SIM205-Identity_.ppt

identity and access and cloud: better together,brjann brekkan sr technical product manager identity and access microsoft corporation,sim205,agenda,framing the cloud opportunity supporting technologies private cloud public cloud paas public cloud saas summary,what is the cloud?,delivering it as a standardized service,opportunities,performing it more cheaply capitalizing on new ways to address customers benefitting from further democratization of it operating a business without it limits leveraging the cloud for competitive advantage developing transformative experiences and solutions,existing internal applications remain critical in foreseeable future need to integrate with applications across organizations and cloud borderless collaboration across on-premises, partners, and cloud partners and customers will bring their own identities identity platform needs to support range of developers identity needs to be more extensible, more flexible,challenges,enabling the hybrid enterprise,types of cloud services identity consistent,(on-premises),you manage,compliance and security in the cloud,an organizations current identity management gaps extend to the cloud and become more complex failure to disable accounts in a timely manner when peoples employment is terminated failure to adjust rights and permissions when people transfer to new roles enabling self-service capabilities without having control of user identities can result in access problems and lack of productivity,identity and the cloud,private cloud,on-premises,public cloud,partners,saas,paas,user,microsoft identity components,private cloud,on-premises,partners,ad federation services,ad certificate services,ad rights management services,appfabric access control service,saml,oauth,ws-trust, saml,user,claims based applications,some of our cloud/federation players,claims-based access basics,resource provider: requires, uses claims to define users claims provider: supports protocols for issuing claims relationship: context in which meaning of claims defined,relationship,claims provider (security token service),2. get claims,3. send claims,1. require claims,subject,resource provider,microsoft claims-based access model,end user,configure: claims rules (federation metadata),configure: establish relationship / trust (signing key),3. get claims,2. authn (creds),claims framework (wif),app business logic,4. authn (claims),1. get policy,5. grant/deny access,resource provider claims-aware application,security token service (ad fs),directory (ad ds),federation: claims sources,authentication comes from ad attributes can come from ad, other ldap directories, sql, custom sources consider whether to put claim values in ad, or create sql tables for new claims when should ad schema be extended? if using sql in adfs, identify a unique key for users as an ad attribute and table column fim manages attributes in ad and sql,enable 2 factor auth on-premises and manage smart cards with fim password reset on-premises,automated security and distribution group memberships self service management of security and distribution groups,add additional data needed in ad with provisioning and synchronization directory clean up and ensure data quality,policy and workflows help with controlling access to cloud services ensure accurate data used in federation scenarios,forefront identity manager 2010 on-premises,scenarios,private cloud self service management of virtualization is based on providing delegated access empowering users access application in windows azure build app. with wif access app via azure appfabric acs federate with id-providers enable bpos / office 365 identity synchronization single sign on and authentication,private cloud,hyper-v authorization manager common identity in private cloud,default role allows access to all operations,additional roles with desired rights can be created 33 different operations oob grouped under hyper-v service operations hyper-v networks operations hyper-v virtual machine operations,virtual machine manager common identity in private cloud,the administrator profile complete administrative access to all the hosts, virtual machines, and library servers in vmm 2008 the delegated administrator profile grants administrative access to a defined set of host groups and library servers the self-service user profile administrative access to a defined set of virtual machines through the web-based virtual machine manager self-service portal additional delegation capabilities in self service portal,enhancing private cloud with fim common identity,hyper-v and sc virtual machine manager uses roles roles can contain users or groups from ad delegation of datacenter management forefront identity manager securely manages membership in ad groups,public cloud identity management options,use cloud service providers (csps) identity management system synchronize on-premises identity store with csps identity store federate identity in trusted third-party provider with csp federate identity in on-premises directory with csp,cloud identity management option use csps system,pros,easy to set up, requiring no work with existing identity management system,cons,difficult to keep identities synchronized between on-premises and cloud terminations and transfers most problematic might not work with hybrid clouds worse, might require dangerous integration practices,cloud identity management option synchronization of on-premises identity,pros,not as difficult to set up as federation synchronization can be scheduled or event-driven terminations and transfers easier to manage works with existing on-premises identity lifecycle solutions,cons,more difficult to set up than csp identity management system user names might not be identical csps usually default to email address as user name passwords often not synchronized may be possible with additional client software,cloud identity management option federate with third-party identity providers,pros,allows integration with existing cloud-based identity potentially services and data, and hybrid clouds integration of third-party with on-premises identity possible useful approach if not possible to federate with on-premises identity store,cons,end users may still have multiple identities can be most difficult to set up and operate of all options taking dependency on third-party identity provider,cloud identity management option federate with on-premises identity,pros,integrates seamlessly with on-premises identity terminations and transfers can be handled with ease user names are usually identical no need to synchronize passwords works well with hybrid clouds,cons,can be difficult to set up requires compatible on-premises identity store can magnify existing identity management problems,public cloud,platform as a service,windows azure identity management options,use cloud service providers (csps) identity management system applications built in windows azure can have own id store synchronize on-premises identity store with csps identity store load application user profiles from on-premises ad federate identity in trusted third-party provider with csp access control service using public identity providers federate identity in on-premises directory with csp federate directly with application federate with access control service,identity and access options common identity across applications,active directory,other providers,ws-* and saml,on premises,use of active directory identities and groups through federation,enable seamless access experience with other corporate applications tied to ad,integration with 3rd party systems through ws-* and saml 2.0 open standards,in the next release of appfabric access control services (acs 2.0), single sign-on with popular internet identity providers,access control service,your service,2. request token (pass input claims),4. return token (receive output claims),5. send message with token,0. establish trust via key exchange,customer,1. define access control rules for an identity provider,3. map input claims to output claims based on access control rules,how acs works,6. process token,demo,fabrikam shipping,example of software as a service in windows azure sign up experience with access control service,public cloud,software as a service,paas identity management options,use cloud service providers (csps) identity management system smaller customers using office 365 id synchronize on-premises identity store with csps identity store directory sync required by appl in office 365 federate identity in trusted third-party provider with csp federate identity in on-premises directory with csp office 365 enables single sign on via federation,on premises,office 365 identity and access options identity synchronization and authentication,ad,online directory sync,identity services,provisioning platform,lync,sharepoint,exchange,active directory federation services,trust,idp,directory store,admin portal,authentication platform,idp,forefront identity manager 2010,small/medium customer,what does dirsync do?,enables “identity” and “application” coexistence identities are managed on premise syncs users, groups and contacts enables easy identity federation enables application coexistence (exchange and oc) application coexistence on premise mail and oc services work with their corresponding cloud services (oc users on premise im cloud users and mail on premise routes to the cloud and vice versa) enabler for exchange “rich coexistence” features involves a write-back of cloud data to on-premises customer directory,enhancing ms online services with fim,fim manages on-premises ad ds simplify and clean up ad necessary attributes for office 365 maintained managing groups on-premises ms online directory synchronization tool keeps on-premises directory in sync with ms online directory fim supplies ad fs with additional data for claims construct a “role”-claim based on data in active directory populated by fim to use for authorizing access to office 365 fim provisions users with smartcards or software certificates enables users to leverage stronger authentication for access to cloud-based services,managing common identity,windows integrated/kerberos,fim 2010,workflow,adds,phone title department manager group,ad fs 2.0,ws-* and saml claims,partner,claims-aware applications,sql server,role client list,self service,ms online directory synchronization,next steps,prepare for and embrace cloud by improving quality and enhancing data in ad leveraging forefront identity manager to prepare for cloud and ongoing management on-premises learning more about identity federation understanding how claims based identity can assist developers,resources,forefront identity manager /fim, /ilm /identitymanagement claims based identity: whitepaper and architecture guide on /wif programming wif from mspress /adfs identity developer training windows azure training kit /cloud /online,related content,tlc: identity federation, identity management, directory services,sim203 | microsoft identity and access strategy sim358 preparing identities for the cloud with fim sim324 | using windows azure access control service 2.0 with your cloud application osp215 | microsoft office 365: identity and access solutions sim322 | developers view on single sign-on for applications using windows azure,sim377-int claims-based identity,sim399-hol managing claims authn using fim 2010 mid274-hol | introduction to the windows azure appfabric access control service v2,track resources,dont forget to visit the cloud power area within the tlc (blue section) to see product demos and speak with experts about the server & cloud platform solutions that help drive your business forward. you can also find the latest information about our products at the following links:,windows azure - /windowsazure/,microsoft s