The databases in which account information is stored are called identity stores, and a primary function of an identity management scheme is integrating and synchronising these stores. The more different the stores are, the more difficult that job becomes.
Small business identity management
When the organisation is small and user needs are simple, identity management can be handled manually. There may be only a couple of sets of credentials needed: the user's Windows logon account and an email account, for example. Users probably won't have much difficulty remembering just two account names and passwords, or the identity information can be synchronised manually by using the same account name for both accounts and changing the passwords on the domain account and the email server to match each time a password change is needed.
Identity management solutions for larger organisations
As the organisation grows, manual identity management becomes impractical. However, with just a few accounts, administrators can write and run scripts to automate the password synchronisation process. There are some disadvantages to this method, too: it requires programming skills, and scripts can present security threats if not constructed properly.
Large organisations generally use special software packages designed to consolidate information from different identity stores and provide centralised management. This can be a metadirectory program (a directory that contains information from more than one directory) or a more robust identity integration program that also provides automated account provisioning and single sign-on capabilities.
Examples of identity management software includes:
- Microsoft Identity Integration Feature Pack (IIFP) for Windows Server Active Directory (for small- to medium-sized businesses or those with simple networks), which synchronises identity information from Active Directory databases (including Active Directory Application Mode) and Exchange 2000 and 2003 databases).
- Microsoft Identity Integration Server 2003 (MIIS), which provides synchronisation of identity information across many different platforms and types of identity stores, including AD/ADAM, Exchange 5.5 and above, NT domains, Lotus Notes, Novell eDirectory, Sun ONE Directory, Oracle and SQL databases, LDAP directories and flat files.
- IBM's Tivoli Identity Manager, which provides automated and policy-based user management and Web-based self service interfaces.
- HP's OpenView Identity Management, which captures enterprise single sign-on log information generated by Citrix Password Manager.
- Novell Identity Manager, which provides a user portal and a provisioning workflow system that automates approval requests and supports role-based and rule-based provisioning of accounts.
- BMC's Identity Management Suite 5.0, which integrates with the company's identity compliance manager that allows monitoring of user access and security policies.
- Oracle's Xellerate Identity Provisioning (aquired from Thor).
The cost of identity management solutions ranges from free downloads such as Microsoft IIFP to thousands of pounds for the major commercial packages.
