SSO Solution

I saw this query on one of user groups

We are looking to move to a SSO solution, but were wondering what everyone else is doing? we have 5K + employees that all need access to various platforms (Sun Solaris, VMS, AIX, SCO, HP-UX, Windows, Citrix, AD, Web, etc).

Is there some sort of app or some such thing that will do a cross-reference of userid's? Or do we even need to worry about that (the 8-character limitation on the Unix boxes)if we implement LDAP or AD?

and I thought that this reply should give a starting point to the complete domain of Identity Management for solving the issue.

Well my suggestion would be that you should consider the various approaches available to you and probably should implement something that suits your requirements. The various approaches available to you are

  1. Consolidation of Authentication repositories well this refers to the basic idea of setting up an enterprise directory which all the products can tie into for authentication purpose and to some extend authorization too. This would essentially mean that there is one id and password that has to be typed by people to login to all the integrated applications (which has its own pros and cons in terms of ease of usage vs security of systems)
  2. Consolidation of Authentication entry-point - Most of the web applications can be consolidated to use web single sign-on system which can be tied to directory server if needed. This would allow the applications that do not provide interface to integrate with LDAP for authentication to be tied together by off-loading the authentication and authorization to a single entry point (the SSO solution). This would also help build the starting point for federated sign-on infrastructure.
  3. Consolidation of Administration This is where the Identity Management solutions like SIM (look below for other possible products) can be set up to integrate with rest of the infrastructural components that can not be consolidated (for what ever reasons) to be provisioned through a single provisioning and administration system. Please note that implementation of Identity Management solution is a very complex undertaking and is very expensive in terms of licensing and in-house training and is not for faint hearted. In addition to that it comes with a lot of features (that may not even work properly or suit your needs) like approval workflow (to approve creation of new accounts), provisioning workflow, rules, password and account data synchronization and compliance management.
  4. Consolidation of Synchronization A lighter version of the Identity management product is the Meta-directory and Password synchronization products which can be used to synchronize the account (and password) information across multiple environments without the overhead of workflows, etc.
  5. Reduced Sign-On A set of products that run on client desktop and track the system that client is trying to access and automatically supply the password.

Comments

Post a Comment

Popular posts from this blog

Vendor List

Updated: November 12 2006 I am trying to come up with the list of vendors and associated products in the Identity and Access Management arena. Please note that this list is based on marketing/public information and my understanding of the terms which may not comply with any specific groups' definitions and/or requirements. This is by no means a complete list and will keep growing as I get more time to add them and find more companies (any help on that front will be really appreciated). Before we go further along, lets try to define what each of these product typically do so that my mode of classification may make sense or any flaw in my classfication will become apparant. Identity Management/User Provisioning These products typically provide the facility of Workflow-based Identity provisioning, password reset, identity reconciliation/discovery, delegated identity administration and self-service features on wide variety of identity platforms (like LDAP, Unix, Windows, Mainfra
Read more

Understanding IAM Technology: Web Single Sign On (Web SSO) Part I - Introduction and Use Case Definition

Image
Update September 6, 2015: Part II in the series is now available . Update August 19,2006: I am rewriting this entry based on the methodology I am using for some of other domains. Hopefully, the new methodology would make it more useful to some of you. I talk to a lot of people from developer background who still do not have a good background in the IAM technology. Eventhough there is a lot of information on the web, I have felt a lack of good technological discussion on the various component that  actually form the IAM domain. Some of the good sources for the information on IAM are Microsoft Identity and Access Management Series Archie Reed Oracle Federated Identity Buyers guide Oracle Identity Management Buyer's Guide Identity Management Dissected Most of these document discuss the basic concepts but do not extend it to existing technologies and how it applies to them. This series is an attempt to look at the technology behind the Identity and access manage
Read more

Reclaiming your account: Password Reset/Forgot Password

Image
This is probably one of the oldest functionality that is part of any password based system and by now I was hoping that people will have figured out most of the ways of doing it. But while reading answers on stackoverflow on this topic, I was impressed by new ways being developed and implemented by developers in wild. While reading the discussion I felt that there is lack of a structure to look and study this functionality and this post is an attempt to define a structure. Before I go there, I wanted to capture my understanding of the password reset functionality. Why - Well if we are not noting down all the accounts we have created in life (either electronically or manually), it is possible that we are going to forget passwords for some accounts as we age. Even if you follow some techniques like having standard passwords across all your accounts, due to site limitations, change in word preferences, etc, you may not remember the applicable password for a site and so the lifesaver Why
Read more