Yesterday Identicentric released simAXS, a developer tool that makes it easy to simulate access management integrations in a development environment. Additional information including a product overview, guided tour, demo screencast, and free trial are available. Some background and history follows.
At the Burton Group Catalyst conference this year Jamie Lewis spoke at length during his keynote about the challenges facing Identity and Access Management products and deployments. Of special interest was the fact that he identified a lack of easy to use developer tools as a major road-block to the widespread adoption of I&AM technology.
Walking away from the keynote I recognized that he was, as is usually the case, spot-on. In fact the subject of the keynote coincided with the idea behind a small utility, inspired by a need for improved development process, that we’d started to write. The premise was simple – provide a small standalone and configurable component that would pass Header variables directly to applications. Many Access management, Single Sign-on, and federation products, including Oracle COREid Access Manager, CA eTrust Siteminder, and Sun Access Manager, use HTTP headers to pass information about the logged in user to a protected application. In some cases the information is as simple as a login ID, but many advanced deployments pass roles, group lists, profile data, and identity information using the same mechanism, like so:
Most access management products do this by installing a small piece of code (WebGate, Policy Agent, etc) into the webserver that can manipulate the HTTP request directly at the server level. In IIS this usually takes the form of an ISAPI filter.
This approach provides interoperability and flexibility between implementations, but has some serious drawbacks – mainly that it is difficult or impossible for developers to insert HTTP Headers programmatically because HTTP servers are opaque. Developers are usually faced with some very undesirable choices:
Over the course of 10+ access management projects it had become apparent that these challenges often resulted in days or weeks of wasted time. Problems with shared data and access control would often complicate the lives of developers even further. Likewise coordinating integration with development teams increased the workload of the shared services groups responsible for the I&AM infrastructure.Enter simAXS: developers use it to simulate the same HTTP header and cookie base integration provided by large-scale commercial access management products.