Patrick Stromberg, Architect, Pharmacy Systems and Automation, McKesson Alexey Shmelkin, CISSP, Senior Security Architect, Information Security Architecture and Services, McKesson Following a brief update on the usage of ForgeRock products within McKesson, this session will provide an overview of the integration between EnterpriseRx, a pharmacy management system, and ForgeRock products. We will cover the challenges specific to the business domain along with a look at how we got here and where we’re going. The challenges are interesting in that they deal with a large number of customers, a native (non-browser) client and limited information about end-users.

1. McKesson Case Study
Pat Stromberg
Alexey Shmelkin

2. Copyright © Identity Summit 2015, all rights reserved.
McKesson At-a-Glance
• Founded in 1833
• Ranked 15th on Fortune’s 2014 list,
with >$170.0 billion in revenues
• Headquartered in San Francisco
• Around 80,000 employees (with Celesio)
• Two segments: Distribution Solutions
and Technology Solutions
• 12 Business Units
• Total focused on health care

3. Copyright © Identity Summit 2015, all rights reserved.
In use by 8 McKesson
Business Units
Claims Processing
Enterprise Rx
HR
Application Developers
Portal, PaaS
Portal
Medical Distribution
Supplies Management
Pharmacy Management
Sales Portal
Pharmaclik
Intranet
Identity Repository
Sales Solutions
Vital Care Management
AMIDM
DJ
Marketing Portal
“ForgeRock has been proven in high-demand, high-scale
environments and has a high level of maturity” (Gartner
2014)
Health Solutions
Technology SolutionsUS Pharma
Manufacturer Portal IVR Self Service
Connected Care & Analytics
Reporting, Analytics
Self Service/ User
Management

4. EnterpriseRx
Copyright © Identity Summit 2015, all rights reserved.

5. EnterpriseRx
• Pharmacy Management System
• Java Swing client (no browser)
• Hosted and Self-hosted deployment
• Back end – Java application server, Oracle DB
• 500+ customers
• 15,000+ end-users
• End users are pharmacy employees
Copyright © Identity Summit 2015, all rights reserved.

6. EnterpriseRx & IAM
Sun ONE / Sun Java Enterprise System
• Directory Server
• Access Manager
• Policy Agent
Integration
Architectural goal of separation to help with supporting both
hosted and self-hosted solution
Copyright © Identity Summit 2015, all rights reserved.

7. Transition to ForgeRock
Major Factors
• Ease of transition
– Upgrade from JES to OpenDJ / OpenAM reasonably painless
• Corporate support
Copyright © Identity Summit 2015, all rights reserved.

8. ForgeRock Products
Copyright © Identity Summit 2015, all rights reserved.

9. Deployment Diagram
Copyright © Identity Summit 2015, all rights reserved.

10. OpenDJ
• Mostly OOTB functionality
• Some customization due to OpenAM integration
• Business requirement on user ID
• Rock solid
Copyright © Identity Summit 2015, all rights reserved.

11. OpenAM
User Administration
• Legacy functionality
• OpenIDM
• Too many realms
• Customizations to UI
Authentication
• REST API
Copyright © Identity Summit 2015, all rights reserved.

12. User Administration
Copyright © Identity Summit 2015, all rights reserved.

13. Policy Agent
• Web policy agent
• Performance testing
• Authentication enforced in web tier
• Authorization decisions in app tier
Copyright © Identity Summit 2015, all rights reserved.

14. Business Challenges
Copyright © Identity Summit 2015, all rights reserved.

15. Business Challenges
Customers
• Size and IT maturity
• Regulatory / Compliance requirements
• Customization leads to increased costs
End users
• Little information
• No good contact method outside of EnterpriseRx
• Poor self-service
Copyright © Identity Summit 2015, all rights reserved.

16. Solutions
Delegate
• Customers know end-users better
• Push user administration tasks to customers
• Better fit
– Small customers like convenience
– Large customers like control (and convenience too)
Process / Tools
• Technical limitations
• Password strength
• Compliance reporting
Copyright © Identity Summit 2015, all rights reserved.

17. Future Direction
Copyright © Identity Summit 2015, all rights reserved.

18. Where are we heading?
Federation
• Removes MPS&A from user administration business
• Never reach full adoption
Identity Management
• OpenIDM
• Will allow us to push more towards customers
• Take load off of OpenAM
New products
• Starting to see microservices
• Common needs for authentication
– End-users, vendors, customers
• Build out security layer
Copyright © Identity Summit 2015, all rights reserved.