Architecting Identity Management Solutions

Dave Cox

Global Solutions Manager

dacox@novell.com

Rainer M. Oebels

Global Solutions Architect

roebels@novell.com

Security starts with Identity

Session Objectives

Introduce the overall Secure Identity Management Architecture

Provide insight into three SIM concepts through a simple scenario

Pique curiosity to seek more information & skills

The Scenario

CIO’s “Inside-Out” Initiative

Objective

To securely extend three web applications beyond the corporate WAN to mobile employees, and select partners.

Web Applications

Intranet web site

Expense Reporting

Product Technical Support (Log support issues, Query knowledge-base)

Mandates

Must pass thorough security audit

Users required to use only one username and password

Differentiate users for authorizing access to applications

Solution Components

Solutions

Technology

Process

People

Simple View of SIM Architecture

Auditing & Compliance Infrastructure

Identity Integration Infrastructure

Access Management Infrastructure

Employees

Cusromers

Partners

Suppliers

Your Existing

Systems

High level components of a secure services network

Identity

Vault

Employees, Customers, Suppliers, Partners

Authentication Services

Authentication Services

Web Services/Portals

Enterprise Apps &

IT Services

Business Process

Automation Services

Access Management Channel

Data Integration Channel

Enterprise Data

Identity Data Integration Channel

Audit Channel

Audit Records

Internet, Intranets, Extranets

Identity & Security

Policy Management

Secure Services Solution Platform

Business Process Management

Web Services and Portals

Access Management

Password Management

Identity Integration

Audit

exteNd

Layers

Nsure or

SIM

Layers

Begin with Identities

Session Objectives

Building Blocks

Identity Data Cleansing

Identity Vault

Authoritative Source
Designation

Administration Process
Mapping

Identity & Security Policy
Management

Identity Data Synchronization Engine

Business Process Management

Web Services and Portals

Access Management

Password Management

Identity Integration

Audit

Identity Vault Issues & Considerations

Number of objects (millions or just “normal”)
Number of attributes

Optimize access speed

Lots of information

Object types (employees, customers, partners …)

Sensitive data (access protection)??

Roles and access control

Authentication or lookup directory

Fast synchronization

Business process management

Identity Vault Issues & Considerations

Business process management

User types and Operation types

Considerations

Response time to operation request

Real time vs non

Number of replicas and partitions to keep in sync

Repairs

Simple architecture = repairs needed less often

Ensure repairs can be done within required SLA

ID Vault should be “sacred” – should not be used for anything not directly related to its function of aggregating and correlating user info across systems

Example is information about people available in a whitepages directory. Not just simple info, often could include heavy data like pictures making the size of the database much larger.

Keep the schema confined to only those attributes that MUST be shared between more than one system.

Non-Integrated Identity Problem
heterogeneous systems

Emplyee

Identity Data

Product

Technical

Support

Intranet Access

Database

Expense

Reporting

System

Partner

Identity

Data

Integrated Identity Model
Identity vault, platforms, and service directories

Identity Vault

Identities

Aggregated,

Accounts Correlated

Emplyee

Identity Data

Product

Technical

Support

Expense

Reporting

System

Partner

Identity

Data

A Distributed Directory Requires a Complex Data Structure

Contains a wide range

of information about

each identity, to

support many uses

Server

Users

Admin

[ROOT]

A Flat Directory Tree Architecture
Is Better For Identity-related functions

Structure supports fast read operations

Small number of attributes per object

Scalable up to millions of objects

One partition

Server

Users

Admin

Draw your Identity Vault & Other Directories Structures

Our Identity Vault Design

ROOT

Admin

Users

IANACTIVE

ACTIVE

ROLSE/GROUPS

Next, Secure & SimplifyAuthentication

Identity Vault Issues & Considerations

Building Blocks

Authentication proxy server

Password sync

Password redirection

Password store and forward

Basic authentication services

Self-service password reset

Security policy management

Graded authentication

Federated authentication

Business Process Management

Web Services and Portals

Access Management

Identity Integration

Audit

Password Management

Identity Vault Issues & Considerations

Security is compromised

Users will

Use weak passwords

Share passwords

Record passwords

Different Architectural Approaches Available for Solving the Problem

Identity

Vault

Identity

Vault

Identity

Vault

App 1

App 2

App 1

App 2

App 1

App 2

Identity Manger 2

Single Password synchronized across all systems

Novell Account Management

All systems redirect the

authentication request to a

single identity

SecureLogin & iChain

Single point of

Authentication despite many

different credential sets

Password

sync

Redirected

authentication

User sets

password

User logs

in to any

system

User

authentication

once

Store

credentials

are forwarded

Components of Scenario

Identity

Vault

Identity

Vault

Authentication Proxy Server

Intranet web site

Expensive Reporting App

Tightl coupled with internal authentication function

Information regarded as sensitive

Product Technical support

UNIX-based authentication

Draw your Secure Password & Authentication Environment

Components of Scenario

Identity

Vault

Identity

Vault

Authentication Proxy Server

Intranet web site

Expensive Reporting App

Tightl coupled with internal authentication function

Information regarded as sensitive

Product Technical support

UNIX-based authentication

Our Drawing

Identity

Vault

Identity

Vault

Authentication Proxy Server

Intranet web site

Expensive Reporting App

Product Technical support

Mobile Employee

Partner Personnel

SSL

LDAP

Redirected (LDAP)

User Data

Password Distributed

Finally, Control Access

Authorizing Access based on Identity

Building Blocks

Role & Group Definition

Authorization Privileges

Forward & Reverse Proxy

Secure Network Access
(i.e. VPN, Firewall)

Business Process Management

Access Management

Password Management

Identity Integration

Audit

Web Services and Portals

Web-Based Resource Types

Public

Open to all without qualification

Restricted

Authentication only required

Secure

Authentication AND Access Control Rules Required

Identity Types

Organization Membership

•	Non-granular. Usually used to grant access to most users in a directory.

Organizational Unit Membership

•	Slightly granular. Used to grant access to a large group of users (i.e. all active employees)

Group & Dynamic Group Membership

•	Granular. Can be used to grant access to a small sub-set of users with specific combinations of attribute values.

Components of Scenario –
Limiting access based on role

Authentication

Directory

Identity

Vault

Authentication Proxy Server

Intranet.com

Intranet.com/products

Partners allowed access

Expense Report App

People managers only

Mobile Employee

People Manager

Partner Personnel

Draw your own access control diagram

Components of Scenario –
Limiting access based on role

Authentication

Directory

Identity

Vault

Authentication Proxy Server

Intranet.com

Intranet.com/products

Partners allowed access

Expense Report App

People managers only

Mobile Employee

People Manager

Partner Personnel

Our Drawing – General Employee Access

Authentication

Directory

Identity

Vault

Authentication Proxy Server

Intranet.com (Secure)

Intranet.com/products

Partners allowed access (Restricted)

Expense Report App

People managers only (Secure)

Mobile Employee

People Manager

Partner Personnel

User Data

Access Denied

Access Granted

Access Granted

Check Organization Unit

Membership

LDAP

Active Employees

SSL

Our Drawing – Partner Access

Authentication

Directory

Identity

Vault

Authentication Proxy Server

Intranet.com (Secure)

Intranet.com/products

Partners allowed access (Restricted)

Expense Report App

People managers only (Secure)

Mobile Employee

People Manager

Partner Personnel

User Data

Access Denied

Access Granted

Access Denied

Check Organization Unit

Membership

LDAP

Active Employees

SSL

SSL

Our Drawing – People Manager Access

Authentication

Directory

Identity

Vault

Authentication Proxy Server

Intranet.com (Secure)

Intranet.com/products

Partners allowed access (Restricted)

Expense Report App

People managers only (Secure)

Mobile Employee

People Manager

Partner Personnel

User Data

Access Granted

Access Granted

Access Granted

Check Organization Unit

Membership

LDAP

Active Employees

SSL

Wrap Up

Build SIM solutions
with all the layers and elements in mind

Solutions

Technology

Process

People

Business Process Management

Web Services and Portals

Access Management

Password Management

Identity Integration

Audit

Appendix

i-login.net

DIR XML

Auth Tree

LDAP

Novell_Inc

Authentication

http://www.i-login.net/(NPS)

http://www.i-login.net/(NPS)

http://support.novell.com

http://www.novell.com

http://education.novell.com

innerweb.novell.com

iChain

Authorization

Tree

IDVAULT

Securing Organizational Resources

Novell Nsure Secure Identity Management

NAM Nsure Resources

DirXML

Secure Login

Border Manager

NET

iChain

Administrator

Partners/suppliers

Custumers

Employees

NT/200/XP

Host

Directory

Web Servers

What’s happening

in my systems?

Identity Integration Architecture
The hub-and-spoke model

Identity Vault

HR System

Help Desk

Sytem

Email

System

File &

Print

PBX

User ID

Email Address

Network Address

First Name

Last Name

First Name

Last Name

Employee ID

Location

First Name

Last Name

Employee ID

Address

Location

First Name

Last Name

Location

Email Address

Phone Number

First Name

Last Name

Location

Multiple Directories Overview

Access Manager

Phone Books

Gaming

Other

Active

Directory/

Exchange

Production

eDirectory

Hierarchical

NT Domains

Sun One

HRIS

eMail

Platform Directories

Directory Providers

Service

Directories

LDAP

Directory

Consumers

Authoritative Source

Databases/Directories

Identity

Vault

Role-Based Access Management

ID

ID

ID

ID

Your business

Who are you?

What is your role?

What do you need access to?

Understanding DirXML
Application to Application

ERP

Application

Email

Application

DirXML

Engine

DirXML

Driver

Shim

DirXML

Engine

DirXML

Driver

Shim

Subscriber Channel

Publisher Channel

Publisher Channel

Subscriber Channel

ERP Application

e-Mail DirXML Driver

Rules & Stylesheets

Rules & Stylesheets

Rules & Stylesheets

Rules & Stylesheets

Data Flow Architecture

Architecture for Cleansing Identity
Data to Load an Identity Vault

Initial Data

remaining

unmatched

records

remaining

unmatched

records

First 'Wash Cycle'

Second 'Wash Cycle'

No

match

100%

match

<100%

0%

Y Filter N

Input File

Copy

Id Vault

Copy

Id Vault

Copy

Id Vault

Copy

Input File

Input File

NEW

Id Vault

Copy

Manually edit

& recycle

Match Y%

Match X%

Match 100%

100% Filter

Summary of Data-Cleansing
and Loading Processes

Remove known old users from all systems.

Clean up attributes of primary repository.

Load primary repository to the identity vault copy.

For each other repository

Back up the repository

Load into input File

Apply the first matching process with identity vault data

Generate unique ID when needed to the ID vault copy

Reflect the change to original systems

Load the ”starting set” to the ID vault.For those records that did not match, run them through the next matching algorithm. Continue the cycle until all unmatched or incorrect records are fixed or purged.

Secure Web Services Portal

Employee

Customer

Partner

email

ERP

CRM

Identity Vault

Firewall

Security Infrastructure

One Net

LHowarth - xxx

MYHales – xxx

GabeW – xxx

Web Servers &

Applications

Password Management in
Novell Secure Login (NSL)

eDirectory

Securely Store passwords in eDirectory

Benefits of
redirecting authentication using NAM

RACF, a mainframe access control
product, does not allow passwords
longer than 8 characters

This limitation could make a company’s
mainframe the weakest point in its
security architecture

With NAM, you can redirect
authentication to an LDAP directory
and require a stronger password

Identity

Vault

NAM

Mainframe

(RACF Security)

NAM redirects the

authentication

request to an LDAP

directory

Foundation for Secure Identity Management

Novell Nsure Secure Identity Management

Identity Integration & Account Provisioning

User Password

Management

Secure Proxy,

VPN Access

NET

Web Access

Management

Partners/suppliers

Custumers

Employees

NT/200/XP

Host

Directory

Web Servers

Auditor or

Administrator

Audit

Partners/suppliers

Other

Organizations

Capabilities of a Full Service Directory?

Discovery Services

Writing and retrieving data

Security Services

Securing the data

Relationship Services

Defining complex relationships among the data elements

Storage Services

Database functions

Maintains distributed data

Functions of Identity-related Directories

Identity Management

Repository for identities

Access privileges

Policy management

Hub solution

Store identities in a central directory

Store personalization information

Store security information

Authentication

Authorization

High-availability by replication

Scalable

Flexible

Performance

Supportable

Support LDAP

Extensible schema

NSure® Audit—Basic Architecture

2003-12-08T12:43:39