This document is intended to help organizations decide whether an appliance or a traditional server is an appropriate platform for hosting enterprise software applications. It is organized as follows:
A growing number of vendors are offering what would otherwise be software-only solutions in the form of dedicated appliances, which incorporate both hardware and software. In this section, terms and concepts relevant to appliances are introduced, so that the subsequent discussion can be more clear.
This document is concerned specifically with "enterprise software applications." That is, applications which:
At issue is whether it is preferable to host such applications on appliance servers or traditional servers, as defined below.
A traditional server consists of several components, possibly from different vendors, which may have to be assembled into a unit by the organization which wishes to run the enterprise software application:
Normally, an organization will have many such servers, and deploy one or more applications on each one.
The above description is only approximate. For example, hardware may be virtualized, other operating systems are available and other components may be required.
An appliance server is one where all of the required functional components, including those identified in (_label_trad-server), plus the application software itself, are integrated and configured into a unit and purchased from a single vendor.
Users sign into applications using a client device. This may be a desktop or laptop PC, a telephone or smart phone, a PDA, etc.
Modern applications often use a web interface to interact with users, which means that the user's hardware runs a web browser, which presents a graphical user interface to the user.
Many home users are very familiar with appliances, if not with the term "server appliance," in the form of wireless routers, small hardware firewalls, print sharing devices, network attached storage, etc. These devices are small, inexpensive and not really scalable or flexible enough to meet the needs of medium to large organizations.
Server appliances intended for enterprise deployment have two basic types:
The commodity hardware approach serves mainly to reduce the initial setup and configuration effort for organizations deploying the product. "Inside the box" is just a traditional software server, assembled and supported by the vendor.
Specialized processing hardware is used mainly where the performance characteristics of the system cannot be easily reached with a conventional server. This is typically required in the context of specialized networking equipment, such as SSL processors, virus scanners, application firewalls and more, all of which must perform complex at "wire speeds" -- 100Mbps or more.
The main benefits promoted by vendors who sell solutions in the form of appliances are:
The operating system and application software are pre-installed on the hardware, which reduces installation time and effort. To the extent possible, the software is normally either pre-configured or self-configuring.
It should be noted that this is only a significant advantage for applications that require minimal integration with existing infrastructure, and minimal customization. Where such integration and customization is required, it normally takes up the bulk of configuration time, so the savings from faster initial setup is inconsequential.
The simplified installation and configuration lead to scenarios where fewer IT skills are required to implement the solution. This is particularly true where the application is quite simple and requires little or no further configuration beyond initial activation.
Any questions about hardware compatibility or operating system patches are eliminated when a single vendor supports every "layer" of the solution, starting with hardware and ending with the application software.
In the case of specialized processing hardware, the additional and overriding benefit is increased performance. Note that this is not generally true for commodity hardware bundled as an appliance -- this advantage is only relevant where the appliance incorporates specialized hardware, most often to provide a specialized network infrastructure function.
Hardware appliances provide some benefits, such as somewhat simpler installation and configuration, but they also have some drawbacks. These include:
In order to reduce manufacturing costs, hardware appliances often incorporate previous-generation components. CPU capacity, memory cache, RAM and disk space are often significantly smaller in an appliance as compared to a contemporary general-purpose server. The result is that commodity-based appliances often have significantly lower performance than the same application software running on newly acquired commodity servers.
Appliance servers are not developed, sold or supported by software vendors. Instead, this work is contracted out to a hardware vendor who simply images the software vendor's OS and application onto their standard hardware, which is then branded as an appliance for that software vendor. Since neither the software vendor nor the appliance hardware vendor (with few exceptions, such as Dell) is likely to have local support staff in many cities, technical support normally leads to customers mailing their appliance to a depot for repair or replacement.
The absence of a local support network, such as might be offered by a big-brand PC server manufacturer (IBM, HP, Dell, etc.). means that hardware repair takes at least 24 hours -- the time required to courier a replacement unit to a customer. This reduced SLA leads to the next problem:
Delivery of hardware appliances to some jurisdictions may require import licenses, export licenses, payment of duties, invoicing in local currency and may present a range of other challenges related to physical delivery of advanced, cryptographic technology to far-away places. This leads to longer lead times to deliver hardware to some locations in the world, higher cost and the need for more locally deployed infrastructure, usually in precisely those locations that would not otherwise merit extra capacity.
Because hardware repair cannot be provided promptly by either appliance software vendors or appliance hardware manufacturers, most vendors that sell appliance solutions encourage customers to buy redundant appliances. This means that where a customer might normally deploy a single conventional server, they must purchase and deploy two appliance servers for the same task, to get a comparable assurance of availability.
Appliances are just that -- pre-packaged hardware. This means that they cannot be virtualized. Organizations seeking to migrate their systems and applications away from raw hardware, and onto virtual servers and perhaps private or public clouds, cannot do so with an appliance.
Virtualization offers some important benefits, so this can be a serious problem:
Using an appliance negates all of these benefits.
For many of the same reasons that organizations are increasingly using virtualization technology, they are also using blade technology to increase the space and power efficiency of their server environments.
Appliances do not generally come in a blade form factor, so cannot contribute to a power and space saving server management strategy.
There are specific use cases where appliances are attractive:
There are also use cases where appliances are unattractive:
Appliance based solutions reduce initial setup time, but increase hardware cost (for redundancy) and where specialized hardware is not used, usually also reduce scalability.
This white paper was produced by Hitachi ID Systems.
Hitachi ID Systems, Inc. delivers access governance and identity administration solutions to organizations globally, including many of the Fortune 500 companies. The Hitachi ID Identity and Access Management Suite is a fully integrated solution for managing identities, security entitlements and credentials, for both business users and shared/privileged accounts, on-premise and in the cloud.
The Hitachi ID Identity and Access Management Suite is well known in the marketplace for high scalability, fault tolerance, a pragmatic design and low total cost of ownership (TCO). Hitachi ID Systems is recognized by customers and analysts for industry leading customer service.
The Hitachi ID Identity and Access Management Suite is an integrated solution for identity administration and access governance. It streamlines and secures the management of identities, security entitlements and credentials across systems and applications. Organizations deploy the Hitachi ID Identity and Access Management Suite to strengthen controls, meet regulatory and audit requirements, improve IT service and reduce IT operating cost.
The Hitachi ID Identity and Access Management Suite is designed to efficiently create, manage and deactivate user objects, identity attributes and security entitlements across systems and applications in medium to large organizations. This is done using a combination of automation and self-service:
A rich set of connectors are included, to easily integrate with most common systems and applications and to manage credentials including passwords, challenge/response profiles, biometric samples, OTP devices, PKI certificates and smart cards.
The Hitachi ID Identity and Access Management Suite is designed as identity management and access governance middleware, in the sense that it presents a uniform user interface and a consolidated set of business processes to manage user objects, identity attributes, security rights and credentials across multiple systems and platforms. This is illustrated in Figure [link].
Hitachi ID Identity and Access Management Suite Overview: Identity Middleware (2)
The Hitachi ID Identity and Access Management Suite includes several functional identity management and access governance modules:
Identity Manager includes the following additional features, at no extra charge:
Password Manager includes the following additional features, at no extra charge:
The relationships between the Hitachi ID Identity and Access Management Suite components is illustrated in Figure [link].
Components of the Hitachi ID Identity and Access Management Suite (3)