I wonder who's on the IAM or identity? Mount Rushmore, which means four people. First of all, I want a much bigger mountain so we can get more people on. That's a that's a really, wow, that's a tough question. That's. Called the Hall of Fame we have we can have an IAM Hall of Fame we'll have you back on another episode and. Go through the whole Hall of Fame. I think that there's there's a couple of folks on there that are that are pretty easy to identify.
Obviously Kim Cameron would be one of those because he's had such a major impact. It's like the George Washington, right? Identity from from day one, right? The the seven laws of identity sort of defined our industry. And so you know, Kim Cameron simply for what he's done and for the for the I think Victoria is another one in that Victoria Bertucci. This is identity at the center. If it has anything to do with IAM. This is the go to podcast now your hosts Jim McDonald and Jeff Stedman.
Welcome to the Identity at the Center podcast. I'm Jeff, and that's Jim. Hey, Jim. Hey, Jeff, how are you? Oh, not so bad yourself. Great, doing great. Actually, you know, the last couple days have been really busy for me and just got a lot of project work, but it's better than Friday. And I, I can't say I had the worst day Friday, but I woke up to the blue screen of death and spent like four or five hours trying to figure it out and try to conduct business from a
mobile phone. But no longer in the kind of like the desktop support phase of my career. I guess everybody's probably figured out by now that I'm talking about that that crowd strike outage that hit not every Windows computer, but it did hit mine 8 1/2. Million is I think, the last count I saw around the world. Yeah, yeah, no doubt. I mean, that's a big number. I mean, I'm talking about there were certain organizations where 10s of thousands of computers were affected.
That's a big deal, right? So those somebody had to go around and like touch computers. And I don't think it was the kind of issue where you could remote control into computers. So you had to have like a physical presence. So I'm sure there are a lot of IT managers out there who were, you know, dealing with that and had a a really rough morning. I tried to not go on social media and like, you know, get too involved because I'm not a Windows person.
But what I do want to offer now to anybody is like, if they are thinking about the long term strategy and how something like this effects their identity program, I'd be very much open to being somebody who is a resource, you know, because I, I think about a crowd strike. I even think back to like solar
winds. And a lot of times we say, all right, well, if there's a legitimate use for an account and the account is OK, right, We also look at it and make sure that it's got the right level of privileges, etcetera. But there are certain situations where you have very powerful accounts in the environment. They have a legitimate reason to exist, but I think a very important part of risk management is knowing what your risks are.
And if you don't have kind of the inventory of risks, then it's hard to manage what you what you can't even measure. Yeah, I mean, you got crowd struck. I got crowd struck. A whole bunch of people got crowd struck. I'm not going to bash anything. I mean, think these things happen, right?
Piece of software softwares are defined by humans and mistakes that we made and it's unfortunate had a wide-ranging impact but for the most part, I think most folks hopefully are back to normal at this point about a week later or so. I'm just glad I wasn't flying on Friday. I actually flew back from South America on Thursday before this happened and that was already a challenge just for for weather
delays. I can't imagine trying to fly back on Friday, you know, after a week in in Bogota and then having to deal with airport delays and stuff like that. So I'm just happy with that. Delta is apparently still recovering. If you're, you know, kicked on the 4th wall. Today is Wednesday. What is Wednesday 24th? So we're just about almost a week from when things happened. And Delta has said that they should be back to normal tomorrow.
But it seems like they have struggled more than most for the airlines to get back up to speed. So I don't know. As long as you're people crumbling as. Long as my flight to New York City tomorrow is on time, I don't care. Yeah, I, I mean, that's, you know, and that's not just being selfish. I mean, you've sat through your fair share of delays. It's it's part of being a road
warrior. If you're going to be a road warrior, you're going to spend some nights in some airport hotels, bottom line, or airports, Yeah. And you're going to have your fair share of turbulence and all
that. But you know, specific to today's episode, what has me excited is like, and the analogy that I was thinking kind of tied to this was, you know, how in we all have our hobbies and these days, like within our hobbies, we've got all the social media and YouTube and people who aren't really celebrities per SE, they become celebrities in your world. But going back kind of like when I first got started in this industry, our guest today was already a celebrity within that industry.
So, you know, he's like one of the people that I looked up to and there's there's several people who kind of fit that bill. But I'm really excited about having him on our show now. So I think it's pretty cool. Yeah. Why don't we take care of a little bit of business and talk about our conference partnerships before we get to Alan? The first up is Identity Week. We've got Identity Week America taking place September 11th, the 12th. Jim, you and I are going to be there.
Actually had a call this morning with the team there just to make sure everything is all set and good to go. Good news, we're going to have power wherever it is we are so we can record podcasts from. I'll be hosting a panel, so that should be up on the agenda now in the first day. So things are starting together, you know, starting to come together for that. But we got a discount code for all of our listeners. And if you're not a listener and you somehow get this code, enjoy.
Ida C30 gets you 30% off of your registration. So you can use that code for both the America conference as well as the one taking place in Asia and Singapore, October 22nd, 23rd. So if you're going to either of those conferences, you can use that code. Ida C30 get 30% off. Good way to show support for the show. Does it cost you anything? Just show support that says, hey, you know, you heard you heard about the conference through the podcast here, so.
If you're not a listener and you use that code though, you owe us like 3 listens and a like on YouTube. Yeah, that would be nice. At least give a like or a subscribe or something just to just to help us out. That would be super. The other conference we have is the authenticate conference. You and I are looking for that as well. That is in October the 14th, the 16th in Carlsbad, CA on a very nice resort, the Omni Acosta or
something like that. Anyway, it's nice golf, California weather, October generally pretty much perfect. So looking forward to that. We've got a discount code for that one as well, ID AC15. That gets you 15% off of your registration. So you and I are going to be there. We're going to be doing something, not sure you're what yet, but doing our normal, probably conference podcast things and maybe even something on stage. We'll see.
Still working that one out, but that's going to be a lot of fun. Anything else, Jim, before we get things going here today? No, I'm thinking that's going to be a good, a good question for our guest today is around conferences because I think he's done his fair share of conferences so. Well, the last time we talked to him, we were at a conference. We were at Identiver. So why don't we go ahead and get to it? He's part of the executive team for the Digital Identity Advancement Foundation.
DIF Emeritus board member for ID Pro, which you and I are both members of, one of the founders of Forge Rock. Now he's enjoying this retiree life, which is awesome. Welcome back to the show, Alan Foster. Thank you. Thank you very much. You. You make me almost jealous for what I'm actually. Living well, thanks for carving out some time for us. I, you know, I think this is an opportunity for us to kind of maybe I, I, you know, we were kind of talking. It's like, what are we, what are
we going to call the show? Like, what is the theme for this? It's we're kind of thinking it's like, well, it's like a walk down identity lane, the Alan Foster version or something like that. But I'm sure it will name itself as they go along. But let's not get too far because you've been in the space for a long time. You know, Jim alluded to it. Tell us about your identity journey. How did you get into the world of identity management? Is it something that you chose or did it choose you?
It pretty much chose me, right? So I mean, to give you the, the quick rundown of where I came into it, late 80s, early 90s, I was the prototypical software engineer feed pizza under the door, writing code, right? I was working, I was working a lot with Apple at the time and my world was back end of the compilers, low level machine debuggers. I mean, I was right down there next to the chip.
The, the I ultimately at Apple got involved in training because I found I was lucky enough to have both a good solid, deep technical understanding of what we were doing as well as had a way of being able to explain that to people and, and draw diagrams on a white board and things like that. So I got involved doing a fair bit of training and then sort of we Fast forward, I did some stuff with Apple and next and
various things like that. But we Fast forward a few years to about 95, and this little upstart company called Netscape ended up giving me a call and said, you used to do some training for Apple, we've got some training work to do. Would you be interested in coming to see us?
And I went to see them, and it turned out that most of the people that I'd worked with in the training group at Apple were now at Netscape. And so for those of us who remember the good old Netscape browser, there was actually more to Netscape than just the browser, right? There were actually three parts to it. The one was the browser. The one was netscape.net, to which everybody had an e-mail address. It was the portal. And the third part was this
server products. And they had this little product called LDAP. It was the Netscape Directory Server. And Needless to say over the next few years, my story was use the Netscape directory server. It's going to solve all of our identity problems from this point forward. Well, Fast forward 30 years, we're still sort of trying to say that. So I, I was with Netscape working in their servers, net,
the e-commerce products. And then we Fast forward again into about 2000 when there was this really strange acquisition where Sun Microsystems and AOL both kind of bought part of Netscape and and consumed it. I followed the Sun path on that because Sun basically wanted to get to all of the server products. Netscape had the directory server, they had mail server, lot of things like that they
also had. And as we started moving into Sun, they were starting to work on products like what was originally called the Identity server and the portal server. These were for, you know, companies to build these products. And that's where I got involved. So I spent the next 10 years in the Sun ecosystem working with Identity, which eventually became access manager.
Fast forward again, we have another really strange acquisition at the end of the, the, the about 2009 when Oracle and Sun had a little steel cage match and Sun didn't work out as well. And so right at that point is when a few of us at, I think it was a bar in London. We're talking about what's going to happen to the open source identity stuff that Sun has. Oracle wasn't known for being a major proponent of open source stuff. And they had sort of said they had their stack, they didn't
want anything. And that was the beginning of Fortruck. And so we founded Forge Rock with sort of this idea that we could take the Sun products and continue those on since we've been working on them for 10 years, right And there. So that little band of merry men in a pub ended up founding Forge Rock. Fast forward again, we end up into 2021, we went public on the New York Stock Exchange, which was a wonderful journey and a, and a, and a very interesting journey.
The, the entire process. I'm sure we'll talk about it a little later. And so at the end of 21, I sort of realized that my part of that journey was, was done and it's time to do other things. And so I retired from Fort Rocket at the end of 21 December 31st in 21. So that's the the sort of quick rundown of of the time that I've been through, all of which were really interesting times. Only a couple notable things happened during that time.
Just a handful of things. I'm curious what you mentioned you were kind of on the software side and then all of a sudden, maybe not even a solid, maybe it was a gradual shift, but that that move from software to identity, was that a conscious shift? Was it something that just kind of occurred naturally or like did you realize you were an identity all of a sudden and wake up?
I was like, oh, I've been, I've been doing this longer than I thought I have or was like, yes, I I want to move into this space. It, it mainly I woke up and discovered I was there, right? I mean, it, it was sort of a, a general movement if you think about it back in the mid 90s, we were still talking about Jeff Bezos being a guy who was in his garage selling books on the Internet, right? That that's sort of what Amazon was.
And so we were really trying to find out what the Internet was capable of, what we were doing with it and things like that, and began to realize that the firewall was no longer going to be the thing which protects our network. And that was sort of the beginning of the point of saying, OK, people are coming in from outside from, you know, the we're connecting things up. And so having some way of knowing who's who became a really interesting technical problem. And so that was sort of the
space. It was actually because, and I, and I keep saying this throughout the entire time I've been an identity, identity in itself is not particularly interesting. It's only interesting because of what it enables, right? The, the, the fact is nobody goes to work saying today I'm going to log in, you know, that that's, that's not a thing, but we have to do that because it enables everything else. And so I got involved and it was about, well, how do we distribute data with the portal?
How do we manage messages? How do we provide access control to calendars, right? It was that kind of stuff. And every time I turned around identity or being able to determine who we were dealing with became the problem Dujour. And and that's sort of how I got into it was really a case of how do we enable all these other things to happen, if that makes sense. Alan, you, you've, I always knew
you from Forge Rock, right? I got involved with Forge Rock in the pretty early days, as well as like a system integrate on the system integrator side. But you've also kind of always been involved with a lot of the industry groups like Liberty Alliance, Kentara. Now you're heavily involved with the Digital Identity Advancement Foundation. Is it DIAF or DIAF? And either one works. DIAF is probably easier to say. Yeah. OK. So DIAF.
So can you tell us a little bit about DIAF, like what's the mission and how are you guys going about it? So the Dayaf that that's actually one that's that's near and dear to my heart that Ian Glaser and Aaron and myself are
are working on that. It came about two or three years ago when Kim Cameron, who is a legend in in the identity space, when he passed away, the Open ID Foundation started an award basically to memorialize him, but also to try and encourage new people to get involved in the industry that all of us have spent a lot of time working in, which they did. And so the first year they actually ran the Kim Cameron Award and almost from day one, they realized that this was not
specifically within their remit. This was not what, what they were doing, You know, they, they were standards body and they work on standards and, and managing that award. It, it seemed like a good incubator, but wasn't really a
place. And so after about a year, the Open ID Foundation came to Ian and myself and, and said, would you guys be interested in putting an organization specifically to manage these awards and fostering new people, enabling people who otherwise wouldn't be able to come to the conferences or these events? And, and, you know, building on, as I think one of Ian's talks, building onto the shoulders of
giants. And so we started off with the Kim Cameron Award. And then for the, the, I'm sure many people remember it was last year when we lost Victoria Bertucci. And that seemed like a, another person who was passionate about enabling people, teaching people, bringing new people in. And it seemed to just fit in onto the mission. And so the, the mission, although Dayaf has started off as, as sort of honoring these people, the goal is sort of bigger than that.
The goal is how do we enable people who are starting off in their careers, people to come into what we are doing, to Start learning about digital identity and carrying on all of the work that we have to do. And that's sort of really why we founded it and put the focus specifically on that. And we did a show with with you guys back around Idaniverse time where we had winners of an award to be able to come and. Attend the Kim Cameron Award. Yeah, the.
Kim Cameron Award So I would definitely, you know, point people back. You can go back and listen to that episode. It was a lot of fun. It was, I think I think that was our biggest show ever, meaning most amount of people on at once. So definitely a lively conversation. We had some, you know, some great folks who are new to identity. Really sharing their perspective on it. I want to we have like, I feel
like there's so much to cover. So I want to keep things moving because I want to ask about Fordrock. I guess take us through the history of Fordrock because it sounds like all great ideas. It was born in a pub over what I'm assuming were a few a few pints of how. This would work. Take us through Take us through Fordrock. So the, the, the team that sort of started up Fordrock had known each other for a few years
before that. We'd all been involved in one form or another within the Sun consulting work, right? We'd, we'd all been working on the products. And so, as I said, when when Oracle bought Sun, we decided to put that together initially with the idea of saying, well, can we start a company that lets us keep doing what we're enjoying doing and, you know, pay the bills for the next few years?
The, the, the trajectory that it went on was sort of the stuff that fairy tales are made of it. It wasn't the plan, right? The plan was just to build a company that we would enjoy working at. And so we officially started it on February 1st. Interesting story on this January 31st of 2010 was the day that Sun was delisted off of the New York Stock Exchange. It's the day that Java died. And so February 1st at 12 O1 is when we officially established 4 truck. That was the the transition time
for us to do that. And so starting off we had about 15 people. There were, there was five or six of us originally, which very quickly led to, you know, the, the, the small group of us who were involved and about 15 folks. And we started working on the Sun access Manager, which at that point was open source.
We were very lucky on that in as much as that the Sun engineering team had done all of the work necessary to get up to a release and were weeks away, possibly even days away from making a release. I believe. I'm probably wrong on this, but I believe it was AM 9 at the time. And so we were lucky enough to be able to take the open source repository, package it and release the the update. And we've been working on that and going in through with that and supporting the folks who had
bought into it right there. There was a lot of Sun customers at the time and working with them. And so you know, a lot of hard work from a lot of people ended up taking us to about 2012 when we decided to take our first round of funding. Everything up until that we had sort of done ourselves. We took our first round of
funding. We then I believe it was 2012, it may have been early 2013 is when John Fernandez who was our Chief Financial Officer came in. And I very clearly remember him at A at a company meeting where he said to us, I strongly believe that if you behave like a public company pretty soon you
are one. And that was the the journey he basically would say throughout the entire time and took us up 2014 or so, a small group of us, myself, Joni Brennan from the DIAC, Ian Grazer from Salesforce and one or two other folks that were, were part of that actually came up with sort of looking at consumer identity. It wasn't a thing at that point, right? All identity was workforce. And so we started bringing up consumer identity. It caught on and we were able to sort of step into that space
quite well from a company. By then, I'm guessing we were probably at, at maybe, I don't know, a hundred, 125 people. I founded the, the, the development office in Portland, OR we had one in Bristol. We moved on through all of that and we then started doing all of the things that happened when a company grows, right. We, we got a new CEO in the Lasso, who was our founding CEO moved into the CTO role.
The, the, when we started it, we were actually focused largely on European business and they were two of us in the US, John and myself were we were being opportunistic about U.S. business. By the time we got to 2014, we were very strongly entrenched in the US and the CEO at the time came to me and they said we'd like to expand into Asia. How would you like to move to Singapore for a while?
And so I up and moved to Singapore and helped establish the Singapore region and our offices down in Sydney and Singapore and then came back in it, it, it wasn't an immediate comeback into COVID, but about five years later, we hit COVID and, and it just, you know, we were in the right place at the right time and, and working with a lot of these things. And so that's sort of the past that it came to from a personal
perspective. I did definitely realize that the bigger the company gets, the less interested I am in really being wanting to work the even though I love the people, I love the culture, I loved everything we did about it. I realized that I was much more suited for a small start up rather than, you know, a big company. And, and I think that happens when when you're at a company that grows like that, you get to a point where you say, I'm glad of the success, but it's not where I want to be.
There's a policy for everything. Oh. Oh, yes, yes. You know, you, you say there's a policy. Our very first policy when we were sitting around the dining room table was we have a no policy policy. And so the, the policy that we had was do the right thing. And then slowly watching over the years as we started getting a travel policy and expense policy, a this policy and a that policy, yeah.
Yeah, Yeah, I've been as a start of companies where you kind of go through that and I was, I was actually the question that I was going to ask you about. I also wanted to just state like I, I guess I discovered open AM pretty far into the journey of the way you tell it, which was that a large university they're running open AM and they were asking me, should we get support from Fordrock. I'm like, I didn't know about open AM before and I don't I've never heard of Fordrock.
So I started to do some research and I was like, wow, this is the best thing since sliced bread because I had been working with like Oracle access manager and CA site minder for, you know, a good part of my career. And they probably would argue that, you know, they, they invented customer identity and access management. But you guys shifted that whole
landscape so much. And people who weren't there at the time don't realize that how much of the shift it was in the access management space, just the introduction of of Forge Rock into that competition between Oracle CA and IBM. Yeah, I mean, it was fascinating to watch and you know, although I'd love to take the credit for it, it it, it was a, it was a perfect storm of things coming together.
The, the, the reality about it is prior to about 2013, if you were a public facing application, you were a web page and you had a My Sequel database behind you and you had a username and password. And that was sort of it, right? The thing which really changed in about 2013 was the idea that you were logging in and there were multiple systems behind that login page that not only staff, but customers we're now
accessing. And then this sort of other piece that came in on the side was the API economy, right? AP is brought in. This whole thing that said, not only are we just providing a web page on to something, submitting a form, we're giving people access to our AP is and we got the mobile phone thing coming up, right?
The smartphones. You know, let's face it, it wasn't that long ago you were talking in, in the introduction about Delta Airlines. It wasn't that long ago that the only way to get a seat assignment was to phone and speak to someone. And this was 20/10/2020 O 8, right? That you phoned and spoke to someone. Now, while you're sitting at the gate, you can sit on your phone and you can change seats to find one with no one sitting next to you or something like that.
That could do it in the sky, sitting in sitting in the airplane. I've never tried, I've never tried that. I, I, I think there's always a Monty Python sketch about that, right? Everybody moving around the plane. But yeah, right. You've got immediate access and I think that really highlighted the the deficiencies that we had in customer identity and customers didn't have access. Customers lined up behind the big wooden desk. You know that that's, that's how customers were.
So there was that big shift in that which I think enabled a lot of the consumer technology and the the consumer adoption that that drove into that and we were lucky enough to be in the right place at the right time. So here's a little fun fact for folks. A lot of people ask Jim How I Met Jim, and we kind of met each other. And I think I've told the story. It's like, you know, the first thing Jim ever said to me was do you like baseball?
And I said no, not really. And then he just kind of walked away from me. So, so hey, guy. Well, nice to meet you, Jim. But that's not the first time that I was actually introduced to Jim. It was a YouTube video that Jim did. I think it was open DJ or open AM. It was a four draw. It was a time machine, I think is what was called Jim. Jim, you can explain better than
I can. But you had done a a video of it and I was doing research as I interviewed, was about to interview with this company called Identity, which is eventually where Jim and I met. And that was actually my first exposure to both Forge Rock and to Jim McDonald. So there was a tie. Out there, the stuff is still out there. It was, you know, recorded 10
years ago. So if you go to the Identity YouTube channel, of course this is when you're out there watching Identity of the Center and you need a break because you've watched so many episodes in a row. You go out and search up Identity and there's a ton of four DRAC videos out there. So we had a great team, really did and a. Lot of a lot of the folks who were doing that really enjoyed doing it, right? They were doing it not because it was their job.
They were doing it not because they were trying to sell product. They were doing because they just want to tell people how cool this was. It was cool, it was fun. And what I thought was so cool about it was you could go in there and take a problem and it was a new problem that required a, a novel solution. And then you could take the, the four draw components and put them together and solve that problem.
I, I think very much today we're at, we're in that mode where it's like, OK, what's the best practice or what's the leading practice? We'll just do that and it takes some of the excitement out for me because it's like, that's my creative juices. My creative drive is to take a problem and draw it out on the whiteboard and figure out a solution, and that's what I love so much. I think about working with Forge Rock was that it kind of gave that opportunity. You mentioned Joni Brennan a
couple of times. We've had her on the podcast recently, actually. Big Thinker talked about DIAC talked about Liberty Alliance. I didn't realize that we should have hit her up about Kantara. So maybe you can give us a couple minutes on the the mission of Kantara and kind of what your role was in that organization? Wow, that takes us back a little ways. So the yes, Joni, Joni and I go back a long way.
In order to tell that story, we actually have to talk a little bit about Liberty Alliance, right. So the Liberty Alliance was back in about let's say 2005 and a few years after that big industry wide, there were 160 companies ultimately that were working in Liberty Alliance partially in response to and it's they came out at the same
time. So I'm not going to say it was in response to, but early on in the 2000s, Microsoft came out with a technology called Passport and it was essentially single sign on to all everything you, you, you had. And the, the response from the industry was to look at that and said, you know, I'm not giving up my login experience. I'm not giving up my identification of customers to Microsoft. That's, you know, I'm, I want to
keep that. And so they founded Liberty Alliance. Son was one of those members. There was a lot of them. I think the Liberty Alliance pages might still be up there. But the net result of all of that was the creation of the Samil 2 standard, actually the Samil one and the Samil 2 standard. And the standards were eventually given to Oasis as a standard body and that's where the standards were brought out.
And Liberty Alliance basically, I, I made it maybe in 2008, it may have been early 2009, the dates are getting a little hazy back there. But the Liberty Alliance basically said, OK, our work here is done. And so they had defined the SAML federation protocols which are showing their long teeth now because it was all XML based, but they defined the protocols and Cantara was actually came out sort of as a result of that as a place to do some standard
verifications. It's a sort of the bridge to the future and the, the Joni ended up so, so Joni was the, I think the second executive director of Cantara. Once we had founded Forge Rock, I had been involved with the Liberty Alliance during the Sundays and then when we founded Forge Rock, I carried on being involved with Canterra. I became president of Canterra, I think in 2011, and Joni was
the executive director. So she and I worked very closely inside of Cantera. And one of the things that we were working heavily on at that point was not only trying to get conformance certification on the actual implementations, but also trying to do conformance certifications on federations. And you know, if you're going to be a relying party, are you doing the right thing with information etcetera and and you know, personal identifying information in the privacy
aspect. And so Kentaro was driving around an auditing process around giving that certification, which was really interesting at the time because the federal government was sort of requiring because they, they bought all in on SAML. And so the federal government
was doing that. So Joni and I worked at or worked, I'm not sure we ever really worked, but Joni and I were heavily involved with with Kentara until eventually she left and is now at the Digital Identity Council of Canada, Digital, Digital Identity and Authentication Council of Canada. And I ended up backing away, resigning from the presidency at about 2018-2019. Just at that point, I was not able to put the time into it.
But we'd spent a lot of time in with Kentara and building that up and building up those conformance things. And they continue to do that to this day and are working very heavily in, in helping people the the conformance around, as you say, best practices around identity best practices and preserving information and privacy, things like that. Yeah, and that I mean, all that's so important, especially the the best practices. And because I think people are
searching for that. They don't know how to do something. They they want someone to tell them this is the right way to do it. But I think, you know, we can't underestimate Samuel. I mean, to me, that's just like such a landmark within the
timeline of identity. It's like we can almost talk about it. Like you can talk about the world like pre 911, post 9/11, pre COVID, post COVID, you talk about the identity world, pre SAML, post SAML, it was like, and I, I know it was a longer time that until everybody adopted SAML, but there was a period of time where it was like you had to use like web agents or proxy servers and things like that to do web access management. Then this new standard comes out SAML.
That's also around the same time that you saw a mass migration from fat applications to web applications. And Samuel just became, people just said, yes, I will do Samuel, I will reengineer my application, will do Samuel. And of course, there were hangers on, but I mean, it was pretty much like it revolutionized the industry, I'd say. It did.
I think the, the thing that Samuel really recognized and the thing that was able to be leveraged with the fact that it was actually a trust framework and it was about codifying how do you trust two different entities in play. And so it gave us the capability. I mean, one of the single biggest SAML networks and the SAML federations in use today is still the universities. The universities have, I don't know how many it is. It's, it's hundreds of different entities within their SAML
federation. And it's the idea that. In controversy into the Federation. Edu. Edu. Is it Edu? Causes the organization, then they have in common. There's a few of them in that picture and the very fact that you can have a university in Bristol in the UK and the university in San Francisco being able to recognize the authentication of their appropriate, their individual students is mind numbing, right. And when when you consider that they are running completely
different systems. And so the, the fact that it enabled us to transfer trust across organizations and at least trust part of what they were doing, even if it was just the authentication, right? You're right, I think it is. It was definitely one of those waterfall moments. Do you agree with that? SAML is the the biggest thing since sliced bread in the identity space?
Is there something else that you think competes with that as far as, I don't know, the biggest impact that you've seen in the IM industry over your career? I would I would agree that probably I don't know if there's any one thing that's as big, but you know, LDAP is obviously one because it it's gone on for the 20 years and a lot of things have been built on it. But SAML or the idea of federation between peers with a trust framework between them and SAML, that's what really what
SAML was all about. I think that fundamentally changed identity from being silos into being a network. And, and it probably was one of the biggest thing that came into us. And the other one that I would sort of put into that is the the emergence of consumer identity from the perspective that it wasn't just something that protected workers or your employees, but but it was a way that you interacted with your customers and that that was a
fundamental shift in change. But yeah, I would definitely put Samuel as to one of those really, really important milestones. Yeah. You know, you just bringing that up kind of gets me thinking about the whole idea of identity providers is like Facebook and Google. And I do think there's a large number of organizations that still trend towards that. But then there's the idea of like, we need to know who our
customers are. So I think it for the convenience of authentication it's needed, but there still needs to be information that the identity really. And it's just like the the big story about identity access management. It's like people who were early on would talk about the importance of the identity, which really comes back to who's the human being who's interacting with us and having that information.
That's the asset and. So I, I think it's, it's different for different use cases, right? A bank definitely needs to know who you are. Amazon simply needs to know that you've got a valid credit card and maybe a valid ship to address, you know, so, so different things, different places have different needs for how much they need to know or how little they need to know.
And yeah, I think that that whole trust framework thing brings out into it. So I'm curious if there is an upcoming area of identity that you think is underrated, Like what's something that we should be paying attention to more that we just aren't as an industry? Right now, well, there's so many things that we're looking at, right?
I think for me, the single overriding term would probably be privacy, but privacy specifically from the perspective that how do I trust the people that have the attributes about me? Yeah. And this is really what decentralized identity is, is sort of trying to address, but that's the reality. I had what was. Was blockchain absolutely right?
Well, whether it's blockchain or decentralized or something, something like that, The, the challenge that you come in with, right, is that for, for, for 2000 years, we've known that information is power. And, you know, more information probably means more power. And so the more that you know about someone, the more you can either mess around with them or compromise them or whatever the case may be.
And so the question that comes up to me is how do we know that the people who have access to that information are going to continue to wear white hats? And how do we stop black hats from being able to use that information in ways we don't want them to be able to use, right? And, and we've seen examples right in, in, I mean, even we, we take the, the, no matter how you look at the, the Ukrainian
war, right? We've now got a situation where you've got a hostile political issue, a hostile military issue between 2 powers. The invading force knows if they get to your tax records, they know where all the money is. If they get to, you know, the, the, let's call it the social records, you know, births and deaths and things. They've got a whole lot of information about the people in your country that, that they can now leverage. And so how do we try and protect?
Yeah. And, and this goes back, I think to to my very early software engineering days, right? It's, it's a case of when you testing software you never tested, it works, right? You test for all of the ways that it can go wrong. And so as we start looking at things like privacy, how do we protect when things go wrong?
Right? The, the, the, and, and a perfect case came up for this about three years ago in Australia. I don't know if you remember it, but Australia was having the, the national census. It was an online census. Everybody was, you know, doing the normal census. And some genius came up with the idea that says we could use census information in order to
track down deadbeat dads. Right Now, I'm not going to express an opinion one way or another about there'd be dads, but that's not a good way to get high participation in your senses if you're going to say, oh, and we're going to use it to beat you over the head, right? And that was a very innocuous thing. It wasn't malevolent in any way. It was simply, Oh, well, with this information, we can do
that. I think that's something that, yes, people are aware of it, but I don't think we've had any really good ways to address it, You know, and, and every single one of us will, will pick up the phone and, and talk to a vendor and we'll give them our credit card number and the little secret code and the date and everything they need on it for, for where's it going? What's what's happening to that? Right? I think that's probably one that
I that keeps me awake at night. What do you think is something that's overrated, that we are talking too much about what's being shoved down by our, you know, down our throats by the industry that is? I don't agree with that one. The, the, the thing for me is it's so easy, and this is probably not what you wanted to go with, but it's so easy to blame identity problems on the stupidity of the end user. And it's not, it's our job, it's the identity industry to make it
so that it just works, right? You know, and I, and I compare this to like, say the automobile industry, right? They've made it to the point now where if you even try and open the hood of your car, somebody from the dealership comes and slaps your hand, right? And, and it, it, it just works. And, you know, invariably when we come in conferences and things people are talking about, well, we need to educate the end
users to use better passwords. No, we've got to come up with a technology that they don't need to worry about that, right? Which should just work. And so that's sort of the the thing for me, it's that that education and to make our users more aware of the problems, that's our job. And we should know what the problems are. And we should come up with, as Jim was talking about earlier, in terms of these are the problems that we have to fix. Let's make those problems just go away.
I don't know if that's quite where you want to go, but that's my little hobby horse. It's it's, it's the hill I'm standing on. So Alan, I've really been looking forward to asking you this next question because I've been thinking about this question for a long time. Kind of a a baseball nut, as Jeff told you earlier. And the one question is always like, who's on the baseball? Mount Rushmore? Like Babe Ruth and Jackie Robinson, but who else? I wonder who's on the IAM or
identity? Mount Rushmore, which means four people. First of all, I want a much bigger mountain so we can get more people on. That's it. That's a really, wow, that's a tough question. That's. Called the Hall of Fame we have one we can have an IAM Hall of Fame. We'll have you back on another episode and. Go through the whole Hall of Fame. I think that there's there's a couple of folks on there that are that are pretty easy to
identify. Obviously Kim Cameron would be one of those because he's had such a major impact. Like the George Washington right? Identity from, from day one, right? The, the seven laws of identity sort of defined our industry.
And so, you know, Kim Cameron simply for what he's done and for the, for the, I think Victoria is another one in that Victoria Bertucci who is, is, has been, you know, talking around authorization or to and really trying to educate developers as to there's better ways to do this, right? He was passionate about that. As I think about the Mount Rushmore thing, the, the, the part for me is that I'm sort of standing back and I'm saying, OK, what qualifies someone to be
up there? And the first thing is that for me, if, if that's their job, it sort of minimizes it a little bit for me, right. If, if they're doing it, because this is, I mean, they may be very good at being a leader and a speaker and a, and a organizer, whatever it might be. But if that's what they are paid to do, does that qualify them? Yes, it, it puts them on the list.
I'm not sure that fully makes them, but there's, there's a there's a few people that I think are sort of thank they, they, they work behind the scenes. One of the people that I would go on that is Don Tebow, but I'm not even sure that many people on the call even recognize the name. But Don Tebow was the president and executive director of the Open ID founder, but I'm not
sure if he was president. I know he was executive director of the Open ID Foundation and Don through the Open ID Foundation has been fundamentally dealing with things like the, the Fappy protocols and the Open ID Connect and all of these are worth 2, all of these standards. And it takes a lot of work to build standards and Don has done
a lot of that stuff. Even though yes, his job was executive director, he was really, really passionate, still is really passionate about doing those things. Another one of the people that I think does belong up there, although he will probably tell me I'm I'm full of beings, is Andy Handel. Andy. Even so, Andy, for those of you that don't know him, Andy is the content curator of all of the content at the Identiverse conferences for it was announced this year.
I think it's, it was it 15 years, something like that. And you know, yes, he's paid to do that, but that is not a job you get paid for. That is a job you do because you are absolutely passionate about it. And Andy I think has been, I would say single handedly, but there's a lot of people that work with him and volunteer with him. But he is responsible for making sure that the things we talk about at Ideniverse are relevant to our industry. And so I, I think he definitely
qualifies for things like that. Another one of the people that I would put up there. And again, I'm, I'm totally ignoring your four people thing, but another one someone John Bradley is another name I would put into that. John, if you've been to a conference, he's the guy who has the ponytail in his beard and you probably recognize him if you see that. But John has been involved in almost every standard that we work with an identity since the
SAML days. And you know, he was part of the SAML organization across at least three, probably 4 different companies that he's worked for, which tells me that isn't he's not doing the job he's paid for. This is what he loves doing and he happens to find jobs that that support him being able to do that. So OK, I'll, I'll go to five. I'll sort of put those up there as being the, the people, I think who have had incredible
influence. And you know, part of the problem is that there's another 20 on the list and they all going to come and phone me and say why didn't I get on your list? No, but what I would like to do is for our listeners, I'd like to offer, you know, Jeff, when Jeff puts out the post on this episode, add your list. If you've got a Mount Rushmore yourself or you want to make an argument for somebody, please do so. Alan, I would love to see that. A list of a few.
I've got a list of a few more questions I wanted to ask. I'm going to ask them in the format of rapid fire, which means you have a minute and a half to two minutes maximum. So if you go over that, we just ask fewer questions. OK. Right. We want to. We don't want to overdo this, but so my first question was something I brought up earlier, which was, you know, around conferences. So it's actually a two-part question. What one, what was your first conference?
And two, what was your favorite conference that you've attended? All time. So the first conference that I went to was actually a small little conference we used to call Mac Hack, and this was back in the late 80s. I was heavily involved in Mac development and it was a, a group of us took over a hotel and we started hacking on the Mac, right? It was essentially a, a glorified land party. In terms of the favorite, my favorite one to go to, That's a much harder one because, you
know, I enjoy all of them. But the, the, the two that I never miss is EIC and identifiers, simply because those are the ones where not only do I, you know, see what's new in the industry and things like that, but I get to hang out with, with my peeps, right? These are where the, the, the people who do this stuff hang out. And so I enjoy the social aspects of both of those. My my first conference was Digital ID World circa O five O 6. I think you might have been there. Possibly.
Open my eyes to this identity industry and I was like, it's not just technology, but it's like philosophy. Like what is an identity? You know, like like mind blowing question, mind expanding stuff. And then you had Kim, Kim Cameron come on and talk about the laws of identity. And literally it was like it made so much sense. But like you can see the reverence from him for him in real time. I think it was like around the year where he was joining Microsoft.
So it was like he was coming from his previous life into Microsoft. It was just like a really cool time, a really cool conference. Jeff, what was your first conference? You know, I was, I, I, I was hoping he wouldn't ask me because I'm trying to remember it was. Probably right? What's that? Weren't you at the first Identiverse? Well, like. Yes, but I think it was Cloud Identity conference or something like that at the time that cloud.
Identity Summit. That cloud identity summit, yeah, that was probably one of the first I'd been to. So my background identity was really more heads down in enterprise doing, you know, real IM work. I wasn't a thinker, still not a thinker was doing provisioning of accounts, right. So my, my solar system, my universe of identity and access management was Walgreens and SC Johnson. That's what I knew because that's what I was doing. That's where I worked. I knew how accounts are provisioned.
I knew how operations ran, I knew how technology worked, etcetera. And then I, when I got into consulting, that's when like everything just kind of blew up. You know, I was like, oh, wait, there's so much more to this, which is really why I wanted to do consulting was to learn more about it, right? So you know, the 1st ten of the 20 plus years I've had in this was not even in this industry of IAM, as we'll call it, it was doing identity work like that
was my thing. So I really didn't attend conferences until 2016, I guess. And now you know, I I try to hit every identity. I think I've been to every Cloud identity summit slash identity since then, but.
It's pretty cool though. Yeah, I mean, I I enjoy going to conferences mostly because like Alan, I get to talk to people and meet new people and my historic being a wallflower and and not really being that outgoing despite the, you know, obvious charm that I exhume on this podcast doesn't manifest itself typically in the real world.
So I've kind of gotten out of that shell a little bit and, you know, meeting people and being more open to, you know, shaking hands and kissing babies, right, and all that good stuff. So every, every conference I go to has been better than the last. But I especially, I particularly enjoy the Identiverse conference and the authenticate conferences. For whatever reason, the vibe at the the at those just seem very welcoming and appealing. So much for the rapid fire succession.
The next question, though, was for Alan. So what is Alan's future hold? You're in retirement now for officially, but you're still doing things. So the I, I answered this one a lot at, at both EIC and Identiverse, people would come to me. What are you doing here? I thought you were retired.
And, you know, for me, retirement simply means I stopped doing the things I had to do and could not concentrate on the things that I want to do and, and the conferences I want to do because that's where I get to meet all the cool kids, right? And, and where we hang out. But what's in it for me now? Well, I've just, I, I enjoy sailing. So this is actually about 3 weeks ago, I got my Blue Ocean passage maker certification from
ASA. So that was, we sailed from Bermuda to New York, which was a, a really fun sail. And I'm working on my instrument pilot's license. I have a, one of my, my side hobbies is, well, I, I guess I bought a, my wife and I went down to Argentina last year and ended up buying a small farm in Argentina, which has a great find on it. And so now I'm signed up at UC Davis doing a wine makers course. So I'm busier now than I ever was.
And you know, I love, I love just learning about things, doing new things, working out how things work. And I've I've enjoyed the drinking side of wine, so I thought I may as well go and see how it gets made. And. Save so much money if you make your own. So that's some of the things last. Question for you, Alan. It's kind of a deep, deep thought question, but what is your identity and access management legacy going to be?
Wow. The, the, I don't know that it's specifically to identity or to IAM and things like that, but I think the legacy that that I would like to be remembered for is in encouraging people to ask why. It's, it's, it's one thing to be able to know how to do something, but to be able to ask why are we doing it that way?
Why does it work that way? Why, why is it not working, etcetera, means that we can open up is, and you sort of mentioned this at the very beginning of the podcast where it, it gives you their creativity to look at a problem, to troubleshoot it and to ask why. And I've always tried to get people to sort of think, whether it's thinking outside of the box or thinking about what's going wrong. I've never been a fan of the, well, reboot it and see if it
goes away model that. That's never, for me, a good solution. So that's probably where I'd like to be remembered. So I'm going to, I'm going to try to add some levity to it. Kind of a morbid question, but would your would your tombstone just say why on it? Why you had to know Alan to know why that was there. All right, why don't we go ahead?
Because I, I have an, I have a little bit of a trivia question for Jim. What do Charlie's Charlize Theron, Elon Musk and Alan Foster all have in common? See if you can figure this out. Well, what do they have in common? Alan. Well, I'm not as good looking as Charlize Theron, but a, we're actually all South Africans, or at least we were all born in South Africa. But more importantly, we were all born within 30 miles of each other and, and probably within a
couple of years of each other. I don't know quite how that works out, but yeah, we, we were all born within about half an hour's drive from, from each other. That's my my little bit of trivia, my little brush with greatness. Does that give us like a, is there like a, a Six degrees of Kevin Bacon? Can we do like a a three degrees of Alan Foster somehow?
And, well, 1° from Alan Foster is Elon Musk, so there's that one sitting there, so. So I've never been to South Africa. I know very little. I don't think we've ever had anyone on the show from South Africa. What is something that I should know as someone who knows only? That. Those people were born there and Trevor Noah, that's about it. And, and Trevor Noah, yeah, I mean, as, as a country, it is a, it is a fascinating country, right?
It's a very beautiful country. And if you get an opportunity to visit, it's well worth taking the visit. I mean, the, a country that goes from heavy tropical banana trees and, and to high deserts to sugar cane and swamplands. You know, it's all there and, and you know, as a visit it, it's, it has had an awful lot of impact across the world, right. You run into people who were originally from South Africa,
They, they came from there. And, and so that's where we grew up originally as a British colony. Can't we can't blame us for that. But the and interestingly, South Africa and the US have a very parallel history in terms of time frames. When when the Pilgrims came to the US was about the same time that the Dutch colonized South Africa and and there's some being repeated history events. So, Alan, one question I had is, you know, American shrink coffee, Brit's drink tea, What
is South Africa's shrink? Mainly coffee. The, the, we were definitely a coffee family or it's sort of on both sides. There's tea and coffee, right? But we were definitely a coffee, coffee family and, and most everybody I had drank coffee down there. And then of course. What is your coffee consumption like? I mean, do you start your day with a coffee? Do you drink it all the way to you go to bed? How much coffee is is the right amount for you. So I, I normally go through six
or seven cups a day. So I, I start my day with, I mean, this is my, my, my Ford rock cup. And that's my, my start, my starting cup of coffee. And I normally have my last one sort of just before I open up a bottle of wine to go with dinner. So you know about 5:00 is sort of the last coffee. OK. So now let me ask you one final question. If I wrap things up, you're flying back to South Africa and you're landing. What's the first food thing that you go for in South Africa?
Is there like a go to place or meal or something that you're like for me, like I go back to Chicago and it's like I got to go to Portillo's and get a hot dog. For you going to South Africa, where are you? Where are you headed to right after the airport to get somebody? So we we have a a social event which is called a bra and a bra is about as close as a BBQ. It's basically a fire and grilled meat. And that is how we live like every weekend.
And so the idea having that and all the compliments that go along with a bride, obviously there's a beer or two or three that go along with that. But yeah, that outdoor, that outdoor BBQ, that outdoor grill is, is sort of the standard. That's that's home. I'm sold. I can get behind that. All right, why don't we go ahead and wrap it up for this week? Alan, thank you so much for taking the time with us. This, this stroll down I am
memory lane. I don't know, still working on a title in my head here, but it's been really eye opening. It's, it's, it's always fascinating for me to hear the stories behind the things right, from the people who are sort of in the room or at the pub or wherever things kind of started right, or, or whatever it may be. So, and now you're part of the Digital Identity Advancement Foundation and you've done work with ID Pro. We want to make sure we get plugs out for them.
ID pro.org, fantastic organization, we're all part of that. The Slack channel, definitely worth its money just just for that alone. For the conversation standpoint, DIAF dot link, that's the the link for the Digital Identity Investment Foundation. So for folks who are newer to identity, there's ways there that people who are in the space or anyone really can kind of support make sure that we have the next generation coming
through. So I'll have links in our show notes for that kind of stuff that people hopefully will go check out. Let's see what else. We're on the web, idacpodcast.com. We're on X Twitter, whatever it's called by the time your your face or ears consume this at IDAC podcast, we're on YouTube. If you're not watching us on YouTube, do us a favor, go over and like and subscribe. We're trying to grow to the YouTube channel.
Make it super easyidacpodcast.tvsoidacpodcast.tv will take you right to our YouTube channel and would appreciate a, a subscribe and A and a like on a video. Let's see what else Connect with us on LinkedIn. I'll have Alan's LinkedIn connection information in our show notes so you can either share stories about Bry's or coffee consumption. Wine. My wife is very into wine, so she'll be very much tuning into that conversation. And anything else, Jim, that I
forget or are we good to go? No, you mentioned everything. I did want to just thank Ellen, not only for being on the show, but just all the contributions you're making and people like you have made over the years. I mean, it's made things a lot easier for the practitioners today. And I think what you're doing with DIAF is, you know, really important. It's about the next generation of identity people. And we all have that
responsibility. Pass it on, you know, pay it forward however you want to. You want to refer to it. I think we've all received and we should all make sure that we give back. Great way to end it. So we'll leave it there. Thanks everyone for watching or listening. Thanks, Alan. Thanks, Jim. And we'll talk to everyone in the next one. You've been listening to Identity at the center. We hope you've enjoyed the show. Make sure to like, rate and review, and we'll be back soon.
But in the meantime, hit the website at identity@thecenter.com. See you next time on Identity at the Center.