Api gateway @ vaudoise assurances
•
0 likes•181 views
Discover how Vaudoise Assurance company implemented a Web SSO solution with Axway API Gateway to improve partner and customer engagement.
Recommended
More Related Content
Similar to Api gateway @ vaudoise assurances
Similar to Api gateway @ vaudoise assurances (20)
More from SmartWave
More from SmartWave (20)
Recently uploaded
Recently uploaded (20)
Api gateway @ vaudoise assurances
- 2. Context 01/02/2018 2 Private Customers Enterprise Customers Partners Employees ▪ SAML WebSSO solution ▪ IGB2B constraints ▪ Local Identity Provider (IDP) RFP POC IDP 2014 2015 2016 2017 POC IDP Axway Other federations POC SAML MeP MeP MeP Note: WebSSO was not the only task in order to have a "go production" Audit Audit simplesamlphp
- 3. Solution 01/02/2018 3 WebSSO policies Authentification level criteria • Application default level • User's group based • Restricted zone (URL, group based) Perimetrical authentification level • No authentification • SAML (sp and idp initiated) • Username/password • OIDC • Facebook Connect • Kerberos backends User repository authN OTP • SMS (email2sms / soap) Step-Up authN supported Backend definition • Applications • Population Different user registries • External users • Employees Anti bruteforce SAML anti replay Backend authentification • JWT • Attribute mapping (saml) • Kerberos AuthZ • Group based Customization of logon pages / error messages DNS alias support authZ MISC
- 5. Non-regression testing (@Vaudoise) 5 • JWT application & Kerberos application ▪ Employees Kerberos ▪ Employees Username/password/OTP ▪ External username/password/OTP ▪ External SAML (sp/idp) ▪ External OIDC • SSO • AuthN failure • SAML anti-replay / validity / … • SAML SLO • Stepup-authN • Timeout verification • AuthZ verification • Attribute mapping • Alias • Group based authN • … 01/02/2018
- 6. Axway apigw advantages / disadvantages • Advantages • Toolbox with lots of predefined filters in order to build a solution. Caution: some filter may not be appropriate (example: OIDC) • Java code in order to implement about everything we want…. • Business requirements, as well as IGB2B constraints have been implemented • Stable solution 01/02/2018 6 • Disadvantages • Time consuming (specifications) • Non-regression testing • No Axway support for the custom solution • No Smartwave SLA contract support for the custom solution • Product lacks of true IDP, but… • We setup an Access Control Solution (SAML SP, OIDP RP, Identity transformation) Our context Interested in our integration work? We are willing to share our policies
- 8. 01/02/2018 8 Merci de votre attention Dorian Rougier / Smartwave Chris Dixon / Smartwave Christian Gigandet / Vaudoise Assurances