블로그 이미지
평범하게 살고 싶은 월급쟁이 기술적인 토론 환영합니다.같이 이야기 하고 싶으시면 부담 말고 연락주세요:이메일-bwcho75골뱅이지메일 닷컴. 조대협


Archive»


 

'클라우드 컴퓨팅 & NoSQL/Identity Management'에 해당되는 글 3

  1. 2013.05.20 Identity Management System (IDM) Overview
  2. 2013.05.15 OpenLdap 를 윈도우에 설치하기 (2)
  3. 2010.05.14 Active Directory의 재발견..(1. DRM)
 

Identity Management System (IDM) Overview

Terry.Cho (http://bcho.tistory.com)


1. Background

 

IDM (Identity Management system) is one of most important and complex component in common IT system. 

Pain Point

Here is sample pain point in Identity management scenario when it comes from identity management area commonly.

 

Federation.

1)        Enterprise build their IT system with very simple & isolated identity management feature. All of each system has own IT management features.

2)        Number of the IT system has been grown, and it has own identity management system.

3)        End user starts complain to log in with different id for each system.

Lifecycle management & Provisioning

1)        After employee leaves company, Enterprise it admin needs to delete all of identity across the system.

2)        After new employee has been joined, his identity need to be created in email, ERP, CRM etc. Some identity creation needs to be approved by manager

 

Without common Identity management platform, identity management is being very painful. 

B2B vs B2C

There are two main category that uses identity management. One is B2B and the other one is B2C.

B2B is enterprise IT. It is designed for manage internal user or restricted number of end client.

The characteristic of B2B system is,

-       It has very complex scenario to support their business

-       It has a lot of package based legacy system like ERP,CRM etc.

-       It needs very elaborate authorization control.

-       It has many types of roles (admin, manager, end user, org admin etc).

So the product which supports B2B scenario,  focuses legacy system integration (provisioning, connector, standard support - WS-Security, SAML, XACML etc ) , work flow support etc.

This area is mainly driven by enterprise vendor like Oracle,CA,IBM etc.

 

In contrast, B2C area has different requirement.

In B2C area , it provides service to customer like SNS.

-       It supports huge # of end user (+million)

-       Role type and authorization control is very simple compare to B2B scenario.

-       Open standard based federation model (OAuth 2.0, Open ID etc)

-       Global deployment 

Trend & Implementation options

To build up IDM system there are 3 different approach.

1)       Option A. build with open source framework

build IDM system from scratch or reuse open source frame work.

To support just single silo system, big identity management system is not required. In this case, user just build the IDM system from scratch. For small to medium # of user, RDBMS backend preferred.  For medium to big number of user, LDAP or Microsoft Active Directory is preferred.

 

To provided more platformanized (or well defined) IDM, open source frame work can be used.

Spring Security is one of major player in this area. It is more focused on web based application.

Apache Shiro is also one of the other major player. It can support web and others (REST API based security control etc).   

2)       Option B. build with niche vendor solution  

If IT has to support more complex scenario. It that case it can consider solution. There are a lot of solutions which are optimized to specific scenario.

For example, Centrify is well optimized to support Active Directory based single sign on in B2B scenario. PingIdentity is good for user account federation scenario.

3)       Option C. Full package from enterprise vendor

If the company has a lot of package based legacy system and it needs sophisticated role based authorization control, long running work flow for authorization approval, audit etc, full packaged IDM is recommended.

These kind of IDM product is delivered by enterprise vendor like Oracle,IBM,CA etc.



Figure 1. IDM gartner magic quadrent 2010

Trend is,

For B2C, commonly it uses Option A and if there is more complex requirement it uses (or moves from Option A to ) Option B. Big B2C company like Facebook, Google builds up their own IDM system with Option A approach.

 

For B2B, for small & isolated system it uses Option A. For restricted scenario, Option B. For enterprise wide it uses Option C. Commonly enterprise IT system has its own LDAP server internally and they provides minimum single sign on with solutions (Option B).

 Commonly they has SSO, Provisioning only, not support authorization and other stuff.  The authorization supports requires a lot of customization both in IDM and service application side. And full package vendor solution is very expensive, complex and hard to manage. 

2. IDM System common features

Here is common feature which is provided by traditional IDM systems.

1)       User Management

It managed user identity during full life cycle. It created, update and delete the user identity information.

Ÿ   Lifecycle management

This feature manages whole life cycle of user identity management from creation to remove. Depends on requirement, user identity can be expired based on pre-defined logic. It also can manage password expiration date etc.

Ÿ   Work flow

Some user identity creation or new authorization permission guarantee needs a approval. For example in case of banking account creation, it needs to check user identity. This kinds of approval required long running process.

It is implemented by using work flow engine (eg. BPM etc)

Ÿ   Provisioning

When user identity has been created or modified, it need to be replicated another system. For example new email has been created in email system, new account in sales system need to be created. In that case the user profile should be replicated (provisioned). It is one of very important feature in centralized IDM.

Ÿ   Delegated Admin

To manage user identity , single IDM admin is not enough. If the company has a lot of organization and authorization control is requires, single IDM admin cannot cover whole of the requests. So in that case restricted admin authority need to be delegated to someone (ex. managers in the organization ). This feature is delegated admin.

One more thing for this feature, if the delegated admin has been leaved the company the delegated authority should be propagated to another user in the IDM.

Ÿ   Identification management

In specific system, user identity which prove "Who is the user?" is very important.

In Banking, Stock Trading system, user identity proven is very important issue. To support them IDM manages additional information like user certification, finger print and user biometric data 

2)       Access Management

Access management defines "Can user access specific resource?". It allows system to provide restricted access

Ÿ   Authentication

Authentication is the process of determining whether someone or something is, in fact, who or what it is declared to be. This is commonly done by comparing user identity & credentials (id & password)

Ÿ   Authorization (ACL , Entitlement)

This is process of granting or denying access to resource.

In other term, it is controlled by "ACL (Access Control List)". It describes "Who can access what resource".

In authorization scenario, there are 3 types of access control

       RBAC (Resource Based Access Control)

Resource access is controlled by user role. Individual user can have number of role. For example a user can be "Partner" ,"Admin" ,"End User". Resource control is granted by pre defined access control based on each role.

RBAC is one of most broadly used authorization method.

       DAC (Discretionary Access Control)

It is more flexible compare to RBAC. DAC manages authority based on user identity (user id or it's associated group)

       MAC (Mandatory Access Control)
User are given permission to resources by system administrator. Only the admin can grant permission to resource.

Ÿ   Federation (SSO)

If there are number of systems and user logged once in one system, it doesn't need to log into other system anymore. This is Single Sign On.

There are standards to support SSO like SAML, CAS, Kerberos etc.  

3)       Repository

Repository persists user identity & profile.

User identity has user id and password for log in. ACL (Access Control List) and user profile which contains user related data for example - name, address , email etc.

This repository is read intensive. And it needs to support tree like structure because, user identity combines user organization structure too. In this reason LDAP is common solution for repository.

If system have to support global roll out, it should also consider regulation issue. Some user information cannot be stored outside their country. When it designs user profile scheme, legal check is required.

And to support the global roll out, data replication across data center should be supported.  

4)       Audit & Reporting

Audit means, "who did what to which resource?". It can enables admin to track resource usage, denial resource access etc. In some system , the access log can be used to track user pattern. Web access log analysis scenario is one of the example. In addition the resource access log can be used to metering service usage. (cloud computing scenario etc)

For denial access, it need to support notification message to admin and reporting. To prevent denied access, it also need to support "black list".

This area is consists of logging, gathering, analysis, reporting and achieving. Now days, it is implemented by using big data technology. (logging framework etc)  

5)       Integrations

Integration feature is integrate multiple identity management system.

There are many perspectives. Replicate user profile from one to other systems is covered by "provisioning". Authentication across number of system can be covered by Single Sign On. Authorization over number of system can be covered by XACML based authorization system.

To simplify integration, we can have 3 perspective like below

Ÿ   Open standard support

Integration support is old problem in Identity management area. So there are already open standard to support the integration issue.

In B2C area, Open ID and OAuth are major player that support authentication.

In B2B area, there are a lot of standard like

-        SAML,WS-Security: support SSO & Federation

-        XACML: support authorization

-        LDAP or Microsoft Active Directory : repository integration

-        WS-Trust : API Security

Ÿ   Internal service integration

In enterprise, there are a lot of internal system. Especially legacy enterprise system (ERP,CRM) has very complex user profile scheme, organization structure and sometimes it doesn't support open standard.  So it needs special integration connector to support the integration (provisioning, authorization etc).

The Connector support is main feature of internal service integration

Ÿ   External service integration

It covers identity integration covers external system which resides in outside of company.  

-        B2C integration - There are already well know B2C service system like google, Windows Live accout, Face book, Twitter account. B2C integration scenario is usually implemented with open standard (OAuth, OpenID, Active Directory etc)

-        B2B integration - This area can have various scenario depends on requirement. If company A provides service B's from company B with white-label. They need to support SSO. In this case company A,B need to integrate their authentication by using SSO. In this scenario, if company B charge the service, user identity need to be provisioned from company A to company B to measure their usage.

B2B integration is occurred by ad-hoc way. There are no common approach in this area. Best way is clarify gap between two different identity management system and make integration scenario case by case. This approach is similar to EAI (Enterprise Application Integration).

-        B2B (Cloud) integration - There are already cloud enterprise cloud service like SalesForce.com, Microsoft Office 365. This service needs to integrate with company wide IDM system. 

3. IDM deployment model

To understand IDM deployment model, we have to understand IDM term first

Ÿ   IdP (Identity Provider) : This is IDM. It persists user identity, authenticate & authorize incoming request.

Ÿ   SP (Service Provider) : It provides service to end user. It has resource. Access to the resources are restricted by Idp. Example. Web Site etc.

Ÿ   Token : User credentials (id & password, or log in token - which is used for authentication)

There are 3 types of deployment models

Isolated IDM Model

Each service provider has it's own IdP. End user has to log in for each service provider with different identity.



Centralized IDM Model

Each services shares single IdP. This is most ideal model. End user can log in and access with single user identity.

All of access controls in all Service Provides are controlled by single ACL. It is consistent.

But it is hard to meet in real world. Product (open source or solution) already has it own Idp internally. If all of Service Providers are built from scratch, it can support this model.



Federated IDM Model

End user perspective, it is same to centralized IDM model. End user logs in Service Provider with single user identity. But each Service Provider has different IdP in backend.

This is common use case in IDM area. Authentication is integrated by SSO (Federation) and Authorization is covered by Entitlement (XACML etc)




Here is reference architecture of federation model



User management system create & update user profile. The profile is propagated to each IdP servers thru provisioning components. Service Provider has recent version of user profile.

End user logs in Service provider. It is federated by using SSO.


 

저작자 표시
신고

 OpenLdap install in Windows


1. 설치 및 구동

http://sourceforge.net/projects/openldapwindows/ 에서 바이너리를 받아서 위자드를 이용하여 설치

${OPENLDAP 설치 디렉토리}/etc/openldap/sldpd.conf 파일에서 root 비밀번호를 다음과 같이 수정

 

#######################################################################

# BDB database definitions

#######################################################################

 

database            bdb

suffix                  "dc=my-domain,dc=com"

rootdn                 "cn=Manager,dc=my-domain,dc=com"

# Cleartext passwords, especially for the rootdn, should

# be avoid.  See slappasswd(8) and slapd.conf(5) for details.

# Use of strong authentication encouraged.

rootpw                asdf1234

# The database directory MUST exist prior to running slapd AND

# should only be accessible by the slapd and slap tools.

# Mode 700 recommended.

directory       ../var/openldap-data

# Indices to maintain

 

C:\dev\solutions\openldap\libexec\StartLDAP.cmd 를 실행

 

2. Sample 데이타 로딩하기

테스트를 위해서 샘플 그룹과, 사용자들을 생성해보자. 샘플 데이타는

${OPENLDAP 설치 디렉토리}\etc\ldif에 있다.

${OPENLDAP 설치 디렉토리}\bin 디렉토리에서 다음과 같은 명령들을 실행한다.

ldapadd.exe -v -x -D "cn=Manager,dc=my-domain,dc=com" -f ..\etc\ldif\base.ldif -W

ldapadd.exe -v -x -D "cn=Manager,dc=my-domain,dc=com" -f ..\etc\ldif\users.ldif -W

 

※ 패스워드를 물어보는데, 패스워드는 앞에 slpd.conf에서 입력한 패스워드를 사용한다.

 

3. 클라이언트를 이용해서 연결하기

http://www.ldapadministrator.com/ 에서 ldap administrator라는 툴을 다운 받는다. (30일 무료 사용 가능)

File > New > New Profile을 선택하여, 새로운 서버를 등록한다.

Step 1. Profile명을 등록한다.

Step 2. Host 주소를 등록한다. Local 에 깔았다면, Host localhost, Port Default 389를 지정한다. 


 

Step 3. 다음으로 log in id/password를 넣는데, 앞에 slapd.conf에서 지정한 id,passwd "Principal Password" 필드에 다음과 같이 넣는다.


 

모든 작업이 다 끝났으면 아래와 같이 LDAP에 접속해서 내용을 볼 수 있다.




2013.5.18 추가 - LDAP에 대한 설명과 Open LDAP에 대한 설명이 잘 나온 글 

http://w.nya.kr/lib/exe/fetch.php?media=%EB%8B%A8%EC%96%B4:ldap:ldap.doc



저작자 표시
신고
사실 얼마전까지만 해도 Microsoft Active Directory는 사용자 정보 디렉토리로 관리하고 윈도우즈 클라이언트가 도메인에 로그인하게 해주고, 이메일 주소정도 관리해주고, LDAP정도로 쓸 수 있는 솔루션으로 알았다.

여기와서, Active Directory(이하 AD)가 많이 언급되길래 자료를 좀 찾아봤더니.. 이건 간단한 Directory솔루션이 아니라, OA환경을 위한 Infrastructure 솔루션이다.

업무 시스템에 대한 SSO, 웹 SSO,DRM,프린터,PC관리, 원견 PC 정책 관리 등등 할 수 있는게 정말 많다.

먼저 DRM을 보면
Acive Directory Right Management Service라는 이름으로 제공된다.
문서나 파일또는 이메일에 까지 Digital Signature를 넣거나 또는 해당 자원에 대한 접근권한(쓰기,읽기,인쇄하기, 이메일의 경우 Forwarding 권한 조정)까지 가능하다. 이는 AD RMS와 통합된 애플리케이션에만 가능한데, 이 통합된 애플리케이션이라는게 우리가 맨날 쓰는 Exchange Server기반의 메일과 MS Office이다.
 별도의 셋업없이도 AD RMS를 도입하면 문서에 대한 세세한 권한 컨트롤이 가능하다는 이야기다.
보통 고객사에 보면 문서에 대한 DRM 솔루션들을 많이 쓰긴하는데, 별도 비용을 (것도 꽤많이) 지불해서 구축하는것 같고, 거기에 보안성도 사실 떨어진다. (VMWare띄워서 파일 복사하기, DRM Process죽이기등..)
그런데 AD RMS는
  • MS Product 자체에 OS 및 File System 레벨에 Embedded되어 있다. 이말은 쉽게 뚫기가 어렵다는 이야기고
  • 가격이 저렴하다. (공짜라고 이야기해야 하나...) WIndows Server에 Bundle되어 있는 솔루션이다. 이말인즉슨, Windows Domain을 사용하고 있는 고객이라면 추가 비용없이 문서와 자원에 대한 DRM 적용이 가능하다는...

간단하게 AD RMS에 대해서 설명했는데... 내일은 PC,Printer 관리 기능에 대해서 설명해보겠다.

참고자료
AD RMS 문서 권한적용 원리: http://blog.crayon.no/blogs/ragnar/archive/2009/04/27/overview-of-ad-rms.aspx
http://edge.technet.com/Media/How-it-works-Active-Directory-Rights-Management-Services/



저작자 표시
신고