Platform and Infrastructure
Chapter 2: Approaches to Choosing a Platform
Establishing a platform for identity and access management involves making some significant decisions that will make a noticeable impact on an organization's IT capabilities. The first decision an organization must make is whether to choose a single-vendor solution or multiple "best-of-breed" products that can integrate to form a complete solution. The advantages of a single-vendor solution can include:
The advantages of a best-of-breed solution can (but again, not always) include:
Many organizations enjoy the advantages of both models by selecting a single vendor (typically a platform vendor) for a significant portion of the infrastructure, and then augment this baseline of products with other products from vendors to fill specific functionality gaps. If an organization chooses this path, it is important for the platform vendor to demonstrate that the technology will interoperate with many other vendors in different technology areas. The rest of this chapter discusses the choices that need to be made when selecting a single platform or best-of-breed product in the following technology areas:
On This Page
Choosing Directory ServicesSuccessful operation of the identity and access management platform requires a suitable location for storing application and identity information. While other options for storing user information exist, the industry has rapidly standardized on directory technology to achieve this capability. Most commercially available directories today support a common set of capabilities that include:
Because directory object storage and directory access mechanisms are fairly consistent across most directories, what differentiates directory service products are often capabilities such as:
Directory requirements may also depend on the role that a directory is asked to perform. Capabilities that are required in one role may differ from those required in another role. For example, many organizations will need to deploy directory services to perform the following roles:
The following sections in this chapter describe considerations for directories in these roles. Intranet DirectoryMost organizations currently have one or more directory service on their intranet. Intranet directory services must provide the following capabilities:
In addition to these capabilities, it is highly valuable if the intranet directory service also integrates tightly with security services that are often found on the intranet. Extranet DirectoryExtranet directories have the same fundamental requirements as intranet directories in most organizations. The additional requirements for choosing a directory that must support applications used by partners, customers, and employees include:
Application DirectoryApplication directories are deployed in organizations where directory service technologies meet the requirements of the scenario, but where the data stored in the directory is not useful to a large set of users or applications. Application directories usually have a subset of directories that are used at the organizational level, and additional requirements for manageability and operability. Application directories should offer the following:
Choosing Access Management ServicesAccess management services provide the organization's applications with the capability to authenticate users securely and carry out robust authorization. When considering your access management choices, select technologies that integrate well with the directory services product. Selecting Authentication MethodsThe requirements and considerations for authentication mechanisms can vary greatly based on the scenario. Typical requirements that differentiate how authentication is performed include:
Although there can be variations within the scenarios, intranet and extranet authentication offers one way to categorize users and applicable authentication mechanisms. Intranet AuthenticationIntranet authentication has the following characteristics that will influence the authentication mechanisms you choose:
Because of these characteristics, it is possible to choose authentication mechanisms for the intranet that offer high levels of security while providing an SSO experience. However, these also require a combination of sophisticated infrastructure, configuration, and certain user behaviors. Examples of authentication technologies that meet this description include:
For more information about these technologies, see the "Intranet Access Management" paper in this series. Extranet AuthenticationWith the single exception of employees (and in a few cases, partners) that access extranet resources by using VPN technologies over the Internet, Web-based extranet access has a completely different set of characteristics:
Because of these characteristics, authentication mechanisms should be chosen for the extranet that offer adequate levels of security without placing unrealistic requirements on users. Examples of authentication technologies that meet this description include:
Even with the very explicit restrictions that the extranet environment dictates, extranet users expect the same SSO experience across multiple applications that intranet users enjoy. Furthermore, many organizations have requirements to provide an SSO user experience across different applications running on different platforms. A strong independent software vendor (ISV) market has matured to address this problem of providing Web SSO across heterogeneous platforms, and many suitable solutions are available from a large number of vendors. For more information about these technologies, see the "Extranet Access Management" paper in this series. Implementing AuthorizationMost platforms support some form of access control list (ACL) mechanism for granting permissions on static objects such as files and printers. Access to these objects is granted by being a user or a member of a group that is explicitly allowed access to the object. In addition, most organizations are contemPlating whether to use some form of role-based access control (RBAC). RBAC tends to be more intuitive, and as a result it is easier to manage and more flexible. RBAC mechanisms should be capable of implementing a business rule to define authorization policy. For example, a RBAC mechanism should be able to enforce a business rule of the following type: Only bank tellers can process savings account deposits between the hours of 9am and 4pm. An organization should choose a platform that provides efficient ACL – based access control for static objects, as well as a robust, flexible RBAC mechanism that is intuitive to manage, and capable of expressing complex business rules as access policies. Implementing Trust MechanismsOf all the technologies that have been discussed so far, the implementation of trust is likely the biggest technology area that differentiates various platforms. At the highest level, trust is the reliance that one computer places on another computer or group of computers to assert the identity of a user. The differentiation between trust mechanisms is mostly in how computers and users become part of a circle of trust. For example, host-based systems are, by their very nature, both autonomous and encompassing. Few organizations have more than one mainframe, and if they do, those computers are unlikely to trust each other except through the explicit sharing of passwords. UNIX and Linux operating systems are typically either stand-alone systems (not a member of any "circle of trust") or part of a Network Information Service (NIS) or NIS+ grouping. You can also configure UNIX and Linux workstations to use LDAP for authentication and authorization. When this happens, all such workstations configured to use the same directory instance become part of this circle of trust. In order to become a truly valuable tool for enabling effective identity and access management, the platform should provide trust mechanisms that scale across the entire organization, and even between organizations. Establishing circles of trust should make up a fundamental component that you can organize into hierarchical groupings to make it easy to administer the trust relationship at the appropriate level. Choosing Identity Life-Cycle Management ToolsIdentity life-cycle management tools provide the means to manage the following basic tasks related to identities:
All platforms come with tools and interfaces that allow the administrator to perform these basic tasks, but this is another area where a strong ISV market has developed in order to provide user-friendly, cross-platform management capabilities. In many cases, these tools are Web-based, which is highly appropriate for extranet identity management scenarios, such as partner-delegated administration (in which the partner organization takes responsibility for administering their users). You should consider using best-of-breed identity management tools for your organization's scenario if the platform-provided tools that have been designed for the intranet scenario in this paper series do not meet your organization's requirements. Implementing Identity IntegrationIdentity integration tools are often sophisticated, complex products in their own right. These tools can aggregate and synchronize the information that describes digital identities (attributes) between the many existing identity stores in established organizations. Some of these products are also described as metadirectory products. Features to consider when evaluating an identity integration product include:
Provisioning and DeprovisioningThe ability to provision and deprovision user accounts in multiple identity stores may be features that are part of an identity integration product or they may be implemented in a stand-alone product. The features to consider when evaluating provisioning products are similar to those for an identity integration product. The ability to support different levels of workflow is also an important distinction for provisioning. Choosing an Application PlatformApplication development environments have a history of integrating well with their native platform, but not so well with other platforms. For this reason, your organization's choice of application platform will most likely depend on your choice of infrastructure platform for the application servers in your environment. Many organizations choose to develop or maintain applications on two or more platforms. For such organizations it is critical to understand how heterogeneous applications can interoperate by using common protocols and by taking advantage of common infrastructure services. An application platform that does not integrate or interoperate well with others should not be chosen. Application platform vendors should have a demonstrated commitment to interoperability and support the relevant standards efforts that make interoperability possible. The Microsoft Identity and Access Management PlatformThe following sections in this chapter describe the core products and technologies that make up the Microsoft Identity and Access Management platform, and the benefits it brings to an organization. Directory ServicesMicrosoft Windows Server™ 2003 includes support for the Microsoft Active Directory® directory service, and for an application directory service called Active Directory Application Mode (ADAM). The following figure shows the central role Active Directory plays, and how it integrates with other Microsoft and ISV technologies. Active DirectoryActive Directory has the following features that make it suitable for both the intranet and extranet directory service role:
Active Directory Application ModeActive Directory Application Mode (ADAM) has the following features that make it suitable for the application directory service role:
For more information about ADAM, download the white paper "Introduction to Active Directory Application Mode" Security ServicesThe following security services are tightly integrated with Windows application servers, Windows client operating systems, and computers running Windows 2000 Server and Windows Server 2003 acting as domain controllers:
Identity Integration ServicesMicrosoft Identity Integration Server 2003, Enterprise Edition with Service Pack 1 (MIIS 2003 with SP1) includes the following features that you can use to streamline identity and access management across your organization:
A reduced feature set version called the Identity Integration Feature Pack for Active Directory offers:
Client Operating SystemOrganizations that standardize on Windows XP Professional will realize these benefits:
Development PlatformMicrosoft Visual Studio.NET and the .NET Framework provide the capability to:
Platform BenefitsImplementing the Microsoft Identity and Access Management platform with the solutions describe in the following chapters of this paper will allow Contoso to achieve the following benefits:
While the platform provides core services that are required for identity and access management, several solutions need to be implemented with the platform to achieve all of these benefits. Chapter 4, "Designing the Infrastructure" in this paper discusses these solutions.
|
In This Article
|
