Comment by VladRussian2 | Hacker News Reader

Comment by VladRussian2 | Hacker News Reader

Parent Full thread

no offense, man, it is just sound like you've never developed or deployed Enterprise Identity and Access Management. I envy you :) The keyword here is "Enterprise" - insanely complex [lets just don't touch whether such complexity is really necessary, it is just the fact of a design to meet any possible RFP in the space :) ] and [in many aspects as a result of the complexity] slow non-scalable products.

>The rest of it sounds like they botched making this system scalable

these systems just don't scale. In a BigCo with local replication to regional sites it takes noticeable time for such systems to perform. Trying to build such a website - well, it is a government procurement, though i don't think this is a worse one around (Halliburton's and the likes' cost+ in Iraq/Afganistan definitely bigger :).

>normally a single table with fields like

It is "normal" from another world :) The simple way you described would be done by some startup, and they would horizontally partition it when time come to scale. It is not the way the "Enterprise" things are done.

no offense, man, it is just sound like you've never developed or deployed Enterprise Identity and Access Management.

Actually, Enterprise systems are my bread and butter. My current company's product is a base framework and code generation system for producing Enterprise-class systems, and among the many features we include is identity and access management. It uses a few tables, as I described. We also integrate with IBMi authentication and Microsoft Active Directory, neither of which are logically more complex than I've described. At my previous employer we designed and built an authentication system that was a lot more complex, with federated authentication managed by dozens of systems that were outside of our control. That took a lot longer to design and build (most of a year for a two-person team) but once deployed it could process a login in a couple of seconds at most, even with the authentication system halfway around the world from the web application's server. And, it could scale to many more federated systems than a few dozen; that's just the number of countries that were using it.

I would guess the user database is 11NF and has 1000 tables. The UML form of it cannot exist in our limited 4 dimensions of space and time :)

This is just fascinating. This must be why I've seen many a store clerk / govt employee / postal office worker / bank worker / etc. sit there want wait for 10 minutes while the "system is processing"?

> "Software that assigned identities to enrollees and ensured that they saw only their own personal data ..."

I guess the simplest EIDM is a where clause in your SQL query :P Just kidding - I do wonder what this thing does more than just a regular authentication / authorization system though. Maybe sandboxes data so that it's impossible to even query for data that doesn't belong to you?

In part because it handles a separate authentication questionnaire with Experian. That's a PII sensitive integration that needs dynamic content.

Reply on news.ycombinator.com