Friday, March 19, 2010

You are here: Home / Blog / Opinion / Review of ActivIdentity ActivID 4Tress AAA and 2 Factor Tokens

Review of ActivIdentity ActivID 4Tress AAA and 2 Factor Tokens

April 9, 2008 by Greg Ferro · 3 Comments 

In a recent pro­ject I was required to use ActivIdentity ActivID for two factor authen­tic­a­tion. This post is about my over­all exper­i­ence with the product and its poor approach to HA. While ActivID does work fine, and its tokens look nice and it works OK, this is not a product for any small or medium com­pany, and requires a lot of IT resources to make it work

The two factor token authen­tic­a­tion mar­ket has many play­ers, and the RSA SecurID solu­tion has first to mar­ket advant­age. The SecurID product is ‘reas­sur­ingly expens­ive’ and is the default solu­tion for token authen­tic­a­tion. It was man­dated from Head Office that ActivID was the chosen product. On a first pass cost ana­lysis, it looked good value for money.

Licensing

The ActivID 4Tress AAA server soft­ware has no licens­ing require­ments and is based on an hon­esty sys­tem. This is refresh­ing in the mod­ern era, how­ever this was never covered in the doc­u­ment­a­tion and it took over two weeks for the sup­port to be able to indic­ate that there was no activ­a­tion or licens­ing required. Just install it and go.

Note how­ever, that you still have to buy the tokens, so you can’t bypass the licens­ing in the end.

Tech Support

I was not able to access qual­ity tech­nical sup­port. Because ActivID only wants to work with big com­pan­ies dir­ectly, I was unable to buy a main­ten­ance con­tract dir­ectly from ActivID. I was forced to use a dis­trib­utor for tech sup­port. At pur­chase time I had deep mis­giv­ings about this know­ing that for a non core product like ActivID, the dis­trib­utor was unlikely to have more than one per­son trained in the product, and that per­son was pos­sibly not their best engin­eer. This turned out to be true and I was unable to get sat­is­fact­ory answers to any ques­tions. In fact, I was unable to get any­one to answer sup­port ques­tions. Even worse, when I tried to escal­ate to ActivID and make dir­ect con­tact, ActivID would refer me back to the dis­trib­utor and refuse to take my call.

Windows Only

So ActivID 4TRESS AAA server is Windows only, and that includes the man­age­ment cli­ent as well. While this is prob­ably suit­able for most cor­por­ate IT depart­ments, a sig­ni­fic­ant num­ber of IT people are mov­ing away from Windows on their own desktops. Vendors need to recog­nise this and move to develop cli­ents that are uni­ver­sal. The Web Help desk does work in any browser but the thick cli­ent does not.

The depend­ency on Microsoft SQL server is sim­ilar, and although integ­ra­tion with other sys­tems is pos­sible, tech sup­port becomes a prob­lem (see above). Many organ­isa­tions are mov­ing to use MySQL instead MSSQL for IT oper­a­tions and the lack of sup­port for any other data­base was a disappointment.

High Availability — use­less

ActvID have chosen to use a data­base backend to achieve syn­chron­isa­tion between serv­ers. Which means that you have to install a full MSSQL (or use an exist­ing unit) to allow for data rep­lic­a­tion. I find this ridicu­lous. As a net­work engin­eer, I do not want to be installing SQL or integ­rat­ing with a data­base admin­is­trator to main­tain such an import­ant sys­tem. In effect, this concept designs fail­ure INTO the system.

And the extra cost for MS SQL licenses is not appre­ci­ated either. While some organ­isa­tions will use MSSQL, many more will use Oracle or some­thing similar.

< ! – -nextpage-​​ – >

Does what it says on the Tin

The product does work, and, once you adapt your­self around the way it works, it works fine. The Web Helpdesk is a nice idea, but obvi­ously some­thing that you are expec­ted develop a user inter­face for as part of your help­desk soft­ware. For smal­ler IT oper­a­tions no one is going to take time to cus­tom­ise it. It looks like an after­thought and is not intu­it­ive to use. ActivIdentity could do a much bet­ter job of this to improve the out of box experience.

ActivID can integ­rate with Windows AD, but I found the inter­face a little funky (read not intu­it­ive). The abil­ity to be cre­at­ive with group selec­tion and user­name match­ing was lim­ited. The entire man­age­ment inter­face looked very dated to me.

Other tools in the box

ActivId has a lot of tools that allow it to integ­rate with other stuff. There are sev­eral dir­ect­or­ies on the CD that might be inter­est­ing if I need to integ­rate with other stuff. If you want these fea­tures then I sus­pect that my neg­at­ives might not be yours thus your mileage may vary.

Conclusion

If I had to work in a very large com­pany, had access to soft­ware devel­op­ment resources and Windows admin­is­trat­ors then the money saved com­pared to SecurID might be worth­while. But if you are small to medium busi­ness with , say, less than 100 IT staff you will be bet­ter off with some­thing else.

Once again, the qual­ity of tech­nical sup­port lets an American product down. The favoured model by US tech com­pan­ies of hav­ing their own tech sup­port in America but hand­ing it to dis­trib­ut­ors in the rest of the world con­tin­ues to be a dis­ap­point­ment. Make sure that you take the time to check how the main­ten­ance is delivered before you buy.

Please rate this post:

  Why Rate Posts?
1 Star - It\\\'s Crud2 Stars - It\\\'s Tosh3 Stars - Something\\\'s missing4 Stars - Needs works5 Stars - Good Enough6 Stars - Good7 Stars - Excellent8 Stars - Brilliant9 Stars - Astonishing10 Stars - Awesomely Godlike? (1 votes, average: 10.00 out of 10)
Loading ... Loading ...

Filed under Opinion · Tagged with

Probably Related Posts on the Same Topic

Comments

3 Responses to “Review of ActivIdentity ActivID 4Tress AAA and 2 Factor Tokens”
  1. Julian lovelock says:
    13 May 2008 at 17:58

    As product man­ager for the ActivID 4Tress AAA Product I obvi­ously read your blog with some interest, and wanted to make a couple of points.

    Tech Support:
    We have a global team of sup­port engin­eers based in AMERICAS, EMEA and APAC to provide con­tinu­ous 24×7 sup­port ser­vices to our End Customers, Partners, Distributors and Resellers.

    We do have a two tier sup­port model. This includes Standard Support (8×5) where end-​​customers obtain Support Services through their ActivIdentity Certified Channel Partner; and Premium Support (24×7) where end-​​customers engage dir­ectly with ActivIdentity for their Support Services.

    It is true that we don’t provide dir­ect sup­port to Customers with small user base as you can under­stand and agree it becomes hard for us to main­tain high qual­ity of ser­vice if we take on all the small cus­tom­ers. That being said it’s very unfor­tu­nate that our Distributor couldn’t provide you proper guid­ance & sup­port. We do require our Distributors to main­tain a min­imum of two tech­nical people cer­ti­fied by ActivIdentity on staff at all times.

    It’s also worth mak­ing the point that com­pet­itor products typ­ic­ally fol­low a sim­ilar model.

    High Availability
    You also com­men­ted that from a high Availability per­spect­ive the product was use­less, which is an unfor­tu­nate obser­va­tion, given that it is not true. The product does sup­port rep­lic­a­tion between dif­fer­ent data­bases instances to enable high avail­ab­il­ity, without rely­ing on the under­ly­ing data­base rep­lic­a­tion cap­ab­il­it­ies. I do take the point that we could prob­ably do a bet­ter job of doc­u­ment­ing this.

    Please note that ActivID 4Tress AAA does sup­port Oracle along with MS SQL Server as database.

    We do have a lot of smal­ler cus­tom­ers with less than 100 staff.

    PS — If its any con­sol­a­tion, I am English, albeit work­ing in America. Not sure whether that makes things bet­ter or worse;)

    Reply
    • Greg Ferro says:
      16 May 2008 at 07:22

      You have your right of reply.

      “It is true that we don’t provide dir­ect sup­port to Customers with small user base as you can under­stand and agree it becomes hard for us to main­tain high qual­ity of ser­vice if we take on all the small customers”

      I do not agree. Customers are the reason for your busi­ness not the cause of it. Small cus­tom­ers become big cus­tom­ers, and they cre­ate mar­ket momentum.

      Further, main­tain­ing a high qual­ity of ser­vice means good man­age­ment and invest­ment to achieve it. You are sug­gest­ing that your com­pany does not or can­not do either. That suggests.….…ah well, that might be a bit harsh. I don’t believe you can abrog­ate sup­port for your cus­tom­ers by claim­ing its too hard.

      Since you have no cap­ab­il­ity to sup­port small to medium cus­tom­ers (by your own admis­sion and by my cri­teria), then don’t sell pack­ages for small com­pan­ies. I have stated that dis­trib­ut­ors are inad­equate, and your product does not seem to have the neces­sary mar­ket pen­et­ra­tion for them to give it focus. (How can one per­son, who spends less than one day a week on your product be a qual­ity ser­vice experience ? ).

      “You also com­men­ted that from a high(sic) Availability per­spect­ive the product was use­less, which is an unfor­tu­nate obser­va­tion, given that it is not true.”

      Indeed it is true. From my pos­i­tion, your attempt at HA is cer­tainly use­less. HA using an external data­base is unac­cept­able as a man­dat­ory choice. By for­cing external depend­en­cies you:

      (1) increase com­plex­ity and thus reduce reli­ab­il­ity
      (2) increase the MTTR
      (3) make troubleshoot­ing more com­plex.
      (4) oper­a­tional costs are higher

      Further, as the solu­tion crosses oper­a­tional bound­ar­ies it is not suit­able for any net­work­ing focused deploy­ment (as I noted in the article).

      Your doc­u­ment­a­tion on HA is (was?) vile. The hid­den cost of MSSQL was not a pleas­ant experience.

      Compared with Cisco Secure Access Control Server with its integ­rated data­base and rep­lic­a­tion engine, the ActivIdentity product is much more com­plex to main­tain and install.

      PS I don’t mind who you are or where you are from. I have my opin­ion and I choose to express it. I wasted way too much time get­ting your product to install and be usable. Particularly, I wasted weeks of man time on the deploy­ment instead of get­ting sup­port and get­ting assist­ance. This reflects badly on your company.

      Reply
      • Julian lovelock says:
        16 May 2008 at 16:35

        Greg,

        I am sorry that your dis­trib­utor was unable to provide suf­fi­cient sup­port and we were unable to provide suf­fi­cient cent­ral­ised backup. I accept the cri­ti­cism of the exe­cu­tion of our model, i.e. using dis­trib­ut­ors and it is some­thing we con­tinue to work on to improve, but not the model itself.

        The product is gen­er­ally accep­ted by our cus­tom­ers and the mar­ket as being easy to install and use. To quote from an SC magazine review which awar­ded the product 5 stars for ease of use, ‘The install­a­tion of 4TRESS AAA was as easy as can be expec­ted. The offer­ing can lever­age exist­ing SQL (struc­tured query lan­guage) or Oracle data­bases, but ships with its own SQL MDSE data­base, which we used for test­ing. The soft­ware installs into two com­pon­ents a server mod­ule and a con­sole mod­ule. The con­sole mod­ule was among the bet­ter mod­ules we used and it had a logical lay­out which was easy to use, even for the novice, and the com­mands were simple to under­stand. If you have worked around a Radius server before, the 4TRESS AAA server should hold no sur­prises. We found the inter­face to be intuitive.’

        To repeat the point I made above ‘The product does sup­port rep­lic­a­tion between dif­fer­ent data­bases instances to enable high avail­ab­il­ity, without rely­ing on the under­ly­ing data­base rep­lic­a­tion cap­ab­il­it­ies.’ In other words, using the external data­base for HA is not a man­dat­ory choice.

        Reply

Speak Your Mind

Tell us what you're thinking...
and oh, if you want a pic to show with your comment, go get a gravatar!

A Random Selection of Other Fine Posts (or Not)