Federated provisioning and the Cloud

Federated Provisioning and the Cloud Nishant Kaushik Lead Strategist, Oracle Identity Management

The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle.

The Backdrop: Provisioning Will Not Die • Provisioning is at the heart of enterprise Identity GRC controls • Re-factoring, not re-architecting, systems for the cloud • Gaps in security coverage not an option Image: X-Men Origins: Wolverine, TM and Copyright 20th Century Fox Film Corp., 2009

Ian Glazer proclaimed… Image: Monty Python and the Holy Grail, TM and Copyright Columbia Pictures or the Killer Rabbit, whoever comes after me first

A lively battle ensued… Image: Monty Python and the Holy Grail, TM and Copyright Columbia Pictures or the Killer Rabbit, whoever comes after me first

And at the end… Image: Monty Python and the Holy Grail, TM and Copyright Columbia Pictures or the Killer Rabbit, whoever comes after me first

The Emancipation of Fed-Prov Federated Provisioning

The Emancipation of Fed-Prov Federated Provisioning Advance Provisioning (≡ Classic Provisioning) • Batch-Oriented (LDIF/XML/XLS exchanges) OR Connector-based • Triggered by Policy Events or Requests

The Emancipation of Fed-Prov Federated Provisioning Advance Provisioning Just-In-Time Provisioning (≡ Classic Provisioning) (≠ Classic Provisioning) • Batch-Oriented • One-off, real-time (LDIF/XML/XLS exchanges) provisioning of access OR Connector-based • Triggered by User • Triggered by Policy Events requesting access at RP or Requests

Enterprises ♥ Advance Provisioning Partner Application SPML Connector Provisioning Engine Extension of existing policies and controls, including updates and de-provisioning

Enterprises ♥ Advance Provisioning (But it’s a little too like Classic Provisioning) Partner Application SPML Connector Provisioning Engine Each integration requires too much work, even with SPML in the picture

Enterprises ♥ Advance Provisioning (But it’s a little too like Classic Provisioning) Partner Applications ? Connector Provisioning Engine Provisioning Engine SPML not designed to completely cover the provisioning engine-to-provisioning engine use cases

And what about The Cloud? ?

Enterprise IdM, Interrupted Identity infrastructure that seamlessly spans an enterprises internal & cloud environments Traditional Enterprise IdM relies on tight Vision integration and heavy customization, with Disruption direct access to data The cloud’s model of sharing stores resources makes tight coupling a non starter Convention

Advance Provisioning in the Cloud Partner Application SPML Connector Provisioning Proprietary APIs Engine Connector Cloud SPs ? Connector Building connectors to Mom & Pop SPs not standardized, doesn’t scale, low-to-negative ROI

Advance Provisioning in the Cloud Partner Application SPML Connector Provisioning Proprietary APIs Engine Connector Cloud SPs SPML Connector Need a Lightweight SPML-based Provisioning Service

JIT Provisioning To The Rescue • Advance Provisioning model doesn’t remove the integration burden • On-the-fly federations needed to enable and secure short- lived/limited use cloud services • JIT Provisioning more suited to a light-touch provisioning approach Image: Iron Man 2, TM and Copyright 2010 MVLFFLLC and 2010 Marvel

JIT Provisioning Flow AuthN token w/ Claims 2 5 Federation Service Cloud Services 1 3 4 Federation Server Provisioning Service Federation Server extracts the claims from the incoming token and passes to Provisioning Engine to use in account enablement

JIT Provisioning: Missing Pieces 2 5 Federation Service Cloud Services 1 ? 3 4 Federation Server Provisioning Service Federation Server to Provisioning Engine interaction needs standardization, enhancement •Add a SAML Profile for SPML? Let’s call this •How do we solve the Schema problem? SPML-FP

JIT Provisioning: Missing Pieces 2 5 Federation Service Cloud Services 1 SPML-FP 3 4 Federation Server ? Identity GRC System Provisioning Service ? How does the Enterprise get visibility into these provisioning interactions?

Scotty...I need more power! • Provisioning often requires more attributes than those in AuthN token • Attributes (Claims) = profile attributes, roles, entitlements • Principle of Minimal Disclosure means not sending all possible data as part of AuthN token • How do we provide discovery, data retrieval and policy enforcement? • More importantly, how do we keep it simple? Image: Star Trek, TM and Copyright CBS Paramount Television

Option 1: OpenID Attribute Exchange 1 2 AuthN + Attribute Request 6 Federation Service Cloud Services 4 SPML-FP 3 AuthN + Attribute Response 5 OpenID Provider (OP) Provisioning Engine / Provisioning Service Identity Provider How does the Federation Server know what attributes the Provisioning Engine needs? •Attributes needed could vary by service accessed •Need to add a Query Response to SPML-FP

Option 2: SAML Attribute Query 2 7 Federation Server Cloud Services 1 SPML-FP 3 Federation Server 4 SAML Attribute 6 Query Provisioning Engine / 5 SAML Response w/ Attribute Assertion Provisioning Service Identity Provider Requires the creation of a Trust Relationship between the two sides ahead of time

Option 3: OAuth + ArisID (IGF) 1 6 Federation Server Cloud Services 2 ? 3 OAuth 5 Federation Server AAPML 4 ArisID (IGF) CARML Provisioning Engine / Provisioning Service Identity Provider OAuth = light-touch federated connection ArisID = standardized, policy-compliant attribute retrieval API

There’s Work To Do • Standards work needs to settle • SPML future uncertain • SAML, OAuth, IGF still evolving • Architecture and Flows need to be spec’d out • How do we handle updates, de-provisioning, audit? • Vendors, Service Providers need to adopt • Will S-O-S make this redundant sooner rather than later? Image: Mr. Smith Goes to Washington, TM and Copyright Columbia Pictures

My “Pitch” Kantara Initiative’s Identity and Access Services WG (previously Burton Group Identity Services WG) • http://www.kantarainitiative.org/confluence/display/ias/Home At Burton Catalyst North America • SPML UnBoF organized by @mark_diodati • I’ll be speaking on “Beyond SPML: Access Provisioning in a Services World” Connect, Discuss @nishantk blog.talkingidentity.com

http://blog.talkingidentity.com	709
http://www.slideshare.net	55
http://www.lmodules.com	4
http://static.slidesharecdn.com	2
http://translate.googleusercontent.com	1

Federated provisioning and the Cloud

by Nishant Kaushik on May 27, 2010

Accessibility

Categories

Tags

Upload Details

Usage Rights

5 Embeds 771

Statistics

Federated provisioning and the Cloud — Presentation Transcript