Loosely Coupled Identity Management Architecture

Transcript

1. LIMA APPROACH IDENTITY MANAGEMENT
2. I AM NOT A SYSTEMS ARCHITECT. JUST STOLE/DERIVED INSPIRATION FROM OTHER SOURCES. Arun Sasidharan
3. IDENTITY MANAGEMENT CORE PROBLEM - UNABLE TO CO-RELATE RELATED DATA ▸ Multiple systems store user data. ▸ Each system holds data for a subset of users. ▸ Data itself is a subset of a user’s attributes. 3
4. IDENTITY MANAGEMENT CORE PROBLEM - UNABLE TO CO-RELATE RELATED DATA ▸ Each system has a locally unique primary key. ▸ Primary keys in different systems are independent. ▸ Each system has local attributes of the user. 4
5. SIMPLE, INFORMAL: A UNIQUE IDENTIFIER AND A SET OF ATTRIBUTES FOR AN ENTITY THAT ARE MEANINGFUL IN A GIVEN CONTEXT. Smart Guy WHAT IS IDENTITY 5
6. IDENTITY MANAGEMENT IDENTITY ONLY MAKES SENSE WITHIN A CONTEXT Pharmacy Diagnostics Doctors Content Mr. Kumar Ashok Dad Papa Buys Antibiotics Gets Full Body Checkup Books appointment for Pulmonologist Reads articles on smoking *SMOKING KILLS 6
7. IF YOU’RE COUPLED ON DATA, YOU’RE COUPLED, PERIOD. Smart Guy IDENTITY IS A DATA PROBLEM, NOT A TECHNOLOGY PROBLEM 7
8. SOLUTION? OLD ARCHITECTURE MAGIC
9. HIGHLY COHESIVE AND LOOSELY COUPLED COHESION AND COUPLING ▸ Cohesion: Things that belong together should go together. (ex. classes, packages) ▸ Coupling: If two modules communicate, they should exchange as little information as possible. 9
10. COHESION AND COUPLING COHESION PROBLEM - GROUP THESE ISLANDS 10
11. COHESION AND COUPLING WRONG - ARBITRARY GROUPING 11
12. COHESION AND COUPLING RIGHT - ATTRIBUTE BASED GROUPING 12
13. LIMA* APPROACH COHESION AND COUPLING APPLIED TO IDENTITY MANAGEMENT *LOOSELY-COUPLED IDENTITY MANAGEMENT ARCHITECTURE
14. LIMA PRINCIPLES 1. NO SURROGATES / SUBSTITUTES / DEPUTIES ▸ When you talk about something, make it a first-class entity and don’t try and use surrogates. 14
15. LIMA PRINCIPLES 2. IDENTIFIERS SHOULD BE MEANING FREE ▸ What is a good identifier for a person (an Identity Management system can use)?
 
 a) Name (First Name + Last Name)
 b) Primary Email Address
 c) Social Security Number or equivalent
 d) A combination (First Name + Last Name + DoB + Address)
 e) None of the above
 
 Correct answer: e ▸ An attribute with meaning can change in value when the context changes. ▸ So meaningful identifiers are a form of tight coupling.. 15
16. SOLUTION? UUID: UNIVERSALLY UNIQUE IDENTIFIER
17. LIMA PRINCIPLES UUID - 0FBBBFD0-8901-4989-9D54-BF0B8F958AE6 ▸ Federation-friendly – multiple systems can generate UUIDs independently without danger of conflict. No need to rely on a single authoritative source of identifiers. ▸ Supports optimistic processes – the probability of conflicting IDs is ridiculously low*. We can check for duplicates once in a while rather than at the time of entity creation. ▸ Supports autonomy – domains can implement systems at their own pace. No need for “coordination” because the touch-points can be reduced to opaque identifiers. *ONLY AFTER GENERATING 1 BILLION UUIDS EVERY SECOND FOR THE NEXT 100 YEARS, THE PROBABILITY OF CREATING JUST ONE DUPLICATE WOULD BE ABOUT 50%. 17
18. LIMA PRINCIPLES 3. DON’T EXPOSE INTERNAL IDENTIFIERS ▸ The model needs to be flexible enough to change ▸ Splitting and merging identities is easier when you don't expose identifiers externally – an “eventual consistency” model. ▸ So exposing internal identifiers to external parties is yet another form of tight coupling. ▸ Keep a mapping to 3rd party identifiers like Facebook OAUTH id, etc. 18
19. LIMA PRINCIPLES 4. DON’T UNIFY, HARMONIZE! 19 ▸ Use UUID to harmonize data with the source of truth. ▸ Use UUID as the candidate key in all systems to harmonize. Change to UUID will not affect the primary key of the table.
20. IDENTITY MANAGEMENT SUMMARY ▸ Data design is more important than technology in the area of Identity and Access Management. Great technology cannot make up for bad data design. ▸ Know what you're talking about. Bite the bullet and create first-class entities instead of sneaking by using surrogates. ▸ Model entity relationships correctly. The data model must be correct, complete and consistent. ▸ Ensure that your entity identifiers are globally unique, meaning-free and externally invisible. ▸ Use the UUID to harmonize replicas of data with the sources of truth. 20
21. THANKS!