SAP Enterprise Portal 6.0: User Management & Security. Version: November 24, 2003

Transcription

1 SAP Enterprise Portal 6.0: User Management & Security Version: November 24, 2003

2 Disclaimer This document contains an overview of the planned User Management & Security features of the SAP Enterprise Portal 6.0 (some of the features are planned to be available for Unrestricted Shipment Phase only). It is subject to change. Please take care that you are always using the newest version of that presentation! SAP AG assumes no responsibility for errors or omissions in these materials. These materials are provided as is without a warranty of any kind, either express or implied, including but not limited to, the implied warranties of merchantability, fitness for a particular purpose, or non-infringement. SAP AG shall not be liable for damages of any kind including without limitation direct, special, indirect, or consequential damages that may result from the use of these materials. SAP AG does not warrant the accuracy or completeness of the information, text, graphics, links or other items contained within these materials. SAP AG has no control over the information that you may access through the use of hot links contained in these materials and does not endorse your use of third party web pages nor provide any warranty whatsoever relating to third party web pages. SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 2

3 Topics Overview New Features EP 6.0 Authentication Single Sign-On (SSO) Authorization User Management Secure Communication Secure Network Architecture SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 3

4 Topics Overview New Features EP 6.0 Authentication Single Sign-On (SSO) Authorization User Management Secure Communication Secure Network Architecture SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 4

5 Enterprise Portal 6.0 Security Features Secure Communication Authorization Authentication Portal Server Single Sign-On Third-Party System User Persistence Store User Management SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 5

6 Architecture Overview Web Browser, PDA, etc. SAP Enterprise Portal 6.0 Web Server Java Java Application Application Server Server SAP SAP J2EE J2EE Engine Engine Portal Server Portal Runtime (PRT) Portal Services User Management Service Authentication SSO User Group Role Persistence Manager Database Persistence LDAP Directory SAP System Backend Systems SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 6

7 Topics Overview New Features EP 6.0 Authentication Single Sign-On (SSO) Authorization User Management Secure Communication Secure Network Architecture SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 7

8 New Features EP 6.0 Authentication Multiple authentication methods in parallel Multiple user sources in parallel Anonymous users Logon without authentication Authorization depending on authentication method iview requires certain logon methods (e.g. digital certificates) Interface for pluggable third-party authentication Java Authentication and Authorization Service (JAAS) standard Partner certification program (planned) Web access management products Other external authentication services (e.g. hardware tokens) SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 8

9 New Features EP 6.0 Single Sign-On (SSO) SAP logon ticket expiration recovery Recovery of previous state of the portal if SAP logon ticket expires and user has to logon again Ticket Verification Library UNIX platforms (planned) Java language SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 9

10 New Features EP 6.0 Authorization Authorization for Portal Content All content under administrative control of the portal Based on Access Control Lists (ACLs) SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 10

11 New Features EP 6.0 User Management Web-based user administration End user self-registration User can create account in the portal Workflow for approval of registration request by administrator Password management & policies Configurable expiration dates Initial passwords and change at first login Limit of failed logon attempts Flexible user persistence layer LDAP directory, database or SAP system as user store Delegated administration SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 11

12 Topics Overview New Features EP 6.0 Authentication Single Sign-On (SSO) Authorization User Management Secure Communication Secure Network Architecture SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 12

13 Authentication Initial Logon Procedure Verification of the user s identity Initial logon procedure to authenticate user Various authentication methods User ID / password X.509 digital certificates Third-party authentication Windows authentication Web Access Management (WAM) products Others through JAAS interface Anonymous users Logon without authentication SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 13

14 Authentication Schemes Define the authentication process Credentials to be supplied User interaction required (e.g. logon screens) Priority of the authentication scheme (how strong it is) Attached to the user s session Allow to enforce different authentication mechanisms for different content (iviews) Re-authentication required in case the iview requires a stronger authentication scheme SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 14

15 Authentication: User ID / Password Logons are provided as Form-based logon (iview) Basic authentication (HTTP Status 401) Portal Server verifies the provided user ID / password against user persistence store SAP logon ticket is issued (later used for Single Sign-On) User ID / PW Portal Server User ID / PW Verification User Persistence Store SAP Logon Ticket User ID Mapping Portal Database SSL SSL SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 15

16 Authentication: Digital Certificates Authentication of user through SSL protocol User presents his digital certificate to Web server during SSL handshake Web server performs SSL client authentication Portal Server checks if user presented the correct certificate Prerequisite: Client certificate has to be mapped to a portal user SAP logon ticket is issued (later used for Single Sign-On) X.509 Certificate Portal Server X.509 Certificate Compare Certificate User Persistence Store SAP Logon Ticket User ID Mapping Portal Database SSL SSL SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 16

17 Getting a Digital Certificate Digital certificates must be X.509v3 compliant Various options possible: Using SAP Trust Center Service For SAP users only Free of charge Portal Server acts as Registration Authority (planned) Setting up internal PKI system Buy software from CA product vendor Using external PKI system Contract with Trust Center Service SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 17

18 SAP Trust Center Service: Enrollment Process 5 SAP Trust Center Service Verifies naming conventions and issues certificate 4 Send approved certificate request Web Browser 1 2 Log on using SAP user ID and password and initiate the SAP Passport request Specify naming convention and trigger key generation Portal Server 3 Web browser generates key pair and sends the SAP Passport request 6 Log on using the SAP Passport SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 18

19 Third-Party Authentication Authentication using an external authentication service Windows authentication Integration of Web Access Management (WAM) products Other authentication methods through pluggable JAAS Login Modules SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 19

20 Windows Authentication Authentication is delegated to Windows operating system* Process with HTTP Basic Authentication: User has to enter his or her Windows user ID and password (HTTP Basic Authentication) Windows Domain Controller authenticates the portal user When the Enterprise Portal is accessible from the Extranet Process with Windows Integrated Authentication (NTLM): Previous logon to Windows operating system can be reused User is not required to reenter his or her Windows authentication credentials When the Enterprise Portal is a pure Intranet portal and only MS IE is used * Requires Microsoft IIS 5.0 as Web server SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 20

21 Integration of Web Access Management Products External Web Access Management (WAM) product authenticates the portal user Technical integration using JAAS Login Module: Generic module provided for reading HTTP header variables Custom implementation (e.g. to verify a provided cookie) Portal Server logs the user on to the portal (user must reside in portal user persistence store) Seamless integration, only configuration required Partner certification program for WAM vendors or integration on a project-specific basis SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 21

22 Pluggable Authentication Plug-in interface for authentication modules Interface defined by Java Authentication and Authorization Service (JAAS) standard Each authentication scheme can define one or more JAAS Login Modules Partner certification program or integration on a project-specific basis SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 22

23 Topics Overview New Features EP 6.0 Authentication Single Sign-On (SSO) Authorization User Management Secure Communication Secure Network Architecture SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 23

24 SSO SAP Logon Tickets SAP logon tickets represent the user credentials Portal Server issues an SAP logon ticket to a user after successful initial authentication SAP logon ticket is stored as per session cookie on the client browser SAP logon ticket is used to authenticate user to applications User gets access to multiple applications and services After initial logon no further user logons required Cross domain support (planned) SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 24

25 SAP Logon Tickets SSO Process Initial Logon SAP System External System Intranet SAP Logon Ticket Any other Web page Internet SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 25

26 SAP Logon Ticket Contents SAP logon tickets contain: User ID(s) Authentication scheme Validity period Issuing system Digital signature SAP logon tickets do NOT contain any passwords! Strong Security: Digitally signed by Portal Server Authenticity and integrity protection through digital signature SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 26

27 SAP Logon Tickets & Security SAP logon ticket serves as authentication token and therefore needs to be protected from unauthorized usage Validity period Authenticity and integrity protection using.digital signature Confidentiality protection through SSL protocol.while in transport SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 27

28 Verifying the SAP Logon Ticket: SAP Systems Component System Portal Server s public-key certificate SAP Logon Ticket SAP Step 1: Verification of the digital signature provided with the SAP logon ticket. Step 2: Logon using the user ID which is stored in the SAP logon ticket. No additional authentication using password or certificate necessary. SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 28

29 Verifying the SAP Logon Ticket: Non-SAP Systems The non-sap component must: Make sure the SAP logon ticket has been issued by a trusted Portal Server Accept the certificate of the Portal Server Verify the Portal Server s digital signature in the SAP logon ticket Ticket Verification Library that can be linked to non-sap systems or Web Server Filter are provided Extract the user ID from the SAP logon ticket Ticket Verification Library or Web Server Filter are provided that extract the user ID from the SAP logon ticket SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 29

30 SSO to non-sap Components Using SAP Logon Tickets Two alternatives: Web Server Filter 2 1 SAP Logon Ticket Filter HTTP Header Field: Application User ID Portal Server s public-key certificate Web Server Non-SAP Component System Application Programming Interface (API) 2 1 Ticket Verification Library SAP Logon Ticket Non-SAP Component System 3 Application User ID Portal Server s public-key certificate SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 30

31 SSO Account Aggregation If the external system does not support SAP logon tickets Portal components connect to the external system with the user s credentials (user ID and password) User mapping and credentials information are stored in the Portal Database Administrator maps users using administration iview Typically to map groups and roles User maps own credentials using portal personalization function Portal User: SAP User: Siebel UserID/Password: Michael_Schumacher d , {yu323ab} Anna_Kournikova i , {34u0nap} Tiger_Woods i , {wq9itxm1} Cathy Freeman i , {12onxc85} SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 31

32 Topics Overview New Features EP 6.0 Authentication Single Sign-On (SSO) Authorization User Management Secure Communication Secure Network Architecture SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 32

33 Authorization Overview Authorization Concept for Portal Content Objects in the Portal Content Directory (PCD) are controlled by Access Control Lists (ACLs). Permissions Editor Knowledge Management Authorization for unstructured data Permissions for users, groups and roles via ACLs Backend Applications User receives authorization in business application according to its authorization policy. SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 33

34 Authorization Concept for Portal Content Objects in the Portal Content Directory (PCD) are controlled by Access Control Lists (ACLs) ACL defines permissions for principals (user, group or role) For example, ACL specifies the roles that can access the iview ACL Service Enforces permissions for portal objects at runtime Permissions Editor GUI for administering ACLs for portal objects SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 34

35 Access Control Lists (ACLs) Portal object creator is automatically the ACL owner Only the ACL owner can Add or remove owners for the object s ACL Grant permissions to a principal Inheritance of permissions If no ACL exists for a PCD object, the permissions are inherited from the parent s ACL Administrator permissions None Read Read/Write Full Control (ACL owner) End-User permissions Enabled/Disabled Design Time Run Time Full Control Read/Write Read Enabled/Disabled SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 35

36 Topics Overview New Features EP 6.0 Authentication Single Sign-On (SSO) Authorization User Management Secure Communication Secure Network Architecture SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 36

37 Architecture Overview User Management Engine Applications Accessing User Management SAP Enterprise Portal User Management Core Layer User API User Account API Group API Role API Persistence Manager Replication Manager Persistence Adapters User Persistence Store Database LDAP Directory SAP System External System SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 37

38 Persistence Manager Central place for reading and writing user-specific data Users Groups Role assignments Uses Persistence Adapters to read/write data Supports database, LDAP directory and SAP system as repository User Management Core Layer Persistence Manager Persistence Adapters User Persistence Store Database LDAP Directory SAP System SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 38

39 Persistence Manager User Partitioning Specific user sets can be distributed across different repositories Example: Persistence Manager Self-registered, external users Database LDAP Directories Internal users Attribute Partitioning Specific user attributes can be distributed across different repositories Example: Persistence Manager Role assignments (portal-specific data) Database LDAP Directory General user data (application independent) SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 39

40 Persistence Supported Repositories Database Oracle 9.2 Microsoft SQL Server 2000 IBM DB2/UDB LDAP Directory Novell edirectory Sun ONE Directory Server Microsoft ADS Siemens DirX SAP System SAP Web Application Server 6.20 or higher For details please see the Product Availability Matrix at SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 40

41 Portal Database Portal Server User Persistence Store LDAP Directory Database SAP System Portal Database Store portalspecific data UM Instance PCD Instance Basic user data Basic group data User group assignment User/group role assignment User mapping (for SSO purposes) User Roles (Metadata) Content role assignment User s personalization data SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 41

42 Replication Manager Replication of user data to external systems Provisioning for external systems that cannot use supported user repositories Notification when users are created or modified Data exchange via XML documents One-way replication of user data (Portal External System) User Management Core Layer Replication Manager External System SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 42

43 Replication Supported External Systems External System SAP Basis 4.6D, SAP Web Application Server 6.10 or higher Business Add-Ins (BAdis) supported Example: Replication Manager Portal User Provisioning to SAP Systems BW SRM CRM SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 43

44 User Administration Administration GUI completely based on iviews User Administration Functions: Create users Copy users Modify users Search for users Create groups Assign users to group(s) Assign users and groups to role(s) Set or auto-create password Set date & time for user account activation Lock/unlock users View user account history Approve/deny self-registered users Adapt attributes contained in self-registration notifications for specified events SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 44

45 Password Management Administration Functions Configure password policies Set initial password for user Let system auto-create password for user Reset password Customizable Forgot Password process Password Policies Min/max. length Numeric characters allowed/mandatory Password different from UID Mixed case required Special characters required Password expiry time period (days) Password must be changed at next logon Number of failed logon attempts before account is locked SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 45

46 User Self-Service User can change his or her profile User profile Portal language User password User mapping information (SSO) User can set a new password During logon (for initial passwords, when expired) By changing user profile User can request new password (sent to user by ) User self-registration User fills out a simple registration form User immediately becomes a guest user User waits for approval by administrator to become a company user SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 46

47 Delegated User Administration Company Concept Delegated user administration based on company concept A company is a set of users User administration can be done per company, by a company administrator for all the users within that company Role assignment If the company concept is enabled, the list of users for role assignment is limited Company administrator can only assign users belonging to his company User self-registration & approval workflow The company concept allows for user self-registration with an approval workflow When registering users can specify which company they belong to Approval or rejection is done by the company administrator SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 47

48 Security Logging & Auditing Logging of all security relevant information User login (successful/failed) IP address of user logged in User logoff User created/modified User approval/denial User locked/unlocked Role assignment changed Logging information is stored in a log file SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 48

49 Topics Overview New Features EP 6.0 Authentication Single Sign-On (SSO) Authorization User Management Secure Communication Secure Network Architecture SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 49

50 Secure Communication Features Secure, encrypted communication between client, Portal Server, persistence layer, and backend systems Support of industry-standard security protocols Secure Sockets Layer (SSL) Secure Network Communications (SNC) Features Confidentiality Authenticity Integrity SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 50

51 Secure Communication Overview DMZ Intranet User Persistence Store Web Browser HTTP SSL Security Proxy (Web Server, Reverse Proxy) HTTP SSL SAP J2EE Engine Dispatcher P4 Portal Server JDBC SSL* LDAP SSL Database LDAP Directory RFC HTTP SSL RFC SNC SNC SAP System * Depending on JDBC provider Web Appl. (SAP, non-sap) Backend Systems SAP System SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 51

52 Topics Overview New Features EP 6.0 Authentication Single Sign-On (SSO) Authorization User Management Secure Communication Secure Network Architecture SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 52

53 Secure Network Architecture Overview Network architecture needs to protect your business needs without allowing unauthorized access Highly sensitive systems and components need to be protected (Portal Server, Persistence Layer, Backend Applications) Locate them in a separate area that is sealed off from network attacks from outside and inside Application servers, database servers, and directory servers should only be accessible via a demilitarized zone (DMZ) that is protected by firewalls SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 53

54 Secure Network Architecture Enterprise Portal 6.0 Front End DMZ DMZ-2 Intranet / Backend Application Servers Retrieval & Classification (TREX) Client External Firewall Internal Firewall Firewall Security Proxy (Web Server, Reverse Proxy, etc.) Portal Servers (incl. Content Management) Persistence Layer Database Servers Corporate Directory Server SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 54

55 Topics Overview New Features EP 6.0 Authentication Single Sign-On (SSO) Authorization User Management Secure Communication Secure Network Architecture SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 55

56 Enterprise Portal 6.0 A Portal For More Security Authentication using various methods User ID/password, digital certificates, third-party authentication Single Sign-On (SSO) Secure, digitally signed SAP logon tickets Account aggregation via user ID/password mapping Authorization ACL-based authorization for portal content Secure communication Between client, portal, and enterprise application servers (SSL, SNC) User Management Support for LDAP directory servers, databases or SAP systems as user persistence store User self-registration (incl. approval process) Delegated administration SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 56

57 Questions? Q&A SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 57

58 Copyright 2003 SAP AG. All Rights Reserved No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice. Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. Microsoft, WINDOWS, NT, EXCEL, Word, PowerPoint and SQL Server are registered trademarks of Microsoft Corporation. IBM, DB2, DB2 Universal Database, OS/2, Parallel Sysplex, MVS/ESA, AIX, S/390, AS/400, OS/390, OS/400, iseries, pseries, xseries, zseries, z/os, AFP, Intelligent Miner, WebSphere, Netfinity, Tivoli, Informix and Informix Dynamic Server TM are trademarks of IBM Corporation in USA and/or other countries. ORACLE is a registered trademark of ORACLE Corporation. UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group. Citrix, the Citrix logo, ICA, Program Neighborhood, MetaFrame, WinFrame, VideoFrame, MultiWin and other Citrix product names referenced herein are trademarks of Citrix Systems, Inc. HTML, DHTML, XML, XHTML are trademarks or registered trademarks of W3C, World Wide Web Consortium, Massachusetts Institute of Technology. JAVA is a registered trademark of Sun Microsystems, Inc. JAVASCRIPT is a registered trademark of Sun Microsystems, Inc., used under license for technology invented and implemented by Netscape. MarketSet and Enterprise Buyer are jointly owned trademarks of SAP AG and Commerce One. SAP, R/3, mysap, mysap.com, xapps, xapp, SAP NetWeaver and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and in several other countries all over the world. All other product and service names mentioned are the trademarks of their respective companies. Data contained in this document serves information purposes only. National product specifications may vary. SAP AG 2002, SAP Enterprise Portal 6.0: User Management & Security / 58