02/11/2015. This is a slide for graphics (It has a white background)

Transcription

1 This is a slide for graphics (It has a white background) 1

2 2

3 Now & Future Password 1 Password 2 Password 3 Password 4 GAfE, AzureAD, onprem AD. ChromeOS, PC, ios. Various web apps. Distributed. Last 10 years Microsoft AD PCs and servers Type of App Identity Issues/Problems Federated a way of connecting different completely independent security realms/networks with each other such that the users in each realm can access resources in each of the these realms 3

4 William Harry s dad Harry aka The Baker Williamson 4

5 5

6 Relationship starts Provisioning De-provisioning Relationship ends Identity Lifecycle Authentication Compliance Authorisation Self-Service Password Management AUTHENTICATION AUTHORISATION PASSWORD COMPLIANCE SELF DEPROVISIONING SERVICE MANAGEMENT Sign Simplify Self-service Enforce Forgotten Simple, Automated into automated a permissions your user passwords via reducing network attribute the startersleavers Role process policy based in only MIS access share user with from the anywhere. RBAC burden. release provisioning. control. minimal Self system. service data password with apps. SSO Delegated recovery Driven from from via integrated password existing devices. data reset SMS. Network Audit source: key MIS admin management rights Cascade where of user appropriate. provides delete to all Support consent tasks, App connected catalog e.g. many for password apps. data shop web release SSO window reset. to standards apps. Reviewing of Onward online provisioning resources hosting makes location app for of all of integration online teachers. your connected services. simpler. services. Provisioning The process of preparing a service for new users, prior to them accessing it In-advance provisioning When the app must know about users before access Needs a data feed to be kept in sync with Identity Provider E.g: Office 365 Outlook (we must create mailbox ahead of time) Just in time provisioning When the app creates account on-the-fly App knows the user is authorised by Identity Provider App might receive a few data attributes about the user E.g.: Simple reading app (just needs to bookmark) 6

7 Service Provider HARRY, Password XYZ HARRY, R+W TRUST HARRY = SMT HARRY, Password XYZ Identity Provider HARRY, R+W KDC 2. Package decrypted & identity claim checked 5. Ticket for file server sent to client 1. Encrypted Authenticator Package 6. Client access to file server via Ticket 3. TGT Sent to client 4. TGT Sent to KDC with request for Ticket 7

8 AKdNCkt9hZ1%2F14GmkwfFl%2Fv%0APfc7p6cr4K3qWNq7Ru%2FFWy%2FAeZ%2Bt0sDGRYx6q5nhIIFp3g pgrmj5erdj1a9y%0az40zlvhiswgeddlotdhqt8lmwr7lsjzudzfqnouayqynlp1kmb62gtdhvwwc%0ad6p SKOEaH8DgE5ni7CEvkLcZokjNT9AzhIM%2FBF4fACvAyNtuYvRSRSIiZXlN%0AwrlY0CriSxKGhNLDFeXhYjkf ZAC92GpwXLsY0YCEM0JnQVQESxaEjCyekZd9%0AP%2BxG6lrq18stlJMI2G1RZLMp%2FJOwMAYfBChZnb pko7e9a%2fcylv9uipj%2ffbjc%0azy6tzcfub%2bx2kxklq6oxkmu%2b1sopezeiccftye%2fft74a%0a& RelayState=cookie%3A &SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsasha1&Signature=M0xoWQfcN3Yp94T2HiqIdJzEkxYqGc6hhopqi8xOI%2B2BtPSLufFDdQIF7z6Xjm6XdLq1MH 9Av5xz2QWYs84ZYhlG3fHtZCjjaoI2wZqplRszHla%2BjtZoW20NGDepDsCRT0AKNkhe%2B4Yj3LshrM6EX5O 3obx2Mypy8EcsoURkTF3kf1dwKqsGA3ka7ehbRmUQGJUXD0u4iFBog7YgkL4Q9FYMTanZeRo2X4%2FkAe NxT8ormKWJfYnAzg0F4Ku60zDd5N7jYu4XeyOsXDthEFI5H4WYucAprREl2hgSUI21J782kKzrslalIaJ5BKPIO 50NPCIb5Sf6Zw4maLpZrFEfrw%3D%3 8

9 ype=code&client_id=3fb2a37f-4ced-409c-937cdddd776f4dfd&redirect_uri= esource= 4. DB1 checks with main identity provider 3. Client needs access DB1 WEB1 2. WEB1 checks with main identity provider 1. Client needs access. Authenticates 9

10 10

11 Sign in 02/11/2015 User accounts MIS Authentication RM Unify AD Sync 11

12 12

13 13