4 ms·

Which identity management tools have you had in mind btw?

by ewuhic 5y ago

jiggawatts 5y ago
Over the years I've seen a lot of presentations from a lot of companies for all sorts of automation tools, especially identity management. Think "new user onboarding" for large enterprise. To be honest, I can't remember the names of any of the products. If it wasn't obvious from my rant, we didn't call any of them back and I promptly forgot about the specific vendors and their products. Most such products are utterly worthless, typically with net negative value. They can't handle even moderately complex cases like name changes or users moving from one department from another. The more complex cases like staff holding multiple positions at once, or filling in temporarily for someone are just out of the question. Conversely, they're power tools and can wipe out your entire staff directory if you make the tiniest mistake. Few such tools have common sense "safety nets" built in by default. Last but not least, all such tools these days carefully block any form of end-user extensibility. That way they can charge for product-specific plugins. Most such plugins are trivial to write, so you could do it yourself. Hence the vendors have to block all APIs or script-based interfaces lest you take their profit margin away from them by spending an afternoon whipping up some PowerShell scripts.
- Too 5y ago
  Luckily these days, this type of product is completely obsolete thanks to oauth and a central id provider. Now the standard question to ask before buying any tool is. Do you support single sign on or do we need $complicatedprovisioningtool from your friends across the street? Ok. Bye. Oauth isn’t perfect either, especially when it comes to propagating changes to a user. But it sure is a lot better than all these unique identity management tools doing even bigger mistakes over the rest api.
- majkinetor 5y ago
  Yeah, IAM software suck quite a lot. The bigger the company, the worst it is.

Which identity management tools have you had in mind btw?

by ewuhic 5y ago

Which identity management tools have you had in mind btw?

Over the years I've seen a lot of presentations from a lot of companies for all sorts of automation tools, especially identity management. Think "new user onboarding" for large enterprise. To be honest, I can't remember the names of any of the products. If it wasn't obvious from my rant, we didn't call any of them back and I promptly forgot about the specific vendors and their products. Most such products are utterly worthless, typically with net negative value. They can't handle even moderately complex cases like name changes or users moving from one department from another. The more complex cases like staff holding multiple positions at once, or filling in temporarily for someone are just out of the question. Conversely, they're power tools and can wipe out your entire staff directory if you make the tiniest mistake. Few such tools have common sense "safety nets" built in by default. Last but not least, all such tools these days carefully block any form of end-user extensibility. That way they can charge for product-specific plugins. Most such plugins are trivial to write, so you could do it yourself. Hence the vendors have to block all APIs or script-based interfaces lest you take their profit margin away from them by spending an afternoon whipping up some PowerShell scripts.

Too 5y ago
Luckily these days, this type of product is completely obsolete thanks to oauth and a central id provider. Now the standard question to ask before buying any tool is. Do you support single sign on or do we need $complicatedprovisioningtool from your friends across the street? Ok. Bye. Oauth isn’t perfect either, especially when it comes to propagating changes to a user. But it sure is a lot better than all these unique identity management tools doing even bigger mistakes over the rest api.
majkinetor 5y ago
Yeah, IAM software suck quite a lot. The bigger the company, the worst it is.