Identity as a Service

By Prabath Siriwardena, WSO2 Identity as a Service

[object Object],Extending internet with an Identity Management Layer

[object Object],User control & consent

[object Object],User control & consent Technical Identity Systems must only reveal information identifying a user with the user’s consent.

[object Object],Minimal disclosure for a given use

[object Object],Minimal disclosure for a given use The solution which discloses the least amount of identifying Information and best limits its use is the most stable long term solution.

[object Object],Justifiable parties

[object Object],Justifiable parties Digital identity system must be designed so the disclosure of Identifying information is limited to parties having a necessary And justifiable place in a given identity relationship.

[object Object],Directed Identity

[object Object],Directed Identity A universal identity system must support both ‘ Omni-directional’ identifiers for use by public entities and ‘unidirectional’ identifiers for use by private entities, thus facilitating discovery while preventing un-necessary release of correlation handles.

[object Object],Pluralism of operators & technologies

[object Object],Pluralism of operators & technologies A universal identity system must channel and enable the Inter-working of ,multiple identity technologies run by Multiple identity providers.

[object Object],Human Integration

[object Object],Human Integration The universal Identity Meta-system must define the human user to be a component of the distributed system integrated through unambiguous human-machine communication mechanisms offering protection against Identity attacks.

[object Object],Consistent experience across contexts

[object Object],Consistent experience across contexts The unifying identity meta-system must guarantee its Users a simple consistent experience while enabling Separation of contexts through multiple operators and technologies.

[object Object],IDENTITY attributes maintained in a central repo

[object Object],IDENTITY attributes shared across multiple applications within the same domain

[object Object],Enterprise SSO can be established within participating applications

[object Object],Protocol incompatibilities could lead to silos

[object Object],Directory awareness at the individual application level

LDAP/Active Directory HR FINANCE ERP BUSINESS LOGIC BUSINESS LOGIC BUSINESS LOGIC EXTERNAL

LDAP/Active Directory HR FINANCE ERP BUSINESS LOGIC BUSINESS LOGIC BUSINESS LOGIC

LDAP/Active Directory HR FINANCE ERP Identity Service

LDAP/Active Directory HR FINANCE ERP Identity Service EXTERNAL

[object Object],Integrates IDENTITY services into application development

[object Object],Decouples IDENTITY related logic from individual application business logic

[object Object],User, IDENTITY related data externalized from the applications themselves

[object Object],Adheres to SOA standards

[object Object],AUTHENTICATION AUTHORIZATION AUDIT IDENTITY PROVIDER PROVISIONING

[object Object],Externalize IDENTITY attributes

[object Object],Information Cards

[object Object],Identity Governance Framework [IGF]

[object Object],User Name/Password

[object Object],User centric identity : CardSpace/OpenID

[object Object],Manages authorization logic

[object Object],A general purpose authorization policy language

[object Object],Policy Expressions ,[object Object],[object Object],[object Object],[object Object],[object Object]

[object Object],XACML Vs SAML Here comes another request…. Let me process the Auth’Z request… SAML XACML

[object Object],Supports administration of IDENTITY & ACCESS Management

[object Object],Provides centralized policy administration and controls

[object Object],http://soa.sys-con.com/node/434383 Service Provisioning via SPML in SOA Simplifying identity and resource management for distributed services By: Manivannan Gopalan

[object Object],Audit all IDENTITY events

[object Object],Distribute Audit Service

[object Object],The principle of accountability

[object Object],Detection of security policy violations

[object Object],http://www.opengroup.org/pubs/catalog/p441.htm

[object Object],AUTHENTICATION [InforCards/OpenID] AUTHORIZATION [XACML] AUDIT [XDAS] IDENTITY PROVIDER [OpenID/InforCards] PROVISIONING [SPML]

[object Object],User in control of identity interactions

Service Provider/User/Identity Provider IDENTITY PROVIDER SERVICE PROVIDER

[object Object],http://www.slideshare.net/prabathsiriwardena/understanding-openid/

[object Object],[object Object],USER STORE OpenID PROVIDER REALM SERVICE PROVIDER

[object Object],Establishing policies, controls & enforcement mechanisms

[object Object],WHY? 1. A fragile and brittle SOA implementation 2. Services that cannot easily be reused because they are unknown to developers or because they were not designed with reuse in mind 3. Lack of trust and confidence in services as enterprise assets, which results in a “build it myself” mentality 4. Security breaches that cannot easily be traced 5. Unpredictable performance

[object Object],IDENTITY GOVERNANCE FRAMEWORK 1. Identity attribute service - a service that supports access to many different identity sources and enforces administrative policy 2. CARML : declarative syntax using which clients may specify their attribute requirements 3. AAPML : declarative syntax which enables providers of identity-related data to express policy on the usage of information, 4. Multi-language API (Java, .NET, Perl) for reading and writing identity-related attributes

[object Object],[object Object]

Identity as a Service

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (20)

Similar to Identity as a Service

Similar to Identity as a Service (20)

More from Prabath Siriwardena

More from Prabath Siriwardena (20)

Recently uploaded

Recently uploaded (20)

Identity as a Service