless. Yesterday, I got to see it in action. I was at a customer, watching our integration with their provisioning system get installed and configured. It was, as all good software installs should be, quite boring. But what did captivate me was the business case and drivers for compliant provisioning. Though our customer has a mature provisioning system in production, they have yet to achieve fully automated provisioning. Why? Certainly not for lack of trying. Because their SAP environment is large, complex, and ever-changing, they cannot implement a comprehensive set of automated provisioning rules for fear of SoD creeping in. They already rely of Approva BizRights to do “What If” analysis. It verifies on an ongoing basis that role definitions do not generate separation of duty problem as well as make sure accounts don’t contain any SoD problems as well. Currently, their outsourced help desk fields access requests. They gather up the roles being requests and use BizRights to perform What If analysis on the proposed account changes and then route the request on for provisioning. Instead of an access request flowing to the help desk then into BizRights for analysis, they plan on automating the access request via their provisioning system. By using our “What If” analysis within the provisioning system they can cut out the help desk all together, eliminating that manual step. A handful of their SAP systems generate the vast majority of their ticket call volume. By implementing compliant provisioning, integrating BizRights with their provisioning tool, they are looking to cut that call volume down to 0 and save a bundle in the process. A couple more of these kinds of deployments and compliant provisioning will be the norm in the provisioning market… and then I’ll be talking to you about what comes next.

Kurt Vonnegut has died. I worry that the stock of American masters is dwindling. Warren Zevon is gone. Kurt Vonnegut is now gone. Hunter S. Thompson is gone. Someday Lou Reed will be gone. I worry that Saul Williams words in his piece, Bloodletting, are too true:

the greatest americans have not been born yet

Who will take up the mantle? Who is our next Twain? Who will be the new Vonnegut? Who will take up where Warren left off? Who will be the new Richard Feynman? What if these greats cannot be replaced? What does it say about our society if we cannot replenish our artistic stock? I hope that artists like Saul Williams, David Eggers, DJ Spooky,and Kev Russell, Jimmy Smith and the rest of The Gourds are those next American Masters. I hope we as a society have the foresight to invest in our culture as a form of national security.

Matt Kelly at Compliance Week threw out a line recently:

Compliance Week is researching a story about compliance with identity management and user access policies. We’d like to hear about what policies you have in place for those needs, and what problems you’ve encountered (and solved) along the way. Send us your thoughts, and expect an article on the topic in upcoming weeks.

Needless to say, I am very curious what people will share on this subject. I’m always fascinated to hear how people apply user provisioning tools. Back in the day there were two major selling points for user provisioning: compliance and reduced help desk call volume. Customers were quick(er) to recognize the reduced help desk call volume but the compliance aspect lagged, mostly dueto the fact that no one knew what compliance meant. (These were the pre-SOX days mind you.) Times have certainly changed as has the messaging. Recently provisioning for compliance has morphed into compliant provisioning. User provisioning systems have matured to a point that organizations can use them as service platforms. Organizations are realizing that their provisioning infrastructures are great vehicles for other services: password management, role lifecycle management, and so on. Compliant provisioning is one of the best examples of this. If our recent webinar with KPMG and IBM was any indication, then the market is desperate for compliant provisioning solutions. We had hundreds of attendees asking some very tough questions about implementation, architecture, and resources needed. I can’t wait to see if Matt’s research reaffirms what we are seeing in the ever maturing provisioning market.

After nearly 7 years of working from home, I have just started a new job… with an office. I have to say, I thought that the adjustment would be a lot harder than it has been. That being said, the commute has been very painless… I am sure I’ll change my tune when I end up sitting on the Beltway for an hour just to go two miles. I am really excited about my new gig. Approva is a great company with awesome people. I actually look forward to the commute and that should tell you something about how much I am into this new job.

We have a solution. The was that the 10.4.9 upgrade changes the Storable cpan module for Perl. The solution came from Peter Walsham at Axomic. I just tried it and it works. (Interesting to note that CPAN reported that my Storable module was version 2.15 before I tried this. Something must have been eaten in the OSX 10.4.9 upgrade.) Thanks Pete!

Hi, We just encountered this on a 10.4.9 server We managed to fix the problem by getting the latest version of Storable and installing it into: /System/Library/Perl/5.8.6/darwin-thread-multi-2level/auto/* /System/Library/Perl/5.8.6/darwin-thread-multi-2level/Storable.pm Get the release from… http://search.cpan.org/~ams/Storable-2.15/ http://search.cpan.org/CPAN/authors/id/A/AM/AMS/Storable-2.15.tar.gz …as root do tar -xvzf Storable-2.15.tar.gz cd Storable-2.15 perl Makefile.PL make make test make install Pete

I used fink for ages. Love it. I just did Apple’s latest Mac OSX 10.4.9 upgrade and something has gone off the rails. Anyone getting this too? Storable object version 2.13 does not match $Storable::VERSION 2.15 at /System/Library/Perl/5.8.6/darwin-thread-multi-2level/DynaLoader.pm line 253. Compilation failed in require at /sw/lib/perl5/Fink/Services.pm line 38. BEGIN failed--compilation aborted at /sw/lib/perl5/Fink/Services.pm line 38. Compilation failed in require at /sw/lib/perl5/Fink/Config.pm line 27. BEGIN failed--compilation aborted at /sw/lib/perl5/Fink/Config.pm line 27. Compilation failed in require at /sw/lib/perl5/Fink.pm line 79. BEGIN failed--compilation aborted at /sw/bin/fink line 29.

So Mike Neuenschwander hung a softball out there with his latest post on becoming an OpenID power user. Dave Kearns was quick to take a swing at it with his response to Mike’s summarization: “There are no identifiers, only attributes.” Mike’s journey to OpenID begins with a single step - getting an OpenID, which is really an exercise in picking a name. Names are important. (I am going to stop myself from going into a discussion of the gravity of names and naming. Literature is soaked in naming issues.) As Mike points out he can pick any unused name (really, any set of unused characters.) The first person in to register ian.glazer.myopenid.com can purport to being Ian Glazer. This is no different than XRI name registration or domain registration or copyright registration… you get the idea. Dave goes from there and reminds us that identifiers have to be unique within a given namespace. He uses the example of disambiguating family members. He provides one of the most familiar examples on unique identifiers:

My friend, Nicole lectures up at American University. A few months ago I spoke to her graduate students on identity management issues. Today I did spoke with her juniors about reputation and identity. It is a funny thing what comes out of your mouth when you don’t have slides, have fifteen minutes to talk, and a very vast topic. My ramblings included:

• an exploration of my wallet seeing what bits of identity I could find in there
• a short talk on the REAL ID Act and some of its problems
• which then lead to Jim Harper
• I changed gears and talked about OpenID

Good fun on a snowy day. Nicole has an amazing network of friends. Last week, Tom Kyte spoke to her class. He brought a camera to class and took pictures. I told the class since I didn’t have my camera with me I’d just blatantly link to Tom’s shots. Thanks Tom! Tom’s picture of Nicole’s class While I’m on the subject of photos, Nicole is a photographer as well. I love this shot… and you can find more of her pictures on her SmugMug gallery.

Jeff Bohren has joined the blogosphere. I’ve known Jeff since the Access360 days. He has been intimately involved in SPML. One of his first posts is a continuation of the discussion Conor and I had on SPML. He makes the point, and rightly so, that:

SPML is not the solution to every problem that has the word “provisioning” in its description

I just heard Frans Lanting speak at National Geographic. He gave a quick tour of his recent project - Life: A Journey Through Time. The goal of the project was to take pictures of the past that can be found in today’s world. It was an ambitious project that took Frans seven years to complete. The photos are simply staggering. One of the Life project’s branches is Life Music. Philip Glass wrote a score of a multimedia production of the project. Watching a bit of it made me think of Koyaanisqatsi. I haven’t watched that in a while… now an IMAX/HD version of that would be worth checking out.