<Insert Picture Here> Understanding Identity as a Service

Transcription

1 <nsert Picture Here> nderstanding dentity as a ervice ishant Kaushik Principal rchitect, Oracle dentity anagement

2 efining dentity elationships ser * Personal & orporate nformation dentity esources (credentials, privileges, activity) uthorizations oles * Let s not forget non-human users (machines, services, ) 2

3 dentity is verywhere biquitous, istributed, ragmented, uplicated very application/physical asset holds a bit of information about enterprise identities dentity is key to the operation and delivery of business services he data that comprises an identity comes from multiple sources, and is constantly in flux H ystems Portals orporate irectory eporting, B ools ystems Helpdesk, Workflow ystems nterprise ainframes pplication tores ollaboration ools Physical ssets 3

4 dentity anagement is oo omplex oday, dentity anagement follows a classic ystems anagement pattern, tying together through integration the various silos that exist within applications ntegration... pplication unctionality ser ables ser & Password tores ser Profiles & Preferences ustom authentication schemes omplex authorization needs Profile & Password anagement 4

5 dentity is ausing Headaches nterprises must deal with complex challenges in managing dentities nsatisfactory ecurity & ompliance Burdensome egulations & Oversight ntegration osts omplex udit rameworks xpensive d eployments onitoring & ynchronization Problems ostly nfrastructure assive esign & evelopment fforts 5

6 ntroducing dentity as a ervice he goal: to devolve all those application identity silos into a common enterprise layer s organizations move towards O, identity components and management capabilities must be made available as a service in that architecture hared, eusable ervices ervice 1 ervice 2 ervice 3 dentity ervices ervice nfrastructure etail ustomer pplication Partner pplication mployee Portal pplications haring ervices all enter pplication 6

7 nterprise rchitecture with aa dentity ervices provide identity in a consistent, reusable way to all applications/services nables them to make identity an integral part of their business logic in a coordinated and meaningful way Presentation (nterfaces) ata ources Process (pplication, ontroller) omain (Business) dentity ervices nfrastructure ata (Persistence) 7

8 Why dentity as a ervice? aa enables integration of identity services into application development and application runtime environments pplications can now embed functionality as part of their inherent business processes without having to code it themselves onforms to the O approach to enterprise development, promoting loose coupling to ensure long term viability and heterogeneity of business solutions 8

9 9 he dentity ervices Layer dentity ervices ole Provider udit uthentication uthorization dentity Provider Others P G & sers Business pplications Provisioning

10 dentity ervices in aa dentity Provider: xternalize dentity ttributes ervice that provides access to identity profile data pproach has evolved over time v1.0: onsolidation in irectory v2.0: Virtualized view over multiple identity data sources sers Business pplications v3.0: ollaborative metasystem? nteresting equirements: G support upport definitive (date of birth) and derived (over 21) identity data eclarative models for both consumer and provider apping/translation layer ederation dentity ervices dentity Provider uthentication ole Provider uthorization P G Provisioning elevant tandards & udit L G (L/PL) Higgins/Bandit Others 10

11 dentity ervices in aa uthentication: xternalize ser dentification ervice that provides identity authentication capabilities urrent state of the art: O, eo, ederation sers Business pplications merging user-centric identity technologies: Open, ardspace nteresting equirements ulti-token authentication support ecurity oken exchange ervice () Graded uthentication Levels Lightweight ederation dentity ervices dentity Provider uthentication ole Provider uthorization Provisioning elevant udit tandards L W-* Others P G & 11

12 dentity ervices in aa ole Provider: xternalize ole anagement ervice that provides roles and role memberships nables heterogeneous B adoption v1.0: reat Groups in dentity irectory as nterprise oles sers Business pplications oo simple for modern enterprise nteresting equirements: upport nterprise oles as well as pplication oles upport context sensitive roles upport session roles dentity ervices dentity Provider uthentication ole Provider uthorization Provisioning udit elevant tandards one Others P G & 12

13 dentity ervices in aa uthorization: xternalize ine-grained ntitlements ervice that supports entitlement modeling & fine-grained authorization arly stages sers Business pplications tarted with the emergence of XL standard nteresting equirements: ine-grained entitlement modeling eal-time, high performance Policy nforcement Points dentity ervices dentity Provider uthentication ole Provider uthorization Provisioning udit elevant tandards XL Others P G & 13

14 dentity ervices in aa Provisioning: xternalize dministration ervice that supports administration of context urns current model inside-out Provides centralized policy administration and controls nteresting equirements: nd-user sers empowerment Business pplications pproval-based administration ederated provisioning upport local context entralized policy enforcement hange notification mechanism Will change dramatically over time dentity ervices dentity Provider uthentication ole Provider uthorization Provisioning udit elevant tandards Others P PL (potentially) G & 14

15 dentity ervices in aa udit: xternalize dentity vent uditing sers Business pplications ervice that audits all identity events Provides centralized repository, denormalization of audit data nteresting equirements: vent orrelation udit rails ctivity onitoring raud etection dentity ervices dentity Provider uthentication ole Provider uthorization Provisioning udit X Others P elevant tandards G & 15

16 e-perimeterisation and aa -PO ove security control closer to the source to the end-points Be in total control of all users access rights Be in control of the connecting device dd policies that dictate how and under what circumstances each user can access each service ake access seamless and base it on cooperation between applications and users and the use of secure protocols Y V aintain identity attributes at the source avoid replicating it out unnecessarily entralize role and identity policy management stablish standard-based policies for how applications connect to and use identity authorities upport a declarative system for identity usage that is based on application usage and environmental factors ake identity services part of your enterprise O platform, and use standards-based protocols where available What is e-perimeterisation taken from the presentation ecure pplications by omas Olovsson at Jericho orum pring onference

17 oadmap to aa till early stages, but a lot can be done today nterprises easure your d maturity level (see appendix) mbrace the O lifestyle dentify identity sources and virtualize an enterprise identity profile ocument and put in place processes to govern management and use of identity information Get involved! (see appendix) Vendors Work on the standards needed for identity services dopt a services-focus in products ake the person part of the process 17

18 onclusions dentity must be aligned with the strategic direction of the enterprise be holistic in its coverage help identify future state bring adaptability in the face of change introduce consistency and efficiency in infrastructure aa will reduce complexity through increased ability to leverage critical identity data while removing the management/replication challenges increase security by providing centralized policy management and a controls framework that can dynamically mitigate risks create a flexible, adaptable, integrated platform on which to build applications makes new types of de-perimeterised, identity-based business functionality viable 18

19 ontinue the ialogue On y Blog 19

20 ppendix: Get nvolved! Project oncordia nternet dentity Workshop Liberty lliance Burton Group s dentity ervices Working Group 20

21 ppendix: easure your d aturity Level 1 actical Level 2 Process-entric onverged & Physical ecurity ull egulatory ompliance Level 3 ligned isk anagement dentity ederation Password anagement nterprise irectory Web ccess anagement nterprise O eta-irectory nterprise oles Virtual irectory onsolidated eports utomated Provisioning 21

22 22 he preceding is intended to outline our general product direction. t is intended for information purposes only, and may not be incorporated into any contract. t is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. he development, release, and timing of any features or functionality described for Oracle s products remains at the sole discretion of Oracle.

23 23