Download as PDF, PPTX
Uploaded byRadovan Semancik
Complete open source IAM solution
The document discusses a comprehensive open-source identity and access management (IAM) solution, emphasizing the limitations of LDAP alone and the need for a more integrated approach. It outlines essential IAM components, their interoperability within a unified system, and the benefits of using an open-source identity ecosystem to avoid vendor lock-in. The content also highlights various deployment examples and encourages participation in the ecosystem for better technological collaboration.
More Related Content
Similar to Complete open source IAM solution
![Support, Monitoring, Continuous Improvement & Scaling Agentic Automation [3/3]](https://cdn.slidesharecdn.com/ss_thumbnails/agenticcommunityseries-day3-cfd-251120170304-ddef8112-thumbnail.jpg?width=640&height=640&fit=bounds)
Complete open source IAM solution
- 1. Complete open source IAMsolution Radovan Semančík LDAPcon, November 2015
- 2. Radovan Semančík Current: Software Architectat Evolveum Architect of Evolveum midPoint Contributor to ConnId and Apache Directory API Past: Sun LDAP and IDM deployments (early 2000s) OpenIDM v1, OpenICF Many software architecture and security projects
- 3. Complete solution? Why? IsLDAP not enough?
- 4. Yes, theoretically ... LDAP Application Application Application Application Users Goodarchitecture: Don't repeat yourself (DRY)
- 5. Practice: Application-Local DB LDAP Application Application Application Application Users join? uid:js123 cn: Jack Sparrow uid: js123 loot: 20000 Name | loot -------------+------- Jack Sparrow | 20000
- 6. Practice: Data Sources LDAP Application Application Application Application Users HR CRM Customscripts? Data conflicts? Reliability? Maintenance?
- 7. Practice: Legacy LDAP Application Application Application Application Users uid: js123 uid:jack3 uid: jsparrow uid: x665342 uid: jsp007
- 8.
- 9. But … theseare application problems! Let's fix the appliations and standardize. We'll be fine.
- 10. Standardization? Really? dn: cn=foo,ou=groups,o=example objectclass:groupOfNames member: uid=bar1,ou=people,o=example member: uid=bar2,ou=people,o=example dn: cn=foo,ou=groups,o=example objectclass: groupOfUniqueNames uniqueMember: uid=bar1,ou=people,o=example uniqueMember: uid=bar2,ou=people,o=example RFC2256 (1997) mandatory(!!!) (Examples are simplified)
- 11. Standardization? Really? dn: cn=foo,ou=groups,o=example objectclass:groupOfNames member: uid=bar1,ou=people,o=example member: uid=bar2,ou=people,o=example dn: cn=foo,ou=groups,o=example objectclass: groupOfUniqueNames uniqueMember: uid=bar1,ou=people,o=example uniqueMember: uid=bar2,ou=people,o=example RFC2256 (1997) dn: cn=foo,ou=groups,o=example objectclass: posixGroup memberUid: bar1 memberUid: bar2 RFC2307 (1998) (Examples are simplified)
- 12. Practice: more problems ●Password reset ● Adaptive authentication ● SSO ● Session management ● ACLs ● Account activation (enabled/disabled status) ● “memberOf” ● Roles / RBAC ● Password policies ● Access policies (autz) ● Paging (SPR vs VLV) ● Audit ● Reporting ● Data consistency ● Management tools ● User experience ● Schema consistency issues ● Standard violations ● Common sense violations ● Too many data types ● … most of them unsupported ● DN case sensitivity ● Synchronization
- 13. Practice: really messy LDAP1 Application Application Application Application Users copy LDAP 2 Manual sync HR CRM export transform script ESB S S O LDAP 3 *) *) nobody really knows how this part works because the guy that did it left 3 years ago script Pull on demand Home-brew LDAP editor
- 14. LDAP-only solutions work onlyin simple cases.
- 15. IAM needs morecomponents Identity Repository HR Application Application Application Application A M Identity Provisioning Users CRM System Admin Requester Approver Application
- 16. Basic IAM Components ●Access Management • Authentication, single sign-on • Basic authorization ● Identity Repository • Storage of identity data ● Identity Provisioning • Management (data, policies, workflows) • Synchronization Access Management Identity Repository Identity Provisioning End Users Admins
- 17. Interoperability ● The componentsshould work together as one system ● Easy product integration ● Smooth user experience • The user should not see component boundaries
- 18. Technology stacks “Stack” isthe obvious answer to interoperability problem. … or … is it? Access Management Identity Provisioning Identity Repository
- 19. What's wrong withstacks? ● Usually single-vendor stacks ● Still quite heterogeneous due to acquisitions ● Vendor lock-in • You can check out any time you like, but you can never leave ● Limited integration options • Just one option for each component • Proprietary interfaces
- 20. Is there anybetter way? The Ecosystem
- 21. Open Source IdentityEcosystem midPoint (Identity Provisioning) OpenLDAP (Directory Server) Fortress (IAM SDK) OSIAM (Access Management) (Identity Repository) CAS (Single Sign-On) (GRC) (Access Management) Syncope (Identity Provisioning) Shibboleth (Federation) ConnId (Identity Connectors) 389 Directory Server (Identity Repository)
- 22. Open Source IdentityEcosystem ● Pure open source model • Any engineer can have complete understanding of the technology • Technological excellence and efficiency ● Standardized or open source interfaces • Unlimited integration options • Replaceable components → no vendor lock-in ● Cooperation instead of domination • Trade influence for control to get substantial benefits
- 23. Ecosystem Deployment Examples OpenLDAP (DirectoryServer) midPoint (Identity Provisioning) CAS (Single Sign-On) 389ds (Directory Server) Apache Syncope (Identity Provisioning) Shibboleth (Federation) OpenLDAP (Directory Server) Fortress (IAM SDK) Custom application
- 24. Ecosystem Deployment Examples midPoint (IdentityProvisioning) ConnId (Identity Connector Framework) ConnId Unix Connector Custom SAP Connector Apache Syncope (Identity Provisioning) ConnId (Identity Connector Framework) midPoint LDAP Connector ConnId Unix Connector Custom SAP Connector OpenLDAP (Directory Server) midPoint LDAP Connector 389ds (Directory Server)
- 25. We know thatit works, because ... ● we have tested the technology • test suites, pilots, real projects ● we share the same goal ● there are business agreements in place
- 26.
- 27.
- 28.