Reconcilable Differences

Having worked in both IdM and ITSM I am constantly struck by the similarities and how the same problems get reworked  over and over again in the two industries. For instance William Vambenepe has this to say about configuration item reconciliation:

Whether you call it a CMDB or some other name, any repository of IT model elements has the problem of establishing whether two entities are the same or not.

Which is exactly the same account reconciliation problem that provisioning vendors have struggled with for years. When a provisioning system discovers a Linux account with user ID jbohren, does it belong to me, or my father Joe Bohren? BTW, if you email to my first initial and last name at tampabay.rr.com, it won’t reach me. If you do the same at yahoo.com it will.

It’s also the same problem that role management software is dealing with when trying to determine if roles in different systems represent the same logical business duty. Does the role named Accounting Manager represent the manager of the accounting department or is it the IT guy who manages the account software system?

Reconciliation is a big scalability problem in IdM and ITSM systems. Often there are too many orphaned items (items that can not be unambiguously matched to a known entity) for the IT staff to handle. Also determining what to do with orphaned items can be very difficult.

One interesting approach account to reconciliation is to let the account owners adopt the orphaned accounts. The adoption process would involve the owner provider the credentials to log into the account in a web page. If the system can verify that those are the correct credentials then, then that person is assumed (or allowed) to be the owner.

But this approach only works with accounts and account based systems. For now reconciling other orphaned items is still mostly a manual process. I would be curious to hear about solutions that other people have found for various reconciliation problems.

One response to “Reconcilable Differences

  1. Reconciling identity is complex, depends on contextual inference, requires the application fo arcane and changing policy, and probably needs human verification anyway, so I suggest the solution is wetware. I.e. forget automated solutions, use people to resolve some or all of it. I suggested recently http://www.itskeptic.org/demand-cmdb that a small team of experts may be a more cost effective solution than CMDB software. the same could be true here

Leave a comment