Open Source Identity Management

Transcription

1 Open Source Management OpenAlt 2015 Radovan Semančík November 2015

2 Ing. Radovan Semančík, PhD. Software architect Co-owner of Evolveum (open source company) Architect of midpoint project Apache committer (Directory API)

3 What is this Management?

4 Let's start with a story... Pirate Brethren, Inc. Fictional company Starts small Lean, efficient Grows quickly Focus on profit

5 Simple and easy start Keeping access rights matrix in spreadsheet Some manual work but still quite OK

6 It gets quite complex very soon...

7 Login Nightmares Shippin' DeLuxe v99.02 Login: mjones Password: NaviGATE+ Username: p Password: Forgot password? Login: marry Password: CrashSoft Woknous Realm: PIRACY Login: jones3 Password:

8 Policy manual synchronization (unreliable, slow, costly) # # # # # no feedback Reality untracked changes LDAPv3 base <dc=example,dc=com> with scope subtree filter: (entryuuid=48b2295e-c a-fa85c863233e) requesting: ALL # jack, people, example.com dn: uid=jack,ou=people,dc=example,dc=com mail: jack2@blackpearl.com givenname: Jack objectclass: person objectclass: inetorgperson objectclass: organizationalperson objectclass: top uid: jack cn: cpt. Jack Sparrow sn: Sparrow

9 $ $ AUDIT VERY COSTLY $ and it has to be repeated... $ # # # # # LDAPv3 base <dc=example,dc=com> with scope subtree filter: (entryuuid=48b2295e-c a-fa85c863233e) requesting: ALL # jack, people, example.com dn: uid=jack,ou=people,dc=example,dc=com mail: jack2@blackpearl.com givenname: Jack objectclass: person objectclass: inetorgperson objectclass: organizationalperson objectclass: top uid: jack cn: cpt. Jack Sparrow sn: Sparrow

10 Call Center Goes Crazy Access request Password reset Password reset Password reset Password reset Password reset Access request Password reset Password reset

11 * Let's do this IAM thing. Everybody is doing that. *) and Access Management

12 Manager's View Users S S O Implementation Details

13 High Level Architect's View HR Users Implementation Details Implementation Details S S O LDAP Implementation Details Implementation Details

14 Reality Relational database Unsupported Users HR Unsupported Incompatible identifiers Local copy No standard LDAP (ugly script needed)! Custom schema Incompatible schema! Expensive Home directory Extremely expensive S S O

15 Single directory approach is not going to work and this has been known since 2006 (at least)

16 What are we going to do now?

17 DO NOT PANIC! SSO is what you think you want IDM is what you really need

18 What is this Management (IDM) thing, again?

19 and Access Management System Admin Requester Approver Users Management Repository HR CRM A M

20 How IDM works? Management A M Repository HR

21 Automatic user provisioning Policies RBAC Rules Management A M Repository HR

22 Business As Usual Management A M Repository HR

23 Password reset (self-service) Management A M Repository HR

24 Employee Leaves Company Management A M Repository HR

25 Automatic user deprovisioning Policies RBAC Rules Management A M Repository HR

26 Business As Usual Management A M Repository HR

27 Bidirectional Synchronization Management A M Repository HR

28 Policy enforcement Policies RBAC Rules Management A M Repository HR

29 What Management does? Provisioning Identifier management Synchronization Data mapping Self-service Segregation of duties Password management Workflow Credentials distribution Notifications Auditing (SSH, X.509) RBAC Reporting Organizational structure Governance Entitlement management...

30 Who needs Management? IDM Rule of the Thumb: < 100 identities: you are fine with manual work 100 1K identities: you might need it 1K - 10K identities: you need it > 10K identities: you desperately need it!

31 This IDM looks like the best thing since the sliced bread. What's the catch?

32 This IDM looks like the best thing since the sliced bread. What's the catch? The commercial IDM products are expensive.

33 This IDM looks like the best thing since the sliced bread. What's the catch? The commercial IDM products are expensive. Very, very expensive.

34 Open Source to the Rescue There was no practical FOSS solution until 2010 (Sun Manager was the king) : Syncope, OpenIDM, midpoint,... (that was the time when Oracle acquired Sun) * Now there are two leading open source IDMs: Apache Syncope Evolveum midpoint *) by open source I mean both license and practice

35 Evolveum midpoint?

36 midpoint Users Management Repository HR CRM A M

37 The midpoint Story Started (5 years, 14 releases) Github, Apache 2.0 License ~500K lines of code (Java) State-of-the-art IDM features Conditions Expressions Provisioning Management Schema Scripting Password reset Organizational structure Segregation of duties Synchronization Policy Consistency Workflow Entitlements Connectors HA Governance Authorization Localization Notifications RBAC Web UI Extensibility Self-service Audit Parametric roles Delegated Bulk actions Data mapping REST administration Identifiers

38 MidPoint Big Picture Target Systems midpoint Source Systems Connectors

39 Complete Open Source Solution midpoint Users CAS Management HR CRM Repository OpenLDAP A M

40 Conclusion

41 and Access Management System Admin Requester Approver Users Management Repository HR CRM A M

42 IAM Letter Soup System Admin Requester Approver Connector Administration Provisioning Workflow System Policy RBAC IDM HR Provisioning Sync LDAP Integration Two-factor AM OAuth LDAP AD Authentication SSO Repository CRM Users A M OpenID Connect Federation SAML UMA

43 Access Management Management Authentication Provisioning Single Sign-On (SSO) RBAC Synchronization Password management Self-service and much more Cost reduction Quite expensive What people want What people need

44 Access Management Management Authentication Provisioning Single Sign-On (SSO) RBAC Synchronization Password management Self-service and much more Cost reduction Quite expensive What people want START HERE What people need

45 Questions and Answers Conditions Expressions Provisioning Management Schema Scripting Password reset Organizational structure Segregation of duties Synchronization Policy Consistency Workflow Entitlements Connectors HA Governance Authorization Localization Notifications RBAC Web UI Extensibility Self-service Audit Parametric roles Delegated Bulk actions Data mapping REST administration Identifiers

46 Thank You Radovan Semančík

47 Extra Slides

48 (Much) More Information midpoint Wiki Architecture and Design (in Wiki) Wiki pages under [Architecture and Design] page Live architecture documentation Includes UML diagrams We try to keep it (reasonably) up to date midpoint Mailing List

49 Example midpoint Deployment Architecture Microsoft s Administrator AD Connector (remote) midpoint User Self-Service (Web GUI) Management Policies (rules, processes) Web GUI Scheduled Exports ADSI Active Directory CSV File SQL IDM Logic FlatFile Connector Custom HR System midpoint Repository (Relational DB) DB Table Connector Oracle Database Database s

50 Connectors Common Connector Framework Sun Connector Framework ConnId Compatible connectors AD, DB Table, DB2, MySQL, Oracle, RACF, Solaris, SPML, VMS, FlatFile, XML, Solaris, SAP,... LDAP: OpenLDAP, 389ds, OpenDJ, edirectory, Active Directory CSV file, Office365, SAS, GitLab, Lotus, LifeRay

51 Live Demo Documentation: search for Live demo in wiki.evolveum.com