Prabath Siriwardena Senior Software Architect. An open source Identity & Entitlement management server.

Slides:



Advertisements
Similar presentations
Suchin Rengan Principal Technical Architect Salesforce.com
Advertisements

Identity Network Ideals – Heterogeneity & Co-existence
GT 4 Security Goals & Plans Sam Meder
SearchSearch User Profiles SearchSearchExcelExcelUserProfilesUserProfiles Managed Metadata.
Kim Cameron Integration Imperative Cloud Computing Compliance++ Compliance++ Mergers, Supply Chain, Outsourcing, Partnering, Globalization, …
Integration Considerations Greg Thompson April 20 th, 2006 Copyright © 2006, Credentica Inc. All Rights Reserved.
FIspace Security Components FIspace Security Components NetFutures 2015 FIspace project Javier Romero Negrín Javier Hitado Simarro ATOS Serdar Arslan KoçSistem.
11 steve plank (“planky”) identity architect microsoft uk.
Securing Insecure Prabath Siriwardena, WSO2 Twitter
WSO2 Identity Server Road Map
Access Control Patterns & Practices with WSO2 Middleware Prabath Siriwardena.
Environmental Council of States Network Authentication and Authorization Services The Shared Security Component February 28, 2005.
T Network Application Frameworks and XML Service Federation Sasu Tarkoma.
NIH iTrust Peter Alterman/Debbie Bucci National Institutes of Health October 2010.
GRDevDay March 21, 2015 Cloud-based Identity for Applications.
1 July 2005© 2005 University of Kent1 Seamless Integration of PERMIS and Shibboleth – Development of a Flexible PERMIS Authorisation Module for Shibboleth.
Cloud app Cloud app Cloud app Separate username/password sign-in Manual or semi-automated provisioning Active Directory App Separate username/password.
SIM205. (On-Premises) Storage Servers Networking O/S Middleware Virtualization Data Applications Runtime You manage Infrastructure (as a Service)
SharePoint Design Tools Office Applications.
©2012 Check Point Software Technologies Ltd. Cloud Security Tamir Zegman Architect.
Scenario covered in this presentation Separate credential from on- premises credential Authentication occurs via cloud directory service Does not.
Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP.
APS (Keystone) Security “dial tone” Doron Grinstein Chief Architect October 2012 | Version 0.2 | Confidential.
Distributed Web Security for Science Gateways Jim Basney In collaboration with: Rion Dooley Jeff Gaynor
Lecture 23 Internet Authentication Applications modified from slides of Lawrie Brown.
Federated Identity and the International Research Community Dr Ken Klingenstein Director, Internet2 Middleware and Security.
FIspace SPT Seyhun Futaci. Technology behind FIspace Authentication and Authorization IDM service of Fispace provides SSO solution for web apps, mobile.
Copyright ©2012 Ping Identity Corporation. All rights reserved.1.
SharePoint Security Fundamentals Introduction to Claims-based Security Configuring Claims-based Security Development Opportunities.
Collaborative Platforms. Collaborations and Virtual Organizations IdM is a critical dimension of collaboration, crossing many applications.
Empowering people-centric IT Unified device management Access and information protection Desktop Virtualization Hybrid Identity.
Paul Andrew. Recently Announced… Identity Integration Options 2 3 Identity Management Overview 1.
Shibboleth Akylbek Zhumabayev September Agenda Introduction Related Standards: SAML, WS-Trust, WS-Federation Overview: Shibboleth, GSI, GridShib.
AAI WG EMI Christoph Witzig on behalf of EMI AAI WG.
Windows Server Active Directory Intranet Managed Access Managed Identities Integrated Business Apps.
EGEE-II INFSO-RI Enabling Grids for E-sciencE EGEE and gLite are registered trademarks Security Token Service Valéry Tschopp - SWITCH.
Prabath Siriwardena – Software Architect, WSO2. Patterns Standards Implementations Plan for the session.
Authentication in the cloud: Step by Step Felix Jorkowski Senior Developer, Planet Software AZR317.
Access Management 2.0: UMA for the #UMAam20 for questions 20 March 2014 tinyurl.com/umawg for slides, recording, and more 1.
EMI is partially funded by the European Commission under Grant Agreement RI Federated Grid Access Using EMI STS Henri Mikkonen Helsinki Institute.
Security and Privacy for the Smart Grid James Bryce Clark, OASIS Robert Griffin, RSA Hal Lockhart, Oracle.
WSO2 Identity Server 4.0 Fall WSO2 Carbon Enterprise Middleware Platform 2.
Slavko Kukrika MVP Connect Windows 10 to the Cloud – Cloud Join.
Secure Mobile Development with NetIQ Access Manager
Alex Thissen | Achmea Designing and implementing a claims-based architecture Alex Thissen | Achmea Claim typeValue
Agenda  Microsoft Directory Synchronization Tool  Active Directory Federation Server  ADFS Proxy  Hybrid Features – LAB.
Prabath Siriwardena, Director of Security, WSO2 Twitter
Workshop on Security for Web Services. Amsterdam, April 2010 Applying SAML to Identity Data Exchange.
In Vivo Imaging Middleware — Phase 6 Ashish Sharma, Tony Pan, Y. Nadir Saghar.
Fermilab supports several authentication mechanisms for user and computer authentication. This talk will cover our authentication systems, design considerations,
Connected Identity & the role of the Identity Bus Prabath Siriwardena Director of Security Architecture WSO2.
WSO2 Identity Server. Small company (called company A) had few services deployed on one app server.
Web SSO with Cloud Resources using AD Federation Services
Alain Bethuyne Web Security Architect BNPParibas Fortis
Access Policy - Federation March 23, 2016
Secure Connected Infrastructure
Stop Those Prying Eyes Getting to Your Data
Azure Active Directory - Business 2 Consumer
Open standard based Identity Provisioning for Cloud
Cloud Security– an overview Keke Chen
Federation made simple
Data and Applications Security Developments and Directions
Introduction How to combine and use services in different security domains? How to take into account privacy aspects? How to enable single sign on (SSO)
ESA Single Sign On (SSO) and Federated Identity Management
Matthew Levy Azure AD B2B vs B2C Matthew Levy
Community AAI with Check-In
Microsoft Ignite NZ October 2016 SKYCITY, Auckland.
Presentation transcript:

Prabath Siriwardena Senior Software Architect

An open source Identity & Entitlement management server

Authentication ADLDAP JDBC

An open source Identity & Entitlement management server Authentication Single Sign On SAML2Kerberos WS-Fed Passive

 Decentralized Single Sign On  Single user profile  Widely used for community & collaboration aspects  Multifactor Authentication [Infocard, XMPP]  OpenID relying party components

 Single Sign On / Single Logout  Widely used *aaS providers [Google Apps, Salesforce]  SAML2 Web SSO Profile  SAML2 Attribute Profile  Distributed Federated SAML2 IdPs  Used in WSO2 StratosLive

SharePoint WS-Fed Passive

An open source Identity & Entitlement management server Authentication Single Sign On Provisioning SCIMSPML

2001 : OASIS PS TC 2003 : SPML : WS-Provisioning 2006 : SPML : SCIM community 2011 : SCIM : SCIM : RESTPML

SCIM Service Provider /Users /Groups SCIM Consumer

{ "schemas":[], "name":{"familyName":”siriwardena","givenName":”prabath"}, "userName":”prabath","password":”prabath123", } curl -v -k --user admin:admin --header "Content-Type:application/json" add-user.json curl command

{ "schemas": ["urn:scim:schemas:core:1.0"], "id": "idnext", "displayName": "IdentityNext", } curl -v -k --user admin:admin --header "Content- Type:application/json" add-group.json curl command

Provisioning Service Provider Domain A Domain B One way provisioning Provisioning Service Provider Domain C SCIM Consumer

Provisioning Service Provider Domain A Domain B One way provisioning with broker mode Provisioning Service Provider Domain C SCIM Consumer

Provisioning Service Provider Domain A Domain B Bi-directional provisioning Provisioning Service Provider Domain C SCIM Consumer

Provisioning Service Provider Domain A Domain B Multi-directional provisioning with a centralized PSP Provisioning Service Provider Domain C SCIM Consumer Provisioning Service Provider

Domain A Domain B Just-in-time provisioning with SAML2 SAML2 IdP

Provisioning Service Provider Domain A Domain B Just-in-time provisioning with SAML2 SAML2 IdP

Provisioning Service Provider SCIM Consumer (facilelogin.com) SCIM Consumer (wso2.com) wso2.com facilelogin.com

An open source Identity & Entitlement management server Authentication Single Sign On Provisioning Auditing XDAS

An open source Identity & Entitlement management server Authentication Single Sign On Provisioning AuditingDelegation WS-TRUST

 Identity Delegation  Securing RESTful services  2-legged & 3-legged OAuth 1.01  XACML integration with OAuth  OAuth 2.0 support with Authorization Code, Implicit, Resource Owner Credentials, Client Credentials

An open source Identity & Entitlement management server Authentication Single Sign On Provisioning AuditingDelegation Federation WS-TRUSTSAML2

Federation

 Supports WS-Trust 1.3/1.4  SAML 1.0/1.1/2.0 token profiles  Claim management

Security Token Service Consumer App Resource Domain A Domain B Cross Domain Authentication with WS-Trust

Cross Domain Authentication with Kerberos and WS-Trust

Decentralized Federated SAML2 IdPs

An open source Identity & Entitlement management server Role Based Access Control

An open source Identity & Entitlement management server Role Based Access Control Attribute Based Access Control

An open source Identity & Entitlement management server Role Based Access Control Attribute Based Access Control Policy Based Access Control XACML

An open source Identity & Entitlement management server Role Based Access Control Attribute Based Access Control Policy Based Access Control SOAP XACML / WS-XACML

An open source Identity & Entitlement management server Role Based Access Control Attribute Based Access Control Policy Based Access Control SOAP REST XACML

 The de-facto standard for authorization  XACML 3.0  Support for multiple PIPs  Policy distribution  Decision / Attribute caching  UI wizard for defining policies  Notifications on policy updates  TryIt tool

EntitlementService EntitlementPolicyAdminService Policy Decision Point Policy Cache Decision Cache XACML Engine Extensions Policy Administration Point Attribute Finder Extensions Default Finder LDAP Attribute Cache SOAP/Thrift/WS- XACML SOAP

 User stores with LDAP/AD/JDBC  Multiple user stores  OpenID  SAML2  Kerberos  Integrated Windows Authentication  Information Cards  XACML 2.0/3.0  OAuth 1.0a/2.0  Security Token Service with WS-Trust  SCIM 1.1  WS-XACML  WS-Fed Passive

Feedback: Privacy Policy Feedback
Do Not Sell My Personal Information
About project: SlidePlayer Terms of Service

© 2025 SlidePlayer.com. Inc. All rights reserved.