Here I am again, up past the witching hour, splitting hairs and picking nits on another mundane technical issue. This time the question that vexes me is whether to federate the identity of the users from our partner or to keep the ids all safely captive in my own repository.

My federation architecture is flawless, even if I say so myself. I have tamed the identities and the groups and the custom attributes in the account side to line up neatly as claims that flow as token to my side of the fence. The Federation Server on my side loving collects these thingies, transforms them to ids, groups and attributes that aligns to my business processes and sends them with a kiss to my MOSS. My MOSS neatly handles these claims through the WebSSO provider and Voila! I have squeaky clean SPUsers and SPGroups. My access control works as do my custom web-parts. So why am I still up moaning?

One reason: Change Management.

A change this big in the architecture means changes to application logic, easily done and change in operational processes, Groan! That’s when the questions start staring at me like the Corsicans do in Asterix in Corsica. Are you sure your Partner uses UPN? What makes you think that their roles can map to ours? How did you think my app will handle this change in time to allow the roll-out to happen? Why do think up all this? Why? How? Now what?

Why do I suddenly get the feeling that I am Asok in a Dilbert cartoon strip?

So here I am again instead of identifying the action items between now and then, poring my heart out to my blog and my fellow iLanders, while wondering what their real Islands are like? Are they as chaotic as mine or serene, are they predictable or unpredictable like mine…

Anyways, work is worship, so said Swamiji, so back to work it is for me…