Upload
autumn-nickless
View
217
Download
0
Tags:
Embed Size (px)
Citation preview
User Authentication for Enterprise Applications
November 16, 2005Tom Board, NUIT
2
Thesis• Trustworthy authentication and authorization are
important• Moving the authentication and authorization
functions out of applications will allow rapid deployment of desirable new technologies
• The services needed are largely available today, and will be complete within 18 months
• The work must now shift to the applications and business processes
3
Agenda
• What are the Problems?
• Industry Trends in User Authentication
• What is NUIT Planning?
• How Should Application Administrators and Planners Prepare?
• Transitions
• Wrap-up
4
Agenda
• What are the Problems?
• Industry Trends in User Authentication
• What is NUIT Planning?
• How Should Application Administrators and Planners Prepare?
• Transitions
• Wrap-up
5
What are the Problems?• External: granting & removing access through
auditable processes• Internal/external: accountability using access
records• Internal/external: maintaining trustworthiness of
tokens or credentials• Internal: reducing the cost of implementing new
security methods• Internal: navigating University applications may
be too complicated for users
6
Contexts
• Network: for access control security
• Enterprise applications: for integrity of business functions
• Divisional and school applications: for consistency and ease of management
• User experience: to reduce complexity
7
Agenda
• What are the Problems?
• Industry Trends in User Authentication
• What is NUIT Planning?
• How Should Application Administrators and Planners Prepare?
• Transitions
• Wrap-up
8
Industry Trends in User Authentication
• Defining clear business rules for identity creation and lifecycle management
• Requiring stronger passwords
• Requiring multi-factor authentication for high-value transactions
• Requiring trustworthy administrative processes
9
Business Rules for Identity Lifecycle Management
• Document the necessary and sufficient conditions for identity creation
• Define the lifecycle and the authorizations granted and revoked at each transition
• Grant authorizations in keeping with business goals and to minimize risks
• Log and audit the management processes
10
Stronger Passwords• Password cracking technology is advancing
beyond our ability to remember passwords• Because attacks are automated, risks are
greater and defenses must be stronger• Passwords must become longer and more
complex.• Likely future minimum will be 8 characters with
more syntax requirements• Implementation requires new IdM system
11
Multi-Factor Authentication• Factors: something you …
– Know (passwords)– Have (swipe card, USB token)– Are (thumbprint, handprint, retinal pattern)– Do (typing pattern, walking gait)
• How many factors are needed to be POSITIVE that the attempted access is by the real person?– What is the risk of being wrong?– What is the inconvenience?– Who will decide?
12
The Importance of Trustworthiness• Federal guidelines for electronic signature stress the
security and trustworthiness of token distribution• Federated authentication between security realms is
based upon trust in our authentication assertions, a portion of which is trust in the management of tokens.
• Our practices for identification, distribution and management of authentication tokens must be judged trustworthy
• Policies on protection of tokens must be enforced• Trust is a contract with legal implications
13
Agenda
• What are the Problems?
• Industry Trends in User Authentication
• What is NUIT Planning?
• How Should Application Administrators and Planners Prepare?
• Transitions
• Wrap-up
14
NUIT Plan• Single identity for each person• Four network-wide authentication services but
only one and one-half authorization services• Workflow-based management of identities and
access control• Federated authentication with others• Smartcards, USB tokens, etc.• A key step: remove authentication from
applications and place it in the surrounding service environment
15
Single Identity (NetID)• Why?
– Tied to authoritative sources– Single token allows rapid action to allow,
modify, or revoke access or permissions– Common authentication infrastructure
simplifies user experience (portal, SSO)
• What about aggregated risk?– Use multi-factor authentication selectively– Educate users – it’s not just e-mail now
16
Four Services
• LDAP 3.x: authentication and authorization attributes
• MSFT Active Directory: authentication and some authorization attributes
• MIT Kerberos 5: authentication
• Web SSO: authentication and coarse-grained access control through LDAP authorization attributes
17
Web SSO (Single Sign-On)
• More correctly: Web Access Management
• Presents a challenge for an authentication token and caches the resulting level of authentication in a session cookie
• Extension: access policies are used to describe the authentication level needed for each URL
18Web Access Mgmt
W e b s e rve r"s him "
0 app.no r thwe s te rn.e du /*1 app.no r thwe s te rn.e du /re po r ts /*2 app.no r thwe s te rn.e du /m o dify/*3 app.no r thwe s te rn.e du /m o dify/bankac c o unts /*
W AM P o lic ie s
W AMs e rve r
c he c k c o o kie
c hal le nge
1 = p as s w o r d
2 = p h y s ic a l to k en
3 = s u p er v is o r p h y s ic a l to k en
C he c k U R L po lic ie s
Applic at io n
c ookie
W e b Se rve r
app.no r thwe s te rn.e du / ....
19Timeline*
* This timeline is for illustrative purposes only and should not be used in planning – please consult with an experienced professional. The views expressed are those of the author and not those of NUIT. No warranty expressed or implied. YMMV. All bets are off.
2006 2007Task Jan-Mar Apr-Jun Jul-Sep Oct-Dec Jan-Mar Apr-Jun Jul-Sep
Ph ase 1
S ign contrac tsH RIS 8.9 Im plem enta tion
Im plem ent W A MD eploy W A M
P repare S N A PP repare B us iness R ules
P repare feedsIns ta ll IdM
IdM process feedsP ara lle l opera tions
C utover to IdMS E S 8.9 Im plem enta tion
Financial S ystem Im plem ntatio n
20
Agenda
• What are the Problems?
• Industry Trends in User Authentication
• What is NUIT Planning?
• How Should Application Administrators and Planners Prepare?
• Transitions
• Wrap-up
21
How Should Applications Prepare?
• Move user authentication into the Web server – application invocation implies successful authentication
• Use identity management workflow to control access to the application
• Use attributes for coarse-grained access control• Optional: Define institutional roles that can drive
coarse-grained (and fine-grained) access control• Optional: Employ first-access provisioning to
simplify management of application user profiles
22
Authenticating at the Web Server
• Applications must give up internal passwords and programming logic to check NetID passwords
• Moving this function to the Web server level allows new functions (Web SSO) to be deployed without wide-spread effects
• If the application is invoked, then the user was successfully authenticated
23
Approve Access Through IdM
• The Identity Management (IdM) system must know if a NetID has been granted access to an enterprise application.
• Using IdM-based workflow to request, authorize, approve and grant access can support this easily.
• The IdM system can enforce business rules subject to entitlements granted.
24
Remove Access Through IdM• What business rules are appropriate (or
required) when an identity changes status?– Move between departments– Move between divisions/schools– Graduation, withdrawal, no registration– Termination
• Possible actions:– Continue services indefinitely or for a defined number
of days– Suspend access and (a) notify individual, and/or (b)
notify supervisor, and/or (c) notify service manager– Suspend without notices
25
Coarse-Grained Access Control
• Through Web SSO and access rules, any NetID attribute can be used to allow or deny access to an application Web page.– Role: “faculty”, “employee”– Entitlement: “access to HRIS”
• Session environment can also be used– IP address– Level of authentication
26
Fine-Grained Access Control• Fine-grained access control is based upon user
profile information unique to the application or interpreted by the application at execution time.– “Can view salaries”– “Can change salaries”– “Can authorize checks up to $100,000”
• Fine-grained access controls could be determined from institutional roles – or not– Examples: “department assistant” implies
• “Can view salaries”• “Can administer grant funds within department”
27Coarse vs. Fine Controls
U s e rp ro file s
D a ta b a s e
Ses
sion
set
-up
Pro
cess
ing
LD A P Re g is t ry
Id e n t ity M a n a g e me n tS y s te m
A p p lic atio n
A c c e s s p o lic yd a ta b a s e
W e b S S O
A c c e s s Co n t ro lS y s te m
A d min is t ra to r
A u th o rity
Acc
ess
Con
trol
Lay
erC o a rs e -G ra ine d
C o ntro lsF ine -G ra ine dC o ntro ls
28
First-Access Provisioning• Avoid provisioning user profiles within the
application until the user attempts access– Eliminate unnecessary local user profiles
• Recognizing no user profile exists:– Invoke an IdM workflow to request access– Create a place-holder profile and allow limited access
by default– Automatically create a profile from attribute
information (institutional roles)
• Result: savings in administrative time
29
Agenda
• What are the Problems?
• Industry Trends in User Authentication
• What is NUIT Planning?
• How Should Application Administrators and Planners Prepare?
• Transitions
• Wrap-up
301. Typical “silo” application
U s e rp ro file s
D a ta b a s e
Ses
sion
set
-up
Pro
cess
ing
A p p lic atio n
A d min is t ra to r
E -m ail &w o rk flo w
Aut
hent
icat
ion
& A
utho
riza
tion
ID &
Rol
eM
aint
enan
ce
312. Convert to NetID authentication
U s e rp ro file s
D a ta b a s e
Ses
sion
set
-up
Pro
cess
ing
LD A P Re g is t ry
Id e n t ity M a n a g e me n tS y s te m
A p p lic atio n
A d min is t ra to r
E -m ail &w o rk flo w
Aut
hent
icat
ion
& A
utho
riza
tion
ID &
Rol
eM
aint
enan
ce
A u th o rity
323. Move authentication to Web server
U s e rp ro file s
D a ta b a s e
Ses
sion
set
-up
Pro
cess
ing
LD A P Re g is t ry
Id e n t ity M a n a g e me n tS y s te m
A p p lic atio nW e b S e rv e r
A d min is t ra to r
E -m ail &w o rk flo w
A u th o rity
Aut
hent
icat
ion
Aut
hori
zati
on
ID &
Rol
eM
aint
enan
ce
334. Web Access Management (SSO)
U s e rp ro file s
D a ta b a s e
Ses
sion
set
-up
Pro
cess
ing
LD A P Re g is t ry
Id e n t ity M a n a g e me n tS y s te m
A p p lic atio nW e b S e rv e r
A c c e s s p o lic yd a ta b a s e
W e b S S O
A c c e s s Co n t ro lS y s te m
A d min is t ra to r
E -m ail &w o rk flo w
c ookie
A u th o rity
Aut
hent
icat
ion
Aut
hori
zati
on
ID &
Rol
eM
aint
enan
ce
345. Coarse-grained authorization
U s e rp ro file s
D a ta b a s e
Ses
sion
set
-up
Pro
cess
ing
LD A P Re g is t ry
Id e n t ity M a n a g e me n tS y s te m
A p p lic atio nW e b S e rv e r
A c c e s s p o lic yd a ta b a s e
W e b S S O
A c c e s s Co n t ro lS y s te m
A d min is t ra to r
E -m ail &w o rk flo w
c ookie
A u th o rity
Aut
hent
icat
ion
Aut
hori
zati
on
ID &
Rol
eM
aint
enan
ce
356. Request access using IdM workflow
U s e rp ro file s
D a ta b a s e
Ses
sion
set
-up
Pro
cess
ing
LD A P Re g is t ry
Id e n t ity M a n a g e me n tS y s te m
A p p lic atio nW e b S e rv e r
A c c e s s p o lic yd a ta b a s e
W e b S S O
A c c e s s Co n t ro lS y s te m
A d min is t ra to r
E -m ail &w o rk flo w
c ookie
A u th o rity
Aut
hent
icat
ion
Aut
hori
zati
on
ID &
Rol
eM
aint
enan
ce
367. Institutional roles drive provisioning
U s e rp ro file s
D a ta b a s e
Ses
sion
set
-up
Pro
cess
ing
LD A P Re g is t ry
Id e n t ity M a n a g e me n tS y s te m
A p p lic atio nW e b S e rv e r
A c c e s s p o lic yd a ta b a s e
W e b S S O
A c c e s s Co n t ro lS y s te m
Ro le e n g in e
A d min is t ra to r
E -m ail &w o rk flo w
c ookie
A u th o rity
Aut
hent
icat
ion
Aut
hori
zati
on
37Step
8
U s e rp ro file s
D a ta b a s e
Ses
sion
set
-up
Pro
cess
ing
LD A P Re g is t ry
Id e n t ity M a n a g e me n tS y s te m
A p p lic atio nW e b S e rv e r
A c c e s s p o lic yd a ta b a s e
W e b S S O
A c c e s s Co n t ro lS y s te m
Ro le e n g in e
A d min is t ra to r
E -m ail &w o rk flo w
c ookie
A u th o rity
Aut
hent
icat
ion
Aut
hori
zati
on
Fir
st-a
cces
spr
ovis
ioni
ng
389. Smart card authentication
U s e rp ro file s
D a ta b a s e
Ses
sion
set
-up
Pro
cess
ing
LD A P Re g is t ry
Id e n t ity M a n a g e me n tS y s te m
A p p lic atio nW e b S e rv e r
A c c e s s p o lic yd a ta b a s e
W e b S S O
A c c e s s Co n t ro lS y s te m
Ro le e n g in e
A d min is t ra to r
E -m ail &w o rk flo w
c ookie
A u th o rity
Aut
hent
icat
ion
Aut
hori
zati
on
Fir
st-a
cces
spr
ovis
ioni
ng
S m a rt c a rd
C a rdm a na ge m e nt
39
Agenda
• What are the Problems?
• Industry Trends in User Authentication
• What is NUIT Planning?
• How Should Application Administrators and Planners Prepare?
• Transitions
• Wrap-up
40
Wrap-Up• Seek to free the application from any
particular authentication technology• IdM workflow can govern the approval
process, provide audit controls, and flag the user’s identity for other business rules
• First-access provisioning saves time and effort for the application administrator
• “Just as secure, with just as much control, just using different tools”
41
Questions?
QA&