B2B Operations with Identity Based Provisioning

Timothy Forde

Principal Consultant

Novell, Inc.

Agenda

Introduction

Customer scenario

Engagement scenario

What we found (Discovery process)

Deliverables

Strategy

Design

Execution path

Lessons learned

Q & A

Trends in the Directory Space

Evolving uses for a directory

File, print and resource mgmt

Access and identity mgmt

Repository for business entities and the relationships between them

Resource for systems that intermediate between constituencies and resources across the web

Trends in the directory space

Multi directory model

Solutions built from many vendors components

Experience is a key differentiator (strategy, design and implementation)

Multi Directory Model

Platform Directories

Authoritative

Directories

Meta Directory

Service Directories

Consumers

Web Based

Applications

Thick Client

Applications

Authentication

Appliance

Novell eGuide

Others

File & print

Active

Directory

UNIX

Others

HRIS

Others

Master Identity

Directory

(ID Vault)

Authorization

White Pages

Others

With an Integrated Identity Platform, many other solutions become possible

Role-based enterprise dashboards and user portals

Automated workflows

User self-service

Role-based access to resources

Single Sign-on

Identity-driven Web services

Strong authentication

An integrated identity foundation gives you:

Consistent, up-to-date identity information

Consistent application of business and security policies

Ability to manage relationships in a Web services environment

Corporate

white pages

Password management

Approval-based Provisioning

Auditing

Identity Foundation

Background Concepts

Consider the evolution of directory services

Managing access to resources

Repository for prescriptive policies

Repository for relationship models

Part of a bigger “web solution” landscape

Intermediation is the solution battle ground

Working with portals that intermediate between end users and back end systems

Working with sources of information (back end systems and user interfaces)

The right place for policy based management

Know the entities and how they are related

Multi Directory Model

AD

Exchange

INSIDERS

Infrastructure

Directory

Firewall

Interwoven

TeamSite

Active

Directory

eBusiness

Directory

Workflow

Internal Apps, DRIVES,

Oracle Forms,

Cold Fusion, etc.

OUTSIDERS

External apps

NetDynamics, BEA,

Weblogic, etc.

Remote

Access

Authen-

tication

Directory

eGuide

Novell

eDirectory

Corporate

Directory

SAP

Connector

Comma Delimited

or Text Connector

LDAP

LDAP

LDAP

LDAP

LDAP

HRMS

SAP

Stage 1

Stage 2

Stage 3+

User name/password

synchronization

DirXML

NetWare® File & Print Services

A Relationship Model

Internal Workforce

Salary & wages

Contractors and consultants

Practical Issues

Connectivity

Access management

Apply business rules

Provide abstraction, aggregation

Directory Services Suite

External Workforce

Merchandise suppliers

Non-merchandise suppliers

Supply chain partners

Transport, logistics

Others

Non Workforce

Customers, Shareholders

Constituencies

Intermediation

Assets, Resources

Relationship model

Person
entities

Non-
person
entities

Organization

Management Issues

Ownership, Access, Control, Audit

Services

Systems

Information

Used for buying, selling, and managing the business

Purchasing

Merchandising

Logistics, warehousing

Human resources

Corporate network

Email

Customer Scenario

Business Landscape

The Business

Conglomerate of separate “brands”

Nearly 200,000 “internal workforce”

Nearly 2000 retail stores and facilities

Outsourced services and embedded businesses

Many highly competitive retail markets

The Pressures

Supply chain mgmt – JIT while stripping cost

Portfolio, placement (merger and acquisition)

SOX, Security, Occupational Health & Safety …

Long term horizons contrast with incremental investment and return cycle

Technology Landscape

Systems landscape

Systems for merchandising, logistics, more

SAP Financials (many)

IBM (Websphere, directory, TAM, IDI)

PeopleSoft HR and others

Microsoft NT, Win 2000, Exchange

Novell eDirectory™, IDM, SUSE Linux

Project landscape

Consolidating disparate HR and outsourcing

Consolidating multiple ERP (8=>2)

Developing new B2B solutions

Many more…

Directory Landscape

Exchange

Exchange

Infrastructure

Directory

eGuide

Active

Directory

Enterprise

Directory

HRMS

Username/password

synchronization

Microsoft Windows

NT/Win2k/AD

Microsoft File & Print Services

“Internal Directory”

(e.g. Employee portal)

IDM

IDM

IDM

Where next?

LDAP

Engagement Scenario

ACME Trading Partner Portal Project

TPP project business requirements

Access mgmt for trading partner staff to systems

Common reference information for supplier data

Platform for collaboration and communication

Supply chain mgmt and cost reduction and/or minimal growth in admin overhead

Its all in the mid tier

Portal, application servers, back end integration

Access & identity management

The focus on trading relationships not just people.

Project scope

Strategy & approach for implementation

Design identity schema & structure

Project briefs for the phases with cost estimates

Big picture considerations

Provide thought leadership to aid management decision making

Inter-operate in a heterogeneous environment

Stay consistent with current Enterprise Directory strategy

Novell TPP Directory Project Overview

Directory Landscape – B2B Trading Partner Portal View

Insider

systems

Firewall

“External facing”

Directory

Enterprise

Directory

LDAP

HRMS

SAP

Firewall

“Internal Directory”

(e.g. Employee portal)

IDM

IDM

IBM Proxy and

Acceleration

IBM WebSpere

Application Services

LAN

Others

eGuide

LDAP

IDM

Discovery Process

Requirements

Business requirements relevant to IDM

Access mgmt for Trading partner staff to systems

Common reference information for supplier data

Platform for collaboration and communication

Supply chain mgmt an cost reduction and/or minimal growth in admin overhead

Areas of interest

What is to be achieved, how participants relate

Relationships between business entities

How to manage organizational change on both sides of trading relationships

Supplier Landscape (High level)

Covers a broad constituency

Major suppliers to sole traders and contractors

Supplier life cycle

Registration and accreditation

Systems side of supplier

SAP handling

Links into other parts of the business

Merchandising, logistics

This engagement starts with user identity but ends in organization identity and relationships

Supplier landscape (Low level)

Supplier (Vendor) Entities

•

Unique ID within a company

•

Relate to brand or trading terms

•

May have a workforce (internal/external)

directly associated with it

•

Referenced extensively in Merchandising

systems

Scholastic Australia

ACME company:

ACME General Merchandise

Vendor Code:

99

ACME Contacts:

(buyers, finance,

corp

, etc)

Vendor Contacts:

(sales, billing, returns, etc)

Vendor Address:

(distribution, returns, finance, etc)

Trading Partner Entities

•

Generally identifiable (eg. ABN, EDI#)

•

Related to actual supplier business

•

May have a workforce (internal/external)

directly associated with it

•

Superior in trading terms or administration?

Conglomerate

•

May have separate identifiers (ABN, etc)

•

Related to trading partner ownership

•

May have a workforce (internal/external)

directly associated with it

•

Superior in trading terms or administration?

Examples include:

•

Lion Nathan

•

Cadbury Schweppes

•

Pacific Brands

Bonds (Trading Partner)

(Supplier entities)

Bonds Ind.

Bonds wear P/L

Bonds etc

Holeproof

(Trading Partner)

(Supplier entities)

(Supplier entities)

Consider supplier data...

But also these others…

Now TP Meta data...

Scholastic Australia

ABN:

EDI:

ACME Contacts:

Vendor Contacts:

Vendor Contacts:

11000614577

9012966999992

Higher

level

roles

Scholastic Australia P/L

Scholastic Australia P/L

Scholastic Australia P/L (CON)

Scholastic Australia PTY LTD

ACME Company

Vendor Code

ACME Office Supplies

2925416

ACME Retail

3999

ACME Company

Vendor Code

ACME Company

Vendor Code

ACME Company

Vendor Code

ACME Australia

421324

ACME Superstore

582

The data never lies!

582

Supplier Relationship Model

Purchasing

Logistics

Finance

ACME

Office Supplies

Super Store

General Merch

Training Partner

Portal

John

Trading Partner

Scholastic

Australia

2925416

99

Trading Relationships

[SAP Vendor Code]

Sally

Recommendations

Strategy recommendation

Take a “total workforce” approach for identity and access management

Manage TP users as an “external workforce”

Model vendor business entities

Separate from the users (have independent value)

Reconcile the relationship with ACME brands

Depict the relationships in a semantically meaningful way for consumption by mid tier services

Provide for organisational change

Both in ACME and “vendor land”

Strategy recommendation

Provide for a zero-cost admin foot print

Delegated administration model is key

Phased implementation of solution

Enterprise Directory extensions for TPP

External facing directory

Back end data integration

Admin interfaces and processes

A Relationship Model

Internal Workforce

Salary & wages

Contractors and consultants

Practical Issues

Connectivity

Access management

Apply business rules

Provide abstraction, aggregation

Directory Services Suite

External Workforce

Merchandise suppliers

Non-merchandise suppliers

Supply chain partners

Transport, logistics

Others

Non Workforce

Customers, Shareholders

Constituencies

Intermediation

Assets, Resources

Relationship model

Person
entities

Non-
person
entities

Organization

Management Issues

Ownership, Access, Control, Audit

Services

Systems

Information

Used for buying, selling, and managing the business

Purchasing

Merchandising

Logistics, warehousing

Human resources

Corporate network

Email

Directory Project Landscape

Employee portal

IBM TAM/eDirectory

IDM Project

Peoplesoft

Preceda

AD

Exchange 2000

SAP HR (Consolidated)

Enterprise Directory

Internal workforce

(Staff plus…)

Non

-

workforce

(customers, shareholders)

External workforce

(Trading Partner users)

Trading Partner Entities

(Supplier/Vendors)

Relationship management

•

Users to entities

•

Delegated admin

-

•

•

•

•

Data Integration

•

Short term

•

Long term

Legacy SAP(5)

SAP Common

Financials

Merchandising

systems

Audit

•

reporting

•

alerts

Trading Partner

portal

IBM TAM/eDirectory

Common

User Interface

White / Yellow

Pages

Delegated

Admin

•

TP users

•

TP entities

•

Password

self

-

service

HR Outsource Project

Projects:

•

IDM (salaried staff)

•

Strategy and ED TP model

•

TPP IDM Phase 1 implementation

Implement ED changes

Short term SAP integration

-

TPP Authentication directory

•

Full SAP Financials integration

•

Common User Interface

•

HR Consolidation (SAP HR)

•

Audit project

-

-

Phased Execution Path

Implement the directory design

Leverage existing Enterprise Directory (ED)

Get going with bare minimum support

Load ED with data from SAP financials

Design and implement external facing portal directory

Integrate the two directories

Add other strategy pieces

Delegated admin user interfaces (exteNd™)

Integration with “new” SAP financials

White pages, audit solution, workflow

Directory Design

Directory Design challenges

Balancing immediate and long term

In terms of requirements for portal access

In terms of available data from source systems

Balancing needs to accommodate

The largest and smallest suppliers

Likely merger, acquisition and divestiture activity within the supplier community

Delegated administration

Zero admin cost impact on internal staff

Workforce mgmt activity for “external staff” at supply businesses.

Directory Design

Administrative

Realm

Administrative

Realm

o=Admin

o=Trading Partner

o=Communities

o=Corporate

ou=Pacific Brands

ou=Direct

ou=Scholastic

ou=Holeproof

ou=Bonds

Meta Data

(inheritable)

Granular Data

(per vendor

relationship)

Personal Data

Role and

Access Data

Meta Data

(inheritable)

BONDS 277

(ACME Retail)

BONDS 48

(ACME

Office Supplies)

B Jones

J Smith

T Arzan

Finance

Logistics

Merchandise

Marketing

Vendor

Entries

External

Workforce

Portal Access

Management

Trading Partner

Layer

Conglomerate

Managing vendor entities

(admin task)

Managing user accounts

(admin task)

Managing portal access groups

(admin task)

Simple “Direct” model

(No hierarchy, first load)

Directory Design

Scholastic Australia

Scholastic Users

ABN: 11000614577

EDI: 9012966999992

Contact:

ACME Company: ACME Merch

SAP Vendor Code: 99

Contact:

Operators

ACME Company: Office Supplies

SAP Vendor Code: 582

Contact:

Operators

99

582

TP Users

Trading Partner Container

Admin group

Admin Group 2

Vendor Entity

Conglomerates

Trading Partner

Entities

Supplier/Vendor

Entities

Trading Partners

Pacific Brands

Bonds Industries

Vendor 123

Design Dimensions

Administrative Spheres

ACME B2B management

Ext. Delegated Administration

Navigable Information Model

Hierarchical options

Descending granularity as appropriate

Membership

Effective Rights

Attributes, Relationships

Create

ACL

Mgmt

ACL

Design functionality checks

Trading Partner Container (context)

Identifies business (ABN etc)

Vendor groups

Identifies ACME (SAP) brand relationship

Portal access groups

Identifies operational grouping within ACME systems (may link to SAP groups)

Admin groups

Identifies hierarchy within the trading partner business (authority, seniority)

Directory Project Landscape

Employee portal

IBM TAM/eDirectory

IDM Project

Peoplesoft

Preceda

AD

Exchange 2000

SAP HR (Consolidated)

Enterprise Directory

Internal workforce

(Staff plus…)

Non

-

workforce

(customers, shareholders)

External workforce

(Trading Partner users)

Trading Partner Entities

(Supplier/Vendors)

Relationship management

•

Users to entities

•

Delegated admin

-

•

•

•

•

Data Integration

•

Short term

•

Long term

Legacy SAP(5)

SAP Common

Financials

Merchandising

systems

Audit

•

reporting

•

alerts

Trading Partner

portal

IBM TAM/eDirectory

Common

User Interface

White / Yellow

Pages

Delegated

Admin

•

TP users

•

TP entities

•

Password

self

-

service

HR Outsource Project

Projects:

•

IDM (salaried staff)

•

Strategy and ED TP model

•

TPP IDM Phase 1 implementation

Implement ED changes

Short term SAP integration

-

TPP Authentication directory

•

Full SAP Financials integration

•

Common User Interface

•

HR Consolidation (SAP HR)

•

Audit project

-

-

Workflow

Staging

directory

Lessons Learned

Lessons Learned

Understand the bigger picture

Broad business environment – goals & projects

Broad solution space the directory fits into (B2B)

Understand the business problem

In business process terms first – end to end. Including work practices, human and machine interfaces.

Filter and refine to the significant entities and how they are related for the purposes we seek to address

Translate relevant into technical requirements

Design around those refined requirements

Build requirements traceability from the start

Validate and socialise with stakeholders

Lessons Learned

Consider life after development

Admin of the directory structure, schema and data

Anticipate impacts (e.g. acquisitions, divestitures, re-organization, wholesale system changes)

Plan for both and don’t preclude likely developments

Leave something of lasting (i.e. strategic) value not just tactical. Don’t leave a rod for anyone’s back!

Combine different skills

High level business analysis, data modeling

Leverage practical skills of implementers

Approach to workshops versus individual meetings

Meetings => workshops or vice versa

This slide is meant to illustrate that once you have a strong identity integration platform in place, you can implement a wide range of identity-driven capabilities and solutions. Think through in advance how to explain how each of these capabilities relies on identities.

This is an opportunity to see which of these capabilities matter most to the client. You can make this message more powerful if you do some research in advance to find out what kinds of challenges the organization is facing with each of these capabilities.

Use this slide – the Identity-driven Web services mention– to make the point that identity applies to any corporate asset (process, application, device) as well as people.

“Just as one cannot manage what cannot be measured, one cannot secure what cannot be identified. Identity management can and will play a critical role in delivering an effective information security program.”

― Earl Perkins, Meta Group 11/03

“Moreover, identity management is critical to scaling e-business relationships across larger populations as well as enabling distributed applications to interoperate using secure Web services.”

Jamie Lewis, The Burton Group 07/03

The further fwd you go toward the firewall, the less detailed and prescriptive you get in terms of the model stored in the directory, intermediation is more abstract. So the “users” are outside the firewall and the data relating to the commercial relationship is in SAP, we need to leverage that to get the right intermediation.

The further fwd you go toward the firewall, the less detailed and prescriptive you get in terms of the model stored in the directory, intermediation is more abstract. So the “users” are outside the firewall and the data relating to the commercial relationship is in SAP, we need to leverage that to get the right intermediation.

The further fwd you go toward the firewall, the less detailed and prescriptive you get in terms of the model stored in the directory, intermediation is more abstract. So the “users” are outside the firewall and the data relating to the commercial relationship is in SAP, we need to leverage that to get the right intermediation.

McKay Brown

2002-04-25T14:40:43