Do you seem to care more about your organization's backup and
recovery system than anybody else?
This is the podcast for you, and we've got another great episode this week.
Regular listeners.
Hear me harp a lot about the security of their backup and recovery system.
There's nothing more crucial to that than having a good identity
authentication and authorization system.
We've got an expert and identity orchestration here this week to help
us understand this important concept.
I learned a lot.
I hope you will too.
W. Curtis Preston: hi, and welcome to Backup Central's Restored All podcast.
I'm your host, w Curtis Preston, a k a, Mr.
Backup.
And I have with me a guy who, honestly, I'm not sure why we're friends.
Uh, Prasanna Malaiyandi
Prasanna Malaiyandi: hey, now what?
What, what did I do this time?
W. Curtis Preston: No, it's the whole, it's the whole movie thing.
So like, you know, like how, how, like you're so not.
Like a person who goes to movies, and I am so a person who goes to movies, I'm
like, like, what do we even talk about?
Prasanna Malaiyandi: Well, I think what ends up happening is you
explain what goes on in movies.
I sit there and listen to it with the plan of never
W. Curtis Preston: yeah.
So you're, so, yeah.
So you're watching, you're watching movies vicariously through me.
Um, and just to, just to.
Illustrate just how much of a goofy movie fanatic I am.
I am as of a few minutes ago.
I am now what some people are referring to as a Barbenheimer.
do, do you know what a Barbenheimer is?
Prasanna.
Prasanna Malaiyandi: Nope.
What's a Barbenheimer?
W. Curtis Preston: So it is, uh, there is next weekend or this
weekend there is the upcoming dual.
Uh, we have two big movie premieres this weekend, both the Barbie movie, which when
I first heard of it, I'm like, that does not sound like a movie that I wanna watch.
But based on the previews and the actors and whatnot it sent out,
I said, you know what, I'm gonna go, I'm gonna go see this movie.
And also Oppenheimer, I.
Which I cannot think of a movie more opposite than, uh, the Barbie
movie, the with Oppenheimer, which is the story of the, the guy behind
the creation of the atomic bomb.
And they're saying that, you know, it's a three hour emotionally draining
according to reviews or whatnot.
It's a three hour thing.
What I wanted to do, and so and so, Barbenheimer, are those
of us who have signed up to see these movies back to back.
Prasanna Malaiyandi: Oh, good Lord
W. Curtis Preston: On, on, on the release date.
So I will be seeing the first showing of both of these movies in San Diego.
I'll be seeing, so next Thursday, I'll be seeing the Barbie movie at 3:00 PM
and based on its runtime, it should finish, you know, with credits it should
finish at, at like, Like, including, it's, it's the, the, what do you call
it, not trailers, what the, the credits.
Right.
Including the trailers in the front and the credits in the back.
It will finish at 5:20 PM and so if I take like five minutes for not
watching the credits, I can then run over to the 5:00 PM showing.
Um, of, of Oppenheimer where the, where the, the trailer should still be running.
Uh, and then I'll just find my seat.
And what I wanna know is I wanna see how many people do that.
Uh, what I, what I wanted to do is I want Go ahead.
Go ahead, please.
Prasanna Malaiyandi: I was, I was wondering why you did it in that order
rather than the reverse, given that.
W. Curtis Preston: That's, that's what I was just about to say.
I wanted to see Oppenheimer and then in tears go watch, um, the Barbie movie.
It is not possible.
It reminds me, actually.
So I live in Oceanside, California, and you have the Metrolink trains that go to
LA and you have this, the, the, uh, San Diego coaster that goes to San Diego.
You can't take the trains.
Either way, you can't, you can't get on a, on a Metrolink train and then land and
then get on a, a coaster train and go to San Diego, um, because they specifically
put the time so that that doesn't work.
And that's exactly what happened with Oppenheimer.
Um, and also this way I'm seeing the firsts showing of both.
So I'm with, you know, the true fans, you know, the true
fans, uh, the true Barbie fans.
Prasanna Malaiyandi: I was just gonna ask, so you are going by yourself.
You're not taking your granddaughter, you're going by yourself
W. Curtis Preston: N no, no.
I'm going by myself to
Prasanna Malaiyandi: to the Barbie movie.
W. Curtis Preston: Uhhuh.
Have you seen any of the previews though?
Prasanna Malaiyandi: have not.
W. Curtis Preston: I, I, I, I, I don't think I would
probably take Lily to go see it.
Well, I would definitely not take Lily to go see it before I go see
it first 'cause she's only 10.
Uh, and I think there's probably gonna be some stuff in there that's
Prasanna Malaiyandi: Is it PG 13?
W. Curtis Preston: old.
I, I, I, I, I think it might be, um, I know it's not g
I know it's not G for sure.
I don't even know if they make G movies anymore, but yeah.
So this is what I'm talking about for those of us, yeah.
And the times just don't work out.
So like if in order to see the Oppenheimer and then Barbie, you have to have this
big, um, delay in between the two.
Prasanna Malaiyandi: and you can use a delay.
Go eat dinner.
Take a nap.
W. Curtis Preston: Well, you, you know me, I'm
Prasanna Malaiyandi: I know you.
Yeah, exactly.
Killing me.
W. Curtis Preston: I'm gonna bring our guest on today.
He has been in the cybersecurity industry for over 25 years and is
now the c e O of Strata Identity and Identity Orchestration Company.
You can find them@strata.io.
Welcome to the pod Eric Olden
Eric Olden: Nice.
Thanks for having me.
I'm looking forward to it, uh, the conversation and, uh, I'm looking
forward to, to the movies as well.
You, you've got my interest piqued and when you were talking about
the, the mashup, I was, yeah, Barbenheimer, that's, it's gotta
be a one heck of a mashup, but I
Prasanna Malaiyandi: Was Eric looking for tickets?
Were you looking up tickets while Curtis and I were talking?
W. Curtis Preston: Yeah.
It's, um, right now if you get your tickets, now you, you get
your choice of seats, right?
Um, although with Oppenheimer it was pretty full.
It was, uh, uh, but, um, and today I saw, actually saw Mission Impossible today.
Or Yeah, I'm sorry.
That was yesterday.
I saw Mission Impossible yesterday, by the way.
Amazing movie.
That guy.
Uh, that movie's just over the top.
Gotta see that movie and gotta see it on a big screen as big a screen as you can.
I think if, if there's ever a movie that's meant to be seen on a big screen,
it's the Mission Impossible movie.
Anyway, but you know what we have to start with, uh, Eric, uh, is, is I need to know
the story behind, uh, bought Not Sold,
Eric Olden: Ah, yes.
Why not sold?
Uh,
W. Curtis Preston: both your Twitter handle and your,
um, your LinkedIn identity.
Eric Olden: Yeah, and I own the, the domain boughtnotsold.com.
So the full set.
Uh, so I guess the short of it is that, you know, I've been in, uh, technology
sales and software development and all that for over 25 years, and I've seen
this kind of evolution of the way that.
You know, people consume technology and you think about that, people talk
often about the consumerization of technology and the move to the cloud and
things like that are accelerating that.
But if you think about the experience that, um, people go through when
they're trying to solve a problem, I.
I've yet to meet anyone who says, oh, please call me and sell me something.
But people need to buy things.
And so if you flip that general relationship 180 degrees and you
help people buy things and not sell things to them, it sounds
like a semantic difference.
But it's a world of difference when, um, applied correctly because, um, And you
think about the whole process of figuring out a solution and you wanna do your
research and you're gonna get onto Google and you're gonna do all of the content and
consume all of the videos and everything that goes into making a decision.
And I like to think of setting things up so that people have a great
experience going through that on their own and lead them to a conclusion.
Let them make a decision, and that's bought not sold.
Prasanna Malaiyandi: I like it.
Yeah, it, it, it, having worked at some companies in the past, I think
sometimes those companies, when they sell to enterprises, they would
talk about sort of being like a trusted partner or a trusted advisor.
But I like what you're talking about Eric, which is going even beyond that
and sort of allowing the end user to be that sort of self-sufficient, right.
Find what they need, figure it out, go on the journey, but give
them the information they need in order to come to that conclusion.
Eric Olden: Exactly, you're, you're exactly right.
Prasanna and, and on Strata io, the website.
Um, for four years we have not gated our content.
So a lot of times people, you say, oh, I'm interested.
I wanna read that white paper.
I want to get this report, and I don't want to have that spam
when I give my email or someone's gonna harass me on the phone.
Uh, instead we just say, Hey, look, the content, if it's good, is gonna teach
people and educate them, and educated people make decisions more quickly and
they're more confident in their decision.
I.
Therefore they spend more money and they, they, you know, make a bigger investment.
So, um, I realize I'm giving away all my secrets here, guys, so, uh, but that's
how it works in, in practice though.
Just let, just give the good content out there.
Don't have people, uh, feel like they're obligated.
Uh, and if it's really good content, you know what you're
doing, uh, it should come through.
And then people want to buy from the person that educates
them and treats them the best.
So that's kind of, uh, applied.
W. Curtis Preston: So I guess you would, you would have a, a, a call to action,
I suppose, in the content somewhere basically saying, Hey, if, if you
found this helpful, then, then go here.
Is that, is that the idea?
Eric Olden: Yeah, that's the idea.
And you know, we have a self-service product, so if
someone says, oh, that seems cool.
What is this identity orchestration thing?
Let me try it out.
And then, Couple clicks, you're in the product.
Again, it's all free to start.
And, um, you can just see if it works and if it does, you know, people love it.
And, um, you know, it's been a nice way to align us with our customers and,
and get the friction out of the way.
So, but it's, it is pretty radical when we bring in new,
uh, people on the sales team.
We say, look, don't, um, don't spam.
We don't send unsolicited emails.
From marketing, people are like, well, how do you do it?
You say, well, you be patient and they'll come to you if you, you
know, build into this content model.
And so, uh, it, it has been great.
It's been wonderful for us.
We've been really happy with it.
Prasanna Malaiyandi: Yeah.
No, I like that transparency aspect.
Now, do you also provide transparency in pricing?
Because I know some vendors, right, they're like, Hey, by the
way, if you need more information, give us your email address.
Right?
Or call a person.
Do you also provide sort of that transparency on your website?
I.
Eric Olden: Yeah, all the pricing's right there give a little pricing calculator
and um, we take that even further.
The whole idea of consumption based pricing, I think that's
another aspect of the bot not sold.
Concept is that if it works, you're gonna buy more of it.
So yeah, I've always felt like when people are saying, Hey, go whatever the,
the thing may be you're buying something that costs a million dollars and you
gotta make a million dollar decision that's more risky and stressful than if
you say, Hey, let's just do 10% of that a hundred thousand dollars decision.
Or 10,000, whatever is appropriate, and let the product prove itself out.
And then people will use it more.
And the more they use it, the more value they get out of it.
So the more willing they are to pay more for it.
And so everybody wins, but it is a bit unusual.
It all, uh, relies on that transparency.
W. Curtis Preston: Yeah, and I, I, I think that would also qualify.
Would you call yourselves a P L G company as well?
Eric Olden: Yeah, we, we, we do consider ourselves a hybrid because
we have the full self-service p l g, front to end, and you can do all
of it without ever talking to us.
But we are in the enterprise, so a lot of the stuff that we do,
there's more complexity and so people want to be able to, um, Get expert
advice in kind of a consulting way.
And so we, we offer that as well.
So it's a, a hybrid model and um, but it's all based on that whole bot not sold idea.
So, you know, our goal is to be no, no pushy anything because, um,
You know, if it works, that that's the kind of, what's the saying?
The product will prove itself out and no product sells itself.
But I think you can have the product prove itself out and that, I think
is the, is a big win for everybody.
I.
Prasanna Malaiyandi: Curtis,
W. Curtis Preston: way, I, I have to, yeah, I was, I, I have to define p l
G as product-led growth, which is a way to, to build a company and, uh,
Prasanna, I, I bet you're gonna ask me about the, the disclaimer, aren't you?
Okay.
Alright.
So, uh, throughout our usual disclaimer, uh, Prasanna and I work
for different companies and, uh, we're not representing either of them here.
This is an independent podcast and, uh, the opinions that you hear are ours.
Also, if you like us, rate us.
If you hate us, don't rate us.
Um, and, um, the, uh, uh, and then, um, uh, if you wanna reach, if you wanna
be part of the conversation, just reach out to me at WC Preston on Twitter
or, uh, w Curtis Preston at gmail.
And as of like two or three days ago, w Curtis Preston on Threads.
Um, and, uh, I wish you all the best results over there.
Uh, at the, you know, the, the latest social media company.
Uh, anyway, so Eric, um, uh, here's a really big question.
What is identity orchestration?
Eric Olden: Yeah, great question.
Um, identity orchestration is, um, I'll kind of break those terms down.
Identity management, which is the way that users access applications and data.
And everything that goes around that.
And the orchestration side is think about automating, uh, different
flows or multi-step, uh, situations.
Where this is, uh, useful is in multi-cloud, and the typical situation
that we see is that an organization has a, uh, on-premises private cloud.
They've got their data center, they've been running for some time.
And they're at some point in their cloud journey where they've
got one or more public clouds.
And when you've got different places where your workloads run, you've got
different identity providers or IDPs, so they're built into the cloud.
So on Amazon you have a W Ss Kognito on Azure, you've got Azure
Active Directory on premises.
You've got things like Oracle and SiteMinder and uh, things
of that type active directory.
So when you start to think about how do we make all of these things work together,
that's where you need to do two things.
One, integrate everything.
And we call that an identity fabric.
And you can think about that as an abstraction layer that
makes everything work together.
And the second part is the orchestration.
So you think about what we've done in computing.
With Kubernetes and virtualization over time, you had more and more
abstraction away from the hardware.
So today we talk about containers and Kubernetes and
moving into serverless, right?
All of those are strata of abstraction.
We applied that same thinking to identity management and said, look, instead of
thinking about and being locked into any one identity provider, What if you can
abstract them and then allow you to mix and match what identity systems make sense
for your risk profile or your compliance or your, uh, management requirements.
So it's a brand new category.
Um, we started this in 2019.
We shipped a product, uh, our product's called Mavericks, and uh, it's the
first identity orchestration platform.
And.
We think about building the VMware of identity, and that's what,
uh, identity orchestration is.
Prasanna Malaiyandi: No, that's pretty awesome, especially given how complex
some of these environments are and people wanting to not be locked in.
Right?
That's one of the biggest challenges is once you start using like Microsoft
from On-Premises and you, you're like, oh, now just use Azure, but maybe
Azure isn't the best option for you.
Maybe you do want use a w S.
Do you also help?
Make it easy for people so they don't need to understand all the underlying
complexities of say A W Ss or Azure and active directory instances There.
Eric Olden: Yeah, absolutely.
And, and that's the role of the abstraction layer.
Uh, it, it integrates with all of the proprietary, uh, APIs of
the various systems and these.
Application programming interfaces.
The, the way that you communicate with software, um, think about
those in a metaphor of like, they're all in different languages.
Some are in Spanish, some are in Japanese, some are in, um, uh, Korean.
And instead of trying to learn all of these different languages, the abstraction
layer is kind of a universal language translation, so that it handles the
translation of one thing into the other.
So that the application doesn't have to, and that means that the, on the
application side of the abstraction layer, what it's seeing is effectively
a facade of what it expects to look at.
If it was originally communicating with Oracle, for instance, and you want to
switch out Oracle for Okta in the cloud, Well, the abstraction layer would have
the application talking to it using whatever protocol is already working.
So like things like, uh, SAML or security assertion, markup language
and Open ID Connect, or O I D C or some of the old school products that
use cookies and um, H T T P headers.
So all of these different ways that applications consume identity.
Are universally managed by that abstraction layer.
And why that's important is that you don't wanna rewrite your application to
have it work with a different identity provider because that's expensive.
It takes a long time, and there's a lot of cases where you just can't do it because
maybe it's a packaged to application, you don't have the source code to.
So this approach of identity orchestration allows you to swap out and mix and
match the different identity providers.
On under the covers without ever rewriting the application.
So
Prasanna Malaiyandi: like N
Eric Olden: make it.
Prasanna Malaiyandi: Yeah, it's like for file storage, right?
You had N F S as a protocol that anyone can switch out.
As long as the vendor was supporting N F Ss, you were all good to go.
And just kind of going back and thinking, I know Curtis, we were
talking about movies earlier, right?
It's kind of like what you guys have built is kind of like
Babelfish for identity, right?
It allows you to translate between various languages, right?
And provide that same abstraction regardless of what the
underlying identity provider is.
W. Curtis Preston: Yeah.
Wh which led to, which is leading to my question, but you.
I, I had a question and then you said something that made
my question even harder.
So, so it's sort of two questions in one.
One is, um, how would you contrast this to something like Okta, what Okta does?
And then in the middle of like, waiting to ask that question, you
said you work with Okta, right?
As an identity provider.
Um, and so in that case it would seem like there's.
Multiple layers between the actual application and, and the customer.
So, so I was just a little, so there you go.
That I don't know, I'm sure there's a question in there somewhere.
Eric Olden: Well, that's a perfect hybrid question from the
Barb Inheimer, uh, school of.
W. Curtis Preston: the, from the Barb Heimer.
Absolutely.
From the Heimer School of Questioning.
Eric Olden: Yeah.
So, um, identity providers are, um, there's a lot of
good ones that are out there.
Okta's a good one.
Um, Microsoft does great stuff with Azure.
They're Azure products, Azure Active Directory.
You've got new ones.
You've got old ones, right?
So those are new ones.
Uh, things like hyper is a different way to do passwordless authentication.
And then you've got the old ones that are on-prem, typically the Oracles,
the cas, IBMs and things like that.
So, um, what an identity fabric is, it's an agnostic, vendor neutral way to
make all of your infrastructure work.
Together, right?
So we specialize in working with everybody so that our customers are
free to choose whatever they want.
And so we partner with all of the vendors.
We have a really broad platform that integrates with all of the major
technologies that are out there, and it's all in support of that no lock-in.
So the customers can say, Hey, you know, 'cause one of the things
that a lot of times, uh, identity.
Shows up in, in interesting ways is mergers and acquisitions and very
common situation where you could have one company who is a Microsoft shop
through and through, they acquire another company that's an Okta shop well.
Identity isn't one of those things that you can just turn a switch
on without some software, right?
And so you're gonna have a challenge because you've got two
different identity systems, two different vendors, and they weren't
engineered to work with one another.
So orchestration and the abstraction layer allows you to, um, basically mix and
match whatever you want so your employees from the original company can use their.
Uh, logins out of Azure, as well as the new employees from the acquired company.
They can use their login on Okta, and the abstraction layer
brings the two of them together.
Prasanna Malaiyandi: So there, Curtis, that's why it's a new category
called Identity Orchestration.
Not
W. Curtis Preston: Yeah.
Yeah.
I, I guess, I guess again, because I don't live in that world, Right.
I, I was thinking this more like, like you said, like Okta being an, they're an
identity provider and you're abstracting that, and so people could, and I get, is
it common for customers to have multiple identity providers within, you know,
obviously in an m and a situation, but I'm guessing there are other situations where
they have an I D P that doesn't support.
A particular part of their environment, and then you help solve that as well.
Eric Olden: Yeah, exactly.
And so think about all of these proliferation of identity
providers on-prem, in the cloud, uh, acquisitions, divestitures.
So there's a lot of reasons why you're gonna have more than one today.
Um, and I think the, the way to think about it is similar
to, uh, virtualization.
And, you know, Pana, we were talking earlier about Silicon Valley and I grew
up, uh, driving on 1 0 1 from the South Bay to San Francisco, and I'd see all of
the tech companies on my way to school.
And what, um, over time, I mean, there was a point where the, the
big hardware companies, the server wars of the nineties, and, uh,
these people like Dell, these people like San other people like hp.
When's the last time people talk about hardware?
They don't because it's all now VMs and it's all cloud services.
So that's an example of how abstraction works.
And so you no longer need to think about whether you're running on uh, one
hardware provider or the other people.
Just think about a higher level of the concept of computing and say, well,
I've got a vm, or I've got a container.
And it doesn't matter what hardware runs on.
That's where identity is headed with orchestration is to say, look, stop
thinking about which of the identity providers that you're using, assume
you're gonna want to use more than one.
And once you have that capability, you can just do whatever you want, right?
You can just swap out different things for whatever use case that matters.
So really helps with complexity, fragmentation, and a situation
where you have many instead of one.
Prasanna Malaiyandi: Could you talk, and I think you kind of touched on
it, could you talk about some of the.
Issues customers face when they have multiple identity providers
and sort of why they really need this identity orchestration.
I know we talked about sort of being able to swap out things, but what
about some of the issues that customers can run into by trying to manage
multiple identity providers today?
Eric Olden: Yeah, a, a very common thing is coexistence, and we see this all
the time where people have stuff that works on premises and they wanna move
to the cloud, and they've gotta have coexistence between the old and the new.
So that's a, pretty much everybody's got that problem.
Um, even if, say you're using Microsoft on both ends, active directory on-prem
does not work with Azure AD in the cloud marketing notwithstanding, right?
But the point is, is that you can, you have the situation all the time.
Uh, another problem that people run into are in very specialized areas of identity.
For instance, in, uh, multi-factor authentication or M F A.
Where people want to use a certain kind of, um, authentication
that doesn't rely on passwords.
Well, I think we've all seen the situation where maybe you're used to
using your biometric on your phone and well, you leave your phone in
the car, you still gotta log into your, your site, but you can't use a
password because that's not secure.
So what do you do in that case?
Well, that's actually a continuity resilience issue because if you're
thinking about the person who needs to do their job, they gotta get online.
Identity is a mission critical, if not one of the most important mission
critical things, because if identity and access management isn't in place,
you need to fail closed, right?
Can't let people in, otherwise it'd be chaos.
So what you need to think about with multiple identity providers is.
Hey, what do we do in the event that our primary identity provider isn't available?
How do we substitute that with a backup?
And so that could be, for instance, uh, I don't have my phone with
me, but I've got my key fob.
And so if I'm presented with an option to say, Hey, how do you wanna authenticate?
We don't use passwords here 'cause they're not secure.
We can give you a choice of your primary, is your phone.
And if you don't have your phone, your secondary could be this, you
know, one of the Fido keys that you plug into your, your computer.
So these are examples of problems that people have.
Resiliency and identity are actually very related.
So, uh, we see a lot of, a lot of that, um, as, as problems.
And I guess the last thing would be, Say you've got a great technology like
Passwordless and you wanna roll it out to all your applications and you've got
hundreds of applications to do it to.
Well, you wouldn't be able to do it very quickly if you had to rewrite
each of the applications to talk with this authentication mechanism.
So with an abstraction layer, you don't change the apps, you just
plug the authentication system into the fabric and everything
that's talking to the fabric and.
Connect with that without any coding or any, uh, modification.
So, uh, a lot of problems we call 'em recipes or use cases and, um, but yeah,
there's, there's a whole lot of different things that people are doing today.
I.
W. Curtis Preston: So, um, another question.
Um, so how does this work then?
So I've got, let's say, Okta.
Right.
And, and then you on top of Okta, and I want m f a, um,
so I'm interacting with you.
I'm not interacting directly with Okta at this point, right?
I'm interacting with your abstraction layer.
So I want M F A and, and Okta is configured for M F a or
how, how, how does that work?
Right?
Because we're not, we're gonna, we're not gonna do two MFAs.
So how, how do you make that happening?
Eric Olden: Yeah, so when you think about the, the architecture
that you need in multi-cloud, it's very different than on-prem.
Very different than SaaS because.
Uh, you need to be able to deploy this identity anywhere, on any cloud, on
premises and in, you know, public clouds.
And the way that we do it at Strata is through this distributed architecture.
We think about it as an air gap, and we have a component of software called,
uh, coincidentally an orchestrator.
And this orchestrator is, acts like a server of sorts.
Can think of it as a proxy, um, but it does more than just proxying and we built
it from the ground up to work in this way.
So think about this orchestrator as a enforcement point, and it is
programmed with policy so it knows, for instance, in your example, Curtis,
What kind of authentication am I going to use for this application?
Is it gonna be Okta with a password or is it gonna be Okta's multifactor
authentication or somebody else's multifactor authentication?
So at Runtime, when that user, through their browser puts in the U R L to get
to that application, that traffic is intercepted through the orchestrator.
So it's transparent.
People don't know about Stratus software.
It's all under the covers.
Behind the scenes.
And so then that orchestrator sees this session coming in and says,
ah, based on where you want to go, I need to enforce this policy.
I'm going to direct in real time, I'm gonna direct you over to this
multifactor authentication system.
You're gonna then be prompted to do the face scan or something else,
and then if that's successful, then the orchestrator says, okay, what's
the next step I'm supposed to do?
Um, you can program it to do a lot of different things, right?
But to keep it simple, uh, maybe that's all you wanted to
do is just the authentication.
And then at that point, the orchestrator would say, you have a valid multifactor
authentication session, so I'm going to now allow you into the application.
And, um, that's kind of how it works.
And you can distribute these orchestrators wherever you need to.
W. Curtis Preston: so if I understand that correctly, what you're
orchestrating is you're orchestrating me actually talking to Okta, right?
So I'm still.
I'm still, you know, like, um, so in the, I don't know how to put it.
Like you said, you're invisible, right?
And I'm still interacting and in this example, I'm still interacting with Okta.
I'm doing M F A with Okta, password, with Okta, whatever it is, you know, or both.
Uh, but you are sort of pointing that and making that happen.
I'm not, 'cause I, I think a minute ago I had the idea where
I was interacting with, with you.
I.
Your being My username and password or whatever it is
that I'm using and my M F A.
And then you were then passing that on to Okta.
That doesn't sound like that was a correct understanding.
Eric Olden: Y Yeah, I, I think the way to to think about it would be,
um, Like in, uh, in the music, the orchestrator, the, the conductor of an
orchestrator orchestra is gonna tell the percussion, do this, the horns do that.
And, uh, I don't know music that well.
So let's stick with those two.
Go here, go there, go here, go there.
And you know that conductor is not the one playing the music, that is the conductor
saying how the music needs to be played.
The instruments are the ones that generate the sound, and that conductor is simply
saying, go here, then here, then here.
That's the way to think about it.
It's, uh, really directing that user session in, uh, runtime.
So it is, um, it requires these IDPs, the identity providers.
It doesn't provide the identity itself.
It's the conductor, not the instrument.
Prasanna Malaiyandi: And since you now have visibility about identity
across the entire environment, do.
Can you use this to figure out, um, who has access to what
resources, if there is a breach?
How did people get in?
Like, I'm sure that you can now do all sorts of interesting
forensic cases based on being that single abstraction layer, right?
Eric Olden: Yeah, you're absolutely right.
And, uh, you bring up a, a really important, uh, area of orchestration.
So what we've been talking about today up until now, has been
about the runtime orchestration.
So what happens when the users.
Clicking on a link.
And there's another part of orchestration that has to do with
the policies or the rules that people set up to govern what needs to happen
in order to access an application.
And similar to the I D P fragmentation, the policies that are in these identity
providers, they're all built in different, uh, languages and syntax as well.
And so, um, if you want to have your policy consistent,
Across three different clouds.
You would need to know how to program that one policy in three different
APIs, three different cloud platforms, and three different data models.
It gets very confusing because you're gonna be dealing with
very quickly hundreds, if not thousands of these policies.
'cause they, you know, just the nature of it.
You have more of the more applications, more data you have, the more of these
policies you need to think about.
So, What do you do?
Wouldn't it be nice if there was a universal language that would
define policy that would work and be translatable to your Babelfish example?
What if we had Babelfish for policy and, uh, we helped at Strata,
we helped create a new standard.
Uh, called I D Q L stands for Identity Query Language and we built a reference
implementation in open source at the Cloud Native Computing Foundation,
the C N C F, which is the organization where Kubernetes and some of these
other cloud native technologies lives.
And what I D Q L will do is policy orchestration.
So imagine you've got two clouds, Azure and a w s.
And let's say for instance, you want to get your policies from
Azure to be the same in a W Ss.
Well, you can take this tool called hexa, it's free, point it at the A w Ss and
it'll discover policies that are in there.
'cause it's programmed to know the APIs.
It'll pull out your policies and say, okay, I've got 3000 of 'em and this
is what they are structured to do.
Translates 'em from the imperative.
A proprietary structure that they live in a W Ss and turns
it into a generic, uh, middle declarative language called I D Q L.
And it's a declarative representation, human readable, which is really handy
for a lot of auditing use cases.
You say, okay, great, well what am I gonna do with this generic thing?
Because I wanna.
Push it into, um, Azure.
And so HEXA can then say, okay, you want to translate it from generic to specific?
No problem.
I got that.
And you just run that orchestration in the other direction.
And what you end up with at, at the end is, uh, two things.
One is consistent policy in two places and a human readable,
easy to audit, way to categorize and inventory all your policies.
In this open free I D Q L standard.
Prasanna Malaiyandi: That's
W. Curtis Preston: like that.
Prasanna Malaiyandi: Yeah.
W. Curtis Preston: Yeah.
Uh, so let me give you another scenario and you tell me if you, uh, I mean,
this is what happens, Eric, when you create a new product category.
So what about, uh, the scenario of, it's sort of two things, which there
could be one solution or you could just go, no, that's not what we do.
So I currently use Okta and I want to use, what's the, the main Okta competitor.
What's the what?
Eric Olden: Microsoft Azure Active Directory is pretty
W. Curtis Preston: I was thinking of like some other third party
company, but it doesn't matter.
I wanna switch from Okta to Azure, um, or I wanna switch from Azure to Okta or
the scenario that you laid out earlier.
Uh, we just acquired a company and one of us is Azure and one of us is Okta
and we want to go to one of those.
Right.
Uh, how, how do you, or do you help with that transition?
Eric Olden: Yeah, a very common use case is, uh, modernization.
So yes, you can go from two modern ones like Okta and Azure
AD are both cutting edge, modern.
Um, but often when you look at the enterprise, they've got stuff that's
been running for like 5, 10, 25 years and they're saying, well, geez, this
thing was built years and decades before.
Things like.
Authentication or passwordless and all that came out.
So how do we modernize it?
How do we get the applications that are used to working on prem
and going to a legacy system?
How do we make that work with the new cloud stuff?
And so that modernization recipe, Or that use case, uh, the way that you
do that is you, uh, really quickly you would connect your two legacy
or your legacy i d P into the fabric and your cloud one into the fabric.
And those don't require code.
It's just kind of plug and play.
So now you've got two IDPs.
Then you tell the orchestrator this is the application today,
it's going to, um, the old system.
And we want to switch that to talk to the new system.
Then you configure that orchestrator and say, look, when a user logs in,
direct them to the cloud system.
And if that cloud system is using a different protocol, then the
old system, the orchestrator, for instance, let's say that the new
system uses SAML or federated.
Single sign on the security assertion markup language and the
old one is using old school cookies.
Well, the orchestrator would say, okay, I need to talk to Azure AD
using saml and I'm gonna do that flow the, the kind of exchange of
the identity information with Azure.
And then when I come back and that user is authenticated, I will, uh,
create a session to that application that looks just like that old
school, one that uses cookies.
And you can basically, I don't wanna say trick 'cause you know, it's not like
nefarious or anything like that, but the facade aspect of the abstraction layer.
It always presents what the application's already expecting in this example,
a cookie or something like that.
And so when the user comes through, they don't see any of that.
They just go to the website and it's like, Hey, I am, uh, going into the
same maybe sign-on portal, but under the covers I actually got authenticated
against the new thing, not the old thing.
And everything works and it's seamless.
W. Curtis Preston: And are you, are you moving or copying like
identities from one to the other?
Eric Olden: Um, generally, no.
W. Curtis Preston: customer?
Eric Olden: Yeah, it, it's generally up to the customer.
You can, but generally we find people have these systems already set up.
That said, there's a use case that a lot of people like about, uh,
just in time or j i t provision.
So let's say going into that modernization thing, we've got a million accounts
on-prem and Oracle system, and we want to move all of those accounts
into the cloud system and what the orchestrator can do when the user
comes in, It can verify that user.
Maybe it's most likely an old system is gonna be a password.
It'll verify that user's password and user ID against Oracle.
If that's successful, then that orchestrator will say, ah, I've been
programmed to go create a new account for you, and I'm gonna talk to the Azure ad.
For instance, I'm gonna create a new account for Eric.
I know the user id 'cause I just.
Verified it, and I'm gonna say this user ID is, um, now need, we created
an account in the cloud and you can even, you know, securely get that
password into that, uh, target system.
And so then the next time the user comes in, The orchestrator can flag
that user and say, wait a minute, you've already been migrated, so I'm
not gonna go through that same steps.
I'm gonna just push point you over to the cloud system.
And now that user, the same username and password are
gonna work in the cloud system.
And the nice thing about just in time is that you don't have this big bang.
And what happens is it's a lot more gradual.
And so you don't have those crazy weekends where you're like, oh,
we're gonna do a hard switchover.
It's just let it run.
For typically 90 days, you'll get majority of your users over there.
And then for the ones that haven't moved, you can, you can batch 'em and get them
over there and have them go through like a pa uh, account verification so
you don't have dormant account risk or you minimize it, I should say.
Prasanna Malaiyandi: Yeah.
W. Curtis Preston: yeah, based on your answer, I, I think your answer
to my question is actually yes.
You just don't do them in mass.
You do the, you, you bring the, the user over when they
authenticate with the system,
Eric Olden: That's right.
W. Curtis Preston: is what, what I heard you say.
Okay.
Eric Olden: It's optional is is what I was trying to say.
You don't have to, but if you want to, this is the way we would recommend it.
W. Curtis Preston: Gotcha.
Well, we're, we're kind of running short on time today, Eric.
Is there anything that you didn't get to talk about that you'd like to talk
about in our last few minutes together?
I.
Eric Olden: Uh, well, you know, this has been a great conversation.
I think, you know, if, if this is interesting to the audience, um,
they could find out more about our, uh, platform@strata.io.
And, um, we also have a fun thing.
We like to, we call it the identity orchestration challenge,
the use case challenge.
So, um, check out our website at strata.io/podcast and if you throw a
use case to us, just find the hardest one that you think we couldn't solve
and, um, we'd love to demo it for you.
Here's how it works, and I'll give you a pair of the Apple Air Pod
Pro, the ones that go in the ear.
I don't know the names exactly, but, uh, AirPod Pro I think is what it's called
W. Curtis Preston: the ones, yeah.
Eric Olden: the good ones.
And, um, yeah, so just check it out.
We'll show you how it works and we'd love to, uh, to have a conversation with you
W. Curtis Preston: So, uh, I, I, does anybody still use n i s?
You remember n i s the na?
Eric Olden: naming information service.
W. Curtis Preston: Yeah.
Does anybody still use that?
Eric Olden: yeah, I bet you know, in the big enterprise's, NetWare,
that's still running around, I'm sure.
W. Curtis Preston: Lord.
just, that was, that was what we used back in the, back in the day
was n i s even that, that's even before your time Prasanna, I
Prasanna Malaiyandi: It is.
Yep.
W. Curtis Preston: Yeah.
Well, thanks, thanks Prasanna for, uh, hanging out.
Good questions again,
Prasanna Malaiyandi: Yeah, I try.
I try.
And Eric, it's nice to meet you and Curtis, I do want to
hear about the Barbenheimer,
W. Curtis Preston: Barbenheimer.
Absolutely.
Well, you know me, you'll hear about it.
Prasanna Malaiyandi: will hear about it.
W. Curtis Preston: And, um, and thanks Eric for coming on
Eric Olden: Thanks so much.
Had a great time.
Appreciate it.
W. Curtis Preston: and, uh, thanks again to our listeners.
We'd be nothing without you, and remember to subscribe so
that you can restore it all.
There was a file, but I deleted it.
Too bad.
Your backup system isn't worth speed.
Needed your backup.
You had.
To fix and said, it's all Jack.
See how right on Facebook about you?
Don't underestimate the things that I'll do.
There was a file, but I deleted it to.
System isn't worth
when it keeps thinking that you restore it.
It didn't work at all.
Think of you up.
It would work if it wasn't.
And rescue.
Yourself into every backup run, hoping not just for once.
It'll be completely done.
Maybe Sunday it'll.
You could,
you could restore it
and rescue.