It's official, I have drunk the federation kool-aid

In a meeting today discussing a B2B web app for which we have deployed and are maintaining an extranet AD to facilitate logons:

Me: "So what mechanism are you using to determine when these extranet accounts should be disabled/deleted?"

Them: "Uhhh...why would we need..."

Me: "You know, such as when an employee is fired from the partner and their account on our extranet is still allowing them to access our BI data?"

Them: *uncomfortable silence*

Me: "And what mechanism is our Help Desk meant to use to determine whether a password reset call 3 months from now is originating from someone who is still employed by the partner?"

Them: *uncomfortable silence*

Here's the problem, though.  My next question, namely "Can we use WS-Federation here, instead?" was met by a staggering blank stare from the vendor. So while I've pointed out the weaknesses created by a lack of federation, I appear to be unable to take the next step forward to address said.  Very frustrating.

Comments

[Unknown Guy /w Dean]

Im sorry :)

[Unknown Guy /w Dean]

Now... if we could only get you to drink the Powershell kool-aid!

Muuhahhhahhhah