There is no hub. There is no center.

Mary Jo Foley knows her stuff, knows identity and knows Microsoft.  She just published a piece called “With Azure Active Directory, Microsoft wants to be the meta ID hub“.  The fact that she picked up on John Shewchuk&#39s piece despite all the glamorous announcements made in the same timeframe testifies to the fact that she understands a lot about the cloud.  On the other hand, I hope she won&#39t mind if I push back on part of her thesis.  But before I do that, let&#39s hear it:

Summary: A soon-to-be-delivered preview of a Windows Azure Active Directory update will include integration with Google and Facebook identity providers.

Microsoft isn’t just reimaginging Windows and reimaginging tablets. It’s also reimaginging Active Directory in the form of the recently (officially) unveiled Windows Azure Active Directory (WAAD).

In a June 19 blog post that largely got lost among the Microsoft Surface shuffle last week, Microsoft Technical Fellow John Shewchuk delivered the promised Part 2 of Microsoft’s overall vision for WAAD.

WAAD is the cloud complement to Microsoft’s Active Directory directory service. Here’s more about Microsoft’s thinking about WAAD, based on the first of Shewchuk’s posts. It already is being used by Office 365, Windows InTune and Windows Azure. Microsoft’s goal is to convince non-Microsoft businesses and product teams to use WAAD, too.

This is how the identity-management world looks today, in the WAAD team’s view:

And this is the ideal and brave new world they want to see, going forward.


WAAD is the center of the universe in this scenario (something with which some of Microsoft’s competitors unsurprisingly have problem).

[Read more of the article here]

The diagrams Mary Jo uses are from John&#39s post.  And the second clearly shows the “Active Directory Service”  triangle in the center of the picture so one can understand why Mary Jo (and others) could think we are talking about Active Directory being at the center of the universe. 

Yet in describing what we are building, John writes,

“Having a shared directory that enables this integration provides many benefits to developers, administrators, and users.”

“Shared” is not the same as “Central”.  For the Windows Azure AD team the “shared directory” is not “THE hub” or “THE center”.  There is no one center any more in our multi-centered world.  We are not building a monolithic, world-wide directory.  We are instead consciously operating a directory service that contains hundreds of thousands of directories that are actually owned by individual enterprises, startups and government organizations.  These directories are each under the control of their data owner, and are completely independent until their data owner decides to share something with someone else.

The difference may sound subtle, but I don&#39t think it is.  When I think of a hub I think of a standalone entity mediating between a set of claims providers and a set of relying parties.  

But with Azure Active Directory the goal is quite different:  to offer a holistic “Identity Management as a Service” for organizations, whether startups, established enterprises or government organizations – in other words to “operate” on behalf of these organizations.  

One of the things such a service can do is to take care of connecting an organization to all the consumer and corporate claims providers that may be of use to it.  We&#39ve actually built that capability, and we&#39ll operate it on a 24/7 basis as something that scales and is robust.  But IdMaaS involves a LOT of other different capabilities as well.  Some organizations will want to use it for authentication, for authorization, for registration, credential management and so on.  The big IdMaaS picture is one of serving the organizations that employ it – quite different from being an independent hub and following a “hub” business model. 

In this era of the cloud, there are many cloud operators.  Martin Kuppinger has pointed out that “the cloud” is too often vendor-speak for “this vendor&#39s cloud”.  In reality there are “clouds” that will each host services that are premium grade and that other services constructed in different clouds will want to consume.  So we will all need the ability to reach accross clouds with complete agility, security and privacy and within a single governance framework.  That&#39s what Identity Management as a Service needs to facilitate, and the Active Directory Service triangle in the diagram above is precisely such a service.  There will be others operated by competitors handling the identity needs of other organizations.  Each of us will need to connect enterprises we serve with those served by our competitors. 

This said, I really accept the point that to express this in a diagram we could (and should)  draw it very differently.  So that&#39s something John and I are going to work on over the next few days.  Then we&#39ll get back to you with a diagram that better expresses our intentions.

 

24 thoughts on “There is no hub. There is no center.

  1. Kim – I&#39d like to say that since you&#39re the ‘father’ of modern day identity architectures, that you&#39re obviously right. But you&#39re not THE father – you&#39re just one of the fathers, in a distributed universe.

    :-)

    BTW I apologize for not having an Identity Card account or OpenID. I just like the idea of signing up for accounts – as me – the lonely human.

    [Kim Cameron: Marc – I like hobbies as much as the next guy so if signing up for accounts is yours I can admire all the passwords you&#39ve collected :) Good to connect again. As far as the distributed universe goes we see eye to eye – and I expect the distributed universe sees us that way too… Meanwhile, if I had worried that I really were the “father” of modern day identity architectures, I would also have worried that I&#39d be responsible for all the permutations and combinations of potential implementations. Very happy to know that an infinitely large number of other dads are involved in this world of “colliding solipsisms”. So let&#39s “get together and feel alright – I sense progress here.”]

Leave a Reply