OracleAS Identity Management Solving Real World Problems
-
Upload
databaseguys -
Category
Documents
-
view
201 -
download
0
Transcript of OracleAS Identity Management Solving Real World Problems
OracleAS Identity ManagementSolving Real World Problems
Web applications are great ...
Inexpensive development
Rapid deployment
Access from anywhere
BUT ….
…but they can be an administrative and usability nightmare!
Business Problem
Many more users of your business system– Anyone with PC has potential access– Not all users are employees or students
partners, suppliers … and hackersManaging users is more complicated
– Authorized users need to access multiple applications– Proliferation of accounts, passwords, privileges
Critical business applications and data are online– Real risk is greater, awareness of risk is also greater– Legal mandates for protection of certain data
IT operational challenges
New employee or student enrollment– Create identity and credentials for the user– Create accounts for all applications he/she needs– Define authorizations
User’s organizational role changes (or user terminated)
– Automate privilege changes in applications– Revoke accounts and authorizations for all applications he/
she had access to– Disable user’s identity and credentials
IT operational challenges, contd.
Manage user authentication securely– Enforce password complexity– Detect and prevent password attacks– Implement efficient procedures for password resets
Deploy a new application– Integrate the application with corporate Portal – Delegate administration– Leverage an existing authentication service– Automate account provisioning for the application– Maintain synch among existing directories such as AD
IT operational challenges, contd.
Support complex deployment scenarios– Deploy many applications and servers securely,
with least privilege– Decentralized IT administration– High availability– Support load balancers, firewalls, HW
accelerators
Oracle’s Solution
Security platform enabled by Oracle Identity Management
Platform components with high assurance
What is Identity Management?
“Identity management is the process by which the complete security lifecycle for users and other entities is managed and controlled for an organization or community of organizations.”
Identity Management Infrastructure
An enterprise directory - Oracle Internet Directory (OID)– Directory of users, groups, applications, roles & policies– Meta-directory platform and connectors - Directory
Synchronization Service (DSS)Access management services
– Single Sign-on (SSO)– Centralized authorization repository (OID)
Provisioning platform - Prov. Integration Service (PIS)– Provisioning policy and account management tools – Provisioning integration platform
Provisioning event propagation, workflow automation
Provisioning connectors
Identity Management Infrastructure
Delegated Administration Services (DAS)– End user self-service tools– Enterprise user, group and role management tools– Application administration delegation tools
Public Key Infrastructure Services– Oracle Certificate Authority (OCA)– Certificate / key archives– Online certificate status
Auditing and security monitoring services – Enterprise audit policy management tools– Central audit log archive and mining tools
Identity Management Benefits
Saves Money– Centralized user management reduces admin cost– Easier to automate and less error prone
Improves Security– By preventing fragmented security
Enhances user experience– Single password and Single Sign-on– Personalization – Delegated Administration and Self-service
4
Oracle Identity Management in Oracle Security Architecture
Oracle Internet Directory
Oracle Certificate Authority
DirectoryIntegrationServices
ProvisioningService
OracleASSSO
Delegated AdministrationServices
3rd Party Directory Service
3rd Party Authentication Service
Oracle 10g RDBMSOracleAS 10gOracleE-Business Suite
JAAS Roles, Component access Controls, Java2 Permissions,…
Enterprise RolesVPDLabel Security, ..
E-Biz Responsibility
OracleCollaboration Suite
File privileges, Secure Mail, Interpersonal Rights granting
OracleAS (9i or 10g)
Oracle Identity Management – Value PropositionAn enterprise infrastructure that leverages Oracle’s
“unbreakable” technology– reliability, scalability, security, performance
Enables deployment of all Oracle products out of the box– AS, DB, OCS, eBiz
A single point of integration for customer’s existing identity management solutions
– Transparent 3rd party integration for OIM enabled products
An open, standards-based infrastructure to accommodate variety of partner solutions and customer deployments
– Accommodate a wide variety of deployments and partner solutions.
Specific Problems and Solutions
New Student Enrollment
Create user in OID - creates user in Enterprise
– Oracle products recognize identity– Third party (e.g., AD) provisioning via PIS
Improved provisioning support through OIM– Single user in OID– Student System-based provisioning though PIS– Windows (and other third party) integration via
DSS– Automated certificate provisioning with OCA
User’s organizational role changes
Change role and/or remove user from OID– Directly via DAS or indirectly via PIS– Immediately changes user in OIM-aware
applications– Other applications can be synchronized via DSS,
PIS
Dynamic group support in OID
Manage User Authentication SecurelySingle Sign On
– OracleAS SSO for web single sign on– Enterprise User Security for client-server SSO to
database– Multilevel authentication in OracleAS SSO 10g– Windows Native Authentication
Proxy authentication for multi-tier database accessAdvanced password management policies in OID
– Password history, Password hints and reset upon expiry– IP address based lockout policies– Centralizes password management for OIM-based
applications
Manage User Authentication Securely, cont.
External authentication plug-ins for 3rd party LDAPDAS management of account lockout statusDAS Self Service password hint and password resetStandalone database continues to support
customizable password management
Deploy New ApplicationOID/SSO provide authentication and
authorization services which are shared across enterprise
Many hooks to leverage OID/SSO– mod_osso– JAZN– Partner application toolkit– Enterprise users (for database applications)– PIS provides automated account provisioning
DSS, PIS supports synch with existing directories
Deploy New Application, cont.
Direct JAAS integration with 3rd party directory via Loginmodule API
DAS supports delegated administrative model– Can delegate admin authority to components of
overall directory tree– Can delegate admin authority down to the
attribute level
New install/admin model in OracleAS ensures least privilege for instance administration
Windows IntegrationWindows Directory Connector for Oracle Internet
Directory– Pre-packaged solution for Windows directories– Built on Oracle Directory Integration Platform
Windows Native Authentication– “Automatic logon” to AS based on Windows logon– Improves Windows user experience
Windows Authentication and Password Plug-ins– “Referral” of authentication to Windows O/S; password
synchronization not required– Update of Windows passwords from Oracle administration
tools
User Provisioning from Windows
OraclePortal
DelegatedAdministration
Console
OracleE-Business
SuiteRelease 11i
Oracle Internet Directory
Oracle9iAS Single Sign-On
Microsoft ADS
WindowsEnvironment
1 - “Add user”
2 - User created in ADS
3- User synchronized
with OID
4 - User provisioned
in Oracle environment
Improved Admin Privilege Model
Least privilege for install/admin– Separation of install and runtime admin privileges– Privilege to administer one 9iAS instance doesn’t
imply privilege to administer every instance
Allows multiple 9iAS instances to share an infrastructure securely
Greatly improves security for real world deployments
Case Study: Golden Gate University’s Legacy Environment
Operating systems: Solaris, Windows, MPE/ix, Netware, Mac OS, Digital Unix
Hardware platforms: SUN (Sparc), Dell (Intel), HP 3000, Macintosh, DEC Alpha
Databases: Oracle, SQL Server, Access, FoxPro, HP Image
Development: Coldfusion, HTML, Javascript, UniBasicNo common code, data, OS, management process,
customer experience
GGU’s new Web Architecture
JSP Pages/XML/HTML
Application Server / Business Tier
HumanResource Financials Student
Data Mining /Reporting
Portal
Oracle Text Search Oracle Collaboration Suite
LDAP - Oracle OID
Storage Area Network / Physical Data Layer
Oracle 9i Enterprise Edition DBMS
IBM IBMIBM
Migrate legacy apps /File / Print / Messaging
Application Layer
Enterprise Database
Server TierLinux / Solaris
Storage Tier
Summary Key Business Problem
– Address security threats– Manage users efficiently, intelligently
Key Solution Features– Complete security for real world deployments
PervasiveHigh AssuranceCommon across Oracle ComponentsSupports wide range of deployment options
– Identity Management SuiteIntegrated solution for Oracle productsEnterprise scalability, reliability, performance
Summary, cont.
Key Oracle Differentiators– Reputation for reliability, scalability, availabity,
assurance– Oracle offers nearly all the enterprise pieces
App Server, database, apps, collab suiteSecurity and Identity Management is pervasive,
integrated