2a Role-based Security en Secure Authentication met SSO 10 ... · Title: 2a_Role-based Security en Secure Authentication met SSO 10-Nov-2016_Bart_Mauro Created Date: 11/16/2016 10:30:31

Copyright©1995-2015QuestionmarkCorporationand/orQuestionmarkComputingLimited,knowncollectivelyasQuestionmark.Allrightsreserved.QuestionmarkisaregisteredtrademarkofQuestionmarkComputingLimited.Allothertrademarksareacknowledged.

2016DutchUsersConferenceAmsterdam| 15th November

Role-basedSecurityen SecureAuthenticationmetSSO

BartHendrickx,QuestionmarkMauroChieppa,UPlearning


2016DutchUsersConference= Amsterdam

Contents

Slide2

1. Role-basedSecurity

2. SingleSign-On(SAML)

3. Q&A



Role-basedSecurity

Slide3



} NotEveryoneShouldBeAbletoDoEverything…

UserManagement:Role-basedsecurity

Slide4

Hi.I’mElla.Iamfillinginfor

Wendywhoisonmaternity

leave.

Cool.Wendyisourreportingrockstar.Shealsoassists

withmanagingouritembank. Iwill

setyouupwithanaccount.



WhenEllaLogsOn,SheSees…

Slide5

Shedoesn'tseethePeopleorAdministrationmenus



GotoPeople>Rolestodothefollowingwithroles:

§ Add§ Edit§ Delete

ManagingRoles

Slide6



Definewhichrolesarolecanassign(andremove)

RoleDelegation

Slide7



WhichfeaturesofAuthoringcanyouuse?

Forwhichtopicsandassessmentfolderscanyouusethosefeatures?

Authors:TwoSetsofPermissions

Slide8

Portal Authoring

Youcancreateitems. YoucancreateitemsintopicAbutnotintopicB.

Example



AssignAccesstoaTopic

Slide9



AssignAccesstoanAssessment Folder

Slide10



SingleSign-On

Slide11



Toomanypasswordstoremember!

Slide12

ERP

Email

Myemployergivesmeaccesstoallthesewonderfultools,but

theyallcomewiththeirownpasswords.



Thechallengeofusermanagement…

Slide13

ERP

CRM

Email

PersonXisnolongerwiththeorganization.

û

û

û

û



} Theabilityforoneapplication,theidentityprovider,totellanotherapplication,theserviceprovider,whoyouare.

SSO:Whatisit?

Slide14

IdentityProviderE.g.MicrosoftActiveDirectory

ServiceProviderE.g.QuestionmarkOnDemand

Authenticationdata



WhySSO?

Slide15

ConsPros

1

2

3

2

3

Reducespasswordfatigue

Simplifiesuserandpasswordmanagement

Savestimeforusersinthelong-term

1 Givesyouthekeystothecastle

Doesn’tworkifIdPisdown

Takestimetosetup



SecurityAssertionMarkupLanguage

Forexchangingauthentication andauthorizationdatabetweenparties§ Identityprovider(IdP)§Serviceprovider(SP)

SAML

Slide16



WebSSO

Slide17

CustomerInc.

[email protected]

Intranet

ERP

CRM

QM

DifferentDomains



HelpswithwebSSO:loginacrossdomains

Supportedbymanyidentityproviders:leverageauthenticationcapabilities,suchasmultifactorauthentication

AdvantagesofSAML

Slide18



Makemetadata available

Includethepersonorteamwhomanagesyouridentityprovider(expertise)

SAMLLessonsLearnedatUP learning

Slide19



TalktoyourAccountManager,whowillhelpsetupadiscoverycall

InterestedinSAML?

Slide20



Q&A

Slide21



BEDANKT!


2016DutchUsersConferenceAmsterdam| 15th November

Role-basedSecurityen SecureAuthenticationmetSSO

BartHendrickx,QuestionmarkMauroChieppa,UPlearning



Bonus

Slide24



SAMLInteractionDiagram

Slide25



<samlp:AuthnRequest […] ID="_d17c957f15359e4e8e7665ce75b06c9b9620e6b9fa" […]

} Thisistherequest} ThisrequesthasanID(therewillbeanewIDforeachrequest,cf.multipleusersloggingon)

ContentsofaSAMLRequest(Example)

Slide26



<samlp:Response ID="_113da1b8-b2a9-4c59-b5e1-97cca4fa107d" [...] InResponseTo="_d17c957f15359e4e8e7665ce75b06c9b9620e6b9fa"[...]<Attribute Name="http://schemas.microsoft.com/identity/claims/objectidentifier"><AttributeValue>ddf6d451-2735-4349-aa6e-86cf5c657967</AttributeValue></Attribute><Attribute Name="http://schemas.microsoft.com/identity/claims/displayname"> <AttributeValue>jane.doe</AttributeValue></Attribute><Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"><AttributeValue>[email protected]</AttributeValue></Attribute>

} Thisistheresponse} Itisaresponseto therequestwiththeIDxyz(cf.therequest)

} Thisuserhasattributeswiththesevalues

ContentsofaSAMLResponse(Example)

Slide27



} CreateusersautomaticallyinthePortalwhentheylogonviaSAML

} EnableexistingparticipantstologonviaSAMLbyupdatingthemthroughCSVimport

} GiveusersarolebasedonaSAMLattributethathasadefinedvalue

} Definewhichuserscanstilllogonlocally§ Peruser§ Perrole

} MapSAMLattributesto§ Portalprofilefields§ Groups(new)

} QuestionmarkTechSupport configuresonyourbehalf

PossiblewithSAML(today)

Slide28



} Automatically enableexisting participantstologonviaSAML§ AninterventionthroughCSVimportisneeded§ Administratorswillneedtobere-createdonlogin

} Updatevaluesfor(i.e.initialsyncispossiblebutcannotbeupdatedifvalueschange)§ Username§ UniqueuserID§ Emailaddress(“primary”)

NotPossiblewithSAML(today)

Slide29



} WhataresomefrequentlyaskedquestionsaboutSAMLintegration?§ https://www.questionmark.com/content/saml-integration-faq-ondemand

} WhatisSAMLandhowdoesitwork?§ https://www.questionmark.com/content/what-is-saml

} WhatiscurrentlypossiblewhenintegratingOnDemandwithSAML?§ https://www.questionmark.com/content/what-is-possible-with-saml

} CanImapSAMLattributestoOnDemandprofilefields?§ https://www.questionmark.com/content/mapping-saml-attributes

} WhoinitiatesloginswhenusingSAML?§ https://www.questionmark.com/content/who-initiates-login-when-using-saml-

questionmark} WhatinformationdoesQuestionmarkneedwhenconfiguringSAMLforan

OnDemandarea?§ https://www.questionmark.com/content/information-required-for-saml-configuration

} UsingSingleSign-OnwithQuestionmark§ https://www.questionmark.com/content/best-practice-using-single-sign-questionmark-

perception

MoreInformation

Slide30

Documents

2a Role-based Security en Secure Authentication met SSO 10 ... · Title: 2a_Role-based Security en Secure Authentication met SSO 10-Nov-2016_Bart_Mauro Created Date: 11/16/2016 10:30:31