Abstract:  The last few decades witnessed ever-increasing complexity of information infrastructures and escalating variety of on-line services offered to customers and business partners. These developments resulted in high number of virtual identities for individuals. As a result, it became a major problem to maintain the integrity and security of virtual identities in various platforms. Organizations developed identity management systems with the aim of easing the burden of the system managers, reducing identity management costs, increasing service quality and user satisfaction, and aligning identity management processes with other business processes. This article will focus on the strategies and problems in development and implementation of identity management systems. An identity management application in Turkey will also be explained.

<Rule name='logAudit'>

    <Comments>
        Refer to Audit workflow for argument definitions
    </Comments>

    <RuleArgument name="type"/>
    <RuleArgument name="action"/>
    <RuleArgument name="name"/>
    <RuleArgument name="status"/>
    <RuleArgument name='reason'/>
    <RuleArgument name='subject'/>
    <RuleArgument name='resource'/>
    <RuleArgument name='accountId'/>
    <RuleArgument name='error'/>
    <RuleArgument name='role'/>
    <RuleArgument name='parameters'/>
    <RuleArgument name='attributes'/>

    <block>
        <defvar name='event'>
            <new class='com.waveset.object.AuditEvent'>
                <ref>type</ref>
                <ref>action</ref>
            </new>
        </defvar>

        <invoke name='setObjectName'>
            <ref>event</ref>
            <ref>name</ref>
        </invoke>
        <invoke name='setStatus'>
            <ref>event</ref>
            <ref>status</ref>
        </invoke>
        <invoke name='setErrorString'>
            <ref>event</ref>
            <ref>error</ref>
        </invoke>
        <invoke name='setReason'>
            <ref>event</ref>
            <ref>reason</ref>
        </invoke>
        <invoke name='setResourceName'>
            <ref>event</ref>
            <ref>resource</ref>
        </invoke>
        <invoke name='setAccountId'>
            <ref>event</ref>
            <ref>accountId</ref>
        </invoke>
        <invoke name='setRoleName'>
            <ref>event</ref>
            <ref>role</ref>
        </invoke>
        <invoke name='setParameterList'>
                <ref>event</ref>
            <ref>parameters</ref>
        </invoke>
        <invoke name='setAuditableAttributes'>
            <ref>event</ref>
            <ref>attributes</ref>
        </invoke>
        <invoke name='setSubjectName'>
            <ref>event</ref>
            <cond>
                <isnull>
                    <ref>subject</ref>
                </isnull>
                <invoke name='getName'>
                    <invoke name='getSubject'>
                        <rule name='EndUserRuleLibrary:getCallerSession'/>
                    </invoke>
                </invoke>
                <ref>subject</ref>
            </cond>
        </invoke>

        <invoke name='logEvent'>
            <invoke name='getLogger' class='com.sun.idm.logging.audit.AuditManager'/>
            <ref>event</ref>
        </invoke>
    </block>
</Rule>

1. Developing a Custom Adapter from Scratch : Although this is the most effective way, it takes very long time and a great amount of development effort.
2. Using the Shell Script Adapter : At this technique, we create executable Web Services clients to communicate from command line. Then, we create shell scripts to run these executables and communicate with them through standard input/output for data exchange. In addition to extra application loading costs, this method has several potential problems such as character encoding, misinterpretation caused by special characters.

Instead, we developed a tricky solution using the Scripted JDBC Adapter which has several pros over classic approaches as follows:

• Rapid development
• Easy to test and maintenance
• Much more fast and efficient than using the Shell Script Adapter

Implementation

1. Create and compile Web Services client code in Java. No matter which framework you prefer, I used Axis 1.4 at the following example. I strongly recommend you to use SoapUI toolkit for WS evaluation, testing, and code generation.
2. Add client classes to IdM’s web application classpath, either copying class files to WEB-INF/classes directory or copying the jar pack to WEB-INF/lib directory.
3. Create a fake Scripted JDBC adapter.
4. Create functional Javascript or BeanShell scripts to implement adapter capabilities with Java calls for WS requests and data exchange in between IdM and the WS client implementation. At the end of this article, you’ll find a sample ‘get user’ script in BeanShell.
5. Upload the scripts and test the resource.

Conclusion

Yes, it is a drawback to have a never used database connection, but it is still, in my opinion, a better solution then using Shell Script Adapter and more practical than developing a new adapter. If I have some free time, I am willing to develop a general purpose scripting adapter at this summer.

Appendix : A Sample getUser script

<?xml version ='1.0' encoding = 'UTF-8'?><!DOCTYPE Waveset PUBLIC 'waveset.dtd' 'waveset.dtd'><Waveset>
    <ResourceAction name='NDS-getUser-bsh'>
        <ResTypeAction restype='ScriptedJDBC' actionType='BeanShell' >
            <act>
import com.primecomponents.idm.avea.nds.UserManagementServiceLocator;
id         = actionContext.get("id");
action     = actionContext.get("action");
attrsToGet = actionContext.get("attrsToGet");
result     = actionContext.get("result");
errors     = actionContext.get("errors");
trace      = actionContext.get("trace");endpointAddress = "http://10.4.26.195:7001/IDMUserWebService/UserManagement";

var attrMap = new java.util.HashMap();
trace.info4( "NDS_getUser", "Starting the script." );

try {
    var locator = new UserManagementServiceLocator();
    locator.setUserManagementSoapPortEndpointAddress( endpointAddress );
    var userMgr = locator.getUserManagementSoapPort();
    var user = userMgr.getUser( id );

    if ( user != null )
    {
        trace.info4("NDS_getUser", "Converting the user object to an attribute map.");
        if ( user.getSurname() != null )
            attrMap.put( "userSurname", user.getSurname() );
        if ( user.getName() != null )
            attrMap.put( "userName", user.getName() );
        if ( user.getGroupId() != null )
            attrMap.put( "groupId", user.getGroupId().toString() );
        result.put( "attrMap", attrMap );
    }
    trace.info4( "NDS_getUser", "Ending operations successfully." );
} catch ( Exception ex ) {
errors.add( new com.waveset.msgcat.Message( ex.getMessage() ) );
trace.caught1( "NDS_getUser", ex );
}
trace.info4( "NDS_getUser", "Ending the script - after try/catch." );
            </act>
        </ResTypeAction>
    </ResourceAction>
</Waveset>

<gt>
    <invoke name='getTime'>
        <ref>date1</ref>
    </invoke>
    <invoke name='getTime'>
        <ref>date2</ref>
    </invoke>
</gt>

Depending on returning long integer values of java.util.Date.getTime() method of your Date instances and their casted integer values, you would get either true or false!!! Particularly for java.util.Date class, you must prefer to call date1.after( date2 ) with following XPRESS equivalent:

<invoke name='after'>
    <ref>date1</ref>
    <ref>date2</ref>
</invoke>