Technical Topics in Privilege Management Minh N. Nguyen Stanford University Advanced CAMP July 1, 2004 Copyright Minh N. Nguyen, 2004. This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

Enabling Systems to Use Signet How will you use Signet for: Defining privileges Assigning privileges Managing the lifecycle of privileges Provisioning privileges What will you need to make Signet work? More data… Develop provisioning connectors 1/14/2019 2

What Signet Provides? Command line interface to load privileges Web application to assign privileges Command line interface to bulk load assignments Assignment lifecycle processor Privileges XML document output for provisioning GUI to define privileges (later phase) 1/14/2019 3

Users of Signet Tool User Command line interface to load privileges Analyst Web application to assign privileges End user Command line interface to bulk load assignments Assignment lifecycle processor System Privileges XML document output for provisioning System, Helpdesk GUI to define privileges 1/14/2019 4

Technologies Java based RDBMS for persistent store JSP & Servlet JDBC JNDI RDBMS for persistent store Tomcat or any servlet engine XML output 1/14/2019 5

Defining and Loading Privileges Defined using building blocks: subsystem, function, entitlement… Function The assignable widget Can be hierarchical (e.g. view, update) Entitlement Used in Privileges XML document 1/14/2019 6

Scope and Prerequisite Via plug-in connector, e.g. from organization registry External data loaded locally, e.g. from HR system Prerequisite Via plug-in connector, e.g. from directory External data loaded locally, e.g. from LMS 1/14/2019 7

Loading Privileges Demo 1/14/2019 8

Identity Management for Signet Finding the right person to assign privileges Linking people and identifiers Affiliation data for condition of assignment Local person and identifier tables in Signet 1/14/2019 9

Delegating Privileges Chain of authority from person to person Bootstrap grantor Requirement that sysadmin not be the super grantor Designate high level officer (e.g. provost) Recorded as system-proxied assignment on behalf of high ranking person 1/14/2019 10

Assignment Considerations What to do when 2 grantors have assigned the same privilege to the same person Allow Warn, but allow Don’t allow Auto-reinstatement of system revoked assignment How to easily grant privileges for a new hire Clone person’s privilege Granting template How to “adjust” privileges due to re-organization 1/14/2019 11

Assigning Proxy Acting proxy – designating someone to temporarily act on your behalf For how long? Granting proxy – someone who can grant privileges for you Proxy for all of your privileges May need to have capability to only designate subset of privileges Can have more than one proxy 1/14/2019 12

Assigning Privilege Demo 1/14/2019 13

Assignment Lifecycle Assignment condition changes: Expiration date passes Affiliation changes Prerequisite satisfied Handled by lifecycle processor Privileges definition change New entitlement to existing function New prerequisite is added to existing entitlement 1/14/2019 14

Bulk Loading Assignments Initial seeding of assignments Applies same rules as in UI for assigning privileges 1/14/2019 15

User Notifications Assignment created/modified/activated Assignment pending for 7 and 30 days Assignment expires within 7 and 30 days 1/14/2019 16

Provisioning Privileges Transaction history table in database Privileges represented in XML document Provisioning strategy: Asynchronous messaging Batch transfer eduPersonEntitlement attribute 1/14/2019 17

Provisioning Example Events DB 1) authority:privileges 2) Harvest event XML Document Service 3) Privileges XML Oracle Financials Harvester 4) Updates Oracle Oracle DB 1/14/2019 18

Provisioning Considerations Periodic reconciliation between Signet and applications Agreement to not make local changes Local privileges not defined in Signet Access not based on assigned privilege in Signet Synchronizing scope tree between Signet and applications 1/14/2019 19

Access to PM System Who should have access? Any authenticated body Only people who have assignments Only grantors Can anyone be assigned privileges? People in academic/administrative community Authentication mechanism External to Signet Authentication plugin (eventually…) 1/14/2019 20

Audit Discrepancy report between PM and target Who has what privilege at some point in the past? Who granted the privilege? Need way to trace transaction in application back to the authorization in Signet Grantors want detailed reports on who has privileges scoped to their organization 1/14/2019 21

Monitoring & Diagnostic URL to probe status of web application: Heap memory usage Connector availability (e.g. database, directory) Log diagnostic events for correlation 1/14/2019 22

Getting Ready for Signet Deploy an identity management system Build an organization registry (scope source) Data source for Prerequisite Condition (affiliation) Identify a system which can be Signet-enabled (doesn’t have to be big) Introduce Signet concepts to your campus Join Signet working group 1/14/2019 23