Testing IAM: it's not only the identity that counts

For a month now I'm busy with testing an Identity and Access Management (IAM) solution build for a Dutch Energy company.
As you already might know by reading my blog, testing IAM is not only testing if someone can log in and out of an application.
No, there's more.
IAM stands for Identity and Access Management.
Identity management, a part of computer security, is about the management of identities and their authentication, authorization,and permissions within or across system and enterprise boundaries.
Access Management also relates to authentication and authorization, but includes Access Control too, which is perhaps a better word for it.
Next to this, Access Control is about measures such as physical devices (biometrics, encryption) and monitoring by humans and automated systems. Trends like Bring Your Own Device (BYOD) and 'Het Nieuwe Werken' (work anywhere any place any time) makes Access Control (and Identity Management) challenging:
People want to work with their devices perfectly in a secure and interoperable way.

This not only affects IAM, but also the testing of IAM: more and more complex testcases which has to be generated and executed in a short time.
These are just some thoughts from me. As you might have seen on Twitter or FaceBook I have started a TestingSaaS-FaceBook page where I want to interact with my blog readers and develop a social network dedicated to sharing knowledge on testing SaaS applications with a special emphasis on identity and security.

Why FaceBook?
I saw with blogging it was most of the time a one-to-one interaction, this social network could be an interaction where all blogreaders are involved and knowledge can be shared. So, if you have thoughts about testing IAM, drop by at my TestingSaaS- FaceBookpage and let's get this network started.

The real deal: testing enterprise identity and access manangement

After two years of weekendtesting identity protocols like UMA I am given the opportunity to show my testing skills in identity management in an international enterprise. And it's not only identity management I have to test, it's IAM: Identity and Access Management. A difference I'll explain in a future post.

Multiple applications, multiple users and multiple devices (BYOD) and all in an international context: that's a challenge I want to take.

I will have to test the whole chain, so it will not be only to check if a user can log in. No, it demands a good functional and technical understanding of the chain and its points of failures. And I found out, it has to be good from the beginning.

It is a chain test, so no stubs or drivers are allowed and the testdata has to be fed in the enterprise personnel management system based on SAP HR. SAP I always wanted to learn, so here's my chance.

This will be an adventurous job, with every day different things in IAM to test: authentication, authorization, IAM-software, SAP, BYOD, Role Based Access Management are just a few. Did I already say I'll have to test this on my own with a lot of stakeholders and little information?

Enough challenges to conquer: Who dares wins!

The next posts I will share my experiences and give you an insight in the life of an IAM-tester.

Tomorrow it's Monday again, mucho trabajo!!