Downloaded 29 times
Uploaded byRik Van Bruggen
Reinventing Identity and Access Management with Graph Databases
This document discusses reinventing identity and access management (IAM) with graph databases. It notes that traditional IAM systems have static views of identity that cannot handle today's complex, dynamic identities for users, things, and services. Graph databases allow for modeling the flexible, multidimensional relationships between entities that are needed for modern IAM. Neo4j is highlighted as a graph database that can represent complex identity relationships and hierarchies and enable real-time traversal of these relationships for advanced access management and compliance checks. Case studies demonstrate how Neo4j has been used successfully for flexible, high performance IAM applications.
More Related Content
Similar to Reinventing Identity and Access Management with Graph Databases
Reinventing Identity and Access Management with Graph Databases
- 1. Reinventing Identity & AccessManagement With Graph Databases WhiteHall Media IDM conference, June 21st 2017
- 2.
- 3.
- 4.
- 5. This is datamodeled as tables!
- 6. This is datamodeled as graph!
- 7. A Property GraphIs NODE (with properties) NODE (with properties) NODE (with properties) RELATIONSHIP (with properties) RELATIONSHIP (with properties) RELATIONSHIP (with properties)
- 8.
- 9.
- 11. A Property GraphIs Also Very Applicable To IAM
- 12. and for theright reason at the right time,Who gets access to what, Identity & Access Management (IAM)
- 13. Traditional IAM-systems 2) Underlyingassumption that organisations are hierarchal 1) Static idea of Identity
- 14. 1) Identity isincreasingly complex Why we need to reinvent IAM?
- 15. http://blogs.gartner.com/ian-glazer/2013/02/08/killing-iam-in-order-to-save-it/ Active Directory SAP Knowledge Base CRM Customer Support Inside Sales HR-system ADD/ CHANGE / LEAVE IAM Static identities left the building!
- 16. Serial # UniqueidPersonal Customer Partner Consumer Citizen User identities Identity of Things Dynamic Complexity of Digital Identities Web- service Micro- service Identity of Services
- 17. Device <-> Service SecurityEnd to EndIdentity of users Identity of things Identity of Services “RBAC on steroids” Dynamic Complexity of Digital Identities
- 18. 2) Traditional hierarchiesare being revised 1) Identity is increasingly complex Why we need to reinvent IAM?
- 19. Running up anddown the tree: Parent-Child relationships Ideal World Query complex, multi-dimensional relationships that traverse multiple hierarchies in real-time Real World
- 20. 2) Traditional hierarchiesare being revised 1) Identity is increasingly complex Why we need to reinvent IAM? 3) Access Management is more and more about the relationships between users, partners, customers, things and their different touchpoint within organisations and eco-systems – and will need to provide REAL-TIME checks
- 21. Identity Relationship ManagementIdentityAccess Management Applications and data Endpoints People Customers (millions) Partners and Suppliers Workforce (thousands) PCs Tablets On-premises Private Cloud Public Cloud Things (Tens of millions) WearablesPhones PCs Customers (millions) On-premises Applications and data Endpoints People “GDPR compliance will largely depend on our ability to check complex relationship patterns in real-time.”
- 22. How does Neo4jhelp?
- 23. • I&AM canbe described in as many dimensions as we need • Multiple hierarchies form one graph: departments, suppliers, partners, assets, roles, projects… • Cross-cutting concerns (eg. roles in multi- functional teams) can be easily described • This flexibility removes the need for application specific directories / user+role management in the long run Hi-Fi model of reality
- 24. • Access control,modeled as a graph, is a perfect graph database application • Traversals can be multi-dimensional – and pretty deep: combining different hierarchies in one query • Asset Hierarchy • Organisational Hierarchy • Partner Hierarchy • Added value of “impact analysis” questions to prevent accidental service disruption • Typical access control questions are very “local”, and have excellent performance characteristics • Yes/No answers to authorisation questions Complex traversals = graph affined
- 25.
- 26.
- 27.