James McGovern over at Enterprise Architecture: Thought Leadership has a nice post where he poses questions for a bunch of his blogrollers.
It's not that the questions are wicked. He asks Dan Blum:
Would it be possible for you to figure out creative ways for others to observe the client/analyst dialog in a more public fashion? What would it take for you to start blogging more frequently?
Pat Patterson gets this one:
What would it take for you to get Liberty Alliance to embrace the WS-Federation specification? Having federation capabilities built directly into an operating system is liberating…
And for me:
I would love it if you could start talking about identity from a corporate perspective and not stay exclusively focused on consumer-centric identity. You can leave the consumer stuff to Dick Hardt…
It's true I've been dealing a lot with user-centric identity. But James, the future of the corporation will unfold largely in the virtual world. What will then be more important to a corporation that its relationships with its “consumers”? The lack of a reliable grid for dealing with the individual in the digital world is, in the big picture, the most urgent corporate identity issue of our time. That's one of the reasons I was led into the problem area.
The most important thing about the identity metasystem the way it creates a unified infrastructure reaching between the corporation (or organization) and the individual (aka consumer).
What are we going to have? One set of precepts that faces towards the inside of the corporation, and another completely different set that faces the outside? That doesn't compute, and my work on this blog applies to both sides of this boundary.
The whole evolution of business is towards a more open mesh of interconnecting organizations in which individual relationships are key. So empowering the individual within the organization will increasingly become the most important aspect of empowering the corporation. The dichotomy you propose is a false one.
One of the most interesting trends I've seen is that of enterprises “kicking their employees out of the firewall”. This isn't a good strategy in all cases, for sure, but I've seen a bunch of studies of companies that have slashed IT expenditures by treating their own employees as external individuals (factors of 10)! More than one of these just tell their employees to buy their own PCs outfitted with various programs “off the street” and expense them back to the company – and still get order of magnitude savings. They only keep there line of business apps remain behind the firewall.
I'm not proposing this as a direction forward – simply reporting on trends I see.
Reliable identity-based collaboration between individual users which also integrates with organizational identity will empower them both the users and the organizations. Making progress on this front is the most important single thing we can do right now to help the corporations we work for benefit from technology. That is the big picture.
One key takeaway from your request is that I should explain where I'm coming from a lot better. On a related theme, I'm getting ready to spend more time on the challenges of being “the relying party” in identity transactions, so I'll try to build these notions into what I'm writing.
You probably know that metadirectory, self-management and provisioning of identities all form an interconnected cluster of passionate interests for me. Note to self: start writing about these issues too.
I agree with Kim that the Infocard/Identity Metasystem (or some other form of user-centric identity implementation) will find its way into the corporate world and help to solve some interesting problems. I have recently been mulling the potential impacts to both privacy and federation.
In the privacy space a colleague of my shared an interesting perspective. Most corporations, especially in the B2C space, have considered user/customer identity data to be an asset. Knowledge about their users that could be leveraged for any number of marketing opportunities. With the rising concerns and increasing regulations around privacy this perspective is, or should be, starting to change. This “asset” is now becoming a liability. Data about people (corporate people and consumer people) is always going to be required to do business, but how do we get that while at the same time minimizing liability? Enter the Infocard concept. It would seem we now have a means to establish authoritative data about the user, but give it to the user for safe keeping.
Relative to B2B federation it also appears the Infocard concept can add value. Today many federations are established by corporations “on behalf” of their employees. Consider the many corporate benefits providers that are establishing SSO federations with their clients. The employees are at the mercy of their employer and the benefits providers to ensure security and privacy, and typically have no choice in the matter. I realize the federation standards provide for “opt-in” federation, but I don’t see that fleshed out in products and implementations. Again enter the Infocard concept. The potential for eliminating the magic, invisible, mandatory federation of today. The corporations can issue Infocard credentials to employees that can be used at benefit provider sites – or not. Employees have visibility, control, and choice. I can imagine the Infocard concept becoming the new federation user experience.
I don't see any difference in establishing my identity reliably as a consumer and establishing it reliably as an employee in an enterprise context. The information being relied on may be somewhat different, but the identity is MINE. By definition, an identity metasystem is about INDIVIDUALS being reliably identified in whatever context they are operating – inside or outside the corporate firewall.