After having worked with identity and access management for a number of years now, including access governance, entitlements, and solving some very interesting challenges, I've been bereft of any decent solution for externalizing authorization into a cloud-based offering. There exist a number of standards and common industry practices for externalizing business rules and entitlements into policies and workflows, but Authorization as a Service has been vaguely defined. That uncertainty may stem from the deep overlaps between IdaaS and an entitlements or rules engine, while ignoring the necessary separation that must exist in a cloud-based offering. Then, sometime last night while having one of those weird dreams of being in a a forest of complex geometric patterns and formula that showed how the universe interconnects on a physical and spiritual level (everyone gets those, right?), I had an epiphany: I've already written most of an Authorization as a Service (AzaaS) solution.
I define Authorization as a Service as: A service able to correlate identity, context and operational facts with a rule-driven policy, produce a decision for an authorized claimant, provide a simple API to assert authorization, and optionally export entitlement and authorization policies back to identity and enforcement systems.
Many Enterprise Service Bus (ESB) products such as Layer 7 or IBM DataPower include XACML processing engines that, when included with Policy Information Point (PIP) configurations, meet this definition. And, a number of token implementations, particularly for OAuth, include framework features, such as for access policies, that also meet this definition. Business Process Management and Business Rules Management systems (BPM and BRM respectively) provide industrial strength process and rules management that are able to capture and articulate complex business workflows, and, in part, meet this definition. So, why are products like Layer 7 and BPM, or entitlement and token formats like XACML and OAuth, or BPM and BRM systems not all billing themselves as AzaaS?
If one of my customers asked for an AzaaS solution, I'm not sure what I could sell them because I have not yet found a product or service offering that meets these challenges.
Providing Identity as a Service is hard enough. There is a veritable mountain of data needed to describe a person, their myriad accounts, and the policies and rules governing those accounts. One additional challenge is an IdaaS must logically separate organization data, or the vendor must operate multiple cloud instances on a per-organization basis. Authorization as a Service shares that challenge. Another challenge is data sensitivity and protection. Authorization rules may need to digest sensitive information that must otherwise remain protected, and storing pan-organization sensitive data ranges from being undesirable right up to being illegal, depending on the location and the type of data. A third challenge is being able to cache the large volumes of identity and account data, in addition to and related with, but decoupled from, rules data. A fourth challenge is being able to represent the different ways organizations and their applications describe entitlements. Technically, these challenges could be me with XACML, PIPs, and a nightmarish configuration, or with OAuth and a framework and a lot of hand-rolling of code. My concern with either of those would be that any AzaaS solution is driven from an entitlement or token format.
Fixing an IdM Challenge
Identity Management (IdM) platforms tend to take a myopic view of entitlements. They define roles, and map roles to entitlements, and evaluate the effective entitlements from the role hierarchy, but roles are only meaningful in a given context; A role in an IdM system only means something in that IdM system. That role doesn't mean anything to a managed application, even if that application defines its own role with the same name, because that application role is usually treated as an entitlement to the IdM system. Also, there is many organizations struggle to architect roles with respect to how roles differ between organization, business, and application, and it's no wonder that role-based access control (RBAC) is so difficult to implement, and why customers gravitate towards attribute-based access control (ABAC). In some cases, organizations that don't use RBAC are already using ABAC without realizing it. Not that that makes configuring the IdM system any easier.
While working through such a challenge, I created a proof of concept (POC) based on my Account Manager 5 and Rocket libraries. Account Manager 5 is a multi-organizational data and directory library. Rocket is set of schema and services that extend Account Manager for use as an object-oriented project management library. The POC integrated with a specific vendor's IdM product, and, in this case, the solution required ingesting multiple views of the same IdM person, application, account, entitlement, role, and attribute data, something that Account Manager and Rocket could already do.
Identities in Bulk
I wrote Account Manager to be a drop-in library for enterprise applications, but use it for less enterprise-y activities like sifting through my photos. One of the first demonstration applications I wrote over ten years ago was a JEE application for navigating through my digital photographs from a Web browser. Over time, as I rewrote the library from Java to .NET to Java again, I got tired of exporting and importing the database, and transforming data around schema changes. Also, as the authorization features become more complex and the object model more normalized, adding one new object could result in several database operations.�To make this more manageable, I added bulk factories that applications use to build up complex object relationships with security configurations, including id references, before actually adding the objects from the database or generating the id. The Bulk Session capability allows for rapidly persisting all types of objects and dependencies into the database.
While creating the IdM POC, I created a set of integration tests that would delete and reload bulk sets of identity data into Rocket projects. This allowed me to replicate the entitlements evaluation of several enterprise IdM solutions N number of times, for N number of organizations.
Over the years, I've been plinking away at a rules evaluation process and have never had a reason to codify it as an extension.�There are already many rules systems out there, so there is no point in reinventing that wheel, except to be more tightly integrated and more direct data-level access. Thinking about an AzaaS solution, or rather, dreaming about one, I realized that if I redefined these rules to function principally for an authorization service, would have a library that could reasonably serve as an AzaaS solution.
The following are features of my AzaaS solution.
The only parts I need to add from the existing libraries are extensions to the authorization service to accommodate a lightweight rules and policy mechanism, and then exposing an API to invoke the policy. The rest of the system is composed of CentOS, JBoss, and PostgreSQL.
While in our cute little Laguna Beach rental cottage, I found a dog-friendly house rental next to Buena Vista park. The owner and I exchanged a few emails and the lease was set. But, something odd about the owner's address struck me. It was on the same street, and very similar to the house number of my co-worker, J. I double-checked J.'s address, and it turned out the rental property was owned by his neighbor. Small world.
J. was a quirky guy, an absolute maven at sales in a manic sort of way. He gravitated towards the technical side of security jobs, even though he had this uncanny knack for resource placement. He should have been in sales; He should have been a recruiter; He should have run his own consulting firm. He would have been a rock star in any one of those fields. J. couldn't swing the pure technical side by himself, though, which is how I had been roped into my current job, which had afforded me the ability to work out of Laguna Beach, and which now brought me to a rental house in San Francisco that, by pure coincidence alone, was owned by his neighbor. And for all of J.'s idiosyncrasies, and he was a very unique fellow, he played the straight man to his neighbor (and being so near Castro, I have to emphasize this as being the non-Castro version of straight).
We arrived at the rental late Sunday afternoon, rain freely falling as it had in Snoqualmie, Washington, and just as chilly. Multi-million dollar homes with gorgeous views of the city lined the street, and sandwiched between them listed our little rental. A large white sign, protected by a sheaf of tattered plastic, decorated a wooden stake in the front yard, where it had stood the test of time for at least, according to the owner, ten years. Was the house condemned or something? No, couldn't be. Was this the right address? Yes. We met with the owner, a thoughtful host who had come straight from the nineteen sixties to meet us, and then apparently returned because we never saw him again. While in the present, he toured us around the rental portion of the property, which included the front door and the first floor of the house.
Not covered by the rental were the driveway, which would have been nice to park in, or the back yard jungle, which would have been nice for the dogs, or the lower floors. The restriction wasn't due to privacy, so he claimed, though Anne and I wondered what secrets lurked below. Although tempted to explore the secrets lurking below, safety was the pragmatic reason for limiting access. While the view from the back of the house was stellar, a million dollar view if there ever was one, that view was supported by some moldy two-by-fours that caused the entire back half of the house to sway whenever we both stood near the window. The first night, we lay awake and Anne wondered if the house would collapse under us at any moment. I consoled her with the knowledge that the owner said the house wasn't condemned, it was just scheduled to be demolished. Difference.
Living in a soon-to-be demolished house, soon being any point the moment we left, came with a set of benefits and quirks. For starters, the furniture was draped in blankets and bedspreads, and we could let the dogs have their way with the wood floor. And boy did they like tearing back and forth across that every time someone walked their dog by the front window which, as it turned out, was twenty-four hours a day. On the other hand, I made little discoveries like the bathroom door knob falling off in my hand when I tried to open the door from the inside, and then having to fuss with the lock to get back out.
Anne and I had been to San Francisco together before, and separately on a number of prior occasions. All of those previous visits went well, and overall San Francisco showed us its gilded side. This time, however, the city rolled over and smothered us with its mangy underbelly. Were it not for our respective friends and coworkers, it probably would have been a wholly miserably experience instead of a mostly miserable experience. Keep in mind our plan was to get some California sun while working remote. This particularly week, it never made it past fifty degrees, and the rain never let up except to part for a little shindig going on in the nearby Castro district because, let's face it, there were far too many rainbows and too much sunshine coming out of Castro for a drop of rain to ever touch the ground.
We took the dogs on a walk around Buena Vista Park, and right away the seedy underbelly infused us with its mongrel stench. It was dark, rainy, the sidewalks and street covered in litter, and shadows emerging from the unlit paths and sidewalks never seemed overly friendly. Of course, the few people we did meet were very nice, but, still, we couldn't shake that feeling. Well, more accurately, the feeling bounced from Anne over to me, because we started the walk with Anne being somewhat worried, and ended with her feeling relieved that they were only leering at me.
We braved the cool rain for few outings, such as walking to the nearest market to tote some groceries back to the rental, and then take a stroll down the street to a little park. Otherwise, the remainder of the week passed under a curtain of rain and cold.
On Wednesday, we met H., one of Anne's former co-workers and friends, and he regaled us with the life and times of a successful software engineer. Listening to him talk excitedly about work and all of the possibilities, replete with the HTT air, took me back over fifteen years to when I first worked at Microsoft and enjoyed my own slice of excitement and success. Granted, it wasn't the buffet style success many associate with high tech, more like a tapas portion. Nonetheless, it was invigorating to hear H. talk and share his stories with us. On Thursday, Anne took the day to visit a customer, and my coworker J. took me on an early morning coffee run that afforded us a chance to let the dogs spelunk around on the beach. The weather sucked, but it was nice for everyone to get out for a bit, rain or no. Sunny and Coco were right at home on the beach, even if it was cold and windy as sin and they wound up getting covered in sea foam, sea weed, and wet sand. J. and I worked out of his house that day, with Sunny and Coco leaving sandy footprints everywhere they stepped; J.'s house was a great pet-friendly working environment.
Thursday night, Anne had the car and I was alone at the rental with the dogs. I ordered a deep dish Chicago-style pizza that took an hour and a half to deliver and weighed a metric tone. Although the astroturfers on Yelp had rated it four stars, it was more like two and a half, but on a rainy and cold March evening, it actually tasted - no, no in retrospect it still tasted pretty bland.
And that's how the week ended, in a chilly torrent of rain. We discussed going back to Laguna Beach, and I know Anne wanted to go, but by then I was somewhat burned out on the back-and-forth, and missed my creature comforts back at the house. Besides, our house wasn't exactly prepped for a long excursion. I suppose it would have been different if I had prepared a little bit more.
We put everything into the car and drove home in a single day. This wasn't the first time we had driven from San Francisco to Snoqualmie in a day, and it wouldn't be the last. I don't know what primal force compels me to make the drive from San Francisco to Seattle in a single day. I have no problem taking my time going south, but going north my brain hones in on the destination and I don't really want to drag it out any longer than needed. And, after each trip, I wonder what the heck I was thinking. I think this is inherited behavior from my father, whose idea of a road trip was to run a forty-gallon tank down to the fumes before calling for a bathroom break. Using early 1980's fuel economy regulations, which, lets face it, allowed us spew a figurative ton of carbon into the air, that comes out to be about five hundred miles. Nine hours of driving without stopping. I'm sure that happened only once or twice a trip, because I have strong recall of stopping when the car broke down too. But, then, it wouldn't have been genuinely Made-in-America if something didn't break.
By the time I passed Medford I just don't want to stop. Maybe Oregon is somehow unidirectional. I just don't know. Our adventure in California ended after a little over three weeks, and it seemed like the iron to pull a similar stunt was cooling off and the opportunity slipping behind us.
Then again, hadn't we made that opportunity for ourselves in the first place? Couldn't we make it again?
Driving home, I wore my birthday present from my MIL, a shirt and sweater vest. For some reason, I was compelled to document the journey of this present, and took pictures of it at each stop before finally opening it in San Francisco. My attempt at Garden Gnome vacation slides, I suppose, except the present never made it to anywhere more exotic than sitting atop my duffel bag.
Recently, Anne and I met H. again for a follow-up, the last time we met being in San Francisco. Although the march of time had smoothed down some of H.'s expectations, he nonetheless exuded infectious optimism. I also received a note from a work acquaintance suggesting I call J.s wife, N. It turns out J. had passed away. Maybe. J. is such a unique character that part of me wonders if he isn't still out there somewhere. Probably working at the NSA.
We made it back home around midnight. Sunny and Coco were curled up together on the back seat, so there was that.
When you're DINKs, life can get pretty monotonous, more so than non-DINKS sometimes, and if you're not careful you forget to take advantage of the situation. Doubly so when both halves of the happy couple work remote. In early two thousand twelve, my wife took me to a quiet mid-week thirty-ninth birthday dinner at the Salish Lodge Attic. Outside it was hard to tell where Snoqualmie Falls started and the February rainfall stopped. Like many times before the conversation turned to warmer climates. Wouldn't it be nice to live somewhere warm? Wouldn't it be nice to walk outside and enjoy a whole lot of sunshine? Why have we never just packed up and worked remote where the sun still shone?
Why indeed. Hell, why not? Let's do it, I said, and so began a journey that led to spending a year in LA. But first we had to get there.
My birthday fell on a Wednesday, and we wanted to strike while the iron was hot which translated into leaving Friday morning. Anne found a rental in Laguna Beach, we threw a bunch of stuff and the dogs in the car, not necessarily in that order, and left the greater Seattle dawn to its usual gray blanket of drizzle. The matter with the dogs is noteworthy because Sunny Pie, our four and a half year old dachshund, loathed the relatively new four-month-old puppy, Coco Puff. Sunny had spent their first two months together avoiding Coco at all costs, and snapping when avoidance wasn't an option. Now they were going to be trapped in a confined space for the next several days. I'll spare my dog-loving friends any angst by saying that at the end of this first adventure leg, Sunny had warmed up to cool toleration of Coco, probably because Coco is a miserable passenger and Sunny took great pleasure in Coco shaking the entire time. I'm speculating, of course, but Sunny did wear her little smirk for long stretches of driving.
The plan was to stay in Ashland, Oregon the first night, about 460 miles, then take a leisurely drive, 330 miles, to Napa, California for our second night, and then push through to Laguna Beach, about 500 miles, the third day. For those unfamiliar with US standard measurement, the equivalent distance is about ten thousand three hundred furlongs.
Oregon is a fine state, and Anne and I spent our childhoods on regular trips to and from Portland or outlying cities, and we had visited Portland and Cannon Beach in recent years. Perhaps it was familiarity, but Oregon as seen from I-5 was largely forgettable that trip. And the way back. And when we went back again. The time we drove up once more, and then drove back, and then back again. Mind you it wasn't without anecdotal commentary, but I wasn't whipping out the camera very often. A token photo near Shasta - oh, wait, that's California. Never mind.
I had driven into Oregon enough at that point that I liked to play a little game: Can I make it out of the state without stopping for gas? There was something unnerving about being required by law to let someone put your card in the slot for you, and pick one of three buttons to push. Maybe it was the Pacific Northwest Gloom hanging over our heads until California that soured that particular drive. And make no mistake, the weather in Oregon wasn't any more gloomy or foul than Washington. Out of all of the photos and video I took over the next eighteen months, the only events captured in or around Oregon were when we let the dogs out near Hayden Island, just over the Washington State border, and then again across the border of California. I may have taken a photo or two at a park in Ashland, but I couldn't find it.
This isn't all to say that Oregon as seen from I-5 is miserable, and we did have a very nice evening in Ashland. We ate at a nice little restaurant near the University, and it was a generally pleasant time. It was raining, of course, but that shouldn't be much of a surprise since the rain wanted to follow us as long as possible.
Right at the border of Oregon and California something amazing happens. This large yellow ball appears where none had existed before, carrying with it a golden glow and warmth. I knew from previous travels and years of schooling that this was called the sun, but nothing had prepared me for its abrupt revelation. If you stand on the border with your left foot in Oregon and your right foot in California, you'll get a sunburn on your right foot and muddy shoe and frostbite on your left. I had anticipated the sun as a possibility in our pursuit of warmer weather, but its outburst was something to behold. I imagine the conversations around drawing the state boundaries included a remark that Oregon Territory should include everything up there where the sun don't shine, and others agreed, and so a line was drawn precisely where the sun stopped shining. And it still looks that way to this day. I think the state line between California and Oregon should be a natural world wonder.
This wasn't our first foray making the drive into California, but on this particular trip the transition between states was stark. We went on to enjoy a nice evening in Napa, walking the dogs around town and then having dinner at a quaint corner cafe* (that's code for burgers and beer - Yes, I admit it, I'm guilty of having a beer in wine country). As in Ashland, we stayed at a Holiday Inn Express that night.
Two nice features of I-5 from Washington through California were the rest areas, where Sunny and Coco could spend some time out of the car, and at that point Sunny could go back to staying away from Coco, and the consistency of the Holiday Express franchises. Although each had their own nuances, they were generally clean and reasonably priced. The first time we made the trip down the coast together, we stayed in bed-and-breakfast inns or little seaside motels. Except for our trips to Cannon Beach, when we stayed at the fantastic Cannon Beach Inn, we went with the Holiday Inn Express hotels.�
The stretch of I-5 between San Francisco and LA can be a tedious and monotonous spear of asphalt. On this particular trip, the cherry blossoms were in bloom. We stopped several times to enjoy the sights, and Sunny and Coco enjoyed the warmth and sunshine almost as much as Anne and I.
As we entered LA, we began the circuitous odyssey of the GPS wanting to send us down the worst possible routes. I have a theory: Municipalities pay mapping software companies to route traffic through their ghost towns, or, in this case, to take the 101 through the city instead of staying on I-5. That led us to the infamous LA traffic, where we lost an hour to Sunday afternoon crawl. Even then, the excitement of reaching Laguna Beach couldn't keep our spirits from being dampened below irritable grousing.
We found our little vacation cottage in Laguna Beach, about a mile from the shoreline. It was a quiet little property with a driveway that could barely contain the car. The steep grade between the building and the road lasted about half a car length and ended at the front door, which meant to be fully parked was to have the rear tires almost off the road, the tail end of the car jutting up into the air, and the bumper begging for a ding from the wood gate. Sunny and Coco hopped out of the car and immediately set to barking at everyone they met. Anne and I checked in and began to explore our lodgings.
The vacation homes were small cottages contained by a high fence, and at one time had been the go-to resort for celebrities wanting to maintain a sense of privacy. That time was about fifty years in the past, but, still, it was an interesting bit of history. Inside, we had a little living room, a bedroom, and a captain's kitchenette; that's a captain's kitchen with quarter-sized appliances. We unpacked, Anne carefully arranging her clothes in the closet and me dropping my suitcase on the floor, and then headed for the beach. This is what we had come for, the opportunity to walk to the beach and enjoy the fine California weather. We hadn't quite prepared ourselves for the chilly evenings, nor expected the fifty-plus year old heater to be malfunctioning that night, so our first night ended with a cool walk followed by huddling around a gas fireplace that, much like the modern equivalent at our house, burned natural gas to heat the outside and nothing inside.
Laguna Beach, as it turns out, was reminiscent of a cleaner and less muggy southern Italy, and judging by the number of Italian tourists I imagine it made for a nice getaway to a somewhat familiar setting. What it wasn't, though, was dog friendly. In fact, to the outsider (though many natives may argue this point) much of LA was decidedly dog-unfriendly when compared with the exuberantly dog friendly Cannon Beach, and Oregon in general, or even San Francisco where, at least around Buena Vista park, people gave way to the dogs. Sunny and Coco didn't need to be treated like little people or anything, though at the time Anne and I went a bit overboard, we did want a place to let them go off leash. We found a little pocket of beach just north of Laguna, tucked out of sight from the road, the sidewalk on the cliff, and the main beach, where we could let Sunny and Coco romp around. Finally, after three days of being cooped up only to be kept on a short leash for fear of them being stepped on, they were sort of free.
But going to Laguna Beach to work remote is a lot like going to a business conference in Las Vegas. You are surrounded by new and exciting places and people, and you have to spend the majority of your time hunched over your laptop, sometimes with a phone taped to your ear. Except, unlike the comfortable den you've created for yourself back at the house, the vacation property has a lot of eclectic furniture that stops being cute or cozy after hour-upon-hour puttering away. Mix in spotty cell service, and let's face it, on a scale of one to ten, Verizon rated slightly under sucking donkey balls, to some bandwidth hog choking the entire pipe by doing god knows what in the adjacent unit, some chinks begin to emerge in the grand plan. On the other hand, the sun sure felt nice while straining to hear the conference call through the abysmal Verizon coverage. Everyone understands Verizon coverage sucked, right? I want to be absolutely clear on this point because, where it sucked donkey balls in Laguna Beach, it went to full on elephant felatio levels of suckage later on, so I want to make sure to establish a baseline.
When not working, Anne and I took strolls to the beach, through town, or both. Why Laguna Beach? That goes back to Anne's Aunt MB. and Uncle G., the yardsticks by which fantastic hosting is measured. We had made annual trips to visit them over the previous ten years, and Laguna Beach was an occasional destination. We weren't unfamiliar with the town, but neither had we really crept through its nooks and crannies, either. Now we had that opportunity.
And one of the first things that caught our attention was the unnerving number of puppy-philes. These somewhat bedraggled characters leering at Coco Puff, wanting to touch her fluffy head, making rude expressions with buggy eyes and kiss-kiss faces. You never expect a dog pervert is going to lust after your dog, and so aren't prepared for when it happens. Anne and I shielded Coco as much as we could, but they (there were several) always seemed to be lurking too close for comfort.
Before we knew it, that first week had flown by and the weekend was upon us. Under normal working-vacation circumstances, this might have been the time to take a couple days and enjoy the locale. However, due to our rapid planning, we had to stagger our preferred reservation and spend one day at another hotel. With the art walk in full swing, most rooms were booked and we prepared ourselves to stay at the finest hotel that money could buy, which in this case, with everything being booked, turned out to be the last available room in a dive up the street.
While waiting for check-in, we made a trip up to Huntington dog beach where Sunny and Coco had a blast. We met a couple of older Jewish ladies who were very friendly, and recommended the Park Bench Cafe as a place for a relatively okay establishment that also served dogs, which made it a great little spot. Sunny and Coco enjoyed some water and canine pastries, and then we took the car in for a wash and a needed oil change.
There is a large chasm in car wash service between Washington State and California. In Washington, most car washes amount to a shower in the back of a gas station that rinses the dirt around into a new pattern and sends you on your way with a blast of muddy air on your bumper. In California, where it helps that the rain isn't a regular occurrence, cars get spoiled in vehicular spas that cost only a little bit more than the mud-shacks in Washington. Two hours later, two and a half states of road-grime had been rubbed off with a diaper, and a layer of wax applied with a little sponge, probably bearing a designer label and hand made in another country, this being LA county and all.
We returned to Laguna Beach to check into our four-star wannabe hotel. Our room was in the corner of two adjoining wings, and by the corner I mean literally in the corner. The door opened on one side of the wing, and inside a bed occupied the bulk of the room, overlooked by a tiny window that was ankle-high on the alley side; Even though this was a second floor unit, they still managed to make it basement level. I don't know which laws of physics they violated to accomplish this feat, but you had to climb two flights of stairs to be underground. As hotel rooms went, this room was like the cookie made with the leftover bowl and spatula scrapings, not quite half the size of the other cookies, and only vaguely resembling a cookie in that it had most of the ingredients but couldn't quite pull off the shape or function. Noboby really wanted that cookie, but it had to be made and, once made, it had to be served. Same with this hotel room. There was a little bit of space left over, so the owners folded a bed in half, hung a fourteen inch TV on the wall, and slapped an out of sequence number on the door. The wireless coverage must have been provided by Verizon, too, because it worked everywhere except where it was needed. That was our hotel room.
I have various extended family scattered from San Diego, Los Angeles, San Francisco, and all the way up to Portland before going back into the territory of immediate family. My cousin C. stopped by with his wife T. and we spent the evening on the art walk. We started out at a studio owned by my cousin's wife's family, bought some criminally underpriced work, and then skirted through several galleries with Anne bandying through various business ideas. Both of us found the people and the sunshine to be invigorating, and that night I could tell that despite the various quirks and adjustments, Anne was finding something that had been missing back up in Washington.
The second week sailed by, and before we knew it the week was coming to a close. Our last night would be on a Saturday night, and we fervently talked about extending the stay. I knew Anne wanted to stay, but a work project compelled me to an onsite meeting in San Francisco. We briefly discussed Anne staying put while I flew up north, but in the end we packed everything up into the car and headed to San Francisco.
Some hundreds of miles north, the temperature began to drop and rain spattered the windshield.