The Open (Source) Identity Stack

About About
- Excellence
- Open Source
- Team
- Case History
- Partners
Solutions Solutions
- Education
  A complete and tested solution for the world of Education
- Healthcare
  A complete and tested solution for the world of Healthcare
- PA
  A complete and tested solution for the world of Public Administration
- Financial
  A complete and proven solution for the word of Finance
- Tailored
  A completely customized and proven solution for your needs
Develop Develop
Blog
Support
Contacts Contacts
Certifications

Written by

Working on IAM you might have heard of the "Open Identity Stack": here's some Open Source alternatives

At Tirasa we have been working on Identity and Access Management for many years now: as consultancy agency for 3rd party proprietary products (especially in the past) and, much more during the last three years, as community builders and contributors for Apache Syncope and ConnId.

We have been building our experience in this IAM world by working for customers different by size, expertise, complexity, involvement and nationality, and this led us to select a restrict toolset of components that are suited to work well together when you need to conceive, design, build and maintain someone's identity infrastructure.

Requirements

What is required for a IAM component to fit into this identity stack? It needs to be:

Implementing open standard
Interoperability is by far the most important requirement.
Designed for integration
Building a IAM solution when some of the building blocks need heavy tweaks to change its default behavior is simply not feasible.
Open Source
No source availability means harder troubleshooting and less security; enterprise / premium versions (nearly) lead to vendor lock-in, as for proprietary software.
Well-established
It needs to have been around for some time, otherwise it would be hard to collect any support via your preferred search engine.
Supported
IAM is for complex enterprise environments, so professional support and maintenance are required.
Alive
How much old is latest release available? How much traffic on the project mailing list(s)? Are there signs of a community?

Categorization

Let's borrow some very good definitions from midPoint's wiki; IAM components can be either:

Identity Store: where user accounts and groups are effectively stored (LDAP, Active Directory, relational database, ...)
Provisioning Engine: keeps account data synchronized across identity stores and a wide range of data formats, models, meanings and purposes
Access Manager: enforces security constraints when users access specific systems or functionalities (Single SignOn, federation, authorization, ...)

The stack(s)

You might have heard of the "Open Identity Stack": here's some real Open Source alternatives.

Alongside with main choice, for each category one or more alternatives are provided that, while still satisfying the requirements above, have proven to be less suitable - with the noticeable exception of Apache Syncope, of course: why should one look for alternatives? (DISCLAIMER: my company provides enterprise support for Apache Syncope).

Access Manager: CAS