Identity Management. Dave Romig, Sr Founder, CTO

Transcription

1 Identity Management Dave Romig, Sr Founder, CTO

2 Identity Management What it is What it does What it means

3 What it is

4 Problem statement Connected apps must handle two functions Authenticate user Authorize user tasks to drive behavior Lots of Technologies! Name/password, X.509, Kerberos, SAML, LDAP, Scenario drives technology choice Application is bound to constraints of technology

5 Identity can be tough Windows authentication is easy Until someone outside your domain wants to play Id / password databases are costly and painful For developers For users

6 What is Identity? It helps answer the questions Who are you? What are you allowed to do? How can I personalize my app for you?

7 How do you handle identity? Internal applications Windows domain accounts, Kerberos Internet-facing ASP.NET applications Forms Authentication ASP.NET Membership / Role Provider Custom Application OpenID You name it

8 Pressure for change There s clearly a need for change Developers are tired of implementing identity in every application Users are tired of tracking lots of passwords The only ones winning are the phishers and hackers!

9 Terminology Subject The user / entity accessing a resource Authentication Proving the subject is who they claim to be Authorization What can this subject do in my app? Claim Assertion of a fact (username, age, )

10 Terminology Security Token Array of bytes representing claims Identity Provider (IdP) Authority that issues tokens Security Token Service (STS) a web service that issues tokens containing claims STS loosely equates to issuer Relying Party (RP) Any application that relies on claims

11 Claims Identity Attributes Associated with a Subject Traverses the Network as a Token Claims-based Identity = Token Containing Claims

12 Claims Claims information about the subject Claim Claim Claim Name Department Location Claim Signature

13 Claims Claims vs. Attribute eharmony, Facebook and Virginia DMV have the age attribute eharmony claims age = 29 Facebook claims age = 35 Virginia DMV claims age = 43 Apps determine which claim to trust Trust depends on scenario not technology

14 Claims What gets sent to the application? Application receives a security token Created, signed, encrypted by the Identity Provider (IdP) Contains claims your IdP makes about the subject Token issued 1666 Photo used under Creative Commons from St. Albans Museums

15 What it does

16 Windows Identity Foundation All problems in computer science can be solved by adding a layer of indirection. David Wheeler WIF adds a level of indirection Removes authentication from the app (the identity provider handles it) Single signon follows naturally

17 Claims-based identity (on premise) Active Directory 3. Validate user, Look up claims Attribute Store trust Identity Provider 5. Send claims 1. Attempt Access Application (WIF) Client Relying Party

18 Active Directory on Azure

19 Azure Active Directory (cloud only)

20 Azure Active Directory (hybrid)

21 Azure Active Directory Access Control

22 What it means

23 Azure AD Editions Free Edition (that s right FREE) Part of every Azure subscription Nothing to license or install Manage user accounts Synchronize with on-premise directories SSO with Office-365, Salesforce, DocuSign, Google Apps and more

24 Azure AD Editions Basic Edition (i.e. not free) Everything from Free edition Company branding Group-based authorization management Self-service password reset (same as with Office 365) Publish on-premise web apps via Azure AD Enterprise-quality SLA of guaranteed 99.9% uptime

25 Azure AD Editions Premium Edition Everything from Basic edition Delegated group administration Security monitor logging and alerts Multi-factor authentication Password write-back to on-premises directories

26 Azure Active Directory Access Control Azure service (not part of Azure Active Directory) Integrates with WIF IdPs Microsoft, Google, Yahoo, Facebook OData-based management Manager portal provided

27 Windows Azure Active Directory

28 LET S GET STARTED We re ready as soon as you are.

29 THANK YOU Dave Romig, Sr. Founder, CTO

30 Resources What is Azure Active Directory?