17 Recommended Requirements for an Identity and Access Management POC
We get requests for POC’s quite often. In an attempt to provide tactical guidance to organizations developing an identity and access management POC, the following are our top recommended criteria for evaluation.
By adding some or all of these requirements to your POC, your organization can limit vendor lock-in and ensure that the solutions considered will satisfy both current and future identity and access management challenges.
- Published results for OpenID Connect Provider (OP) and Relying Party (RP) software in InterOp 5 that indicate the vendor has at least 80% coverage of both the RP and OP defined inter-op use cases. For example, here are Gluu’s InterOp results.
- Support for UMA 0.9 Authorization Server endpoints, Resource Server endpoints, and supported client code. Include details on how the policy mapping is made to UMA scopes.
- Support for adaptive authentication: i.e. the ability to make changes to the business logic of authentication at run time. Or how to use a 1 or 2 step authentication workflow depending on the person (i.e. the IT group has to use two-factor authentication, normal users can use passwords…)
- Support for the publication of SAML Multi-party federation management, including a workflow tool for vetting SAML IDPs and SPs to join the federation, and other federation administrator operational tools.
- Support for public user registration.
- Support for invitation code based user registration.
- IDP must be able to specify authentication type on a per SP basis. For example, use passwords for Google, but tokens for Salesforce.
- Support for SAML persistent non-correlatable identifiers.
- Support for per SP attribute release policies in SAML.
- Native mobile client application for strong authentication, along with mobile device enrollment and management features.
- Support for the SCIM user management API’s to enable your organization to interface with the IDM system to send updates about users.
- Supported SAML client API for Java.
- Supported OpenID Connect client API for Java.
- Supported UMA client API for Java.
- Supported SCIM Client code.
- Support for open standards based API access control using headless API’s and a mobile client (i.e. no browser).
- Free open source license for binaries for major linux operating systems so your organization can easily take over operation and provide a reasonable free open source option to partners who do not want to purchase expensive enterprise software.
Have questions about these requirements? Feel free to schedule a meeting with us or comment on the blog to discuss the rationale behind our recommendations.
Subscribe to Get News and Product Updates
our RSS Feed