Achieving Identity Federation

Transcription

1 Achieving Identity Federation Tony Da Costa Principal Pre-Sales Consultant African Operations Copyright 2014, Oracle and/or its affiliates. All rights reserved.

2 Safe Harbor Statement The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decision. The development, release, and timing of any features or functionality described for Oracle s products remains at the sole discretion of Oracle.

3 Agenda Introducing Identity Federation Exploring Federation Use Cases Oracle Identity Federation - Benefits of Federation in Access Management Q&A 3

4 Introducing Identity Federation

5 What is Identity Federation? A group of two or more trusted partners Bound by business and technical agreements Allows a user from one federation partner to seamlessly access information resources from another federation partner Transaction done in a secure and trustworthy manner Organizational participants in a federation vet and maintain information on the users they manage Each federation partner retains control over the business rules for granting access to the sensitive information it owns Bottom line: provides cross-domain single sign-on (SSO) among federated partners 5

6 Identity Federation Is Key To The Cloud Identity Federation is primarily used to authenticate users across domains Example Generic Financial Corporation uses Oracle Fusion Apps on Oracle Public Cloud. Federation allows Generic Financial users to login to Fusion Apps without needing a password on Oracle Public Cloud Secondarily sharing identity attributes across domain

7 Key Federation Terms Identity Provider The organization that authenticates the user and generates the SAML assertion The organization optionally shares attributes requested by the Service Provider Service Provider Accepts SAML assertions to identify the user (as opposed to username & password) Also referred as a relying partner within discussions around social login (aka OpenID and OAuth)

8 When Do You Use SAML Vs OpenId Or OAuth Depends upon how partner wishes to integrate Example Generic Financial uses Google Applications for outsourcing & wants to SSO to Google Apps Google Apps uses SAML to authenticate Example Generic Financial marketing department wants to allow prospects to login to marketing pages using their Google accounts (aka social identity) -- Google social identity uses OpenID

9 OpenID Feature: Provider Discovery Benefits: No metadata files publishing or exchange Fully automatic discovery of OpenID endpoints and capabilities RPs and OPs can interoperate without any manual setup or configuration Tradeoff: Weaker on account of security

10 Challenges of Identity Federation The proprietary nature of many of these solutions. The proliferation of content formats, supply chains, customer management systems, and user data stores poses security and maintenance concerns. Ever-expanding and increasingly dynamic end-user communities. 10

11 Benefits of Identity Federation The end user does not need to supply login credentials to access each entity where business is conducted. Enterprises do not need to create additional accounts to manage the identities of users who are already known to a partner organization. 11

12 Exploring Federation Use Cases

13 Use Case: Transient Federation Only user session is transferred between domains The actual authentication happens in the sending domain Receiving domain blindly trusts the sending IDP

14 Use Case: Account Mapping The user has accounts with both federation partners and there are one or more common user attributes available for mapping

15 Use Case: Account Linking The user has accounts with both federation partners but there are no common attributes available for mapping

16 Use Case: Attribute-based Federation Federate is based on groups, roles, attributes, or specific entitlements, not user identity

17 Oracle Identity Federation Benefits of Federation in Access Management

18 What is Oracle Identity Federation? User at the Web Browser SAML1.x SAML2.0 Liberty WS-Fed OpenID A service within Oracle Access Management Built-in integration with rest of access stack Conforms to industry standards Flexible

19 Identity Federation Is Standards Based Primary standard for web-based single sign-on across domains is SAML. Identity Federation supports all common industry federation standards: SAML v1 and v2 Liberty

20 Federation Is An Access Management Service Federation is fundamentally just another login system Identity Providers need to make sure they are able to securely authenticate the users locally Service Providers need to provide session management, access control and SSO within the apps hosted in their domain Both IdP and SP need to mitigate risk within the authentication

21 Access Management 11gR2 Simplified Converged Services Authentication and SSO (OAM) Federated SSO (OIF) Mobile & Social Security Token Service Common Infrastructure Session management Identity Context Authorization Policy Store Lifecycle Management Install & Configuration

22 Simplified Service Provider Deployment 1 click SAML authentication enablement Federation is an authentication scheme Each IdP Metadata configured has their own scheme Multi-Tenant Support (shared IDM) 22 Copyright 2012, Oracle. All rights reserved.

23 Federation Integrates With Identity Context Session attributes support Federated attributes can be sent response headers to application Federation attributes can be sent in identity assertion Federated attributes in authorization policy constraints Federation attributes in Entitlement Server policy constraints for fine grained authorization Attribute mapping

24 Simplifying End-User Experience Can create user entry on demand within the SP identity store AKA Federated Provisioning Enable user to enter profile information and link with their SAML assertion User registration service IdP discovery service

25 Improve Authentication By Reducing Risk Oracle Identity Federation can work with Oracle Adaptive Access Manager with just a single click Adaptive Access can be used to provide higher-level authentication on a service provider resource Oracle Adaptive Access Manager can be used to provider stronger authentication for the Identity Provider

26 Standards Supported SAML 2.0, SAML 1.1 IdP/SP-initiated SSO, Logout (SAML 2.0) Legacy OpenID 2.0 Most customers find more benefit with OpenId via Oracle Social and Mobile Security Service

27 OAM Convergence Service Provider functionality is converged in Access Management 11gR2 Identity Provider still provided by Oracle Identity Federation IdP convergence planned for 11gR2 PS2 scheduled for January 2014

28 Questions 35