UNIFY Identity Broker

Cloud, mobile, and IoT adoption is exposing limits in traditional identity and access management architectures, especially monolithic enterprise directories accessed via LDAP. Many organizations still depend on Active Directory or LDAP directories as the control point for user and contractor access, but an increasing share of modern applications no longer uses LDAP. Exposing LDAP externally also creates material security risk because directory contents can be queried with LDAP filters, making it easier to extract personally identifiable and other sensitive information—an issue with serious compliance implications. Even on-premises, stronger approaches such as using secure LDAP with certificates and signed lookups are positioned as necessary risk-reduction measures, though not a complete defense against advanced compromise.

Performance and developer experience reinforce the need for change. Cloud applications cannot reliably meet millisecond expectations if every identity lookup must traverse firewalls and load balancers back into the corporate network. Developers also prefer object-oriented, web-native interfaces—JSON and HTTP/REST—rather than embedding LDAP logic into applications. This shift is illustrated by Azure AD’s adoption of a Graph API aligned with OData.

UNIFY Identity Broker is presented as a unifying identity provider service and “data pump” that connects to directories and databases, models and transforms identity/entity data, and serves it in the protocol and structure each relying application requires. It includes configurable agents, connectors, adapters, logging/auditing writers, gateways (LDAP v3, OData v4, SCIM 2.0), and a REST API. Typical deployments synchronize identity into the broker’s datastore to avoid real-time dependency on source systems while enabling delta updates, governance reporting, and consolidation of connectors. Strengths include broad protocol and platform support; challenges include data-model mapping complexity, reliance on mature API management/security, and limited partner reach.

• Many companies use enterprise directories to manage staff and contractor details and to control access to corporate systems.
• Active Directory and LDAP directories are commonly used to control access, while many newer applications do not use LDAP.
• Externally exposing an LDAP directory allows directory contents to be queried using LDAP filters, creating a significant security risk.
• Azure AD adopted a Graph API using the OData standard as an interface rather than an LDAP interface.
• Synchronizing identity information from on-premises directories into each cloud application leads to a proliferation of identity stores in the cloud.
• UNIFY Solutions was founded in 2004 and is headquartered in Australia.
• UNIFY Solutions has over 65 people and is growing.
• UNIFY Identity Broker includes gateways supporting LDAP v3, OData v4, and SCIM 2.0.
• Supported log writers include Splunk, Windows Event, and Azure Log Analytics in addition to default CSV logging.
• Identity Broker audit writers can send audit entries to targets including Splunk and Azure Log Analytics.

• “As Cloud technology has developed the monolithic enterprise directory with an LDAP interface is no longer the appropriate source of identity information.”
• “A better model is to provide a single source-of-authority for identity information that all cloud applications can access.”
• “It can be thought of as a ‘data pump’ that can support the requirements of specific APIs exposed by legacy and modern-day applications.”
• “Software developers no longer want to build LDAP calls into their program logic.”
• “Developers prefer JSON arrays and HTTP methods over LDAP queries.”
• “Exposing a corporate directory to the Cloud is not recommended from a performance viewpoint.”
• “Applications expect millisecond responses which require a planned configuration that mitigates network latency to the degree possible.”
• “No program development and the associated software development lifecycle management is required.”
• “Organisations must take a strategic approach to their identity services to avoid the proliferation of identity stores and to keep costs in-check as more demands are made on the identity management environment.”
• “Support for the protocols used by the identity management environment should be mandatory selection criteria.”