Roadmap from Static RBAC to Dynamic ABAC @ IDM Europe 2017
•
3 likes•608 views
The Dutch Prison Service (Dienst Justitiële Inrichtingen), part of the Dutch Ministry of Security and Justice, has embarked on the implementation of a future-proof IAM solution for its own staff and those of business partners. The Toegangsplatform DJI (Access Platform) project has developed a 2020 vision in which static RBAC and dynamic ABAC will be realised. By these means, authorisation management will become an inherent part of the regular business processes, and the business itself can be ‘in control’ of its IAM responsibilities. Jean-Pierre Vincent and Matthijs Kempers will share their vision and the status of the project.
Recommended
More Related Content
Similar to Roadmap from Static RBAC to Dynamic ABAC @ IDM Europe 2017
Similar to Roadmap from Static RBAC to Dynamic ABAC @ IDM Europe 2017 (20)
Recently uploaded
Recently uploaded (20)
Roadmap from Static RBAC to Dynamic ABAC @ IDM Europe 2017
- 1. Toegangsplatform DJI (IAM platform DJI) Jean-Pierre Vincent (Programme manager) Matthijs Kempers (Project manager business) Datum: 8-3-2017
- 2. Agenda 1. About Dienst Justitiële Inrichtingen (part of Ministry of Security and Justice) 2. Project overview Toegangsplatform DJI 3. Vision 2020: Dynamic ABAC 4. Roadmap: from Static RBAC to Dynamic ABAC 2
- 3. 3 About Ministry of Security and Justice Justitiële uitvoerings- dienst Toetsing Brandweer De rechtbank Inspectie Veiligheid en Justitie Dienst Terugkeer & Vertrek Openbaar Ministerie Politie Dienst Justitiële Inrichtingen Nationaal Coördinator Terrorismebe strijding en Veiligheid Integriteit en Screening IND Ministry of Security and Justice Centraal Justitieel Incasso- bureau
- 4. Facts Dienst Justitiële Inrichtingen DJI is: • House of detention • Prison • Juvenile penitentiary • Forensic psychiatric centre • Detention centre • Approx. 55000 inmates • 38 institutions Our focus is on: • approx. 13.500 employees • approx. 260 target systems • Many third-party organisations 4
- 6. User organisation Attribute Provider Attribute Provider Attribute Provider Supplier organisation 6 Service Provider Project overview Toegangsplatform DJI Audit solution IAM solution Active Directory HR store Identity Provider SAML Identities Attributes Target system Target system
- 7. Project phases and deliverables Toegangsplatform DJI Selected IAM solution Implemented IAM solution Business pilot: • roles (RBAC) • cleanup • new IAM processes Security officers: • automated reports • new audit processes • get and stay 100% clean Business provided with roles Future-proof federation environment Project completion Q3 2015 2016 2017 Q1 20192018 Project Start Preparation and pilot Business rollout 7 Decharge
- 8. Supplier organisation User organisation 8 Service Provider IAM solution Identity Provider 1 4 2 3 8ab 6 7b 5 Vision 2020: Dynamic ABAC HR storeHR Identities & attributes 7a Target system Attribute Provider Attribute Provider Attribute Provider Trusted party Trusted party Attribute Provider 8c 7c
- 9. Supplier organisation User organisation 9 Service Provider IAM solution Identity Provider Vision 2020: Dynamic ABAC HR store Target system Attribute Provider Attribute Provider Attribute Provider Trusted party Trusted party Attribute Provider Conve nantAudit solution Target system HR Identities & attributes
- 11. 11 03 04 0501 02 Dynamic ABAC Target situation No authorisation model Start situation Dynamic RBAC Static ABAC / Hybrid ABAC/RBACStatic RBAC Roadmap Authorisation Models
- 12. Target system CTarget system BTarget system A 12 Start situation No authorisation model • Numerous points of request • Missing insight 01 Aut Aut Resource Aut Aut Resource Aut Aut Resource Aut Aut Resource Aut Aut Resource Aut Aut Resource Aut Aut Resource Aut Aut Resource
- 13. 13 Static RBAC • One stop shop • Insight into the reason for authorisation • Fast removal of authorisations Task Func Org Proj • Function roles • Task roles • Project roles • Organisation roles 02 TaskFunc OrgProjTask Proj Org Auth Auth Auth Auth Auth Auth Auth Auth Resour ce Resour ce Resour ce Resour ce Resour ce Resour ce Resour ce Resour ce
- 14. 14 Dynamic RBAC based on attributes from attribute store x based on HR attributes 03 Task OrgProjFunc Auth Auth Auth Auth Autj Auth AuthAuth Audit solution IAM solution Active Directory Target system HR store Con- nectorAttribute Provider
- 15. Supplier organisationUser organisation 15 Static ABAC 1 2 5 User requests access to system A (Service Provider) Send SAML message Request for SAML message 04 Audit solution IAM solution Active Directory Identity Provider 3 4 Authenticate against AD Request attributes Service ProviderConverter from ABAC to RBAC Hybrid ABAC/RBAC Target system A
- 16. 16 Vision 2020: Dynamic ABAC 05 Supplier organisation User organisation Service Provider IAM solution Identity Provider 1 4 2 3 8ab 6 7b 5 HR storeHR Identities & attributes 7a Target system Attribute Provider Attribute Provider Attribute Provider Trusted party Trusted party Attribute Provider 8c 7c
- 17. Thank you for your attention 17