Four Big IAM Topics We’ve Tackled at Advance CAMP (and One We’ll Hear About at TechEX25)

Government agencies such as the National Institutes of Health and the National Science Foundation are actively pushing security requirements that mandate higher levels of assurance within InCommon Federation.

At ACAMP, IAM professionals shared real implementation challenges. Those included difficulty getting users to put work authentication on personal devices, medical workers unable to bring devices into treatment areas, students from export-controlled countries facing device restrictions, and YubiKeys not working in embedded browsers despite bulk adoption efforts.

Error handling also remains problematic. When authentication strength is insufficient, users get stuck at the Identity Providers, or Service Providers receive unknown errors with no way to restart the flow.

The community is now working through InCommon Expectations and the InCommon Community Trust and Assurance Board to formalize standards, including new REFEDS context classes for phishing-resistant Multi-Factor Authentication (MFA).

Heading into previous ACAMP sessions, some IAM practitioners reported their campus leaders were asking a similar question.

Why were they running a customized open-source identity platform, such as Shibboleth, when they could simply buy a commercial service to do the job?

The move to commercial solutions is often driven by managerial optimism and vendor sales assurances. The discussions at ACAMP exposed the reality that migrating can mean paying twice for core services (such as dual MFA contracts) and risks to business continuity for essential campus resources (such as student health services) if they rely solely on external cloud platforms.

Attendees at different ACAMP breakout sessions shared real-world stories about how they navigated hybrid solutions, using tools like Grouper and midPoint to manage complex access policies that commercial platforms weren’t built for.

Over their lifespans, IAM systems can unintentionally become an “ultimate shadow system”. These systems accumulate so much employee and student data that they eclipse even HR systems.

This data bloat is actively harmful. It increases the attack surface, broadens the scope of any potential breach, and causes performance bottlenecks.

ACAMP talks in the past have focused on the difficult process of purging identities from these shadow systems. Attendees gathered that this process wasn’t solely technical. Solutions needed to include a governance decision requiring consensus on how little data is needed to support critical use cases, such as successfully matching a returning alumnus or employee.

The consensus is moving toward an identity-first approach, keeping only minimal, persistent identifiers and mapping out to source systems for detailed data.

While authentication (logging in) gets much of the spotlight, ACAMP attendees tackled the equally critical challenge of authorization — determining who gets access to what after they log in. 

Many institutions are wrestling with Identity Governance and Administration (IGA) systems that have accumulated layers of cruft and dark patterns over years or decades.

Replacing these specialized systems is a complex undertaking. ACAMP attendees noted that the effort required to replace an IGA solution is sometimes as difficult as replacing an entire ERP system.

ACAMP discussions focused on practical advances in Attribute-Based Access Control (ABAC). Some institutions also shared simple custom frontends they have built that shield non-technical faculty and staff from enterprise tool complexity.

These solutions can clean up decades of tangled access rules, making policy management usable by the people who actually own the data.

Altogether, these four themes represent a fraction of the conversations that take place across ACAMP sessions each year. As the IAM landscape evolves, new challenges emerge, and the community comes together to tackle them.