http://www.nfcrumors.com/08-17-2011/is-the-htc-incredible-s-the-next-google-wallet-enabled-nfc-phone-it-just-passed-through-the-fcc/

Just-in-Time manufacturing is a simple concept – rather than keep all the unassembled car parts in expensive warehouses, have them delivered to the factory at the time they are needed to assemble a car.  This idea stuck with me and has been rattling around in the back of my mind for the past twenty years. Dell later used a similar concept steal market share away from IBM and Gateway who were building huge numbers of PCs and storing them until they were sold – while Dell built PCs that were already sold.

A project I have been working on for the past year or so was applying Just-in-Time concept to the process of granting users access to applications or data. The idea is that when a user attempts to access a resource for which they have not been granted access – the access attempt kicks of a self-service process or an automatic grant of access.

While I have seen other applications perform similar activities, many people have seen Microsoft SharePoint’s basic request access feature. The challenge I see with SharePoint is that it only allows generic requests that don’t allow the user to select the level of access they wish nor does it tell the user the state of their access request. Both are needed and both must be components of any more complete solution. A more complete solution must also provide access to more than just SharePoint; files, folders and applications access are also desperately needed.

Today, we posted a technical preview of Just-in-Time Access Provisioning called the ActiveRoles AuthX Provider The provider not only integrates authentication using SAML between AD users and Google Apps, it also can trigger a self-service access request through ActiveRoles if the user does not yet have an account. Once the request is approved a Google account is created. The next time the user points his/her browser to Google Apps URL the Provider seamlessly authenticates the user by doing an account mapping of AD user to the Google account and creates a SAML token that automatically signs the user into their Google Apps account. We created a 2 minute video showing the process so you can see how this works. The video was a little long and choppy at some points so I cut it down to about 2 minutes.

 Video:ActiveRoles Access Provider

• Access Accountability
• Authorizing groups today using roles and attribute access control (ABAC) to resources
• Authorizing groups in the future with emerging technologies
• Moving from Group Management to Access Governance and the keys to success

Presented by:
Robert Bobel, Platform Director of Product Management, Quest Software
Jason Barnett, Partner and Information Security Practice Manager, Ingenuity Associates,

View Archived Webcast

Check out MSNBC’s coverage here.

For more information on this see PC World – http://www.pcworld.com/businesscenter/article/171183/ibm_puts_virtual_desktops_in_the_cloud.html

http://msexchangeteam.com/archive/2009/08/17/451976.aspx

Information Week

To use this beta you will need to have ActiveRoles Server 6.1 installed and a key for Quick Connect for Base Systems. (When you download the beta you will receive an email telling you how to get a trial key if you don’t own Quick Connet for Base Systems.)

Because this is a beta there is no official support from Quest Support Services so please direct any Questions to the ActiveRoles Community forum at http://activeroles.inside.quest.com/forum.jspa?forumID=264.

You can download the public beta from http://www.quest.com/common/registration.aspx?requestdefid=20088.

This reminds me a lot of the situation RIM faced, but one difference is obvious. In that case an individual “claimed” to own RIM’s technology – here it is pretty clear Joltid DOES own the technology.

http://edition.cnn.com/2009/TECH/biztech/07/31/skype.lawsuit.threat/index.html

SharePoint Attestation: For customers who own ActiveRoles Server and ActiveRoles Self-Service manager, this new addition will allow you to extend access certification reviews (a.k.a. Attestation) to your SharePoint Site owners through the easy-to-use self-service interface. The goal of attestation it to have the owner of the site’s data periodically review the individuals that have been granted access. The owner of the data is the logical choice for this type of review because he/she is typically the person who understands the business reasons why a particular user was granted access the data. Period certification reviews also provide a great way to determine which groups in AD are being properly managed – meaning if a group owner fails to perform the review their group is added to a list of suspect groups. If you want to understand more about Attestation, see my recent posts http://www.bobbobel.com/what-is-attestation/.

SharePoint Access Remediation: (Warning-teaser) In the next major release of ActiveRoles Server we will include a new set of optional policies that can be used to what essentially amounts to the ability to disable a group that is granting security access. We also link this new capability to our Attestation Policy so that when the resource owner fails to perform a required attestation review within a given review timeframe access can be withheld in a non-destructive way. This is of course optional and the disablement of the group can be reversed with a single click so that if a group is super critical it can be brought back almost instantly.

New: ActiveRoles Quick Connect for Lotus Notes extends ActiveRoles Server to quickly provision Lotus Notes user accounts for use with Notes mail or Notes applications. Quick Connect for Lotus Notes also extends ActiveRoles automated and self-service group management through the provisioning of Lotus Notes Groups. Provisioning of Lotus Notes accounts has never been easier.

 New: ActiveRoles Quick Connect for Online Services extends ActiveRoles Server to quickly provision Google Premier accounts from and to ActiveRoles Server. It populates Google groups from Active Directory using easily-configured provisioning workflows. Once accounts or groups are provisioned or mapped, one or more workflows can be created to keep the account properties synchronized. Deprovisioning workflows may be used to lockdown or delete obsolete users and groups.

To download the latest versions go to http://www.quest.com/common/registration.aspx?requestdefid=20088. 

To learn more about the power of ActiveRoles or to see how easy Quick Connect to deploy visit our demo video page at http://www.quest.com/activeroles-server/integration.aspx

Attestation usually provides an organization with a  measure of protection from liability and the risks associated with the failure of the resource owner to control access the his or her resource so that to comply with legal or regulatory requirements. (See http://en.wiktionary.org/wiki/attestation) 

Three Typical Statements Required for Attestation:

There are three basic tenants that most compliance auditors deem as necessary and in fact the following three statements are actually from a SOX compliance statement.

1. I am the individual who makes the authorization decision for the specific resource(s).

2. These individuals and/ or groups are authorized to use the intended resource(s).

3. I understand which resource(s) I have authorized these individuals to access.

Read Part 2 of 3 here http://www.bobbobel.com/what-makes-attestation-difficult-2-of-3/