Secure Authentication: Accessing Questionmark OnDemand with SSO

Transcription

1 Secure Authentication: Accessing Questionmark OnDemand with SSO Christian Rowenstrunk, Technical Support Representative Q u e s t i o n m a r k C o n f e r e n c e M i a m i All rights reserved. Questionmark is a registered trademark of Questionmark Computing Limited. All other trademarks are acknowledged.

2 Heads-Up This session focuses on the latest OnDemand version (NextGen) If you are not on OnDemand, or have no plans to move to it, and you want to learn something that you can apply now, then you may get more value out of another session Slide 2

3 Learning Objectives Understand which Single Sign-On options exist for Questionmark Review the advantages of the SAML protocol Evaluate which options work best in your organization Slide 3

4 What Is Single Sign-On (SSO)? The ability for one application, the identity provider, to tell another application, the service provider, who you are. Related terms Federated authentication Centralized login Slide 4

5 Identity Provider and Service Provider Identity Provider E.g. Microsoft Active Directory Authentication data Service Provider E.g. Questionmark OnDemand Slide 5

6 Example of SSO Identity Provider (IdP) Service Provider (SP) Slide 6

7 Why SSO? Pro Reduce password fatigue No need for different passwords for each system No need to remember multiple passwords Reduce password exposure No need to type password multiple times (if "full" SSO), cf. shoulder surfing Save time Con Increases impact if Sign-on details are misused Identity provider is unavailable Slide 7

8 SSO Options for Questionmark Windows Authentication QMWISe (Web Services) SAML Slide 8

9 Windows Authentication WINUSER (or NTUSER) parameter in perception.php URL Picks up the Windows user of the session and passes that on to Questionmark Participant must exist in Questionmark database Participant (or IT department) must configure browser Only works for OnPremise (Perception) Slide 9

10 QMWISe (Web Services) Set of web services to programmatically interact with Questionmark Allows you to tailor the SSO experience Typical web methods: GetAccessAdministrator GetAccessAssessmentList GetAccessAssessmentNotify GetAccessScheduleNotify Slide 10

11 SAML Security Assertion Markup Language For exchanging authentication and authorization data between parties Identity provider (IdP), e.g. Microsoft Active Directory Service provider (SP), e.g. Questionmark OnDemand Slide 11

12 Why SAML? It is the top protocol you have been asking about to enable SSO This is no coincidence: it is an industry standard It is not new: it has been around since 2001 and it is becoming more and more common because working in the Cloud is continually increasing Slide 12

13 Web SSO Customer Inc. CRM ERP QM Intranet Different Domains Slide 13

14 Advantages of SAML It helps with web SSO, meaning that it enables login across domains E.g. your Active Directory behind the firewall and Questionmark OnDemand: OnDemand does not need to be able to talk to Active Directory directly; the browser is in the middle It enables you to leverage authentication capabilities on your identity provider, such as multifactor authentication Slide 14

15 Overview of SSO Options Method Pro Con Available Windows Authentication Relatively easy to set up if your identity provider and Questionmark server are on the same domain QMWISe (Web Services) Can be used for very custom scenarios Works with participants and administrators SAML Can create users on the fly, with attributes Works with participants and administrators Participants always need to be created beforehand Does not work with administrators -/OP Requires programming OD/OP Takes time to configure (some trial and error) Participants still need to be created beforehand if you want to schedule them in advance OD/- Slide 15

16 Deep Dive on SAML Slide 16

17 SAML Interaction Diagram Slide 17

18 Contents of a SAML Request (Example) <samlp:authnrequest [ ] ID="_d17c957f15359e4e8e7665ce75b06c9b9620e6b 9fa" [ ] This is the request This request has an ID (there will be a new ID for each request, cf. multiple users logging on) Slide 18

19 Contents of a SAML Response (Example) <samlp:response ID="_113da1b8-b2a9-4c59- b5e1-97cca4fa107d" [...] InResponseTo="_d17c957f15359e4e8e7665ce75b06 c9b9620e6b9fa" [...] <Attribute Name=" claims/objectidentifier"> <AttributeValue>ddf6d aa6e- 86cf5c657967</AttributeValue></Attribute> <Attribute Name=" claims/displayname"> <AttributeValue>jane.doe</AttributeValue></A ttribute> <Attribute Name=" identity/claims/ address"><attributevalu e>jane.doe@qmportaltestad.onmicrosoft.com</a ttributevalue></attribute> This is the response It is a response to the request with the ID xyz (cf. the request) This user has attributes with these values Slide 19

20 Possible with SAML (today) Create users automatically in the Portal when they log on via SAML Enable existing participants to log on via SAML by updating them through CSV import Give users a role based on a SAML attribute that has a defined value Define which users can still log on locally Per user Per role Map SAML attributes to Portal profile fields Questionmark Tech Support configures on your behalf Slide 20

21 Not Possible with SAML (today) Automatically enable existing participants to log on via SAML An intervention through CSV import is needed Administrators will need to be re-created on login Use SAML attributes to link users to groups Groups are assigned in the Portal Update values for (i.e. initial sync is possible but cannot be updated if values change) Username Unique user ID address ( primary ) Slide 21

22 Setting Up SAML SAML is not enabled by default We must enable it for your OnDemand area Setting up SAML can take time Foresee at least a couple of weeks for testing It is likely trial and error will be involved, with multiple backand-forths We set it up on a test environment first When it is confirmed working, we set it up on Production Enables you to use a test identity provider as well Slide 22

23 Interested in SAML? Talk to your Account Manager, who will help set up a discovery call Slide 23

24 More Information What is SAML and how does it work? What is currently possible when integrating OnDemand with SAML? Can I map SAML attributes to OnDemand profile fields? Who initiates logins when using SAML? Using Single Sign-On with Questionmark Slide 24