Building Your Identity Bridge to the Cloud

Most identity professionals are highly focused on their particular area of responsibility and don’t have a lot of time to broaden their knowledge to other areas that are related to—but don’t directly affect—their day-to-day jobs. This makes it challenging to have an awareness (let alone an understanding) of the different types of identity services that have sprung up in recent years. As the maxim goes, “You don’t know what you don’t know.”

In May, Gartner analyst Mark Diodati published a report entitled “Identity Bridges: Uniting Users and Applications Across the Hybrid Cloud.” This report summarizes the evolution of a product segment that I've been writing about in this column since I joined Windows IT Pro. Diodati calls this product an identity bridge, which is an appropriate name because it bridges the traditional on-premises identity management system (IAM) such as Active Directory (AD) to cloud-based services that need these identities. All working identity professionals need to become conversant with the capabilities encompassed by identity bridges, because they will be expected to understand and perhaps recommend what their company needs to implement its own bridges to the cloud.

Incidentally, Diodati might not have intended it, but I can't resist mentioning that the term identity bridge also nicely parallels Norse mythology. (No, I have never attended Comic-Con, but I did grow up watching Thor cartoons after school.) Bifrost is also a bridge: the rainbow bridge to the Norse god's home of Asgard. Bifrost connects the world we're familiar with (mortals, or on-premises identity) with the unfamiliar, ethereal world in the clouds (immortals, or cloud-based services). You could stretch the Norse analogy even further to say the god Heimdallr is the equivalent of the identity router component of many identity bridges, guarding the bridge against transgressions. I'm surprised that Nordic Edge, a federation software company that Intel purchased to jumpstart its entry into this market, never picked up on this analogy. Now you can go watch Thor and say you're doing identity research!

Diodati’s report nicely summarizes the many different types of products and capabilities that might be required to provide seamless and secure identity to cloud services, from the well known and mature to the still emerging. Although vendors vary in their products’ competencies, some of the capabilities that identity bridges can provide are as follows:

Some identity bridges—for example, Microsoft’s Active Directory Federation Service (AD FS)—don’t have a SaaS component ( Windows Azure AD notwithstanding), but many are tightly integrated with an identity-management service or are entirely service-based. Mobile device management, which can distribute authentication credentials to smartphones and tablets, has quickly become a standard capability.

Like many markets, the identity bridge market was pioneered by startups that offered unique, single-purpose products. As this market matures, the startups grow into larger companies with broader product portfolios and greater capabilities in their products, often combining two or three identity-related capabilities. These small companies are often acquired by larger players seeking to jump into this area or to quickly add capability to their existing products. This maturity also gives rise to a class of products that Diodati calls super bridges, which have a superset of services such as storage and network load balancing that go beyond identity services alone.

This report is a great way to quickly understand the different aspects of these identity bridging technologies and who the key players are in the market. It’s evolving rapidly, so although most of the base technologies will still apply at this time next year, I expect that many of the players will have changed. And as if to underscore these changes—and his faith in the future expansion of this market segment—Diodati left Gartner in August to join Ping Identity. Download the “ Identity Bridge + Identity-as-a-Service: Where Will It Take You?” report from Ping Identity's website. I’ll continue to pay close attention to this area and keep you aware of interesting developments and information you need to know.

Sean writes about cloud identity, Microsoft hybrid identity, and whatever else he finds interesting at his blog on Enterprise Identity and on Twitter at @shorinsean.