TECHNICAL WHITE PAPER Intel Cloud SSO How Intel Cloud SSO Works Just as security professionals have done for ages, we must continue to evolve our processes, methods, and techniques in light of the opportunities that Cloud Computing brings to our industries. The concepts in this Intel white paper, follow and bring new detail to the recommended best practices being established by the Cloud Security Alliance. Abstract This paper is designed for evaluators and administrators of Intel Cloud SSO as a preread prior to trial of the solution. It provides background on the cloud Identity as a Service (IDaaS) usage model & benefits. The paper also describes solution architecture, deployment models, and configuration capabilities for SSO, strong authentication, and integration options with on-prem identity infrastructure. Jim Reavis Executive Director Cloud Security Alliance
Intel Cloud SSO Technical White Paper Table of Contents The Cloud Identity Challenge.... 2 The SSO Solution................. 3 How Do I Get Intel Cloud SSO?.... 3 User Management.... 4 Authentication into.... 4 Intel Cloud SSO Setting Up Connections with.... 5 Target Apps How Is SSO Performed With.... 6 Target Apps? How Is Context-aware.... 7 Strong Authentication Performed? How Is User Account.... 7 Provisioning/de-provisioning Performed? How Does Intel Cloud SSO......... 7 Integrate With Corporate Directories? How Does Intel Cloud SSO Store.... 8 and Secure Customer Data? Summary.... 8 Challenge: Increase end-user convenience & productivity. Eliminate the security & cost burdens of using passwords. Ensure that only authorized users have access to sensitive cloud apps. Solution: Cloud-based single sign-on provides users with rapid access without passwords. 2-factor strong authentication reliably verifies user identities. Automated provisioning/de-provisioning enables the enterprise to efficiently manage end-user identities. The Cloud Identity Challenge Today, large and midsize enterprises are using an average of 10 or more softwareas-a-service (SaaS) applications. This strategy of outsourcing formerly internal IT functions to the cloud brings the following challenges to the IT department and end-users. Too Many Credentials: The proliferation of SaaS solutions within the enterprise leads, inexorably, to a plethora of identities and creates a unique operational challenge: how to efficiently manage all the identities that users require one for each cloud application they access. Dormant and Orphan Accounts: As new users join the company, they need cloud accounts which are synchronized with their internal identities. Similarly, as their roles change or when they leave, their accounts need to be appropriately updated or automatically terminated. Leaving orphan accounts active risks potential security breaches and data leaks and creates extraneous costs for unused licenses. BYOD Devices in the Enterprise: The cloud is unique in that it allows an organization to provide its users with anytime, anywhere access, from any device. Users increasingly insist on using their own devices (mobile phones, ipad* tablets, etc.), compelling many organization to adopt a BYOD (bring-your-own-device) policy. BYOD has the advantage of reducing some costs, however, the organization must address how to control and monitor access from only certified, secure mobile devices. User Experience & Productivity: As more and more applications become part of the enterprise portfolio, users desire a single sign-on (SSO) entry point into all their applications eliminating the need to remember multiple user ID/password combinations. When people must remember different credentials for different apps, some will invariably resort to using the same password across all the apps, or use weak passwords that can be easily remembered and broken. Secure Multi-factor Authentication: Another consideration, which is particularly relevant to cloud-based applications, is the need to invoke strong, out-of-band authentication for certain use cases. In particular circumstances, users should be challenged to authenticate themselves with more than a user ID and password. For example, users who are located outside the firewall, who are contractors or other temporary hires, who belong to a particular group, or who use a particularly sensitive app, would all be candidates for multi-factor authentication (MFA). 2
Intel Cloud SSO Technical White Paper The SSO Solution Intel Cloud SSO is an on-demand hosted Identity as-a-service (IDaaS) offering from Intel that enables enterprise users to securely authenticate and enjoy seamless single sign-on (SSO) into hundreds of SaaS applications. The system is designed to make it easy for both the IT admin and the end-user to use. The IT admin logs into the Intel Cloud SSO management console, using a browser, to configure the system in three easy steps: Set up connections to business applications the company is using Assign users or groups of users to these applications Define when and where to apply context-aware access restrictions, such as MFA. Once a user profile is configured, the user logs into Intel Cloud SSO at www. intelcloudsso.com, and sees a personalized portal page listing all the SaaS applications the IT admin had assigned to that user. To access the application using SSO, the user simply clicks on the application icon, which is launched in a separate browser window. Once the user is initially authenticated to the SSO portal, they never see another user ID/password prompt again. Now, let s take a more detailed look into Intel Cloud SSO works. How Do I Get Intel Cloud SSO? To start, you can obtain a free 30-day trial account of Intel Cloud SSO. During this period, you can test the application with a limited number of user seats, using the SaaS application connectors in the Intel Cloud SSO catalog 1. You can convert your trial license to a full Intel Cloud SSO subscription at any time during the trial. There are two ways to sign up for your free trial account: Directly on the Intel Cloud SSO website (www.intelcloudsso.com/trial) Visit Salesforce AppExchange (www.appexchange.com), and search for Intel Cloud SSO. Intel Cloud SSO is available in two different modes: Standalone mode or Shared mode. (see Table 1 below) Regardless of which mode you choose, after completing the trial order form on the site you choose, you will receive an email from Intel with your login credentials and a link to a Quick Start Guide. To purchase an Intel Cloud SSO license, click the Request Quote link on the Intel Cloud SSO home page and complete the request quote form. Table 1 MODE Standalone mode Shared mode DESCRIPTION Intel Cloud SSO runs independently and doesn t share the user database with any other Force.com-enabled application. You can receive Intel Cloud SSO standalone through EITHER the website or AppExchange. Intel Cloud SSO shares the user database with an existing Salesforce.com application (such as Salesforce CRM). In shared mode, Intel Cloud SSO is installed on the same Salesforce organization (Org ID) as your Salesforce application. This option is for existing Salesforce customers who would like to provide SSO to their Salesforce users. You can ONLY receive an Intel Cloud SSO shared mode account through AppExchange. Note: You must provide your Salesforce Org ID to take advantage of this option. 1 Intel Cloud SSO runs on Force.com and includes an embedded Force.com platform license. It does NOT include any Salesforce.com CRM or other target SaaS application licenses. If you do not have existing accounts on your target SaaS applications, you should contact the vendor directly to obtain the appropriate license. 3
Intel Cloud SSO Technical White Paper Intel s cloud access broker strategy as well as roadmap integration of McAfee security functionality, makes for a compelling vision. Steve Coplan, 451 Research User Management Intel Cloud SSO allows you, or an authorized administrator, to: Create/modify/delete user accounts Change/reset user passwords Assign users to Intel Cloud SSO groups Create/modify/delete User Accounts Intel Cloud SSO administrators can create accounts for new users by logging onto the service, and navigating to Name > Setup > Manage Users. This interface is powered by the Force.com platform, which is incorporated within the Intel Cloud SSO application. Ensure that you select the proper profile while creating users 2. Intel Cloud SSO works with users that belong to either of the following profiles only: (see Table 2 below) Change/reset Password Intel Cloud SSO leverages Force.com for password management of its users. End users can change their password from either: Login page by clicking on the Forgot Password link After login, navigate to Name > Setup > My Personal Information > Change My Password. The Administrator can reset a password for any end user by navigating to Name > Setup > Manage Users> Users Note: If you are integrating Intel Cloud SSO with a corporate directory (such as Active Directory), using the Identity Bridge, the password isn t stored in Table 2 INTEL CLOUD SSO PROFILE Super Admin SSO Admin SSO User DESCRIPTION Access to all Intel Cloud SSO features and Force.com platform settings. The initial user login account you receive with Intel Cloud SSO account has these privileges. Typically, you need only one user with this profile. Access to all Intel Cloud SSO features, but restricted access to Force.com settings. This may be useful when you want separate Intel Cloud SSO administrators for each business unit within a large enterprise. Access to only the end-user facing MyApps tab of Intel Cloud SSO. 2 If you want to integrate and synchronize Intel Cloud SSO accounts with a corporate directory (such as Active Directory or any LDAP directory), then don t use the above interface to create/modify/delete user identities. Instead, you can use the Intel Cloud SSO Identity Bridge to automatically manage and synchronize user accounts with AD. Refer to the section in this document on Integrating with corporate directories. 4
Intel Cloud SSO Technical White Paper Intel Cloud SSO. Instead, you change the password in the corporate directory using its interface. Assign User to Intel Cloud SSO Groups Intel Cloud SSO includes the ability to manage users within a group. Administrators can navigate to the Users/Groups tab, create a new group, and assign users to the group through either of the following mechanisms: Static group membership - select users individually, and assign them to the group Dynamic group membership - use an attribute of the user profile to dynamically assign all users having that attribute value to the group. If you use the Intel Cloud SSO Identity Bridge to provision users you can automatically assign them to a target Intel Cloud SSO group (such as Sales ), based on AD groups the user belongs to. Intel Cloud SSO can the automatically provision users in a specific group to one or more apps, depending on how you configure groups and apps. Authentication into Intel Cloud SSO Intel Cloud SSO leverages the Force.com login mechanism to authenticate users. Administrators can set up one of the following mechanisms for users to login into the SSO portal: (see Table 3 below) Note that administrators can optionally set up 2-factor authentication using the built-in Intel Cloud SSO One Time Password (OTP) feature for strong authentication. For example, require OTP when users log onto the Intel Cloud SSO portal from outside the firewall. Table 3 AUTHENTICATION METHOD Local Remote 3rd party Identity Provider DESCRIPTION Enter a username/password into a login form presented by Intel Cloud SSO and authenticate locally. Use the Intel Cloud SSO Identity Bridge to authenticate the user against a corporate directory. Remote authentication can take two forms: 1. Users log onto Intel Cloud SSO, enter their AD user ID/password and are authenticated by the Bridge. 2. Users log onto Windows and are authenticated by their local AD. They can then SSO directly into the Intel Cloud SSO portal without re-authenticating. Federate with an external Identity provider (IP), using the industry-standard SAML protocol to redirect the logon request to the IP for authentication. This is how authentication using Salesforce.com IDs is accomplished. 5
Intel Cloud SSO Technical White Paper Figure 1 Configure App to set up connectivity with application Figure 3 Configure any restrictions for accessing the application Figure 2 Assign users or group of users that can access the application Setting Up Connections with Target Apps Intel Cloud SSO customers get unlimited SaaS application and provisioning connectors at no additional cost. To configure connections to target apps the IT admin log onto Intel Cloud SSO, navigates to the Admin tab, and clicks the New Application link. From here the admin can search or browse the catalog of supported applications. After selecting an application, they go through a simple 3-step process to configure the application connector. 1. Configure the app to set up connectivity 2. Assign users or group of users that can access the application 3. Configure any restrictions for accessing the application There are two types of connectors available to be configured for an app. SSO connector - mandatory Provisioning connector optional, and only available for applications that support a provisioning interface. As we see in Figure 2, users can be assigned to an application either as an individual, or as a member of a particular group. In the third step (see Fig. 3) you configure context-aware strong authentication, such as 2-factor authentication or restricting access based on contextual attributes such as: type of client device used to access, IP address range or other factors. This can be used to selectively restrict access from mobile devices for BYOD scenarios. 6
Intel Cloud SSO Technical White Paper How Is SSO Performed With Target Apps? Intel Cloud SSO supports 3 models of single sign-on (SSO) to target apps: Standards-based federated SSO Native federated SSO Form-based auto-login Where target applications (such as Salesforce.com, Google Apps, Box, etc.) support federated login using standards such as SAML, Intel Cloud SSO uses it for SSO into such applications. SAML tokens are used in place of passwords, which enhances security. However, not all SaaS applications support standards, such as SAML, today. There are a few SaaS applications which support proprietary mechanisms (such as using common shared secrets) to SSO into them. For these types of applications, Intel Cloud SSO has built native connectors. Finally, there are many other SaaS applications that do not support either of the above two mechanisms. For such SaaS applications, Intel Cloud SSO provides form-based authentication. In this scenario, Intel Cloud SSO asks the user for their credentials during the first access to the application. It stores the credentials in a secure credential database. Thereafter, Intel Cloud SSO automatically uses the credentials to log the user onto the application, using HTTP POST. Credentials are stored in the credential database in encrypted format using the AES-256 algorithm (which is the strongest encryption algorithm available). How Is Context-aware Strong Authentication Performed? Before a SSO login session to a target application is created by Intel Cloud SSO, it performs an additional check for contextual attributes, the result of which can: Block the login from accessing the target application Trigger step-up authentication using a one-time password (OTP) Contextual attributes that can be checked include (with more planned to be added in future versions) Type of mobile device such as ios, Android, Blackberry, Windows Mobile, etc. Client IP address range Day of week/time of day This feature can be useful for companies adopting BYOD or wanting to enforce 2-factor authentication using OTP for certain use cases. How Is User Account Provisioning/ de-provisioning Performed? Most major SaaS vendors, such as Salesforce.com, provide an API for provisioning and de-provisioning. Where target applications support APIs to create/ modify/delete user accounts, Intel Cloud SSO leverages those APIs to provision and de-provision the users automatically into the target application when users are assigned or de-assigned an application using the Intel Cloud SSO admin console. Figure 4 Intel Identity Bridge How Does Intel Cloud SSO Integrate With Corporate Directories? Intel Cloud SSO can use its own independent identity repository or leverage existing identity repositories an organization may have, such as Active Directory* or any LDAP-enabled directory. Customers can install a lightweight, optional component called the Intel Cloud SSO Identity Bridge on an on-premise domain server that communicates with the corporate directory on one end and Intel Cloud SSO on the other end. The Identity Bridge performs the following functions: Intel Cloud SSO user authentication using the corporate directory, with optional 2nd factor authentication using OTP. Automated user provisioning/de-provisioning from the corporate directory into SaaS apps through Intel Cloud SSO. For user authentication, the Identity Bridge can be configured to support either: Authentication of users logging into the Intel Cloud SSO portal in the cloud. User credentials can be validated by AD, without any requirement for the user to employ a VPN. Authentication from the Windows domain into Intel Cloud SSO using Integrated Windows Authentication (IWA). Once the user is authenticated by Windows, they can SSO directly into Intel Cloud SSO. For provisioning, the Bridge can automatically detect AD updates (add/change/ delete) that trigger the appropriate action (provision/update/de-provision) in Intel Cloud SSO. The Bridge supports AD Groups, which work in conjunction with the app configuration (see above) to automatically create accounts in SaaS target apps. For example, the system can detect that a new user profile in AD is in the Sales group, which will: a) create a new user profile in Intel Cloud SSO, and b) provision the user with a Salesforce.com account (or any other apps that are linked to Sales).
Intel Cloud SSO Technical White Paper Deployment of the Identity Bridge doesn t require any firewall changes, because it initiates a secure SSL connection from the enterprise to the Intel Cloud SSO server, rather than Intel Cloud SSO initiating a connection from outside the firewall into the enterprise. How Does Intel Cloud SSO Store and Secure Customer Data? Intel Cloud SSO stores the following types of data for each customer. User identities Connector configuration Audit logs Runtime metrics User credentials for form-based SSO connectors Intel Cloud SSO is a multi-tenant system and each customer s data is strictly isolated from other customer s data. User credentials are stored encrypted using AES-256 encryption algorithm. For additional details about the Intel Cloud SSO security architecture, refer to the white paper Intel Cloud SSO - Platform Security. Summary Intel Cloud SSO is an on-demand hosted identity as a service (IDaaS) solution from three trusted providers Intel, McAfee and Salesforce.com. It offers a complete identity and access management solution for enterprises that are outsourcing IT operations and applications to the cloud. Intel Cloud SSO enables application users to authenticate securely and conveniently access hundreds of SaaS applications through single sign-on (SSO). The built-in personalized portal provides users with a convenient launch pad with quick one-click access to all authorized SaaS business applications. SSO delivers three major benefits: It enhances end-user productivity and convenience, since it eliminates the need for them to remember and manage all their passwords. It reduces IT administrative effort by significantly reducing password reset calls. It improves security by controlling access to the target apps. Many organizations are understandably concerned about cloud security. Intel Cloud SSO addresses these concerns with context-aware strong authentication. Outof-band authentication using a one-time password (OTP) can be used to verify the user s identity via a mobile device, such as a cell phone or smart phone. Contextaware authentication also includes a mechanism for IT to enforce access restrictions based on IP address, type of mobile device, and other parameters. Customers can chose to store their user identities in the cloud or synchronize SaaS application identities with identities stored in on-premise directories (such as Active Directory), using a lightweight agent called an Identity Bridge. The Bridge is firewall-friendly, easy to set up, can be configured in minutes, and supports both authentication and automatic provisioning/de-provisioning, providing IT administrators with a single point of control for all user identities and attributes. For more information about Intel Cloud SSO. and to apply for you FREE 30 day trial, visit www.intelcloudsso.com. More Information and Partner Program Details Intel Cloud SSO: intelcloudsso.com Intel Application Security and Identity Products: cloudsecurity.intel.com Contact us by phone: Phone: 855-229-5580 E-mail: asipcustomercare@intel.com Contact us by email: asipcustomercare@intel.com INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL PRODUCTS. NO LICENSE, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, TO ANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT. EXCEPT AS PROVIDED IN INTEL S TERMS AND CONDITIONS OF SALE FOR SUCH PRODUCTS, INTEL ASSUMES NO LIABILITY WHATSOEVER, AND INTEL DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY, RELATING TO SALE AND/OR USE OF INTEL PRODUCTS INCLUDING LIABILITY OR WARRANTIES RELATING TO FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, OR INFRINGEMENT OF ANY PATENT, COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT. UNLESS OTHERWISE AGREED IN WRITING BY INTEL, THE INTEL PRODUCTS ARE NOT DESIGNED NOR INTENDED FOR ANY APPLICATION IN WHICH THE FAILURE OF THE INTEL PRODUCT COULD CREATE A SITUATION WHERE PERSONAL INJURY OR DEATH MAY OCCUR. Intel may make changes to specifications and product descriptions at any time, without notice. Designers must not rely on the absence or characteristics of any features or instructions marked reserved or undefined. Intel reserves these for future definition and shall have no responsibility whatsoever for conflicts or incompatibilities arising from future changes to them. The information here is subject to change without notice. Do not finalize a design with this information. The products described in this document may contain design defects or errors known as errata which may cause the product to deviate from published specifications. Current characterized errata are available on request. Contact your local Intel sales office or your distributor to obtain the latest specifications and before placing your product order. Copies of documents which have an order number and are referenced in this document, or other Intel literature, may be obtained by calling 1-800-548-4725, or by visiting Intel s Web site at www.intel.com. Copyright 2012 Intel Corporation. All rights reserved. Intel, the Intel logo, and Xeon are trademarks of Intel Corporation in the U.S. and other countries. *Other names and brands may be claimed as the property of others. Printed in USA Please Recycle Intel Cloud SSO Technical Works White Paper 0512