Novell Access Manager

Transcription

1 Novell Access Manager Product Overview Kiran Mova

2 Agenda Introduction Architecture IDP AG SSL VPN Administration Console How it works? Web SSO Federation SSO Protect HTTP Resources Protect non-http Resources NetIQ Corporation. All rights reserved.

3 Introduction Access Manager is a set of components that help to : Provide Web and Federated SSO Protect HTTP/Non-HTTP enterprise servers Provide SSO to Legacy Web Servers Also allows customers to extend : Authentication Mechanisms using Authentication SDK Authentication against Custom User stores using LDAP Server Plugin Policy Engine using Policy Extension API NetIQ Corporation. All rights reserved.

4 Sample NAM Deployment InnerWeb Access Gateway (innerweb.novell.com) VersionOne (v1.innerweb.novell.com) Employee Self Service (psselfservice.innerweb.novell.com) Identity Provider (login.innerweb.novell.com) SSLVPN (sslvpn.innerweb.novell.com) NetIQ Corporation. All rights reserved.

5 Architecture NAM 1..3 User Federated Identity Providers SAML 2.0, SAML 1.x, Liberty, WS Fed Web SSO Federated SSO Non-HTTP server Access Load Balancer(s) Identity Servers, Access Gateways, SSLVPNs 1 Identity Provider (Authenticate) 1 Access Gateway (Authorized Access) VPN SSL VPN (Authorized Access) 1 1 Audit, Alerts Configuration, Policy Administration Console J2EE Agent (Authorized Access) Web UI User Directory (LDAP) Administrator Authentication Servers (RADIUS, etc.,) Mission Critical and Enterprise Data Systems. HTTP and non-http NetIQ Corporation. All rights reserved.

6 Admin Console Key Features Administration Console Configure Components Monitor Health and Statistics of Individual Components Policy Administration Certificate Management Delegated Administration Persistent configuration store Granular Auditing (embedded NSure Audit Server) NetIQ Corporation. All rights reserved.

7 Architecture AC Federated Identity Providers NAM Administration Console edirectory Web UI (HTTPS) Administrator User Load Balancer Authenticate Identity Provider Access Gateway Nsure Audit Server Audit (TCP) Audit Cache Alerts (HTTPS) Device Manager (imanager/tomcat) JCC Configuration/ Commands (HTTPS) LDAPS Cert Configure (LDAPS) Config, Policy, Certificate Store Clustering (edirectory Replica) Configuration, Policy (LDAPS) User Directory (LDAP) Authentication Servers (RADIUS, etc.,) Mission Critical and Enterprise Data Systems. HTTP and non-http SSL VPN NetIQ Corporation. All rights reserved.

8 Identity Provider Key Features Identity Provider (IdP) Authentication (includes x509, RADIUS..) Federated Authentication (SAML/ADFS) Associate Roles and Attributes with authenticated user Capable of authenticating against multiple User ID stores like edirectory, Active Directory Sun One etc., Extensible Authentication and Policy framework SP (Service Provider) Agent Shared Component Redirects all authentication requests to IdP Maintains a cache of user data fetched from IdP Evaluates Policies by requesting additional data from IdP NetIQ Corporation. All rights reserved.

9 Architecture - IDP Federated Identity Providers NAM Identity Provider Audit (TCP) Alerts(HTTPS) Administration Console SAML 2.0, SAML 1.x, Liberty, WS Fed (HTTPS) Load Balancer Audit Agent Authentication & Attribute Services (Tomcat) JCC RMI Configuration (HTTPS) Configuration, Policy (LDAPS) User Data (LDAP[S] ) Custom Connections Web UI Administrator User Directory (LDAP) Authenticate 2 Clustering (JGROUPS) Authentication Servers (RADIUS, etc.,) User Access Gateway SSL VPN Liberty and Attribute Service (HTTPS) Mission Critical and Enterprise Data Systems. HTTP and non-http NetIQ Corporation. All rights reserved.

10 Access Gateway Key Features Access Gateway (AG) Authentication (via Identity Server) Authorization Single sign-on to Legacy Web Servers (form-fill, identity injection) Identity injection (personalization) Secure exchange (SSLizer) Multi Homing Load Balancing URL Normalization/ Rewriting Caching Policy Extensions API NetIQ Corporation. All rights reserved.

11 Architecture - AG Federated Identity Providers User Load Balancer Authenticate SAML 2.0, SAML 1.x, Liberty, WS Fed (HTTPS) 2 NAM Identity Provider Access Gateway Clustering (JGROUPS) HTTP(S) AJP Liberty and Attribute Service (HTTPS) Audit (TCP) Session Cache SSL VPN Alerts(HTTPS) Configuration (HTTPS) Active MQ Administration Console Web UI Administrator User Directory (LDAP) Audit Agent JCC RMI Configuration, Policy (LDAPS) SP Authentication Agent Gateway Policy Extension API Servers Manager (RADIUS, etc.,) HTTP Apache Instance Config Messages HTTP(S) Mission Critical and Enterprise Data Systems. HTTP and non-http NetIQ Corporation. All rights reserved.

12 SSLVPN Key Features SSL VPN Provide Secure access to Non-HTTP Applications Enterprise mode (full access) or KIOSK mode (application access) Client Integrity Check and Policy Based Access Desktop Clean-up / Secure Folder NetIQ Corporation. All rights reserved.

13 Architecture SSLVPN (Server) Federated Identity Providers NAM Identity Provider Audit (TCP) Administration Console Alerts(HTTPS) SAML 2.0, SAML 1.x, Liberty, WS Fed (HTTPS) Access Gateway HTTP(S) Liberty and Attribute Service (HTTPS) Configuration (HTTPS) Web UI Administrator User Directory (LDAP) Load Balancer HTTP Authentication Servers (RADIUS, etc.,) 2 User Authenticate HTTP(S) SSL SSL SP Agent STunnel Open VPN Server Audit Agent Conn Mgr Socks Server JCC Configuration(LDAPS) TCP Mission Critical and Enterprise Data Systems. HTTP and non-http SSL VPN NetIQ Corporation. All rights reserved.

14 Architecture SSLVPN Client (KIOSK) NAM SSL VPN Client Stunnel Policy Engine Socks Client SSL SP Agent STunnel Open VPN Server Audit Agent Conn Mgr Socks Server JCC SSL VPN TCP Mission Critical and Enterprise Data Systems. HTTP and non-http Application User NetIQ Corporation. All rights reserved.

15 Architecture SSLVPN Client (Enterprise) NAM SSL VPN Client Open VPN Client TUN Driver SSL over TCP/UDP SP Agent STunnel Open VPN Server Audit Agent Conn Mgr Socks Server JCC SSL VPN TCP/UDP Mission Critical and Enterprise Data Systems. HTTP and non-http Application User NetIQ Corporation. All rights reserved.

16 Recent/Current Initiatives... Access Management On Demand Federation Hub Simplification Creating products out of individual components NetIQ Corporation. All rights reserved.

17 Simplification NetIQ Corporation. All rights reserved.

18 How it works?

19 Web SSO User Service Provider (Web Server) Identity Provider User Id Store 1 SP Agent Redirects to IdP for authentication If authenticated goto (4) If not, seek credentials 2 Post Credentials 3 Validate Credentials 4 IdP Redirects to SP Agent with Auth Token 5 Verify Token Create User Session, form a token to send to SP Agent Respond with Assertion, including user attributes/roles Provide Access NetIQ Corporation. All rights reserved.

20 Federated SSO User Identity Provider User Id Store Federated Identity Provider 1 Request for Authentication (SAML/Liberty/WSFed) If authenticated goto (8) If not, redirect to Trusted Federated Identity Provider Configuration Store 2 Send AuthRequest to Federated IdP If not authenticated seek credentials 5 IdP Receives the authentication 6 Verify Token 6 Provide AuthResponse with authentication details Map to Local user or Autoprovision the user. 7 Create user session and store persistent federation mapping 8 Respond with Auth Token NetIQ Corporation. All rights reserved.

21 Protect HTTP Resources User Access Gateway Identity Provider User Id Store Web Server(s) 1 Access v1.innerweb.novell.com If authenticated goto (7) If not, redirect to SP Agent 2 SP Agent Redirects to IdP for authentication If authenticated goto (5) If not, seek credentials 3 Post Credentials 4 Validate Credentials 5 IdP Redirects to SP Agent with Auth Token 6 Verify Token Create User Session, form a token to send to SP Agent Respond with Assertion, including user attributes/roles 7 Authorization Policy 8 Redirect to Access Resource 9 Form fill, Identity Injection, Load Balance 10 URL Rewriting, Cache NetIQ Corporation. All rights reserved.

22 Access to Non-HTTP Resources User SSL VPN Client 1 Login to SSL VPN (using IdP or AG) SSL VPN If authorized user, push the SSL VPN Client Enterprise Server(s) 2 Accept and Install Client Install Client Integrity Check Establish VPN Tunnel Client Policy Update VPN Tunnel 3 Access Enterprise Server Virtual/HookingAdapter, takes request, routes through tunnel. 4 Authorize Access, Forward 5 Logout Desktop Clean up NetIQ Corporation. All rights reserved.

23 NetIQ Corporation. All rights reserved.

24 Worldwide Headquarters 1233 West Loop South Suite 810 Houston, TX USA (Worldwide) (Toll-free) [email protected] NetIQ.com NetIQ Corporation. All rights reserved.

25 nts in or changes to the software described in this document at any time., Group Policy Administrator, Group Policy Guardian, Group Policy Suite, IntelliPolicy, Knowledge Scripts, NetConnect, NetIQ, the NetIQ