I gave this talk a few months ago. I had just finished writing our 2013 Identity and Privacy Planning Guide and was trying to think of a different way to express what I had written. What I came up with was this very very different way to express what I had written. I’d love your feedback. Also, no commas were harmed in the filming of this presentation.
[Here is a transcription with light AI edit of the talk. I cannot seem to find the original text. - IG September 14, 2026.]
Enterprise Identity & Access Management
Hi, I’m Ian Glazer, and I want to talk to you about killing off identity management in order to save it.
Enterprise identity and access management is primarily the discipline concerned with who gets access to what. Pretty simple thing to do — at least on paper. But there’s a lot more complexity to it.
Now, the problem is that Enterprise identity and access management, I believe, cannot adapt, cannot evolve to the contemporary web.
Cannot evolve, cannot adapt to the contemporary web
And what I mean is this: you see, identity management currently is stuck in a reasonably static world. Identities are created and owned and managed by the Enterprise.
And the problem is that the world around identity management is growing — both larger in terms of the constituents that have to be served, and moving faster than this sort of static model can keep up with.
We must kill identity management to save it
And so I believe that in order to save identity management, we actually have to kill it. And I’m going to talk about this in terms of three parts. First: that static world that I mentioned.
Enterprise identity’s world is fairly static
It is exactly that. Identity’s world is very static. It looks like this: we have an individual, and, well, they get put into, say, an HR system. And then some magic happens, and it hits the identity and access management system — a provisioning system — and that triggers a bunch of things to be created in AD, in your knowledge base, and SAP, and so on. So that’s when someone’s added to the organization.
Similarly, we see what happens when someone changes jobs. Someone moves from, say, customer support to inside sales. Well, that too signals the IAM system to do something — by way of HR, in this case — remove someone from the knowledge base and add them to the CRM system.
And lastly, people also leave the organization. And so when that happens, it signals the HR system, which signals the IAM system to clean out all of those accounts associated with that individual.
Those are the three major lifecycle triggers, if you will — when someone’s added, when they change roles, and when they leave — that trigger something to happen. So this is identity management. It’s happy, it’s slow, but it’s reasonably effective.
This isn’t the current pace or style of the modern enterprise
This isn’t the current pace or style of the modern Enterprise, and that is a real challenge for identity management. You see, just waiting for add, move, and leave — when someone’s added, moves inside the organization, or leaves — well, that’s by no means the pace of our partners or their customers.
And let’s face it, it’s those kinds of people, those constituents — they’re the ones we most want to work with. So identity management has a problem with its pace and the way it serves its constituency. But that’s not the only problem it faces.
Identity is a set of services unto itself
The second problem — you see, identity management is today not a part of something; it is this separate entity. It’s not a part of something well-integrated. You see, it is a set of services unto itself.
And these services have been optimized around convenience and operational efficiency — convenience in the form of, often, single sign-on, and operational efficiency in the form of automated onboarding of people.
So we’d have our crucial business app, and around it we have a smattering of identity services, and for every crucial app we have to go and, well, do a bunch of plumbing for all of these different services so that the crucial business app can get everything it needs — both the convenience benefits and the access management and operational efficiency benefits. And it’s a rinse-lather-repeat situation.
You see, this is all because identity is apart from those business services. It’s not a part of those business services. It’s not well integrated.
Identity professionals have to justify identity time and time again
And the thing is, that forces identity professionals to have to justify the need for identity time and time again, with every single business app.
Identity projects fail
Furthermore, identity management projects — they fail. Like every project. But these fail, and when they do so, that impact is not immediately felt by the business. And so what that means is that the business is unaware something has gone on or gone wrong for too long.
And so there’s no drive from the business to fix the problem. And this makes justifying identity to the business even harder, because you’re in a position as an identity professional to say, “This thing that you never really noticed was — or maybe wasn’t — working didn’t go so well, and we need your help to fix it. We need funding.” That’s an awfully hard conversation to have.
And this all stems from the fact that identity management is apart from and not a part of the crucial business services of the Enterprise.
So this separation is the second issue that identity management faces.
Single. Greatest. Achievement.
But the third one is probably the most insidious. The third problem is this. Behold: the comma. The comma is the single greatest achievement in identity management.
You’re thinking, “I’m being a bit dramatic.” But no — it is, in fact, the single greatest achievement. The comma is to IAM as the zero is to arithmetic. The comma gives us some major fundamental capabilities for identity — two of them: comma-separated value files, and LDAP.
Extract data from HR? Load users into a directory?
CSV — comma-separated value files. If you want to extract data from an HR system, what do you get? A CSV file. You want to load users into a directory? What do you do? You end up with a CSV file.
You want to provision users into a SaaS application? Use a CSV file. Wait — a CSV file? Really? Really? In our day and age, to get people into a SaaS application, you’re telling me I’m using a text-based comma-separated value file, predominantly? The answer is yes.
I mean, look — a spreadsheet should not be confused for a user management tool. But guess what? This is often the way people manage users in SaaS applications. That’s just embarrassing. That’s just awful.
CSV programmatic awesomesauce
I mean, CSV is not programmatic awesomesauce. It is not great. It’s not the language of the contemporary web, and it’s not even the language of SOA. You need different typography for that.
So relying on CSV as the fundamental exchange protocol of information and identity — it’s a bit dodgy. It’s just not a modern approach to a modern problem. And this is because of the reliance on the comma.
But we also have the second thing that the comma gives us: LDAP.
Now, I love a good LDAP string as much as the next person. But you know, most people don’t read these things the way we all do. The thing about it is, the important part of this is: this describes a lot of information about me, and it really is the dominant interface for getting information about identities and getting attributes.
LDAP is the dominant interface for identities and attributes
Now, if you don’t have LDAP, you’ve got to do some trickery to figure out things about me. So, you know, LDAP enables that identity and attribute service, and with that information you find out things about me, and then you can make decisions based on that information — access-related decisions. Should I have access to this system? Should I be able to look up this record?
Now, the thing about LDAP is, it’s hierarchical. It likes to put things in hierarchies.
Is your organization a strict hierarchy?
The problem is, however: ask yourself this. Is your organization strictly a hierarchy? Do you ever, never, never have cross-functional teams? Is every relationship in your organization identical?
Well, if the answer is yes to these three, then hey, great — LDAP is for you.
But you see, the web — well, the web’s not hierarchical. And you know, I mean, there’s no way I can draw a representation of the web and make it a hierarchy. I mean, even if you swap out SkyNet for Al Gore, there’s just no way to do it. And we’ve known this — we’ve known this since ‘77, when we were building ARPANET. We realized that it’s not a hierarchy. It looks more like, well, a network. A graph.
Business relationships
Our business relationships, furthermore — they’re not hierarchical. Think about the ways we interact. For example, you know, think about a surgeon, a general practitioner, their patient, her partner, their insurance company, and a claims processor. Those relationships — those are not hierarchical relationships. The way I interact with personal cloud, with public cloud — that’s not hierarchical either.
And yet, because of our slavish devotion to the comma, we are forced into a low-resolution hierarchy. All because of the comma.
Now look, don’t get me wrong. I love commas. I’ve got binders full of them. But if the comma is the crowning achievement of IAM — if typographic clutter is our greatest achievement — I’m not convinced there is hope for stepwise evolution.
Identity management must die and be reborn
I believe, thus, that we need to kill off identity management and have it reborn. And as it’s reborn, let’s talk about the ways it will be reborn to be more effective in the modern web.
Fit for purpose
So first, it’s going to be fit for purpose. 2013 is going to be the year of identity standards, building off the momentum of the adoption of OAuth as an IETF specification — 6749 and 6750, for those of you playing at home. That becomes the underpin for things like OpenID Connect, as well as we expect to see SCIM being ratified this year — as two, well, three new identity standards that will really push identity management into the modern era.
So OpenID Connect is a federation and authentication protocol, and it’s modular. We can implement a little bit of it and get going, and implement more as we go.
And we have things like SCIM — System for Cross-domain Identity Management — which is specialized, focused on setting up accounts, and a neutral way of representing how I create accounts across services.
Now, it’s important to note: these standards do not do everything. And there’s been a lot of critique about them regarding this point. But here’s the thing: not doing everything is kind of the point. These standards are optimized for adoption, and they will build functionality over time.
Adoption → functionality
But as we’ve seen time and time again — and frankly, OAuth is a great example of this — getting adoption leads to the enhancement in functionality, and not the other way around.
So what would we expect of identity management in the modern era? It would be lean. It would be widely usable. And it would be reasonably functional. And our standards that we’re seeing emerge from 2012 and 2013 are just that.
Contemporary identity management should mirror the modern web
And so, if the contemporary identity management is going to be adopted, it really needs to mirror the modern web. And to talk about the modern web means we’re going to talk about REST.
REST
Now, there’s nothing magical about REST per se. It’s just that that’s where the developers are, and that’s where identity needs to be.
So we need identity management to be something that is a natural thing for developers to interact with, and that means REST. And so, identity has to be something natural to use and natural to integrate. And what we’re seeing of these emergent standards throughout the year is just that.
So, a fit-for-purpose identity management.
Identity management also has to get over being apart from something and become a part of it. It has to be integrated into the business services we crave — that the business craves. And that’s why Salesforce’s entrance in the market is such a big deal. Because Salesforce is baking in identity and not talking about it as “oh look, we’ve got all this identity stuff” — they’re interweaving it into business services that lines of business care about and desire and need.
This is the future of identity management
And so this is the future of identity management. This is how identity will be cast forward — by being closely tied into business services.
So I’ve talked about this from time to time — that Salesforce’s entrance in the market is an extinction event. It’s going to have a humongous impact on smaller cloud-based identity vendors, because they’re going to be aggressive, they’re going to position a standards-based solution, and more importantly — most importantly — the identity capabilities that people like Salesforce and others are bringing to bear are closely tied, integrated, and baked in to business services that lines of business actually care about.
So in some regards — okay, maybe “extinction event” is a little dramatic. Maybe it’s more like, well, the last drink at the oasis. Some vendors will find places to be successful. But I will tell you that as identity is more intertwined, becomes a part of these business services, these oases of customers are starting to dry up.
And what we see is the battle lines — the traditional battle lines between incumbent on-premises, especially identity management vendors — are being redrawn. Because now it’s not about this identity vendor versus that identity vendor. It’s more about how business services drag identity along with it, integrated into it, and redefining the way these competitors compete.
The end of the beginning of identity management
So we can think of what’s happening right now as the end of the beginning of identity management. We’ve matured the technology, we understand the processes better, and we are now transitioning into a time where identity is a part of those business services and not apart from them.
And so, whether it’s Salesforce, Microsoft in terms of Dynamics CRM and Azure, even Oracle Public Cloud offerings — they’re baking identity into what they’re doing. They’re making it a part of it and not apart from.
Ready for the dynamic world
Lastly, identity has to be ready for a dynamic world. And this means that recognizing that waiting for someone to hit your HR system, or to register on a website — it’s too slow, it’s too static, it’s too staid. It’s not the pace that our business expects. It’s not the pace of our customers. It’s not the pace of their customers.
And we need to see identity act more like “if this, than that,” than a CSV-and-batch model. We need something much more dynamic. And in that regard, identity has to become more intelligent, more active, and more adaptive.
Let’s face it: CSV is not that.
And furthermore, you know, the rigid hierarchy that the comma drives us to — through LDAP — that’s not our world. I think we recognize that. We need to think about representing our world in something that looks more like a graph.
And to talk about a graph — it’s not because graphs are magical or they’re just the hot thing. It’s, well, they’re a good way of representing relationships. Consider again the surgeon, the general practitioner, their patient, her partner, their insurance company, and the claims agent. Their relationships are not hierarchical. We cannot represent the richness of the semantics of how they interrelate — and thus how their access ought to be managed — using a rigid hierarchy. It will not work. But a graph will. Representing these relationships in a much more semantically rich way allows us to build stronger policy and more easily manage access.
Today’s identity management systems
So today’s identity management systems simply cannot model relationships well. Part of it — a big part of it — has to do with just the hierarchical representation. But frankly, our identity systems in general don’t manage relationships well.
And I think if we give them another 10 years, the current way of how we do identity management will not stepwise evolve into what the business actually needs.
Identity management must be killed
I think identity management has to be killed, and it will be reborn — in a fit-for-purpose manner, part of the business services (the things our peers crave and rely on), and identity management will be ready for the real world.