Hacker News Reader

Comment by DougWebb | Hacker News Reader

The first part sounds like they created a user management system: normally a single table with fields like username, password-hash, real name, address, etc, and sometimes a couple of other tables for groups/roles and cross-ref tables for relationships. In this case the user table would also probably have ids/references to the various government backend systems that the site used to verify your identity, income, etc as you signed up.

The rest of it sounds like they botched making this system scalable, to handle both the number of possible users (every adult in the US) and the rate at which they'd be signing up. "Endless technological loops" might refer to either a circular reference in an overly-complex schema, or to normal dependency checking in the schema which takes too long to evaluate within the database when the database is under enormous load.

View on HN

no offense, man, it is just sound like you've never developed or deployed Enterprise Identity and Access Management. I envy you :) The keyword here is "Enterprise" - insanely complex [lets just don't touch whether such complexity is really necessary, it is just the fact of a design to meet any possible RFP in the space :) ] and [in many aspects as a result of the complexity] slow non-scalable products.

>The rest of it sounds like they botched making this system scalable

these systems just don't scale. In a BigCo with local replication to regional sites it takes noticeable time for such systems to perform. Trying to build such a website - well, it is a government procurement, though i don't think this is a worse one around (Halliburton's and the likes' cost+ in Iraq/Afganistan definitely bigger :).

>normally a single table with fields like

It is "normal" from another world :) The simple way you described would be done by some startup, and they would horizontally partition it when time come to scale. It is not the way the "Enterprise" things are done.

I would guess the user database is 11NF and has 1000 tables. The UML form of it cannot exist in our limited 4 dimensions of space and time :)

This is just fascinating. This must be why I've seen many a store clerk / govt employee / postal office worker / bank worker / etc. sit there want wait for 10 minutes while the "system is processing"?

> "Software that assigned identities to enrollees and ensured that they saw only their own personal data ..."

I guess the simplest EIDM is a where clause in your SQL query :P Just kidding - I do wonder what this thing does more than just a regular authentication / authorization system though. Maybe sandboxes data so that it's impossible to even query for data that doesn't belong to you?

In part because it handles a separate authentication questionnaire with Experian. That's a PII sensitive integration that needs dynamic content.

no offense, man, it is just sound like you've never developed or deployed Enterprise Identity and Access Management.

Actually, Enterprise systems are my bread and butter. My current company's product is a base framework and code generation system for producing Enterprise-class systems, and among the many features we include is identity and access management. It uses a few tables, as I described. We also integrate with IBMi authentication and Microsoft Active Directory, neither of which are logically more complex than I've described. At my previous employer we designed and built an authentication system that was a lot more complex, with federated authentication managed by dozens of systems that were outside of our control. That took a lot longer to design and build (most of a year for a two-person team) but once deployed it could process a login in a couple of seconds at most, even with the authentication system halfway around the world from the web application's server. And, it could scale to many more federated systems than a few dozen; that's just the number of countries that were using it.

Reply on news.ycombinator.com