One person, one view

Who are you?

If your organization is typical, you could be listed several ways in its enterprise directories. You could be listed as Richard Smith, Dick Smith, RSmith or even dick.smith. And you probably have other identities ' some current and others obsolete ' floating around the enterprise where you work and access resources.

'There isn't any one authoritative source' for identity information, said Bill Claycomb, managing director of synchronization and account provisioning at Sandia National Laboratories.

This can slow the task of provisioning access to networks, applications and other enterprisewide resources in addition to complicating security by making it difficult to tell who has access, who doesn't, what accounts belong to whom and whether accounts have been terminated when a user leaves an organization or changes roles.

Ideally, there would be a single directory service to handle all requests for applications. But in the real world, political questions of resource ownership, difficult integration of products in a heterogeneous environment and histories of legacy development often mean applications have their own user information directories. So identities proliferate throughout the enterprise, sometimes in Microsoft Active Directory and other times in databases or other domains that do not work well with Lightweight Directory Access Protocol, the industry standard that defines protocols for accessing and updating directories.

Several years ago, Sandia began virtualizing its directories to help with account provisioning. The RadiantOne Virtual Directory from Radiant Logic brought user data from a variety of directories together into a common view.

'All of the info describes a single person,' one row per user from many sources, Claycomb said. 'It does for identity data what VMWare does for the server,' said Dieter Schuller, Radiant Logic's vice president of business development. 'It creates unified directories from multiple back-end sources.'

Like most of the Energy Department's national laboratories, Sandia, established in 1949, is involved in nuclear weapons research, doing work in nuclear stockpile security and energy and infrastructure assurance. The lab is managed for Energy's National Nuclear Security Administration by Sandia Corp., a Lockheed Martin company, and has an annual budget of about $2.5 billion. It has facilities in Livermore, Calif., and Kauai, Hawaii, but most of its 8,500 full-time staff members are at its main facilities in Albuquerque, N.M.

'It is easily manageable,' Claycomb said of the Sandia network, but managing accounts and identities was more complex than it needed to be. 'For as long as I know, we have had an automated process' for provisioning accounts.

A script was used, pulling data from a flat file in a custom database. 'That was not adequate because a lot of the information we needed was not in that database.'

One answer would be a consolidated directory, which Claycomb said Sandia is moving toward.

'Once that happens, it makes my job easier,' he said. 'It will reduce the number of sources that I have to touch.' But it will not provide all the information he needs because it will contain information only about people, not accounts.

A metadirectory, containing data from multiple directories, would also be useful. But creating one can be politically and technically tricky because it takes data out of the hands of the original owner and duplicates it, requiring constant updating to ensure accuracy.

A virtual directory, on the other hand, leaves the data where it is but presents unified and uniform views that can be accessed as needed.

'The data owners retain their control,' Schuller said. 'It is secured at the dataowner level, but it can be consolidated into different views so, in effect, what you have is an enterprisewide directory.'

RadiantOne uses proprietary algorithms to understand the different schemas in directories and databases, recognizing objects and their relations. It creates maps of the multiple back ends and establishes links to consolidate the data into a single, familiar view using Extensible Markup Language.

Government, financial services and telecommunications companies are the primary markets for virtual directories, Schuller said.

'Governments are large, fragmented and need to share information,' he said.

RadiantOne is a single piece of software running on a server that can provide multiple views. The number of servers required depends primarily on the throughput needed, which depends not so much on the number of entries in the directories as the number and frequency of people accessing them. Sandia is using a single RadiantOne server.

'We haven't stressed the system enough to need any server clustering,' Claycomb said.

Large or geographically dispersed organizations might need multiple servers, or an organization might want multiple servers for load balancing and failover.

RadiantOne can work with nearly any directory or database and works out of the box with the handful of products that make up 80 percent of commonly used directories, Schuller said. Some customization might be required for the remaining 20 percent of the installed base.

Some applications at Sandia that understand only LDAP require user information that is kept only in a SQL database, Claycomb said. With a virtual directory, the data can be presented to the application so it appears to be from an LDAP directory.

In addition to easing the job of provisioning accounts, a virtual directory can help protect sensitive personal information. As a research center, Sandia shares contact information with other DOE and non-DOE organizations, and exposing this data can raise security issues, Claycomb said.

Putting scrubbed data into an outside directory raises the problem of possible mistakes in copying and the need to keep it updated. But the virtual directory can be created to expose only data the owners deem appropriate.
Virtualizing directories can help administrators use multiple sources of identity data more effectively, but the virtual directory is only as good as the directories it relies on. And often, that is not very good.

'In most cases, the data is as dirty as a pig pen,' said Dieter Schuller, vice president of business development at Radiant Logic, which makes the RadiantOne Virtual Directory.

In addition to being accurate, identity data must be presented to the virtualizing engine in a way that lets it understand, for example, the relationship between Richard Smith and Dick Smith.

'The application is not difficult,' said Bill Claycomb, who uses RadiantOne as head of user account provisioning at Sandia National Laboratories. 'The tricky part is understanding how the data relate to each other.' The virtual directory can be made to look like any directory the user is familiar with, making it easy to use. 'But it was challenging to put the data together in the right way and to be sure that we were showing the data we wanted to show,' he said.

As with many other technologies, the virtual directory does not eliminate the need for work.

'There is no magic here,' Schuller said. Cleaning up the roles and identities in multiple data sources requires defining business rules to identify multiple presences in directories and establish correct links between multiple directories. And keeping the directories clean and up-to-date is not a one-time job but an ongoing process.