CIS 2015-API's & Identity: Enabling the Business to Become the Cloud- Carlos Garcia
1 like632 views
Optum is transforming itself into a healthcare cloud platform. APIs and identity management are enabling this transformation by allowing Optum to expose healthcare data and services, enable developers, and provide identity and access management for applications. Originally, Optum's identity management focused on its own applications, but now it must provide services for commercial customers on its cloud platform at scale. Optum built an identity management system using best of breed technologies to support millions of users, rapid growth of applications, and the needs of its new commercial customers.
CIS 2015-API's & Identity: Enabling the Business to Become the Cloud- Carlos Garcia
- 2. API’s and Identity: Enabling Optum to become the HealthCare cloud Carlos Garcia
- 3. Synopsis This is a short story on how Optum is transforming itself to become the HealthCare Services Cloud and how APIs and Identity are the enablers to make this possible. Copyright © 2015 Cloud Identity Summit. All rights reserved. 3
- 4. Or as I like to call it…. How the security dog finally caught the car Copyright © 2015 Cloud Identity Summit. All rights reserved. 4
- 5. Back to the security dog… Copyright © 2015 Cloud Identity Summit. All rights reserved. 5
- 6. But first…. Who are we? UnitedHealth Group is an interconnected company composed of business segments. A few examples: Copyright © 2015 Cloud Identity Summit. All rights reserved. 6 Health Benefits • Employer and individual • Medicare & Retirement • Military and Veterans • Amil (Brazil) • NHS (UK) • Lusíadas Saúde (Portugal) Health Services • Provider Solutions • Payer Solutions • Optum Bank • OptumRX • OptumCloud • OptumIT
- 7. Story of the chase Copyright © 2015 Cloud Identity Summit. All rights reserved. 7
- 8. The Big Challenges Selling the value of WAM and SAML; Gaining adoption but not improving end-user experience. • 12+ million identities but silo’d. • End user experience • SAML masks identity problem. • Common security framework for registration. • Standard WAM/SSO integration patterns and SDK Copyright © 2015 Cloud Identity Summit. All rights reserved. 8
- 9. Optum Opportunities • ACA provides huge opportunities • Claims data mining. 100’s of millions of claims • Fraud Monitoring (US) 80 Billion dollars in 2014 • Expose and monetize the data and services • Enable the developers • IaaS/PaaS/SaaS and Hosting • Healthcare exchanges (Private and Government) Copyright © 2015 Cloud Identity Summit. All rights reserved. 9
- 10. Wait… I think we need Identity All of a sudden, the security dog didn’t catch the car, but rather the car hit the breaks…. ….and security dog was along for the ride! Copyright © 2015 Cloud Identity Summit. All rights reserved. 10
- 11. Businessman’s best friend Copyright © 2015 Cloud Identity Summit. All rights reserved. 11 IAM team now has a business partner and needs to solve for: • Optum Cloud Marketplace • Commercialization • Health Exchanges (private & public)
- 12. We need it yesterday! Now instead of selling the value of identity to the business, we run to keep up with demand • Health APIs • SaaS, PaaS, IaaS • Developer Enablement • Cloud Identity Provider Copyright © 2015 Cloud Identity Summit. All rights reserved. 12
- 13. It better be bulletproof • Downtime was no longer something you coordinated and forced upon the business. Now you have commercial customers who expect 24x7 • Enterprise support versus commercial support forced a change of culture. • From enterprise IAM shop to essentially a commercial cloud IDP. Copyright © 2015 Cloud Identity Summit. All rights reserved. 13
- 14. What did we build?? We had green field to work with and great technology vendor partners. • Best of Breed and home grown • SOAP/REST • Legacy to mobile • LOA3 – FICAM/MARS-E • Multi-tenancy Copyright © 2015 Cloud Identity Summit. All rights reserved. 14
- 15. Copyright © 2015 Cloud Identity Summit. All rights reserved. 15 Front-‐Ends Policy Enforcements Points / Abstraction SDK Policy Decision Point / Core IDM Services Policy Information Point OptumID UI (healthid) Identity Management Web Services Radiant Logic VDS Identity verification web services DB SiteMinder DB Ping Federate IDP/SP Security SDK Delegated Login Service 1. Registration 2 Forgot Password/UserName 3. Login 4. Change Password and update profile. 5. Administrator UI for setting up relying party 6. Identity verification workflow Extended attributes Web Services DB Layer 7 (API Gateway) External Applications/ Developer Portal/orgs (consumers of our APIs) SOAP / RESTful Interface UnboundID OptumID LDAP Cloud DB Step-‐Up Authentication/ OTP Services Axiomatics Agents IDP for Consumers, Providers
- 16. Copyright © 2015 Cloud Identity Summit. All rights reserved. 16 ESSO WebSphere ESSO Service Profile Audit Oracle DB Authentication LDAP Advanced Auth Service SiteMinder Policy Server OptumID Component Level Diagram OptumID LDAP Strong Auth Risk Engine Adapters healthid.optum.com OptumID UI WebSphere Strong Auth Oracle DB ESSO REST WebSphere REST Interface – User Profile SiteMinder Policy LDAP OptumID VDS Layer7 API Gateway
- 17. What’s underneath the hood? • Java based App on WebSphere • Multi-DC Active-Active • Abstraction SDK • 4 million users; 40+ reply party apps – rapid growth • Target migration of 25+ million identities Copyright © 2015 Cloud Identity Summit. All rights reserved. 17
- 18. Copyright © 2015 Cloud Identity Summit. All rights reserved. 18 User Experience
- 19. User Experience Copyright © 2015 Cloud Identity Summit. All rights reserved. 19
- 20. Copyright © 2015 Cloud Identity Summit. All rights reserved. 20
- 21. BFF Vendors • CA SiteMinder • CA Layer7 • CA Strong Auth • Ping Federate • RadiantLogic • Axiomatics Copyright © 2015 Cloud Identity Summit. All rights reserved. 21
- 22. No time to slow down! • We have started working on our next generation of IDM services based on micro architecture. • More branding flexibility. • Automation – Service Catalog • REST as default for everything. • Get ride of agents, identity tokens for everything. • Dynamic elasticity, resiliency, containers and open shift enterpriseCopyright © 2015 Cloud Identity Summit. All rights reserved. 22
- 23. Thank You!