Latest / Identity at the Center / #296 - Allan Foster Walks Down IAM Memory Lane

Transcript

#296 - Allan Foster Walks Down IAM Memory Lane · Identity at the Center

• 0:00
  I wonder who's on the IAM or identity?
• 0:04
  Mount Rushmore, which means four people.
• 0:09
  First of all, I want a much bigger mountain so we can get
• 0:14
  more people on. That's a that's a really, wow,
• 0:16
  that's a tough question. That's.
• 0:18
  Called the Hall of Fame we have we can have an IAM Hall of Fame
• 0:22
  we'll have you back on another episode and.
• 0:25
  Go through the whole Hall of Fame.
• 0:28
  I think that there's there's a couple of folks on there that
• 0:31
  are that are pretty easy to identify.
• 0:33
  Obviously Kim Cameron would be one of those because he's had
• 0:36
  such a major impact. It's like the George Washington,
• 0:39
  right? Identity from from day one,
• 0:41
  right? The the seven laws of identity
• 0:43
  sort of defined our industry. And so you know, Kim Cameron
• 0:47
  simply for what he's done and for the for the I think Victoria
• 0:53
  is another one in that Victoria Bertucci.
• 1:01
  This is identity at the center. If it has anything to do with
• 1:06
  IAM. This is the go to podcast now
• 1:10
  your hosts Jim McDonald and Jeff Stedman.
• 1:20
  Welcome to the Identity at the Center podcast.
• 1:22
  I'm Jeff, and that's Jim. Hey, Jim.
• 1:24
  Hey, Jeff, how are you? Oh, not so bad yourself.
• 1:27
  Great, doing great. Actually, you know, the last
• 1:31
  couple days have been really busy for me and just got a lot
• 1:34
  of project work, but it's better than Friday.
• 1:38
  And I, I can't say I had the worst day Friday, but I woke up
• 1:42
  to the blue screen of death and spent like four or five hours
• 1:46
  trying to figure it out and try to conduct business from a
• 1:51
  mobile phone. But no longer in the kind of
• 1:54
  like the desktop support phase of my career.
• 1:58
  I guess everybody's probably figured out by now that I'm
• 2:01
  talking about that that crowd strike outage that hit not every
• 2:05
  Windows computer, but it did hit mine 8 1/2.
• 2:08
  Million is I think, the last count I saw around the world.
• 2:11
  Yeah, yeah, no doubt. I mean, that's a big number.
• 2:14
  I mean, I'm talking about there were certain organizations where
• 2:18
  10s of thousands of computers were affected.
• 2:21
  That's a big deal, right? So those somebody had to go
• 2:25
  around and like touch computers. And I don't think it was the
• 2:30
  kind of issue where you could remote control into computers.
• 2:33
  So you had to have like a physical presence.
• 2:35
  So I'm sure there are a lot of IT managers out there who were,
• 2:39
  you know, dealing with that and had a a really rough morning.
• 2:44
  I tried to not go on social media and like, you know, get
• 2:48
  too involved because I'm not a Windows person.
• 2:51
  But what I do want to offer now to anybody is like, if they are
• 2:58
  thinking about the long term strategy and how something like
• 3:01
  this effects their identity program, I'd be very much open
• 3:06
  to being somebody who is a resource, you know, because I, I
• 3:12
  think about a crowd strike. I even think back to like solar
• 3:16
  winds. And a lot of times we say, all
• 3:19
  right, well, if there's a legitimate use for an account
• 3:23
  and the account is OK, right, We also look at it and make sure
• 3:25
  that it's got the right level of privileges, etcetera.
• 3:29
  But there are certain situations where you have very powerful
• 3:32
  accounts in the environment. They have a legitimate reason to
• 3:35
  exist, but I think a very important part of risk
• 3:40
  management is knowing what your risks are.
• 3:43
  And if you don't have kind of the inventory of risks, then
• 3:48
  it's hard to manage what you what you can't even measure.
• 3:52
  Yeah, I mean, you got crowd struck.
• 3:56
  I got crowd struck. A whole bunch of people got
• 3:58
  crowd struck. I'm not going to bash anything.
• 4:01
  I mean, think these things happen, right?
• 4:03
  Piece of software softwares are defined by humans and mistakes
• 4:07
  that we made and it's unfortunate had a wide-ranging
• 4:10
  impact but for the most part, I think most folks hopefully are
• 4:14
  back to normal at this point about a week later or so.
• 4:16
  I'm just glad I wasn't flying on Friday.
• 4:19
  I actually flew back from South America on Thursday before this
• 4:23
  happened and that was already a challenge just for for weather
• 4:26
  delays. I can't imagine trying to fly
• 4:27
  back on Friday, you know, after a week in in Bogota and then
• 4:33
  having to deal with airport delays and stuff like that.
• 4:36
  So I'm just happy with that. Delta is apparently still
• 4:38
  recovering. If you're, you know, kicked on
• 4:40
  the 4th wall. Today is Wednesday.
• 4:42
  What is Wednesday 24th? So we're just about almost a
• 4:45
  week from when things happened. And Delta has said that they
• 4:49
  should be back to normal tomorrow.
• 4:52
  But it seems like they have struggled more than most for the
• 4:54
  airlines to get back up to speed.
• 4:56
  So I don't know. As long as you're people
• 4:58
  crumbling as. Long as my flight to New York
• 5:00
  City tomorrow is on time, I don't care.
• 5:02
  Yeah, I, I mean, that's, you know, and that's not just being
• 5:06
  selfish. I mean, you've sat through your
• 5:08
  fair share of delays. It's it's part of being a road
• 5:12
  warrior. If you're going to be a road
• 5:13
  warrior, you're going to spend some nights in some airport
• 5:16
  hotels, bottom line, or airports, Yeah.
• 5:20
  And you're going to have your fair share of turbulence and all
• 5:22
  that. But you know, specific to
• 5:24
  today's episode, what has me excited is like, and the analogy
• 5:29
  that I was thinking kind of tied to this was, you know, how in we
• 5:34
  all have our hobbies and these days, like within our hobbies,
• 5:37
  we've got all the social media and YouTube and people who
• 5:41
  aren't really celebrities per SE, they become celebrities in
• 5:46
  your world. But going back kind of like when
• 5:50
  I first got started in this industry, our guest today was
• 5:54
  already a celebrity within that industry.
• 5:57
  So, you know, he's like one of the people that I looked up to
• 6:01
  and there's there's several people who kind of fit that
• 6:03
  bill. But I'm really excited about
• 6:05
  having him on our show now. So I think it's pretty cool.
• 6:10
  Yeah. Why don't we take care of a
• 6:11
  little bit of business and talk about our conference
• 6:13
  partnerships before we get to Alan?
• 6:16
  The first up is Identity Week. We've got Identity Week America
• 6:19
  taking place September 11th, the 12th.
• 6:21
  Jim, you and I are going to be there.
• 6:22
  Actually had a call this morning with the team there just to make
• 6:25
  sure everything is all set and good to go.
• 6:27
  Good news, we're going to have power wherever it is we are so
• 6:30
  we can record podcasts from. I'll be hosting a panel, so that
• 6:34
  should be up on the agenda now in the first day.
• 6:36
  So things are starting together, you know, starting to come
• 6:38
  together for that. But we got a discount code for
• 6:41
  all of our listeners. And if you're not a listener and
• 6:44
  you somehow get this code, enjoy.
• 6:45
  Ida C30 gets you 30% off of your registration.
• 6:50
  So you can use that code for both the America conference as
• 6:53
  well as the one taking place in Asia and Singapore, October
• 6:56
  22nd, 23rd. So if you're going to either of
• 6:59
  those conferences, you can use that code.
• 7:01
  Ida C30 get 30% off. Good way to show support for the
• 7:05
  show. Does it cost you anything?
• 7:07
  Just show support that says, hey, you know, you heard you
• 7:09
  heard about the conference through the podcast here, so.
• 7:13
  If you're not a listener and you use that code though, you owe us
• 7:16
  like 3 listens and a like on YouTube.
• 7:19
  Yeah, that would be nice. At least give a like or a
• 7:21
  subscribe or something just to just to help us out.
• 7:23
  That would be super. The other conference we have is
• 7:26
  the authenticate conference. You and I are looking for that
• 7:28
  as well. That is in October the 14th, the
• 7:30
  16th in Carlsbad, CA on a very nice resort, the Omni Acosta or
• 7:36
  something like that. Anyway, it's nice golf,
• 7:39
  California weather, October generally pretty much perfect.
• 7:44
  So looking forward to that. We've got a discount code for
• 7:46
  that one as well, ID AC15. That gets you 15% off of your
• 7:50
  registration. So you and I are going to be
• 7:52
  there. We're going to be doing
• 7:53
  something, not sure you're what yet, but doing our normal,
• 7:56
  probably conference podcast things and maybe even something
• 7:59
  on stage. We'll see.
• 8:00
  Still working that one out, but that's going to be a lot of fun.
• 8:03
  Anything else, Jim, before we get things going here today?
• 8:06
  No, I'm thinking that's going to be a good, a good question for
• 8:10
  our guest today is around conferences because I think he's
• 8:13
  done his fair share of conferences so.
• 8:15
  Well, the last time we talked to him, we were at a conference.
• 8:17
  We were at Identiver. So why don't we go ahead and get
• 8:19
  to it? He's part of the executive team
• 8:21
  for the Digital Identity Advancement Foundation.
• 8:23
  DIF Emeritus board member for ID Pro, which you and I are both
• 8:27
  members of, one of the founders of Forge Rock.
• 8:29
  Now he's enjoying this retiree life, which is awesome.
• 8:32
  Welcome back to the show, Alan Foster.
• 8:35
  Thank you. Thank you very much.
• 8:37
  You. You make me almost jealous for
• 8:38
  what I'm actually. Living well, thanks for carving
• 8:43
  out some time for us. I, you know, I think this is an
• 8:46
  opportunity for us to kind of maybe I, I, you know, we were
• 8:49
  kind of talking. It's like, what are we, what are
• 8:50
  we going to call the show? Like, what is the theme for
• 8:52
  this? It's we're kind of thinking it's
• 8:53
  like, well, it's like a walk down identity lane, the Alan
• 8:57
  Foster version or something like that.
• 8:58
  But I'm sure it will name itself as they go along.
• 9:00
  But let's not get too far because you've been in the space
• 9:03
  for a long time. You know, Jim alluded to it.
• 9:07
  Tell us about your identity journey.
• 9:08
  How did you get into the world of identity management?
• 9:11
  Is it something that you chose or did it choose you?
• 9:15
  It pretty much chose me, right? So I mean, to give you the, the
• 9:18
  quick rundown of where I came into it, late 80s, early 90s, I
• 9:25
  was the prototypical software engineer feed pizza under the
• 9:30
  door, writing code, right? I was working, I was working a
• 9:33
  lot with Apple at the time and my world was back end of the
• 9:38
  compilers, low level machine debuggers.
• 9:41
  I mean, I was right down there next to the chip.
• 9:45
  The, the I ultimately at Apple got involved in training because
• 9:50
  I found I was lucky enough to have both a good solid, deep
• 9:55
  technical understanding of what we were doing as well as had a
• 9:59
  way of being able to explain that to people and, and draw
• 10:02
  diagrams on a white board and things like that.
• 10:04
  So I got involved doing a fair bit of training and then sort of
• 10:08
  we Fast forward, I did some stuff with Apple and next and
• 10:11
  various things like that. But we Fast forward a few years
• 10:13
  to about 95, and this little upstart company called Netscape
• 10:19
  ended up giving me a call and said, you used to do some
• 10:23
  training for Apple, we've got some training work to do.
• 10:26
  Would you be interested in coming to see us?
• 10:29
  And I went to see them, and it turned out that most of the
• 10:31
  people that I'd worked with in the training group at Apple were
• 10:34
  now at Netscape. And so for those of us who
• 10:38
  remember the good old Netscape browser, there was actually more
• 10:43
  to Netscape than just the browser, right?
• 10:46
  There were actually three parts to it.
• 10:47
  The one was the browser. The one was netscape.net, to
• 10:53
  which everybody had an e-mail address.
• 10:55
  It was the portal. And the third part was this
• 10:58
  server products. And they had this little product
• 11:03
  called LDAP. It was the Netscape Directory
• 11:05
  Server. And Needless to say over the
• 11:08
  next few years, my story was use the Netscape directory server.
• 11:14
  It's going to solve all of our identity problems from this
• 11:16
  point forward. Well, Fast forward 30 years,
• 11:19
  we're still sort of trying to say that.
• 11:23
  So I, I was with Netscape working in their servers, net,
• 11:27
  the e-commerce products. And then we Fast forward again
• 11:30
  into about 2000 when there was this really strange acquisition
• 11:35
  where Sun Microsystems and AOL both kind of bought part of
• 11:41
  Netscape and and consumed it. I followed the Sun path on that
• 11:45
  because Sun basically wanted to get to all of the server
• 11:47
  products. Netscape had the directory
• 11:50
  server, they had mail server, lot of things like that they
• 11:55
  also had. And as we started moving into
• 11:58
  Sun, they were starting to work on products like what was
• 12:01
  originally called the Identity server and the portal server.
• 12:06
  These were for, you know, companies to build these
• 12:08
  products. And that's where I got involved.
• 12:10
  So I spent the next 10 years in the Sun ecosystem working with
• 12:15
  Identity, which eventually became access manager.
• 12:19
  Fast forward again, we have another really strange
• 12:23
  acquisition at the end of the, the, the about 2009 when Oracle
• 12:30
  and Sun had a little steel cage match and Sun didn't work out as
• 12:35
  well. And so right at that point is
• 12:38
  when a few of us at, I think it was a bar in London.
• 12:43
  We're talking about what's going to happen to the open source
• 12:46
  identity stuff that Sun has. Oracle wasn't known for being a
• 12:51
  major proponent of open source stuff.
• 12:53
  And they had sort of said they had their stack, they didn't
• 12:55
  want anything. And that was the beginning of
• 12:58
  Fortruck. And so we founded Forge Rock
• 13:01
  with sort of this idea that we could take the Sun products and
• 13:07
  continue those on since we've been working on them for 10
• 13:10
  years, right And there. So that little band of merry men
• 13:15
  in a pub ended up founding Forge Rock.
• 13:18
  Fast forward again, we end up into 2021, we went public on the
• 13:24
  New York Stock Exchange, which was a wonderful journey and a,
• 13:27
  and a, and a very interesting journey.
• 13:29
  The, the entire process. I'm sure we'll talk about it a
• 13:32
  little later. And so at the end of 21, I sort
• 13:35
  of realized that my part of that journey was, was done and it's
• 13:38
  time to do other things. And so I retired from Fort
• 13:41
  Rocket at the end of 21 December 31st in 21.
• 13:45
  So that's the the sort of quick rundown of of the time that I've
• 13:49
  been through, all of which were really interesting times.
• 13:53
  Only a couple notable things happened during that time.
• 13:57
  Just a handful of things. I'm curious what you mentioned
• 14:01
  you were kind of on the software side and then all of a sudden,
• 14:04
  maybe not even a solid, maybe it was a gradual shift, but that
• 14:06
  that move from software to identity, was that a conscious
• 14:10
  shift? Was it something that just kind
• 14:11
  of occurred naturally or like did you realize you were an
• 14:15
  identity all of a sudden and wake up?
• 14:16
  I was like, oh, I've been, I've been doing this longer than I
• 14:18
  thought I have or was like, yes, I I want to move into this
• 14:22
  space. It, it mainly I woke up and
• 14:27
  discovered I was there, right? I mean, it, it was sort of a, a
• 14:33
  general movement if you think about it back in the mid 90s, we
• 14:37
  were still talking about Jeff Bezos being a guy who was in his
• 14:41
  garage selling books on the Internet, right?
• 14:44
  That that's sort of what Amazon was.
• 14:46
  And so we were really trying to find out what the Internet was
• 14:51
  capable of, what we were doing with it and things like that,
• 14:54
  and began to realize that the firewall was no longer going to
• 15:00
  be the thing which protects our network.
• 15:03
  And that was sort of the beginning of the point of
• 15:06
  saying, OK, people are coming in from outside from, you know, the
• 15:11
  we're connecting things up. And so having some way of
• 15:14
  knowing who's who became a really interesting technical
• 15:20
  problem. And so that was sort of the
• 15:23
  space. It was actually because, and I,
• 15:25
  and I keep saying this throughout the entire time I've
• 15:28
  been an identity, identity in itself is not particularly
• 15:32
  interesting. It's only interesting because of
• 15:34
  what it enables, right? The, the, the fact is nobody
• 15:38
  goes to work saying today I'm going to log in, you know, that
• 15:42
  that's, that's not a thing, but we have to do that because it
• 15:47
  enables everything else. And so I got involved and it was
• 15:50
  about, well, how do we distribute data with the portal?
• 15:54
  How do we manage messages? How do we provide access control
• 15:58
  to calendars, right? It was that kind of stuff.
• 16:02
  And every time I turned around identity or being able to
• 16:07
  determine who we were dealing with became the problem Dujour.
• 16:12
  And and that's sort of how I got into it was really a case of how
• 16:16
  do we enable all these other things to happen, if that makes
• 16:20
  sense. Alan, you, you've, I always knew
• 16:24
  you from Forge Rock, right? I got involved with Forge Rock
• 16:27
  in the pretty early days, as well as like a system integrate
• 16:32
  on the system integrator side. But you've also kind of always
• 16:38
  been involved with a lot of the industry groups like Liberty
• 16:41
  Alliance, Kentara. Now you're heavily involved with
• 16:46
  the Digital Identity Advancement Foundation.
• 16:50
  Is it DIAF or DIAF? And either one works.
• 16:54
  DIAF is probably easier to say. Yeah.
• 16:57
  OK. So DIAF.
• 16:59
  So can you tell us a little bit about DIAF, like what's the
• 17:02
  mission and how are you guys going about it?
• 17:07
  So the Dayaf that that's actually one that's that's near
• 17:09
  and dear to my heart that Ian Glaser and Aaron and myself are
• 17:15
  are working on that. It came about two or three years
• 17:21
  ago when Kim Cameron, who is a legend in in the identity space,
• 17:28
  when he passed away, the Open ID Foundation started an award
• 17:35
  basically to memorialize him, but also to try and encourage
• 17:41
  new people to get involved in the industry that all of us have
• 17:45
  spent a lot of time working in, which they did.
• 17:48
  And so the first year they actually ran the Kim Cameron
• 17:51
  Award and almost from day one, they realized that this was not
• 17:57
  specifically within their remit. This was not what, what they
• 18:01
  were doing, You know, they, they were standards body and they
• 18:04
  work on standards and, and managing that award.
• 18:07
  It, it seemed like a good incubator, but wasn't really a
• 18:10
  place. And so after about a year, the
• 18:13
  Open ID Foundation came to Ian and myself and, and said, would
• 18:19
  you guys be interested in putting an organization
• 18:22
  specifically to manage these awards and fostering new people,
• 18:27
  enabling people who otherwise wouldn't be able to come to the
• 18:31
  conferences or these events? And, and, you know, building on,
• 18:35
  as I think one of Ian's talks, building onto the shoulders of
• 18:37
  giants. And so we started off with the
• 18:41
  Kim Cameron Award. And then for the, the, I'm sure
• 18:45
  many people remember it was last year when we lost Victoria
• 18:48
  Bertucci. And that seemed like a, another
• 18:53
  person who was passionate about enabling people, teaching
• 18:58
  people, bringing new people in. And it seemed to just fit in
• 19:01
  onto the mission. And so the, the mission,
• 19:04
  although Dayaf has started off as, as sort of honoring these
• 19:10
  people, the goal is sort of bigger than that.
• 19:12
  The goal is how do we enable people who are starting off in
• 19:18
  their careers, people to come into what we are doing, to Start
• 19:23
  learning about digital identity and carrying on all of the work
• 19:26
  that we have to do. And that's sort of really why we
• 19:29
  founded it and put the focus specifically on that.
• 19:34
  And we did a show with with you guys back around Idaniverse time
• 19:37
  where we had winners of an award to be able to come and.
• 19:42
  Attend the Kim Cameron Award. Yeah, the.
• 19:44
  Kim Cameron Award So I would definitely, you know, point
• 19:46
  people back. You can go back and listen to
• 19:47
  that episode. It was a lot of fun.
• 19:48
  It was, I think I think that was our biggest show ever, meaning
• 19:52
  most amount of people on at once.
• 19:54
  So definitely a lively conversation.
• 19:56
  We had some, you know, some great folks who are new to
• 19:59
  identity. Really sharing their perspective
• 20:01
  on it. I want to we have like, I feel
• 20:03
  like there's so much to cover. So I want to keep things moving
• 20:06
  because I want to ask about Fordrock.
• 20:08
  I guess take us through the history of Fordrock because it
• 20:10
  sounds like all great ideas. It was born in a pub over what
• 20:15
  I'm assuming were a few a few pints of how.
• 20:19
  This would work. Take us through Take us through
• 20:21
  Fordrock. So the, the, the team that sort
• 20:26
  of started up Fordrock had known each other for a few years
• 20:29
  before that. We'd all been involved in one
• 20:31
  form or another within the Sun consulting work, right?
• 20:34
  We'd, we'd all been working on the products.
• 20:38
  And so, as I said, when when Oracle bought Sun, we decided to
• 20:41
  put that together initially with the idea of saying, well, can we
• 20:47
  start a company that lets us keep doing what we're enjoying
• 20:50
  doing and, you know, pay the bills for the next few years?
• 20:56
  The, the, the trajectory that it went on was sort of the stuff
• 21:01
  that fairy tales are made of it. It wasn't the plan, right?
• 21:05
  The plan was just to build a company that we would enjoy
• 21:07
  working at. And so we officially started it
• 21:12
  on February 1st. Interesting story on this
• 21:15
  January 31st of 2010 was the day that Sun was delisted off of the
• 21:23
  New York Stock Exchange. It's the day that Java died.
• 21:26
  And so February 1st at 12 O1 is when we officially established 4
• 21:32
  truck. That was the the transition time
• 21:35
  for us to do that. And so starting off we had about
• 21:40
  15 people. There were, there was five or
• 21:42
  six of us originally, which very quickly led to, you know, the,
• 21:46
  the, the small group of us who were involved and about 15
• 21:49
  folks. And we started working on the
• 21:55
  Sun access Manager, which at that point was open source.
• 22:01
  We were very lucky on that in as much as that the Sun engineering
• 22:07
  team had done all of the work necessary to get up to a release
• 22:12
  and were weeks away, possibly even days away from making a
• 22:17
  release. I believe.
• 22:19
  I'm probably wrong on this, but I believe it was AM 9 at the
• 22:22
  time. And so we were lucky enough to
• 22:26
  be able to take the open source repository, package it and
• 22:31
  release the the update. And we've been working on that
• 22:35
  and going in through with that and supporting the folks who had
• 22:40
  bought into it right there. There was a lot of Sun customers
• 22:43
  at the time and working with them.
• 22:44
  And so you know, a lot of hard work from a lot of people ended
• 22:48
  up taking us to about 2012 when we decided to take our first
• 22:59
  round of funding. Everything up until that we had
• 23:01
  sort of done ourselves. We took our first round of
• 23:04
  funding. We then I believe it was 2012,
• 23:08
  it may have been early 2013 is when John Fernandez who was our
• 23:13
  Chief Financial Officer came in. And I very clearly remember him
• 23:19
  at A at a company meeting where he said to us, I strongly
• 23:22
  believe that if you behave like a public company pretty soon you
• 23:26
  are one. And that was the the journey he
• 23:29
  basically would say throughout the entire time and took us up
• 23:33
  2014 or so, a small group of us, myself, Joni Brennan from the
• 23:39
  DIAC, Ian Grazer from Salesforce and one or two other folks that
• 23:47
  were, were part of that actually came up with sort of looking at
• 23:52
  consumer identity. It wasn't a thing at that point,
• 23:55
  right? All identity was workforce.
• 23:57
  And so we started bringing up consumer identity.
• 24:01
  It caught on and we were able to sort of step into that space
• 24:06
  quite well from a company. By then, I'm guessing we were
• 24:11
  probably at, at maybe, I don't know, a hundred, 125 people.
• 24:17
  I founded the, the, the development office in Portland,
• 24:21
  OR we had one in Bristol. We moved on through all of that
• 24:26
  and we then started doing all of the things that happened when a
• 24:30
  company grows, right. We, we got a new CEO in the
• 24:35
  Lasso, who was our founding CEO moved into the CTO role.
• 24:41
  The, the, when we started it, we were actually focused largely on
• 24:46
  European business and they were two of us in the US, John and
• 24:51
  myself were we were being opportunistic about U.S.
• 24:55
  business. By the time we got to 2014, we
• 24:58
  were very strongly entrenched in the US and the CEO at the time
• 25:03
  came to me and they said we'd like to expand into Asia.
• 25:08
  How would you like to move to Singapore for a while?
• 25:11
  And so I up and moved to Singapore and helped establish
• 25:15
  the Singapore region and our offices down in Sydney and
• 25:17
  Singapore and then came back in it, it, it wasn't an immediate
• 25:24
  comeback into COVID, but about five years later, we hit COVID
• 25:30
  and, and it just, you know, we were in the right place at the
• 25:32
  right time and, and working with a lot of these things.
• 25:34
  And so that's sort of the past that it came to from a personal
• 25:39
  perspective. I did definitely realize that
• 25:41
  the bigger the company gets, the less interested I am in really
• 25:47
  being wanting to work the even though I love the people, I love
• 25:51
  the culture, I loved everything we did about it.
• 25:53
  I realized that I was much more suited for a small start up
• 25:58
  rather than, you know, a big company.
• 26:01
  And, and I think that happens when when you're at a company
• 26:03
  that grows like that, you get to a point where you say, I'm glad
• 26:08
  of the success, but it's not where I want to be.
• 26:11
  There's a policy for everything. Oh.
• 26:14
  Oh, yes, yes. You know, you, you say there's a
• 26:16
  policy. Our very first policy when we
• 26:19
  were sitting around the dining room table was we have a no
• 26:22
  policy policy. And so the, the policy that we
• 26:26
  had was do the right thing. And then slowly watching over
• 26:30
  the years as we started getting a travel policy and expense
• 26:33
  policy, a this policy and a that policy, yeah.
• 26:38
  Yeah, Yeah, I've been as a start of companies where you kind of
• 26:42
  go through that and I was, I was actually the question that I was
• 26:45
  going to ask you about. I also wanted to just state like
• 26:49
  I, I guess I discovered open AM pretty far into the journey of
• 26:54
  the way you tell it, which was that a large university they're
• 26:58
  running open AM and they were asking me, should we get support
• 27:01
  from Fordrock. I'm like, I didn't know about
• 27:04
  open AM before and I don't I've never heard of Fordrock.
• 27:08
  So I started to do some research and I was like, wow, this is the
• 27:13
  best thing since sliced bread because I had been working with
• 27:16
  like Oracle access manager and CA site minder for, you know, a
• 27:21
  good part of my career. And they probably would argue
• 27:24
  that, you know, they, they invented customer identity and
• 27:28
  access management. But you guys shifted that whole
• 27:33
  landscape so much. And people who weren't there at
• 27:36
  the time don't realize that how much of the shift it was in the
• 27:44
  access management space, just the introduction of of Forge
• 27:48
  Rock into that competition between Oracle CA and IBM.
• 27:55
  Yeah, I mean, it was fascinating to watch and you know, although
• 27:59
  I'd love to take the credit for it, it it, it was a, it was a
• 28:03
  perfect storm of things coming together.
• 28:06
  The, the, the reality about it is prior to about 2013, if you
• 28:13
  were a public facing application, you were a web page
• 28:17
  and you had a My Sequel database behind you and you had a
• 28:20
  username and password. And that was sort of it, right?
• 28:23
  The thing which really changed in about 2013 was the idea that
• 28:29
  you were logging in and there were multiple systems behind
• 28:33
  that login page that not only staff, but customers we're now
• 28:38
  accessing. And then this sort of other
• 28:40
  piece that came in on the side was the API economy, right?
• 28:44
  AP is brought in. This whole thing that said, not
• 28:47
  only are we just providing a web page on to something, submitting
• 28:51
  a form, we're giving people access to our AP is and we got
• 28:55
  the mobile phone thing coming up, right?
• 28:58
  The smartphones. You know, let's face it, it
• 29:01
  wasn't that long ago you were talking in, in the introduction
• 29:04
  about Delta Airlines. It wasn't that long ago that the
• 29:07
  only way to get a seat assignment was to phone and
• 29:10
  speak to someone. And this was 20/10/2020 O 8,
• 29:15
  right? That you phoned and spoke to
• 29:16
  someone. Now, while you're sitting at the
• 29:19
  gate, you can sit on your phone and you can change seats to find
• 29:23
  one with no one sitting next to you or something like that.
• 29:26
  That could do it in the sky, sitting in sitting in the
• 29:29
  airplane. I've never tried, I've never
• 29:32
  tried that. I, I, I think there's always a
• 29:34
  Monty Python sketch about that, right?
• 29:37
  Everybody moving around the plane.
• 29:39
  But yeah, right. You've got immediate access and
• 29:42
  I think that really highlighted the the deficiencies that we had
• 29:48
  in customer identity and customers didn't have access.
• 29:53
  Customers lined up behind the big wooden desk.
• 29:56
  You know that that's, that's how customers were.
• 29:59
  So there was that big shift in that which I think enabled a lot
• 30:02
  of the consumer technology and the the consumer adoption that
• 30:07
  that drove into that and we were lucky enough to be in the right
• 30:09
  place at the right time. So here's a little fun fact for
• 30:13
  folks. A lot of people ask Jim How I
• 30:17
  Met Jim, and we kind of met each other.
• 30:19
  And I think I've told the story. It's like, you know, the first
• 30:21
  thing Jim ever said to me was do you like baseball?
• 30:25
  And I said no, not really. And then he just kind of walked
• 30:27
  away from me. So, so hey, guy.
• 30:29
  Well, nice to meet you, Jim. But that's not the first time
• 30:32
  that I was actually introduced to Jim.
• 30:35
  It was a YouTube video that Jim did.
• 30:38
  I think it was open DJ or open AM.
• 30:41
  It was a four draw. It was a time machine, I think
• 30:43
  is what was called Jim. Jim, you can explain better than
• 30:45
  I can. But you had done a a video of it
• 30:48
  and I was doing research as I interviewed, was about to
• 30:52
  interview with this company called Identity, which is
• 30:53
  eventually where Jim and I met. And that was actually my first
• 30:57
  exposure to both Forge Rock and to Jim McDonald.
• 31:00
  So there was a tie. Out there, the stuff is still
• 31:03
  out there. It was, you know, recorded 10
• 31:05
  years ago. So if you go to the Identity
• 31:09
  YouTube channel, of course this is when you're out there
• 31:12
  watching Identity of the Center and you need a break because
• 31:16
  you've watched so many episodes in a row.
• 31:17
  You go out and search up Identity and there's a ton of
• 31:20
  four DRAC videos out there. So we had a great team, really
• 31:24
  did and a. Lot of a lot of the folks who
• 31:29
  were doing that really enjoyed doing it, right?
• 31:31
  They were doing it not because it was their job.
• 31:34
  They were doing it not because they were trying to sell
• 31:36
  product. They were doing because they
• 31:37
  just want to tell people how cool this was.
• 31:40
  It was cool, it was fun. And what I thought was so cool
• 31:43
  about it was you could go in there and take a problem and it
• 31:47
  was a new problem that required a, a novel solution.
• 31:52
  And then you could take the, the four draw components and put
• 31:56
  them together and solve that problem.
• 31:58
  I, I think very much today we're at, we're in that mode where
• 32:02
  it's like, OK, what's the best practice or what's the leading
• 32:05
  practice? We'll just do that and it takes
• 32:09
  some of the excitement out for me because it's like, that's my
• 32:11
  creative juices. My creative drive is to take a
• 32:15
  problem and draw it out on the whiteboard and figure out a
• 32:17
  solution, and that's what I love so much.
• 32:20
  I think about working with Forge Rock was that it kind of gave
• 32:24
  that opportunity. You mentioned Joni Brennan a
• 32:28
  couple of times. We've had her on the podcast
• 32:31
  recently, actually. Big Thinker talked about DIAC
• 32:35
  talked about Liberty Alliance. I didn't realize that we should
• 32:39
  have hit her up about Kantara. So maybe you can give us a
• 32:42
  couple minutes on the the mission of Kantara and kind of
• 32:46
  what your role was in that organization?
• 32:50
  Wow, that takes us back a little ways.
• 32:52
  So the yes, Joni, Joni and I go back a long way.
• 32:57
  In order to tell that story, we actually have to talk a little
• 33:00
  bit about Liberty Alliance, right.
• 33:02
  So the Liberty Alliance was back in about let's say 2005 and a
• 33:10
  few years after that big industry wide, there were 160
• 33:14
  companies ultimately that were working in Liberty Alliance
• 33:19
  partially in response to and it's they came out at the same
• 33:25
  time. So I'm not going to say it was
• 33:26
  in response to, but early on in the 2000s, Microsoft came out
• 33:30
  with a technology called Passport and it was essentially
• 33:36
  single sign on to all everything you, you, you had.
• 33:40
  And the, the response from the industry was to look at that and
• 33:45
  said, you know, I'm not giving up my login experience.
• 33:48
  I'm not giving up my identification of customers to
• 33:51
  Microsoft. That's, you know, I'm, I want to
• 33:55
  keep that. And so they founded Liberty
• 33:57
  Alliance. Son was one of those members.
• 33:59
  There was a lot of them. I think the Liberty Alliance
• 34:01
  pages might still be up there. But the net result of all of
• 34:06
  that was the creation of the Samil 2 standard, actually the
• 34:12
  Samil one and the Samil 2 standard.
• 34:15
  And the standards were eventually given to Oasis as a
• 34:21
  standard body and that's where the standards were brought out.
• 34:24
  And Liberty Alliance basically, I, I made it maybe in 2008, it
• 34:31
  may have been early 2009, the dates are getting a little hazy
• 34:35
  back there. But the Liberty Alliance
• 34:36
  basically said, OK, our work here is done.
• 34:40
  And so they had defined the SAML federation protocols which are
• 34:46
  showing their long teeth now because it was all XML based,
• 34:50
  but they defined the protocols and Cantara was actually came
• 34:57
  out sort of as a result of that as a place to do some standard
• 35:03
  verifications. It's a sort of the bridge to the
• 35:05
  future and the, the Joni ended up so, so Joni was the, I think
• 35:15
  the second executive director of Cantara.
• 35:20
  Once we had founded Forge Rock, I had been involved with the
• 35:24
  Liberty Alliance during the Sundays and then when we founded
• 35:27
  Forge Rock, I carried on being involved with Canterra.
• 35:31
  I became president of Canterra, I think in 2011, and Joni was
• 35:37
  the executive director. So she and I worked very closely
• 35:40
  inside of Cantera. And one of the things that we
• 35:44
  were working heavily on at that point was not only trying to get
• 35:51
  conformance certification on the actual implementations, but also
• 35:57
  trying to do conformance certifications on federations.
• 36:02
  And you know, if you're going to be a relying party, are you
• 36:05
  doing the right thing with information etcetera and and you
• 36:09
  know, personal identifying information in the privacy
• 36:12
  aspect. And so Kentaro was driving
• 36:14
  around an auditing process around giving that
• 36:17
  certification, which was really interesting at the time because
• 36:20
  the federal government was sort of requiring because they, they
• 36:25
  bought all in on SAML. And so the federal government
• 36:29
  was doing that. So Joni and I worked at or
• 36:32
  worked, I'm not sure we ever really worked, but Joni and I
• 36:36
  were heavily involved with with Kentara until eventually she
• 36:42
  left and is now at the Digital Identity Council of Canada,
• 36:46
  Digital, Digital Identity and Authentication Council of
• 36:50
  Canada. And I ended up backing away,
• 36:54
  resigning from the presidency at about 2018-2019.
• 36:59
  Just at that point, I was not able to put the time into it.
• 37:03
  But we'd spent a lot of time in with Kentara and building that
• 37:07
  up and building up those conformance things.
• 37:09
  And they continue to do that to this day and are working very
• 37:14
  heavily in, in helping people the the conformance around, as
• 37:19
  you say, best practices around identity best practices and
• 37:22
  preserving information and privacy, things like that.
• 37:27
  Yeah, and that I mean, all that's so important, especially
• 37:29
  the the best practices. And because I think people are
• 37:32
  searching for that. They don't know how to do
• 37:35
  something. They they want someone to tell
• 37:37
  them this is the right way to do it.
• 37:39
  But I think, you know, we can't underestimate Samuel.
• 37:43
  I mean, to me, that's just like such a landmark within the
• 37:48
  timeline of identity. It's like we can almost talk
• 37:51
  about it. Like you can talk about the
• 37:52
  world like pre 911, post 9/11, pre COVID, post COVID, you talk
• 37:56
  about the identity world, pre SAML, post SAML, it was like,
• 38:03
  and I, I know it was a longer time that until everybody
• 38:06
  adopted SAML, but there was a period of time where it was like
• 38:10
  you had to use like web agents or proxy servers and things like
• 38:15
  that to do web access management.
• 38:18
  Then this new standard comes out SAML.
• 38:21
  That's also around the same time that you saw a mass migration
• 38:25
  from fat applications to web applications.
• 38:30
  And Samuel just became, people just said, yes, I will do
• 38:34
  Samuel, I will reengineer my application, will do Samuel.
• 38:37
  And of course, there were hangers on, but I mean, it was
• 38:41
  pretty much like it revolutionized the industry, I'd
• 38:44
  say. It did.
• 38:46
  I think the, the thing that Samuel really recognized and the
• 38:49
  thing that was able to be leveraged with the fact that it
• 38:52
  was actually a trust framework and it was about codifying how
• 38:57
  do you trust two different entities in play.
• 39:00
  And so it gave us the capability.
• 39:02
  I mean, one of the single biggest SAML networks and the
• 39:06
  SAML federations in use today is still the universities.
• 39:11
  The universities have, I don't know how many it is.
• 39:14
  It's, it's hundreds of different entities within their SAML
• 39:19
  federation. And it's the idea that.
• 39:21
  In controversy into the Federation.
• 39:24
  Edu. Edu.
• 39:25
  Is it Edu? Causes the organization, then
• 39:27
  they have in common. There's a few of them in that
• 39:31
  picture and the very fact that you can have a university in
• 39:36
  Bristol in the UK and the university in San Francisco
• 39:41
  being able to recognize the authentication of their
• 39:45
  appropriate, their individual students is mind numbing, right.
• 39:49
  And when when you consider that they are running completely
• 39:52
  different systems. And so the, the fact that it
• 39:55
  enabled us to transfer trust across organizations and at
• 39:59
  least trust part of what they were doing, even if it was just
• 40:03
  the authentication, right? You're right, I think it is.
• 40:08
  It was definitely one of those waterfall moments.
• 40:12
  Do you agree with that? SAML is the the biggest thing
• 40:15
  since sliced bread in the identity space?
• 40:16
  Is there something else that you think competes with that as far
• 40:19
  as, I don't know, the biggest impact that you've seen in the
• 40:22
  IM industry over your career? I would I would agree that
• 40:26
  probably I don't know if there's any one thing that's as big, but
• 40:31
  you know, LDAP is obviously one because it it's gone on for the
• 40:37
  20 years and a lot of things have been built on it.
• 40:40
  But SAML or the idea of federation between peers with a
• 40:48
  trust framework between them and SAML, that's what really what
• 40:51
  SAML was all about. I think that fundamentally
• 40:54
  changed identity from being silos into being a network.
• 40:59
  And, and it probably was one of the biggest thing that came into
• 41:03
  us. And the other one that I would
• 41:05
  sort of put into that is the the emergence of consumer identity
• 41:13
  from the perspective that it wasn't just something that
• 41:15
  protected workers or your employees, but but it was a way
• 41:20
  that you interacted with your customers and that that was a
• 41:23
  fundamental shift in change. But yeah, I would definitely put
• 41:27
  Samuel as to one of those really, really important
• 41:30
  milestones. Yeah.
• 41:33
  You know, you just bringing that up kind of gets me thinking
• 41:36
  about the whole idea of identity providers is like Facebook and
• 41:43
  Google. And I do think there's a large
• 41:45
  number of organizations that still trend towards that.
• 41:49
  But then there's the idea of like, we need to know who our
• 41:53
  customers are. So I think it for the
• 41:55
  convenience of authentication it's needed, but there still
• 42:00
  needs to be information that the identity really.
• 42:04
  And it's just like the the big story about identity access
• 42:07
  management. It's like people who were early
• 42:09
  on would talk about the importance of the identity,
• 42:12
  which really comes back to who's the human being who's
• 42:15
  interacting with us and having that information.
• 42:18
  That's the asset and. So I, I think it's, it's
• 42:24
  different for different use cases, right?
• 42:27
  A bank definitely needs to know who you are.
• 42:32
  Amazon simply needs to know that you've got a valid credit card
• 42:37
  and maybe a valid ship to address, you know, so, so
• 42:41
  different things, different places have different needs for
• 42:45
  how much they need to know or how little they need to know.
• 42:49
  And yeah, I think that that whole trust framework thing
• 42:52
  brings out into it. So I'm curious if there is an
• 42:59
  upcoming area of identity that you think is underrated, Like
• 43:05
  what's something that we should be paying attention to more that
• 43:08
  we just aren't as an industry? Right now, well, there's so many
• 43:15
  things that we're looking at, right?
• 43:16
  I think for me, the single overriding term would probably
• 43:21
  be privacy, but privacy specifically from the
• 43:25
  perspective that how do I trust the people that have the
• 43:31
  attributes about me? Yeah.
• 43:33
  And this is really what decentralized identity is, is
• 43:37
  sort of trying to address, but that's the reality.
• 43:40
  I had what was. Was blockchain absolutely right?
• 43:44
  Well, whether it's blockchain or decentralized or something,
• 43:47
  something like that, The, the challenge that you come in with,
• 43:50
  right, is that for, for, for 2000 years, we've known that
• 43:54
  information is power. And, you know, more information
• 44:00
  probably means more power. And so the more that you know
• 44:05
  about someone, the more you can either mess around with them or
• 44:09
  compromise them or whatever the case may be.
• 44:12
  And so the question that comes up to me is how do we know that
• 44:16
  the people who have access to that information are going to
• 44:20
  continue to wear white hats? And how do we stop black hats
• 44:25
  from being able to use that information in ways we don't
• 44:30
  want them to be able to use, right?
• 44:32
  And, and we've seen examples right in, in, I mean, even we,
• 44:37
  we take the, the, no matter how you look at the, the Ukrainian
• 44:42
  war, right? We've now got a situation where
• 44:45
  you've got a hostile political issue, a hostile military issue
• 44:49
  between 2 powers. The invading force knows if they
• 44:54
  get to your tax records, they know where all the money is.
• 44:57
  If they get to, you know, the, the, let's call it the social
• 45:02
  records, you know, births and deaths and things.
• 45:05
  They've got a whole lot of information about the people in
• 45:09
  your country that, that they can now leverage.
• 45:13
  And so how do we try and protect?
• 45:17
  Yeah. And, and this goes back, I think
• 45:19
  to to my very early software engineering days, right?
• 45:22
  It's, it's a case of when you testing software you never
• 45:26
  tested, it works, right? You test for all of the ways
• 45:29
  that it can go wrong. And so as we start looking at
• 45:33
  things like privacy, how do we protect when things go wrong?
• 45:40
  Right? The, the, the, and, and a
• 45:42
  perfect case came up for this about three years ago in
• 45:45
  Australia. I don't know if you remember it,
• 45:47
  but Australia was having the, the national census.
• 45:51
  It was an online census. Everybody was, you know, doing
• 45:53
  the normal census. And some genius came up with the
• 45:57
  idea that says we could use census information in order to
• 46:01
  track down deadbeat dads. Right Now, I'm not going to
• 46:06
  express an opinion one way or another about there'd be dads,
• 46:09
  but that's not a good way to get high participation in your
• 46:14
  senses if you're going to say, oh, and we're going to use it to
• 46:17
  beat you over the head, right? And that was a very innocuous
• 46:22
  thing. It wasn't malevolent in any way.
• 46:25
  It was simply, Oh, well, with this information, we can do
• 46:27
  that. I think that's something that,
• 46:31
  yes, people are aware of it, but I don't think we've had any
• 46:34
  really good ways to address it, You know, and, and every single
• 46:39
  one of us will, will pick up the phone and, and talk to a vendor
• 46:43
  and we'll give them our credit card number and the little
• 46:45
  secret code and the date and everything they need on it for,
• 46:49
  for where's it going? What's what's happening to that?
• 46:53
  Right? I think that's probably one that
• 46:55
  I that keeps me awake at night. What do you think is something
• 47:01
  that's overrated, that we are talking too much about what's
• 47:04
  being shoved down by our, you know, down our throats by the
• 47:07
  industry that is? I don't agree with that one.
• 47:12
  The, the, the thing for me is it's so easy, and this is
• 47:16
  probably not what you wanted to go with, but it's so easy to
• 47:19
  blame identity problems on the stupidity of the end user.
• 47:24
  And it's not, it's our job, it's the identity industry to make it
• 47:28
  so that it just works, right? You know, and I, and I compare
• 47:33
  this to like, say the automobile industry, right?
• 47:36
  They've made it to the point now where if you even try and open
• 47:40
  the hood of your car, somebody from the dealership comes and
• 47:42
  slaps your hand, right? And, and it, it, it just works.
• 47:47
  And, you know, invariably when we come in conferences and
• 47:51
  things people are talking about, well, we need to educate the end
• 47:54
  users to use better passwords. No, we've got to come up with a
• 47:58
  technology that they don't need to worry about that, right?
• 48:01
  Which should just work. And so that's sort of the the
• 48:05
  thing for me, it's that that education and to make our users
• 48:08
  more aware of the problems, that's our job.
• 48:12
  And we should know what the problems are.
• 48:13
  And we should come up with, as Jim was talking about earlier,
• 48:16
  in terms of these are the problems that we have to fix.
• 48:19
  Let's make those problems just go away.
• 48:22
  I don't know if that's quite where you want to go, but that's
• 48:24
  my little hobby horse. It's it's, it's the hill I'm
• 48:27
  standing on. So Alan, I've really been
• 48:32
  looking forward to asking you this next question because I've
• 48:36
  been thinking about this question for a long time.
• 48:39
  Kind of a a baseball nut, as Jeff told you earlier.
• 48:42
  And the one question is always like, who's on the baseball?
• 48:46
  Mount Rushmore? Like Babe Ruth and Jackie
• 48:48
  Robinson, but who else? I wonder who's on the IAM or
• 48:54
  identity? Mount Rushmore, which means four
• 48:58
  people. First of all, I want a much
• 49:01
  bigger mountain so we can get more people on.
• 49:05
  That's it. That's a really, wow, that's a
• 49:08
  tough question. That's.
• 49:09
  Called the Hall of Fame we have one we can have an IAM Hall of
• 49:13
  Fame. We'll have you back on another
• 49:14
  episode and. Go through the whole Hall of
• 49:17
  Fame. I think that there's there's a
• 49:21
  couple of folks on there that are that are pretty easy to
• 49:23
  identify. Obviously Kim Cameron would be
• 49:26
  one of those because he's had such a major impact.
• 49:29
  Like the George Washington right?
• 49:30
  Identity from, from day one, right?
• 49:32
  The, the seven laws of identity sort of defined our industry.
• 49:36
  And so, you know, Kim Cameron simply for what he's done and
• 49:41
  for the, for the, I think Victoria is another one in that
• 49:45
  Victoria Bertucci who is, is, has been, you know, talking
• 49:51
  around authorization or to and really trying to educate
• 49:56
  developers as to there's better ways to do this, right?
• 50:00
  He was passionate about that. As I think about the Mount
• 50:05
  Rushmore thing, the, the, the part for me is that I'm sort of
• 50:09
  standing back and I'm saying, OK, what qualifies someone to be
• 50:13
  up there? And the first thing is that for
• 50:16
  me, if, if that's their job, it sort of minimizes it a little
• 50:22
  bit for me, right. If, if they're doing it, because
• 50:24
  this is, I mean, they may be very good at being a leader and
• 50:28
  a speaker and a, and a organizer, whatever it might be.
• 50:31
  But if that's what they are paid to do, does that qualify them?
• 50:38
  Yes, it, it puts them on the list.
• 50:40
  I'm not sure that fully makes them, but there's, there's a
• 50:43
  there's a few people that I think are sort of thank they,
• 50:48
  they, they work behind the scenes.
• 50:49
  One of the people that I would go on that is Don Tebow, but I'm
• 50:53
  not even sure that many people on the call even recognize the
• 50:56
  name. But Don Tebow was the president
• 51:01
  and executive director of the Open ID founder, but I'm not
• 51:04
  sure if he was president. I know he was executive director
• 51:06
  of the Open ID Foundation and Don through the Open ID
• 51:11
  Foundation has been fundamentally dealing with
• 51:14
  things like the, the Fappy protocols and the Open ID
• 51:19
  Connect and all of these are worth 2, all of these standards.
• 51:24
  And it takes a lot of work to build standards and Don has done
• 51:28
  a lot of that stuff. Even though yes, his job was
• 51:31
  executive director, he was really, really passionate, still
• 51:36
  is really passionate about doing those things.
• 51:41
  Another one of the people that I think does belong up there,
• 51:45
  although he will probably tell me I'm I'm full of beings, is
• 51:49
  Andy Handel. Andy.
• 51:52
  Even so, Andy, for those of you that don't know him, Andy is the
• 51:56
  content curator of all of the content at the Identiverse
• 52:00
  conferences for it was announced this year.
• 52:04
  I think it's, it was it 15 years, something like that.
• 52:10
  And you know, yes, he's paid to do that, but that is not a job
• 52:14
  you get paid for. That is a job you do because you
• 52:16
  are absolutely passionate about it.
• 52:18
  And Andy I think has been, I would say single handedly, but
• 52:23
  there's a lot of people that work with him and volunteer with
• 52:25
  him. But he is responsible for making
• 52:28
  sure that the things we talk about at Ideniverse are relevant
• 52:32
  to our industry. And so I, I think he definitely
• 52:36
  qualifies for things like that. Another one of the people that I
• 52:42
  would put up there. And again, I'm, I'm totally
• 52:44
  ignoring your four people thing, but another one someone John
• 52:50
  Bradley is another name I would put into that.
• 52:53
  John, if you've been to a conference, he's the guy who has
• 52:58
  the ponytail in his beard and you probably recognize him if
• 53:02
  you see that. But John has been involved in
• 53:04
  almost every standard that we work with an identity since the
• 53:08
  SAML days. And you know, he was part of the
• 53:11
  SAML organization across at least three, probably 4
• 53:17
  different companies that he's worked for, which tells me that
• 53:21
  isn't he's not doing the job he's paid for.
• 53:23
  This is what he loves doing and he happens to find jobs that
• 53:27
  that support him being able to do that.
• 53:31
  So OK, I'll, I'll go to five. I'll sort of put those up there
• 53:34
  as being the, the people, I think who have had incredible
• 53:39
  influence. And you know, part of the
• 53:41
  problem is that there's another 20 on the list and they all
• 53:43
  going to come and phone me and say why didn't I get on your
• 53:45
  list? No, but what I would like to do
• 53:48
  is for our listeners, I'd like to offer, you know, Jeff, when
• 53:51
  Jeff puts out the post on this episode, add your list.
• 53:58
  If you've got a Mount Rushmore yourself or you want to make an
• 54:01
  argument for somebody, please do so.
• 54:07
  Alan, I would love to see that. A list of a few.
• 54:09
  I've got a list of a few more questions I wanted to ask.
• 54:12
  I'm going to ask them in the format of rapid fire, which
• 54:15
  means you have a minute and a half to two minutes maximum.
• 54:19
  So if you go over that, we just ask fewer questions.
• 54:22
  OK. Right.
• 54:23
  We want to. We don't want to overdo this,
• 54:26
  but so my first question was something I brought up earlier,
• 54:29
  which was, you know, around conferences.
• 54:33
  So it's actually a two-part question.
• 54:34
  What one, what was your first conference?
• 54:37
  And two, what was your favorite conference that you've attended?
• 54:41
  All time. So the first conference that I
• 54:45
  went to was actually a small little conference we used to
• 54:47
  call Mac Hack, and this was back in the late 80s.
• 54:51
  I was heavily involved in Mac development and it was a, a
• 54:56
  group of us took over a hotel and we started hacking on the
• 55:00
  Mac, right? It was essentially a, a
• 55:01
  glorified land party. In terms of the favorite, my
• 55:07
  favorite one to go to, That's a much harder one because, you
• 55:12
  know, I enjoy all of them. But the, the, the two that I
• 55:16
  never miss is EIC and identifiers, simply because
• 55:20
  those are the ones where not only do I, you know, see what's
• 55:25
  new in the industry and things like that, but I get to hang out
• 55:28
  with, with my peeps, right? These are where the, the, the
• 55:33
  people who do this stuff hang out.
• 55:36
  And so I enjoy the social aspects of both of those.
• 55:40
  My my first conference was Digital ID World circa O five O
• 55:44
  6. I think you might have been
• 55:47
  there. Possibly.
• 55:49
  Open my eyes to this identity industry and I was like, it's
• 55:54
  not just technology, but it's like philosophy.
• 55:58
  Like what is an identity? You know, like like mind blowing
• 56:03
  question, mind expanding stuff. And then you had Kim, Kim
• 56:07
  Cameron come on and talk about the laws of identity.
• 56:11
  And literally it was like it made so much sense.
• 56:13
  But like you can see the reverence from him for him in
• 56:17
  real time. I think it was like around the
• 56:20
  year where he was joining Microsoft.
• 56:23
  So it was like he was coming from his previous life into
• 56:26
  Microsoft. It was just like a really cool
• 56:30
  time, a really cool conference. Jeff, what was your first
• 56:33
  conference? You know, I was, I, I, I was
• 56:36
  hoping he wouldn't ask me because I'm trying to remember
• 56:39
  it was. Probably right?
• 56:41
  What's that? Weren't you at the first
• 56:43
  Identiverse? Well, like.
• 56:45
  Yes, but I think it was Cloud Identity conference or something
• 56:47
  like that at the time that cloud.
• 56:49
  Identity Summit. That cloud identity summit,
• 56:51
  yeah, that was probably one of the first I'd been to.
• 56:53
  So my background identity was really more heads down in
• 56:56
  enterprise doing, you know, real IM work.
• 56:59
  I wasn't a thinker, still not a thinker was doing provisioning
• 57:04
  of accounts, right. So my, my solar system, my
• 57:09
  universe of identity and access management was Walgreens and SC
• 57:13
  Johnson. That's what I knew because
• 57:15
  that's what I was doing. That's where I worked.
• 57:17
  I knew how accounts are provisioned.
• 57:19
  I knew how operations ran, I knew how technology worked,
• 57:21
  etcetera. And then I, when I got into
• 57:24
  consulting, that's when like everything just kind of blew up.
• 57:27
  You know, I was like, oh, wait, there's so much more to this,
• 57:29
  which is really why I wanted to do consulting was to learn more
• 57:32
  about it, right? So you know, the 1st ten of the
• 57:36
  20 plus years I've had in this was not even in this industry of
• 57:41
  IAM, as we'll call it, it was doing identity work like that
• 57:44
  was my thing. So I really didn't attend
• 57:46
  conferences until 2016, I guess. And now you know, I I try to hit
• 57:52
  every identity. I think I've been to every Cloud
• 57:54
  identity summit slash identity since then, but.
• 57:58
  It's pretty cool though. Yeah, I mean, I I enjoy going to
• 58:01
  conferences mostly because like Alan, I get to talk to people
• 58:04
  and meet new people and my historic being a wallflower and
• 58:09
  and not really being that outgoing despite the, you know,
• 58:12
  obvious charm that I exhume on this podcast doesn't manifest
• 58:17
  itself typically in the real world.
• 58:18
  So I've kind of gotten out of that shell a little bit and, you
• 58:21
  know, meeting people and being more open to, you know, shaking
• 58:25
  hands and kissing babies, right, and all that good stuff.
• 58:27
  So every, every conference I go to has been better than the
• 58:32
  last. But I especially, I particularly
• 58:34
  enjoy the Identiverse conference and the authenticate
• 58:36
  conferences. For whatever reason, the vibe at
• 58:39
  the the at those just seem very welcoming and appealing.
• 58:45
  So much for the rapid fire succession.
• 58:48
  The next question, though, was for Alan.
• 58:51
  So what is Alan's future hold? You're in retirement now for
• 58:55
  officially, but you're still doing things.
• 58:59
  So the I, I answered this one a lot at, at both EIC and
• 59:04
  Identiverse, people would come to me.
• 59:06
  What are you doing here? I thought you were retired.
• 59:08
  And, you know, for me, retirement simply means I
• 59:11
  stopped doing the things I had to do and could not concentrate
• 59:14
  on the things that I want to do and, and the conferences I want
• 59:18
  to do because that's where I get to meet all the cool kids,
• 59:20
  right? And, and where we hang out.
• 59:22
  But what's in it for me now? Well, I've just, I, I enjoy
• 59:27
  sailing. So this is actually about 3
• 59:29
  weeks ago, I got my Blue Ocean passage maker certification from
• 59:34
  ASA. So that was, we sailed from
• 59:37
  Bermuda to New York, which was a, a really fun sail.
• 59:42
  And I'm working on my instrument pilot's license.
• 59:46
  I have a, one of my, my side hobbies is, well, I, I guess I
• 59:53
  bought a, my wife and I went down to Argentina last year and
• 59:58
  ended up buying a small farm in Argentina, which has a great
• 1:00:03
  find on it. And so now I'm signed up at UC
• 1:00:07
  Davis doing a wine makers course.
• 1:00:11
  So I'm busier now than I ever was.
• 1:00:15
  And you know, I love, I love just learning about things,
• 1:00:18
  doing new things, working out how things work.
• 1:00:21
  And I've I've enjoyed the drinking side of wine, so I
• 1:00:25
  thought I may as well go and see how it gets made.
• 1:00:27
  And. Save so much money if you make
• 1:00:30
  your own. So that's some of the things
• 1:00:36
  last. Question for you, Alan.
• 1:00:39
  It's kind of a deep, deep thought question, but what is
• 1:00:42
  your identity and access management legacy going to be?
• 1:00:49
  Wow. The, the, I don't know that it's
• 1:00:57
  specifically to identity or to IAM and things like that, but I
• 1:01:02
  think the legacy that that I would like to be remembered for
• 1:01:07
  is in encouraging people to ask why.
• 1:01:16
  It's, it's, it's one thing to be able to know how to do
• 1:01:20
  something, but to be able to ask why are we doing it that way?
• 1:01:24
  Why does it work that way? Why, why is it not working,
• 1:01:28
  etcetera, means that we can open up is, and you sort of mentioned
• 1:01:32
  this at the very beginning of the podcast where it, it gives
• 1:01:35
  you their creativity to look at a problem, to troubleshoot it
• 1:01:38
  and to ask why. And I've always tried to get
• 1:01:43
  people to sort of think, whether it's thinking outside of the box
• 1:01:46
  or thinking about what's going wrong.
• 1:01:50
  I've never been a fan of the, well, reboot it and see if it
• 1:01:53
  goes away model that. That's never, for me, a good
• 1:01:57
  solution. So that's probably where I'd
• 1:02:00
  like to be remembered. So I'm going to, I'm going to
• 1:02:04
  try to add some levity to it. Kind of a morbid question, but
• 1:02:07
  would your would your tombstone just say why on it?
• 1:02:11
  Why you had to know Alan to know why that was there.
• 1:02:20
  All right, why don't we go ahead?
• 1:02:21
  Because I, I have an, I have a little bit of a trivia question
• 1:02:24
  for Jim. What do Charlie's Charlize
• 1:02:28
  Theron, Elon Musk and Alan Foster all have in common?
• 1:02:32
  See if you can figure this out. Well, what do they have in
• 1:02:36
  common? Alan.
• 1:02:39
  Well, I'm not as good looking as Charlize Theron, but a, we're
• 1:02:44
  actually all South Africans, or at least we were all born in
• 1:02:47
  South Africa. But more importantly, we were
• 1:02:49
  all born within 30 miles of each other and, and probably within a
• 1:02:54
  couple of years of each other. I don't know quite how that
• 1:02:56
  works out, but yeah, we, we were all born within about half an
• 1:03:01
  hour's drive from, from each other.
• 1:03:04
  That's my my little bit of trivia, my little brush with
• 1:03:07
  greatness. Does that give us like a, is
• 1:03:10
  there like a, a Six degrees of Kevin Bacon?
• 1:03:12
  Can we do like a a three degrees of Alan Foster somehow?
• 1:03:15
  And, well, 1° from Alan Foster is Elon Musk, so there's that
• 1:03:18
  one sitting there, so. So I've never been to South
• 1:03:22
  Africa. I know very little.
• 1:03:23
  I don't think we've ever had anyone on the show from South
• 1:03:26
  Africa. What is something that I should
• 1:03:29
  know as someone who knows only? That.
• 1:03:32
  Those people were born there and Trevor Noah, that's about it.
• 1:03:35
  And, and Trevor Noah, yeah, I mean, as, as a country, it is a,
• 1:03:42
  it is a fascinating country, right?
• 1:03:44
  It's a very beautiful country. And if you get an opportunity to
• 1:03:47
  visit, it's well worth taking the visit.
• 1:03:49
  I mean, the, a country that goes from heavy tropical banana trees
• 1:03:57
  and, and to high deserts to sugar cane and swamplands.
• 1:04:02
  You know, it's all there and, and you know, as a visit it,
• 1:04:08
  it's, it has had an awful lot of impact across the world, right.
• 1:04:13
  You run into people who were originally from South Africa,
• 1:04:16
  They, they came from there. And, and so that's where we grew
• 1:04:20
  up originally as a British colony.
• 1:04:22
  Can't we can't blame us for that.
• 1:04:24
  But the and interestingly, South Africa and the US have a very
• 1:04:30
  parallel history in terms of time frames.
• 1:04:33
  When when the Pilgrims came to the US was about the same time
• 1:04:36
  that the Dutch colonized South Africa and and there's some
• 1:04:40
  being repeated history events. So, Alan, one question I had is,
• 1:04:45
  you know, American shrink coffee, Brit's drink tea, What
• 1:04:49
  is South Africa's shrink? Mainly coffee.
• 1:04:53
  The, the, we were definitely a coffee family or it's sort of on
• 1:04:57
  both sides. There's tea and coffee, right?
• 1:05:00
  But we were definitely a coffee, coffee family and, and most
• 1:05:04
  everybody I had drank coffee down there.
• 1:05:08
  And then of course. What is your coffee consumption
• 1:05:11
  like? I mean, do you start your day
• 1:05:12
  with a coffee? Do you drink it all the way to
• 1:05:14
  you go to bed? How much coffee is is the right
• 1:05:17
  amount for you. So I, I normally go through six
• 1:05:21
  or seven cups a day. So I, I start my day with, I
• 1:05:24
  mean, this is my, my, my Ford rock cup.
• 1:05:29
  And that's my, my start, my starting cup of coffee.
• 1:05:33
  And I normally have my last one sort of just before I open up a
• 1:05:39
  bottle of wine to go with dinner.
• 1:05:41
  So you know about 5:00 is sort of the last coffee.
• 1:05:44
  OK. So now let me ask you one final
• 1:05:47
  question. If I wrap things up, you're
• 1:05:49
  flying back to South Africa and you're landing.
• 1:05:53
  What's the first food thing that you go for in South Africa?
• 1:05:57
  Is there like a go to place or meal or something that you're
• 1:06:01
  like for me, like I go back to Chicago and it's like I got to
• 1:06:04
  go to Portillo's and get a hot dog.
• 1:06:07
  For you going to South Africa, where are you?
• 1:06:09
  Where are you headed to right after the airport to get
• 1:06:11
  somebody? So we we have a a social event
• 1:06:14
  which is called a bra and a bra is about as close as a BBQ.
• 1:06:18
  It's basically a fire and grilled meat.
• 1:06:21
  And that is how we live like every weekend.
• 1:06:25
  And so the idea having that and all the compliments that go
• 1:06:30
  along with a bride, obviously there's a beer or two or three
• 1:06:34
  that go along with that. But yeah, that outdoor, that
• 1:06:36
  outdoor BBQ, that outdoor grill is, is sort of the standard.
• 1:06:41
  That's that's home. I'm sold.
• 1:06:45
  I can get behind that. All right, why don't we go ahead
• 1:06:48
  and wrap it up for this week? Alan, thank you so much for
• 1:06:51
  taking the time with us. This, this stroll down I am
• 1:06:54
  memory lane. I don't know, still working on a
• 1:06:56
  title in my head here, but it's been really eye opening.
• 1:06:59
  It's, it's, it's always fascinating for me to hear the
• 1:07:01
  stories behind the things right, from the people who are sort of
• 1:07:03
  in the room or at the pub or wherever things kind of started
• 1:07:08
  right, or, or whatever it may be.
• 1:07:09
  So, and now you're part of the Digital Identity Advancement
• 1:07:12
  Foundation and you've done work with ID Pro.
• 1:07:14
  We want to make sure we get plugs out for them.
• 1:07:16
  ID pro.org, fantastic organization, we're all part of
• 1:07:19
  that. The Slack channel, definitely
• 1:07:21
  worth its money just just for that alone.
• 1:07:24
  For the conversation standpoint, DIAF dot link, that's the the
• 1:07:29
  link for the Digital Identity Investment Foundation.
• 1:07:31
  So for folks who are newer to identity, there's ways there
• 1:07:35
  that people who are in the space or anyone really can kind of
• 1:07:38
  support make sure that we have the next generation coming
• 1:07:40
  through. So I'll have links in our show
• 1:07:43
  notes for that kind of stuff that people hopefully will go
• 1:07:45
  check out. Let's see what else.
• 1:07:47
  We're on the web, idacpodcast.com.
• 1:07:49
  We're on X Twitter, whatever it's called by the time your
• 1:07:52
  your face or ears consume this at IDAC podcast, we're on
• 1:07:57
  YouTube. If you're not watching us on
• 1:07:58
  YouTube, do us a favor, go over and like and subscribe.
• 1:08:01
  We're trying to grow to the YouTube channel.
• 1:08:03
  Make it super easyidacpodcast.tvsoidacpodcast.tv
• 1:08:08
  will take you right to our YouTube channel and would
• 1:08:12
  appreciate a, a subscribe and A and a like on a video.
• 1:08:16
  Let's see what else Connect with us on LinkedIn.
• 1:08:18
  I'll have Alan's LinkedIn connection information in our
• 1:08:21
  show notes so you can either share stories about Bry's or
• 1:08:26
  coffee consumption. Wine.
• 1:08:28
  My wife is very into wine, so she'll be very much tuning into
• 1:08:32
  that conversation. And anything else, Jim, that I
• 1:08:35
  forget or are we good to go? No, you mentioned everything.
• 1:08:38
  I did want to just thank Ellen, not only for being on the show,
• 1:08:42
  but just all the contributions you're making and people like
• 1:08:45
  you have made over the years. I mean, it's made things a lot
• 1:08:49
  easier for the practitioners today.
• 1:08:53
  And I think what you're doing with DIAF is, you know, really
• 1:08:59
  important. It's about the next generation
• 1:09:02
  of identity people. And we all have that
• 1:09:05
  responsibility. Pass it on, you know, pay it
• 1:09:07
  forward however you want to. You want to refer to it.
• 1:09:11
  I think we've all received and we should all make sure that we
• 1:09:16
  give back. Great way to end it.
• 1:09:19
  So we'll leave it there. Thanks everyone for watching or
• 1:09:22
  listening. Thanks, Alan.
• 1:09:24
  Thanks, Jim. And we'll talk to everyone in
• 1:09:26
  the next one. You've been listening to
• 1:09:30
  Identity at the center. We hope you've enjoyed the show.
• 1:09:34
  Make sure to like, rate and review, and we'll be back soon.
• 1:09:38
  But in the meantime, hit the website at
• 1:09:40
  identity@thecenter.com. See you next time on Identity at
• 1:09:47
  the Center.