Identity Management with midpoint. Radovan Semančík FOSDEM, January 2016

Transcription

1 Management with midpoint Radovan Semančík FOSDEM, January 2016

2 Radovan Semančík Current: Software Architect at Evolveum Architect of Evolveum midpoint Contributor to ConnId and Apache Directory API Past: Sun LDAP and IDM deployments (early 2000s) OpenIDM v1, OpenICF Many software architecture and security projects

3 and Access Management System Admin Requester Approver Users Management HR Repository A M CRM

4 There is no security without identity management

5 If you have no IDM, how can you be sure that... illegal accounts are disabled/deleted? temporary accounts are deleted? users have only the least privileges? the privileges are not accumulated? no secondary authentication is possible? the data are up to date? (title, affiliation, ) notifications and tasks are suspended?

6 The solution is trivial Let's put everything in LDAP!

7 Expectation HR Users LDAP S S O

8 Reality Relational database Unsupported HR Users No standard (ugly script needed) Incompatible schema Unsupported Incompatible identifiers LDAP Custom! schema Local copy! Expensive S S O Home directory Extremely expensive

9 Single directory approach is not going to work and this has been known since 2006 (at least)

10 and Access Management System Admin Requester Approver Users Management HR Repository A M CRM

11 How IDM works? Management HR Repository A M

12 Automatic user provisioning Policies RBAC Rules Management HR Repository A M

13 Business As Usual Management HR Repository A M

14 Password reset (self-service) Management HR Repository A M

15 Employee Leaves Company Management HR Repository A M

16 Automatic user deprovisioning Policies RBAC Rules Management HR Repository A M

17 Business As Usual Management HR Repository A M

18 Bidirectional Synchronization Management HR Repository A M

19 Policy enforcement Policies RBAC Rules Management HR Repository A M

20 What Management does? Provisioning Identifier management Synchronization Data mapping Self-service Segregation of duties Password management Workflow Credentials distribution (SSH, X.509) RBAC Organizational structure Entitlement management... Notifications Auditing Reporting Governance

21 This IDM looks like the best thing since the sliced bread. What's the catch?

22 This IDM looks like the best thing since the sliced bread. What's the catch? The commercial IDM products are expensive.

23 This IDM looks like the best thing since the sliced bread. What's the catch? The commercial IDM products are expensive. Very, very expensive.

24 Open Source to the Rescue There was no practical FOSS solution until 2010 (Sun Manager was the king) : Syncope, OpenIDM, midpoint,... (that was the time when Oracle acquired Sun) Now there are two leading open source * IDMs: Apache Syncope Evolveum midpoint *) by open source I mean both license and practice

25 Evolveum midpoint?

26 midpoint Users Management HR Repository A M CRM

27 The midpoint Story Started (5 years, 14 releases) Github, Apache 2.0 License ~500K lines of code (Java) State-of-the-art IDM features Expressions Provisioning Segregation of duties Password reset Synchronization Policy Organizational structure Consistency HA Workflow Entitlements Connectors Governance Audit Authorization Localization Notifications RBAC Web UI Scripting Conditions Self-service Parametric roles Bulk actions Management Data mapping Schema REST Delegated administration Extensibility Identifiers

28

29

30 Questions and Answers Expressions Provisioning Segregation of duties Password reset Synchronization Policy Organizational structure Consistency HA Workflow Entitlements Connectors Governance Audit Authorization Localization Notifications RBAC Web UI Scripting Conditions Self-service Parametric roles Bulk actions Management Data mapping Schema REST Delegated administration Extensibility Identifiers

31 Thank You Radovan Semančík