Has anyone developed a security architecture around Intalio that allows for integration with external services and user interface components?
Out of the box, the Intalio suite does very basic user logon into the TEMPO workflow application. Some guidance on fitting Intalio into enterprise or multi-enterprise operations would be of interest.

We have good integration with LDAP if that's what you are after.

Yes I understand that and obviously for a single enterprise LDAP is sufficient as a database of roles, rights and the like. However, it is more complicated when the Intalio product is used to integrate between organisations or independent systems or in any case where the end points of ODE and TEMPO components are exposed .

Consider for example the simple case where the business process receives inbound SOAP messages from a 'black box' external entity. If you take an Intalio-centric view you could
1. Require the external entity to authenticate itself
2. Pass a token representing that authentication in every inbound message to Intalio BPMS
3. Validate that token in each BPMS process before doing anything else

This strikes me as being open to error and difficult to scale in a large development.

Alternatively you could move the problem up to the WS security layer. Has any work been done in this area?