User Authentication for Enterprise Applications - The Future in Transitions

2 Thesis Well-managed, trustworthy authentication and authorization are important today and will be vital in the future Moving the authentication and authorization functions to the Web layer allows rapid deployment of newer tools and technologies The services needed are largely available today, and will be complete within 18 months The work must now shift to the applications and business processes

3 Agenda Trends in User Authentication NUIT Plan How Should Applications Prepare? Transitions Wrap-up

4 Agenda Trends in User Authentication NUIT Plan How Should Applications Prepare? Transitions Wrap-up

5 Trends in User Authentication Defining clear business rules for identity creation and lifecycle management Requiring stronger passwords Requiring multi-factor authentication for high-value transactions Moving to universal identity tokens and federated domains

6 Business Rules for Identity Lifecycle Management Document the necessary and sufficient conditions for identity creation Define the lifecycle and especially what authorizations are granted and revoked at each transition Grant authorizations in manners that fit business goals and minimize risks Log and audit the management processes

7 Stronger Passwords Password cracking technology is advancing beyond our ability to remember passwords Because attacks are automated, risks are greater and defenses must be stronger Passwords must become longer and more complex.

8 Stronger Passwords Number of characters A..ZA..Z, a..zA..Z, a..z, 0..9, symbols 65 mins6 hrs8 days 858 hrs21 mons196 yrs 105 yrs4648 yrs1.7M yrs Assumes 1M password tests per second Stated figures are 100% surety, 50% would be half, 25% one-quarter, etc. Source:

9 Multi-Factor Authentication Factors: something you … –Know (passwords) –Have (swipe card, USB token) –Are (thumbprint, handprint, retinal pattern) –Do (typing pattern, walking gait) How many factors are needed to be POSITIVE that the attempted access is by the real person? –What is the risk of being wrong? –What is the inconvenience?

10 Universal Identity and Federation If multi-factor authentication is needed then everyone should have two or more factors available Certification attests to the level of confidence which a third party puts into the association of a factor to a particular person Federation is not giving another institution access to our authentication services, it is based upon trust in our assertions of authentication. That trust is built upon their knowledge of our identification and management practices

11 Agenda Trends in User Authentication NUIT Plan How Should Applications Prepare? Transitions Wrap-up

12 NUIT Plan Single identity for each person Remove authentication from applications and place it in the surrounding service environment Four network-wide authentication services but only one and one-half authorization services Workflow-based identity management Federated authentication Smartcards, USB tokens, etc.

13 Four Services LDAP 3.x: authentication and authorization attributes MSFT Active Directory: authentication and some authorization attributes MIT Kerberos 5: authentication Web SSO: authentication and coarse- grained access control through LDAP authorization attributes

14 Agenda Trends in User Authentication NUIT Plan How Should Applications Prepare? Transitions Wrap-up

15 How Should Applications Prepare? Move user authentication into the Web server Use identity management workflow to control access to the application Use institutional roles or other attributes for coarse-grained access control Optional: Employ first-access provisioning to simplify management of user profiles within the application

16 Authenticating at the Web Server Applications must give up internal passwords and programming logic to check NetID passwords Moving this function to the Web server level allows new functions (Web SSO) to be deployed without wide-spread effects If the application is invoked, then the user was successfully authenticated

17 Approve Access Through IdM The Identity Management (IdM) system must know if a NetID has been granted access to an enterprise application. Using IdM-based workflow to request, authorize, approve and grant access can support this easily. The IdM system can enforce business rules subject to entitlements granted.

18 Coarse-Grained Access Control Through Web SSO and access rules, any NetID attribute can be used to allow or deny access to an application Web page. –Role: “faculty”, “employee” –Entitlement: “access to HRIS” Session environment can also be used –IP address –Level of authentication

19 First-Access Provisioning Avoid provisioning user profiles within the application until the user attempts access. Recognizing no user profile exists: –Invoke an IdM workflow to request access –Create a place-holder profile and allow access –Automatically create a profile from attribute information (institutional roles) Result: savings in administrative time

20 Agenda Trends in User Authentication NUIT Plan How Should Applications Prepare? Transitions Wrap-up

21 Step 1

22 Step 2

23 Step 3

24 Step 4

25 Step 5

26 Step 6

27 Step 7

28 Step 8

29 Step 9

30 Agenda Trends in User Authentication NUIT Plan How Should Applications Prepare? Transitions Wrap-up

31 Wrap-Up “Abstraction” frees the application from any particular authentication technology Identity workflow orders the approval process, allows audit controls, and flags the user’s identity for other business rules First-access provisioning saves time and effort for the application administrator Just as secure, with just as much control, just using different tools

Questions? Tom Board