Levering Identity Manager with exteNd™

Greg Sengle

Solution Principal

Novell, Inc.

Avinash Vaz

Senior Architect

Novell, Inc.

Loren Russon

Director of Product Management

Novell, Inc.

Business Challenges
The Complexity of Business

Agility

Regulations & Threats

Conformance to Policy

Auditability

Information & Systems

Redundant Data

Multiple sources & platforms

Multiple User Types

Roles

Skill levels

Administration Models

Centralized

Distributed

Delegated

Security

Privacy

Internal & external attacks

Globalization

Across business boudaries

Across borders

Across languages

Costs

Budget (IT v.s. LoB)

Justification

Customization

Home-grown

Out-of-the-box

Upgradeable

Adding to the Complexity

Your Enterprise

Computers

Mobile Devices

Content

Applications

Messages

Employees

Customers

Suppliers

Partners

Regulators

Servers

Routers

Switches

PBX

The constant churn of new
entities your business has to
deal with.

Providing Business Agility via Technology
Enterprise Management Systems

Different management paradigms

Different standards

Different protocols

Each could be a silo introducing
another level of complexity

Ways we’ve tried to integrate them

Heterogeneity

Operating System

Directory Service

Vendor

Need to make a more
fundamental change

Resource
Management

Collaboration
Doc. Management

Server/Network
Management

Identity
Management

Your Enterprise

Find the Commonality
Lifecycle Management

Resource
Management

Server/Network
Management

Identity
Management

Your Enterprise

Collaboration
Doc. Management

Find the Commonality
What they manage

Resource
Management

Server/Network
Management

Identity
Management

They each manage “Identities”

Digital Identity

The representation of the
distinguishing characteristics
of an entity in a digital
system

Changes the paradigm

Allows for new possibilities

Leverage existing technology used to
manage people and apply it to other
forms of identities

The results of the new definition

Your Enterprise

Collaboration
Doc. Management

The Identity Driven Enterprise
Common Management Paradigm

Resource
Management

Server/Network
Management

Identity
Management

Your Identity Driven
Enterprise

Take standard business methodology
to solving problems…

Understand the whole problem

Create a re-usable process that can be
applied flexibly to many circumstances

Define the business policy to manage the
process for a given set of circumstances

…and apply it to technology

Manage through Policy for business
automation

Expose processes as re-usable Services

Derive Context to allow services to behave
properly based on policies

Collaboration
Doc. Management

Product Overview

Packages
SAP, PS, Oracle,
Siebel, etc.

Identity Driven Product Functionality

LDAP
A/D, eDirectory, etc.

RDBMS
Oracle, DB/2, etc.

Custom

External Identity

Stores / Applications

Access Management

& Federation

Audit & Compliance

Portal & Self-Service

Business Process Management

Enterprise Identity Stores

MetaDirectory

Visual Modeling of IDM Infrastructure

Policy &

Configuration

Virtualization

Identity

Stores /

Applications

Integrate

Automate

Access

Comply

Novell Virtual Directory Services

Novell Nsure Identity Manager

Novell exteNd

File System Factory

Enhanced Provisioning

Module

Novell Nsure SecureLogin

Novell Nsure Access Manager/
iChain

Novell Security Manager

Novell Modular Authentication Service

Novell Nsure Audit

Databases

ERP

Directories

CRM

Identity-Driven Products
Novell Nsure® & exteNd

Integration and Interaction

Access Security

Identity Management

Personalized Portal

Business Process Management

Web Services

Authentication

Single Sign-on

Authorization

Auditing

Directory MetaDirectory

Provisioning

Password Management

Role Based Profiling

Integration

Nsure

exteNd

Identity-Driven Solutions
Novell Nsure & exteNd

Intergration
exteNd & Nsure

Enhanced Provisioning Modules

Infrastructure

Visual Applications

Rapid Prototyping and Customer Value through Visual End User Applications

End-user &

Admin GUI

Powerful Identity Provisioning and Aggregation

Nsure Identity

Manager 2

Approval Workflow

Advanced White Pages

Advanced Organizational Charting

Lightweight User Administration

Delegated Administration

Visual Design, Deployment & Configuration

Distributed Authority

Automated Provisioning

Extensive Connectivity

Role Based Access Control

Logging, Monitoring, Auditing

Customize For Business Needs

Infrastructure

Visual Applications

Rapid Prototyping and Customer Value through Visual End User Applications

End-user &

Admin GUI

Powerful Identity Provisioning and Aggregation

Nsure Identity

Manager 2

Distributed Authority

Automated Provisioning

Extensive Connectivity

Role Based Access Control

Logging, Monitoring, Auditing

Customize the Applications to meet the Business Need

exteNd

ExteNd and Nsure

Identity and Provisioning as a foundation for ExteNd Solutions

Portals

Dashboards

Web Application development

Workflow

ExteNd as a toolkit to build Identity Management and Provisioning Solutions

Self Service

Provisioning Portal

Workflow

Case Study
Federating Business Objects

Identity is the key to Service Oriented Architecture

There are three dimensions of any service

•	The request itself, what is the service

•	The requestor, i.e. who is making the request

•	The object(s) of the request

Its necessary but not sufficient to package and deliver the requests and responses; all vendors can do this

Identity management is the key to the other two dimensions

•	Services must consistently authenticate, authorize and audit requests

•	Services must understand the relationship between the requestor and the object for authorization and audit

•	Services must know where to access any requested object given multiple systems and key structures

Services are a means to an end

So now that we have services, what do we do with them?

•	Combine into higher level services

•	Build entire orchestrated business processes

•	Leverage in workflows

•	Aggregate data from multiple sources

•	Enable inter-system communication

A service is only useful if constructed to be flexibly consumed

•	reducing total cost of ownership

•	achieving greater business agility

A complete application stack for identity driven computing

Authentication

Business

Integration

Presentation

Existing Systems

ExteNd

Composer

Local

Database

ExteNd Director

iChain

eDirectory

IDM 2.0

The Business Model and the Federated Namespace

$

User

Company

Account

Service

User requests access to the banking portal...

Existing Systems

ExteNd

Composer

Local

Database

ExteNd Director

iChain

eDirectory

IDM 2.0

IChain, managing access, verifies user credentials

Existing Systems

ExteNd

Composer

Local

Database

ExteNd Director

iChain

eDirectory

IDM 2.0

Portal personalizes environment based on user identity

Existing Systems

ExteNd

Composer

Local

Database

ExteNd Director

iChain

eDirectory

IDM 2.0

User selects “Get All Balances”...

Existing Systems

ExteNd

Composer

Local

Database

ExteNd Director

iChain

eDirectory

IDM 2.0

Portlet calls ExteNd composer web service to “Get All Balances”

Existing Systems

ExteNd

Composer

Local

Database

ExteNd Director

iChain

eDirectory

IDM 2.0

Authorized?

Existing Systems

ExteNd

Composer

Local

Database

ExteNd Director

iChain

eDirectory

IDM 2.0

For What Accounts?

Existing Systems

ExteNd

Composer

Local

Database

ExteNd Director

iChain

eDirectory

IDM 2.0

Where are the accounts?
What access credentials to use?

Existing Systems

ExteNd

Composer

Local

Database

ExteNd Director

iChain

eDirectory

IDM 2.0

Based on retrieved account identities, run “Get Account Balance” n times...

Existing Systems

ExteNd

Composer

Local

Database

ExteNd Director

iChain

eDirectory

IDM 2.0

Activity is audit logged using the same set of identities...

Existing Systems

ExteNd

Composer

Local

Database

ExteNd Director

iChain

eDirectory

IDM 2.0

Account identities are synchronized to the federated namespace in advance

Existing Systems

ExteNd

Composer

Local

Database

ExteNd Director

iChain

eDirectory

IDM 2.0

Companies are provisioned in advance, services assigned, delegated admin created

Existing Systems

ExteNd

Composer

Local

Database

ExteNd Director

iChain

eDirectory

IDM 2.0

Bank

Business

Admin

Finally, the customer's delegated administrator can provision their users

Existing Systems

ExteNd

Composer

Local

Database

ExteNd Director

iChain

eDirectory

IDM 2.0

Customer

Administrator

The Business Model and the
Federated Namespace

$

User

Company

Account

Service

eDirectory &

ExteNd

eDirectory &

ExteNd

eDirectory &

ExteNd

Deposit

System

Case Study
Provisioning with ExteNd & IDM

Features of the Provisioning System

The Provisioning Solution :

Allowed for provisioning requests made by multiple sources including Self Provisioning, Hiring Manager, and HR Manager.

Facilitated the creation of identities for Employees and Supplemental Staff allowing for the immediate provisioning of entitled systems.

Provided for the immediate disabling of an identity and the provisions associated with that identity.

Allowed for approval workflow at user defined points in the provisioning and de-provisioning process.

Features of the Provisioning System Cont..

Provided a solution for automating the provisioning of key Platforms: Lotus Notes, Active Directory, NDS etc.

Allowed for business units to define their own provisioning processes for both the entire business unit or for a group within the business unit.

Provisioning Solution Overview

Meta Directory – A centralized eDirectory instance that provides multi-directional synchronization within the Federated tree space.

Provisioning Engine – A collection of Web Services, JMS Services, a Business Process Engine, and Portal Services

Provisioning Portal – The web GUI used to administer the provisioning solution

Provisioners – The DirXML drivers and custom java connectors

Provisioned Systems – The directories, domains, system hosts and other network elements provisioned by the solution.

Logical View of the Provisioning System

Design & Implementation Details

Provisioning Portal

Is built on ExteNd Director

Uses Page Flow Technology

Uses Web Service Clients to invoke Web Services

Uses Portlets, XML & XSL

The Meta Directory

The Meta Directory

Is designed to represent the entire organization

Is designed to support organizational changes

Acquisitions

Divestures

Is designed to contain data of value to more than one connected system and/or necessary to facilitate management of the solution

Has a shallow container structure

The Meta Directory

META -1- CORP TREE

Company 2

Company 1

Vendor

Customer

Supplemental Staff

Employee

External
Vendor

Customer1

Contractor

FTE1

Vendor 1

Consultant

META -1- CORP

Services

Lookup

Servers

Location

eDir Server 1

ID Store

eDir Server 2

Loc. Code 1

ID 1

Loc. Code 2

ID 2

ProvGroup

ITGroup

AcctGroup

Intern/Coop

The Meta Directory Cont.

The Meta Directory

•	Contains objects for multiple identity types

–	Employees

–	Temporary Identities for Employees

–	Supplemental Staff

–	Customers

•	Contains non-identity data

–	Vendor / Partner Companies

–	Physical Locations

–	Unique credential lookup objects

•	Serves as the central component between each of the solution’s systems

Provisioning Engine

The Provisioning Engine provides for :

Notification Services

Provisioning Rules

Approval Service

Task Factories

Logging Services

Workflow Management

Accounts Being Provisioned

Lotus Notes

Microsoft Active Directory

Novell Directory Server

VPN Account

iNotes Account

White Pages Account

NDS Authentication Tree Account

Provisioning Rules Engine

The Provisioning Rules Engine specify rules that govern certain aspects of provisioning.

It determines the availability of Provisions for an Identity

Provisions can be assigned at various levels in an Organization. For example,at an Enterprise Level, Business Unit and Business Unit Group Level

Provisioning Types

Automated Provisioning

Automatically provisions accounts based on the rules setup in the Provisioning Rules Engine

On-Demand Provisioning

Allows for Ad-Hoc provisioning of accounts

Manual Provisioning

Allows for provisioning of commodities that require manual intervention. For example, provisioning a user with a Laptop or Cellular Phone

Subscription based Notification

Users of the Provisioning Portal can Subscribe/Un-subscribe to Notification events

User can Subscribe/Un-subscribe to Notification Events at an Enterprise, Business Unit or a Business Unit Group level

Examples of Notification Events:

Person Identity Created

Lotus Notes Account Provisioning Failed

PAM Authentication Tree Account Rename Successful

Provisioning Sequence Diagram

Provisioning Sequence Diagram contd.

JMS IDM Driver

Provisioners

Meta Directory

Logging Server

Notify Driver

Auth Tree

JMS

Drivers

PS Driver

Lotus Notes

Whitepages eDir

Lotus Notes

Java Agent

VPN

Auth

AIX-PAM

Linux-PAM

eGuide

Provisioning

Portal

Provisioning

Engine

Corporate PeopleSoft HRMS

Non-US based Employee Integration Architecture

Move and Rename Loopback

iChain protected web resources

LDAP

Notify Driver

Move Proxy Driver

Notify
Driver

Charlotte

eDir

GIS Active Directory

Legend

Java Provisioner

ID Manager
Driver

AD Driver

eDirectory Drivers

Publisher driver utilizes a set of shared stylesheets to ensure unique object names in the Meta Directory

Subscriber driver that drops identity events from the Meta Directory into a JMS Queue.

Provisioners – JMS IDM Driver

Extend

Compser

Meta Director(eDirectory)

eDirectory Request

Queue

Composer Request

Queue

Data

Data

Composer

JMS

Connectors

exteNd MP

IDM

Drivers

Getting Started
Identity Driven Computing
Discovery Workshop

CAPABILITIES

Business and IT strategy

Solution implementation and integration

Services-oriented architecture design model

Web application development

Web services-based system integration

Flexible delivery and pricing approach

Proven project management skills & methodologies

CORE VALUES

Rapid delivery of business value

Innovation and IT transformation

Vendor objectivity

Collaborative, iterative client interaction

Phased delivery model

Milestone-driven with visible ROI

FOCUSED AROUND…
Service-oriented architecture

Web application development & integration

Identity & access management

Novell Consulting

SOLUTIONS

Integration

Implementation

Strategy

Novell Consulting Methodology

Identity Driven Computing Discovery Workshop

Questions & Answers

The complexity of business affects each and everyone of us on a daily basis. Some are forced upon us, some have occurred through evolution, and some we have chosen ourselves. (Ask audience what systems they have, what kind of user community they support and how many.)

Regulatory Issues

Security

Who is accessing information ?

What is their role ?

Where & how is the information being accessed ?

How and when is it being delivered ?

Is it too much information or too little ?

Governance issues

128 bit encryption required

Operating systems and patch requirements

Cant be accessed at particular times and dates

Customers each have their own unique set of needs, driven by their business model, their industry, and their IT environment. Novell has the ability to respond to those needs, regardless of where they may start in relation to our product and service offerings. The customers immediate priorities and “pain points” can be addressed with our SIM offerings whether they start with Portals, Access and Security, or Identity Management. From any one, or any combination of these entry points Novell has the ability to take the customer forward towards a complete SIM solution.

The advantage to the customer, is that we respond according to their immediate pain, their unique environment, their business model. Novell’s approach allows them to avoid a rip and replace process, building on their current IT environment. Once the initial solution is in place, they continue to build, further leveraging not only their legacy investment, but also their investment in Novell products and services. We can enable our customers to leverage their entry point with a quick ROI. We can then increase their VOI by expanding our SIM solution into their environment via phased engagements. The further down the road map they travel, the more valued derived.

For Novell, this removes constraints to up sell the customer towards other solutions and addresses integration issues.

In summary, multiple entry points based upon a building block approach provides the customer with a roadmap to a long-range solution with increasing value while removing issues of integration.

Note that competitors such as Waveset and BusinessLayers are primarily in the middle layer:

they lack the connectivity and synchronization facilities of Identity Manager, relying primarily on protocols such as LDAP, JDBC and XML

they lack the robust extension framework of exteNd: customization is typically through javascript or other such facilities

2003-12-08T12:43:39