G Cloud 6 CDG Service Definition for Forgerock Software Services

Transcription

1 G Cloud 6 CDG Service Definition for Forgerock Software Services Author: CDG Date: October 2015

2 Table of Contents Table of Contents Service Definition 3

3 1.0 Service Definition Forgerock as a Platform from CDG helps government organisations reach all of its citizens online, provide access to a wide variety of digital services whilst maintaining the highest security standards. This service offers access to three Forgerock services: OPenAM, OpenDJ and OpenIDM. The Open Identity Stack is a shared services-based architecture for managing the complete lifecycle of an identity and its ongoing usage, including the attributes, credentials, and entitlements;; the real-time controls for access based on attributes, role, entitlement, and context;; and the administration and reporting of those activities. The architecture has many shared services that span the three core products, making it easier to develop, implement and manage your deployment. These services include a common RESTful API, registration, and standards-based services such as OAuth2, among others, along with a common lightweight UI model to help integrate the internal Open Identity Stack components as well as external systems, and provide a unified experience for developers and administrators.

4 The Open Identity Stack is 100% open source and consists of the following solutions: OpenAM is an open source Authentication, Authorization, Federation, Web Services Security, Fine- Grained Entitlements, and Adaptive Authorization solution. It also includes application and web container policy enforcement agents. Packaged with OpenAM, OpenIG (Identity Gateway) is a highperformance gateway with specialized session management and credential replay functionality. OpenIDM is an open source User Administration and Provisioning solution. OpenIDM uses the Open Identity Connectors Framework and Toolkit (OpenICF) to aid development of resource connectors. OpenDJ is an open source LDAP directory service - the first-ever DS server natively supporting REST API - with a high-performance, highly available, secure directory server, built-in data replication, client tools, and a developer- friendly LDAP SDK. Access is provided via LDAP, Web Services, and REST API. OpenAM

5 OpenAM was designed in response to a milieu of access management suites that were pieced together through acquisitions, creating an accidental architecture that complicates deployment and passes integration costs on to customers. Based on the Sun OpenSSO codebase, OpenAM is an All-In-One access management platform for protecting any type of resource across enterprise, cloud, social, and mobile environments. What has traditionally been delivered by legacy identity vendors as six different products - SSO, adaptive authentication, strong authentication, federation, web services security, and fine-grained entitlements - is delivered as a single, unified offering. Organizations can use the access control services they need and simply turn on additional services when ready. The solution has an inherently unique architecture to support use cases from complex enterprise access control, to multi-protocol federation, to enabling SSO for cloud systems. At the highest level OpenAM consists of a single, self-contained Java application;; service components such as session management;; client side APIs in C, Java, REST;; service provider interfaces to enable custom plugins;; and policy agents for web and app server containers to enforce access policies to protected web sites and web applications. Organizations with existing internal access management solutions can easily integrate OpenAM into their environment through API services or through the token translation service. Maintaining all installation and configuration capabilities within one application vastly simplifies deployment. In addition, agent configuration, server configuration, and other tasks are simplified to be repeatable and scalable, so multiple instances of the solution can be deployed without additional effort. The embedded OpenDJ directory server eliminates the need to configure a separate directory to support the configuration and user stores, or if desired, users can utilize other LDAP directories such as Sun DSEE or databases. OpenAM functional diagram

6 OpenIDM overview OpenIDM is a response to the pain organizations experience when deploying legacy enterprise provisioning solutions. These mostly proprietary solutions are monolithic, heavyweight, painfully slow to deploy, and outrageously expensive. Unlike legacy identity management solutions, OpenIDM is the only 100% open source, lightweight, provisioning solution purpose-built for Internet Scale. OpenIDM consists of modular identity services that are plug and play. For example, the solutions ships with Activiti as its Business Process Management (BPM) Engine. However, if you want to replace it with an alternative BPM engine, the modular architecture allows you to easily do so. In addition, OpenIDM has a simple REST API that is ideal for developers in need of provisioning across enterprise, cloud, social, and mobile

7 environments. OpenIDM is a User Administration and Provisioning solution that addresses the challenges faced by organizations using legacy provisioning systems, by removing deployment complexity, proprietary scripting, business process modeling, and limited scalability. Because the Java-based architecture is built on the OSGi framework, OpenIDM is able to provide lightweight, modular services such as automated workflow, user self-service, registration, password sync, data reconciliation, and audit logging, all accessible through developer-friendly REST API using standard Java development tools such as Eclipse, NetBeans, Spring etc. OpenIDM provides workflow-driven provisioning activities through an embedded workflow and business process engine based on Activiti and the Business Process Model and Notation (BPMN) 2.0 standard. The modular design of OpenIDM enables complete flexibility to use the embedded workflow engine and nosql database or replace with your own choice. In addition, with a small footprint, the entire OpenIDM service can itself be completely embedded and custom-tooled to the requirements of the target application. OpenIDM connects to external systems, databases, directory servers, and other sources of identity through the identity connector framework, OpenICF (Open Identity Connectors Framework). Historically, the reason for building an internal enterprise User Administration and Provisioning system was to connect to the HR system. Now with OpenIDM, organizations can support both internal employee systems and largescale customer-facing applications for registration, user self-service, password reset, and user profile management. The object model is designed to support the methods the organization chooses to manage identity information. The options are to configure OpenIDM to create a virtual identity with links to external systems (data sparse model) or to create a meta-directory that centrally stores (data full model) a copy of identity attributes.

8 OpenIDM Functional Diagram OpenDJ Overview OpenDJ is the only 100% open source, lightweight, embeddable big data platform for easily sharing real-time user identity data across enterprise, cloud, social, and mobile environments. Recognizing that traditional approaches to accessing identity data are overly complex, OpenDJ provides developers with choice. Developers no longer need to be LDAP experts. OpenDJ lets developers choose either LDAP or REST to access identity data using a single solution that can replicate data across on-premise and off-premise applications. OpenDJ combines the security of a proven directory with the accessibility of a database.

9 OpenDJ is an LDAPv3 and REST compliant directory service, developed for the Java platform, providing a high- performance, highly available, and secure store for the identities managed by your organization. Easy to install and configure, and combined with the utility of the Java platform, OpenDJ is the simplest, fastest directory to deploy and manage. Core to the management of identity information, OpenDJ directory services are used in many different use cases whether it is for a large-scale cloud service directory, a consumer-facing directory, or an enterprise or network operating system (NOS) directory. With a 100% Java code base, OpenDJ runs on many platforms, including virtualized environments. All software and data are architecture-independent, so migration to a different OS or a different server is as simple as copying an instance to the new server. This increases the deployment flexibility, as well as the portability between different operating systems and system architectures. OpenDJ functional diagram