Identity and Access Management: Strategy and Solution Sandeep Sinha Lead Product Manager Windows Server Product Management Redmond, USA

Agenda   Business Drivers   The Challenge   Identity and Access Management Framework   Identity and Access Management Solutions

The Issues  Password Management  Provisioning and De-provisioning  Customer Portal  Partner Integration  Security  Regulatory Compliance

Business Drivers Strategic Initiative Connecting with customers and partners Connecting with customers and partners Employee Portal/Personalization Employee Portal/Personalization Externalization of business processes Externalization of business processes Improve Security Secure data and network access Secure data and network access Assure authentication across platforms Assure authentication across platforms Manage cross-platform environment centrally Manage cross-platform environment centrally Regulatory Compliance HIPAA HIPAA Gramm-Leach-Blailey Gramm-Leach-Blailey FDIC FDIC Lower Operations Cost Decrease administrative/help desk overhead Decrease administrative/help desk overhead Reduce number of logins/passwords Reduce number of logins/passwords Lower cost for high-turnover environments Lower cost for high-turnover environments

The Challenge Provisioning Single Sign On Interoperability Authentication Authorization Passwords Directories

Microsoft’s Framework Directory Services Federation AuthenticationAuthorization Applications Provisioning

The Solution  Active Directory – The foundation  Windows Integrated Applications  Network Single Sign-on with Windows Server  Extending to non-integrated applications  Using Active Directory for LDAP authentication  The role of Microsoft Metadirectory Server (MMS) WindowsSingleSign-on  B2E using Active Directory and IIS  B2C using Active Directory and Passport  Extranet Access Management using Active Directory Web Single Sign-on Reduced Enterprise Sign-on

Windows Single Sign-on Integrated Windows Sign-on ActiveDirectory Logon to Windows Flexible Authentication Kerberos X509 v3/Smartcard Biometrics Passport (Web) Basic (Web) Digest (Web) Single Sign-on to: Windows File servers Windows Web applications Exchange SQL Server BizTalk Server Other Microsoft applications 3 rd Party Integrated Apps Exchange Web Service File Share Windows Integrated Applications

Reduced Enterprise Sign-On Extending Windows SSO ActiveDirectory Logon to AD Services for UNIX  NIS Server for AD  NIS-AD directory sync  Password synchronization  User name mapping UNIX Host Integration Server  Windows to RACF accounts  Windows to AS/400 Security System  Bi-Directional Password Synchronization 390/AS400 KerberosApplication Kerberos  Native AuthN protocol  MIT v5 Compliant  Carries group info in PAC  Windows PAC is open

Reduced Enterprise Sign-on LDAP Authentication & Directory Integration Account Directory LDAP SQL Enterprise App Integrate LDAP with AD  LDAP v3 compliant  Single AD and LDAP user account  AD/AM for personalization data Microsoft Metadirectory Server  Directory synchronization  LDAP (eg iPlanet & others)  Relational databases  Application specific  Account Provisioning  Automate account creation  Automate account de- provisioning  Password Management (MMS 2003)  Self-service password reset Exchange Web Service File Share Application Application ActiveDirectory

Web Single Sign-on B2C Using Active Directory and Passport Windows Server 2003 IIS Web Server (Step 1) Customer accesses a Web site using any standards-based browser (Step 4) User is authorized based AD account. (Step 2) Passport verifies the user’s credentials and sends a PUID back to the Web site (Step 3) Web app verifies activation code & maps PUID to AD account. ActiveDirectory Applications Passport manages user credentials Passport manages user authentication You manage user access controls

Web Single Sign-on Extranet Access Management using AD Web App 1 SSO Agent Web App 2 Delegated Admin ActiveDirectory EAM Web SSO Authentication LDAP Bind SSL Session Cookie Corporate Identities Authorization Check Partner Identities Enterprise Extranet“Trusted” Business Partner ActiveDirectory

Microsoft Products  Windows Server 2003  Active Directory, PKI, IAS  Microsoft Metadirectory Server 2003  Host Integration Server  Services for UNIX

Identity and Access Management Solution  Prescriptive Guidance  Proven  Actionable  Relevant  Benefits  Faster Time to Market  Lower Implementation Cost  Lower implementation Risks

Identity and Access Management Solution  Availability  Partners ready to deliver today.  Early July – Customer documents  Cost  Free  Development Partners  PricewaterhouseCoopers LLP  Oblix  OpenNetworks  Global Service Partners  PricewaterhouseCoopers LLP  Unisys  Hewlett Packard  Cap Gemini Ernst and Young  Demo  Available at Microsoft Booth

Call to Action  Call Microsoft or Partner Sales Reps  Create Vision and Strategy  Start small and focus on ROI  Leverage Microsoft’s Solution  Engage Partners and MCS

© 2003 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.