Microsoft’s Identity Management Strategy and Roadmap SOL214 4/21/2017 6:03 PM Microsoft’s Identity Management Strategy and Roadmap John Pritchard Microsoft Corporation johnpr@microsoft.com © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Agenda Situation Strategy Next generation digital identity Roadmap 4/21/2017 6:03 PM Agenda Situation Strategy Federated identity Process-driven identity and entitlement management Evolution of directory services Next generation digital identity Roadmap © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Situation Increasingly connected systems 4/21/2017 6:03 PM Situation Increasingly connected systems Connections span technical, org boundaries Distinctions blur - customer, partner, employee, intranet, Internet Demand for business process integration Clear business drivers around security, cost efficiency, regulatory compliance Issues around policy, compliance, reporting Rapid rise of threats to online safety Phishing, pharming, phraud Concerns over privacy, tracking © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Technology Areas User Experience Logon & credentials Self-service 4/21/2017 6:03 PM Technology Areas User Experience Logon & credentials Self-service Developer Experience Directory APIs Access APIs Integration APIs IT Pro Experience Management Delegated admin Identity and Access Platform Integration Services Process automation Process control Directory Services Distributed publication Access Services Authentication Authorization Audit Credential management Connectors Integration with non-Windows integrated applications and systems © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

4/21/2017 6:03 PM Microsoft’s Strategy Add native support for interoperable federated identity to Active Directory using web services Build on Microsoft Identity Integration Server as platform for process-driven management of identities and entitlements Evolve and refine Active Directory directory services © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Federated Identity and Web Services 4/21/2017 6:03 PM Federated Identity and Web Services © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

What is a Digital Identity? 4/21/2017 6:03 PM What is a Digital Identity? A set of claims one subject makes about another Many identities for many uses Required for transactions in real world and online © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Claims-Based Access Control 4/21/2017 6:03 PM Claims-Based Access Control “Submit order” requires {Purchaser} claim Read policy for “Submit Order” Server Client {Purchaser=True} 2. Call “Submit Order” including Security Token with {Purchaser=True} claim © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Claims-Based Access Control 4/21/2017 6:03 PM Claims-Based Access Control “Submit order” requires {Role} from STS_A Read policy for “Submit Order” Server Read policy for Request Security Token Client {Role} requires [Name,Password] cred Security Token Server STS_A Request Security Token passing [Ryan, ****] © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Claims-Based Access Control 4/21/2017 6:03 PM Claims-Based Access Control “Submit order” requires {Role} from STS_A Call “Submit Order” with security token Server {Role=Purchaser} signed STS_A Client {Role} requires [Name,Password] cred {Role=Purchaser} signed STS_A Security Token Server STS_A 4. Request Security Token Response Mapping: (Ryan,****)  {Role = Purchaser} © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Claims-Based Access Control 4/21/2017 6:03 PM Claims-Based Access Control Read policy for “Submit Order” “Submit order” requires {Submit order} from STS_AuthZ Client Read policy for Request Security Token Server Request Security Token passing [Ryan’s Kerb ticket] Read policy for Request Security Token {Role} requires [Kerb ticket] or [Name/Pwd] cred {Submit order} requires {Role} claim from STS_Identity Security Token Server STS_Identity “Identity claims provider” Security Token Server STS_AuthZ “Authorization claims provider” © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Claims-Based Access Control 4/21/2017 6:03 PM Claims-Based Access Control Call “Submit Order” 8 “Submit order” requires {Submit order} from STS_AuthZ {Submit order = True} signed STS_AuthZ Client 7 Server 6 {Submit order = True} signed STS_AuthZ 5 {Role=Purchaser} signed STS_Identity {Submit order} requires {Role} claim from STS_Identity {Role=Purchaser} signed STS_Identity Security Token Server STS_Identity Security Token Server STS_AuthZ Mapping: Ryan  {Role = Purchaser} Mapping: {Role = Purchaser}  {Submit order = True} © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

WS-* Architecture Composable architecture for Web services 4/21/2017 6:03 PM WS-* Architecture Composable architecture for Web services Broad participation across the industry Published, standards-track architecture Available royalty-free Security token format neutral OASIS WS-Security specification is the basis Supports x509, Kerb, SAML 1.1, 1.2, 2.0, XrML … Dynamic system for exchanging claims WS-MetadataExchange, WS-SecurityPolicy Token and claim translation WS-Trust defines Security Token Services (STS) © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Active Directory Federation Services 4/21/2017 6:03 PM Active Directory Federation Services Federated web single sign on WS-Federation Passive Requestor Profile Support SAML token, claims as SAML assertions Integrated with Windows SSO Support Windows Integrated Security and native claims-based identity Transform claims into SIDs for Windows apps Enable web apps to natively consume claims Authorization Manager integration Delivered in Windows Server 2003 R2 © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

4/21/2017 6:03 PM ADFS Experience © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Process-driven management of identities and entitlements 4/21/2017 6:03 PM Process-driven management of identities and entitlements © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

4/21/2017 6:03 PM Integration Services Process automation for managing identity and entitlement lifecycle Fully automated add/update/delete Delegated administration End user self-service Process control for reporting, assessment and enforcement Metadirectory “closed-loop” enforcement State auditing and reporting © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Integration Services MIIS 2003 SP1 Windows Server 2003 R2 wave 4/21/2017 6:03 PM Integration Services MIIS 2003 SP1 Automated provisioning, de-provisioning Enforce consistency of data Password change management Management agents for common directories, databases, flat file formats Management agent SDK Windows Server 2003 R2 wave RACF, ACF2, Top Secret, SAP, Peoplesoft © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Longhorn Wave: “Gemini” 4/21/2017 6:03 PM Longhorn Wave: “Gemini” Integration of workflow with metadirectory Declarative authoring Advanced auditing and reporting Computed attributes Automated group membership management Identity and entitlement management platform Make your application manageable via MIIS Self-service applications: user, group, and password management © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

The Evolution of Directory Services 4/21/2017 6:03 PM The Evolution of Directory Services © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Active Directory Broad usage Performance at scale 4/21/2017 6:03 PM Active Directory Broad usage 86% of US, 57% of enterprises >500 PCs worldwide running Active Directory * Performance at scale Scale out: 1000+ servers Scale up: deployments at 20M+ users Flexibility: AD and ADAM Centralized or distributed physical deployment Centralized or distributed logical management Shared across applications or dedicated to a specific application Interop: Unix/Linux SSO via Vintela, Centrify * Source: Microsoft internal survey, spring 2005 © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Domain Mode Windows Server 2003 R2 Longhorn Server 4/21/2017 6:03 PM Domain Mode Windows Server 2003 R2 Unix compatibility schema ADMT v3 (web download) Longhorn Server Read-only DC: reduced physical security requirements, simplified manageability Restartable AD: reduce DC reboots DC on Server Core: minimize surface area DC/Domain Admin role separation © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Application Mode Windows Server 2003 ADAM download 4/21/2017 6:03 PM Application Mode Windows Server 2003 ADAM download LDAP-only mode of Active Directory with independent configuration Identical performance at scale Windows Server 2003 R2 ADAM included in OS distribution One-way AD-to-ADAM sync: eliminate need for MIIS (or IIFP) in simple scenarios Longhorn Server: same as R2 © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

The Next Generation of Digital Identity 4/21/2017 6:03 PM The Next Generation of Digital Identity © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Threats to Online Safety 4/21/2017 6:03 PM Threats to Online Safety The Internet was built without a way to know who and what you are connecting to Everyone offering Internet service has come up with workaround – a patchwork of one-offs Inadvertently taught people to be phished Greater use and greater value attract professional international criminal fringe Understand and exploit weaknesses in patchwork Phishing and pharming at 1000% CAGR Add “Stash attacks” reported as “Identity losses” © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

From Patchwork to Fabric 4/21/2017 6:03 PM From Patchwork to Fabric Little agreement on what identity layer is, or how it should be run Digital identity related to contexts Partial success in specific domains (SSL, Kerberos) Enterprises, governments, verticals prefer one-offs to loss of control Individual is also a key player No simplistic solution is realistic Consider cross cultural, international issues Diverse needs of players means need to integrate multiple constituent technologies © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

“The Laws of Identity” User control and consent 4/21/2017 6:03 PM “The Laws of Identity” User control and consent Minimal disclosure for a defined use Justifiable parties Directional identity Pluralism of operators and technologies Human integration Consistent experience across contexts Join the discussion at www.identityblog.com © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Identity Metasystem We need a unifying “Identity metasystem” 4/21/2017 6:03 PM Identity Metasystem We need a unifying “Identity metasystem” Protect applications from identity complexities Allow digital identity to be loosely coupled: multiple operators, technologies, and implementations Not first time we’ve seen this in computing Abstract display services made possible through device drivers Emergence of TCP/IP unified Ethernet, Token Ring, Frame Relay, X.25, even the not-yet-invented wireless protocols © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Empowers the User… You Applications Technologies Governments Devices 4/21/2017 6:03 PM Empowers the User… Applications Existing & New Technologies X509, Kerberos, SAML Governments You Devices PCs, Mobile, Phone Organizations Individuals Work & Consumer Private Businesses © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Brings Technologies Together… 4/21/2017 6:03 PM Brings Technologies Together… Smartcards Self-issued identities Corporate identities Government identities Passport identities Liberty identities Client applications Operating systems Network access systems Governments Organizations Companies Individuals Mobile phones Computers Hard ID tokens … and everything else © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Metasystem Characteristics Requirements for the Identity Metasystem 4/21/2017 6:03 PM Metasystem Characteristics Requirements for the Identity Metasystem Negotiation Driven Enable participants to negotiate technical policy requirements Encapsulation Technology-agnostic way to exchange policies and claims Claims Transformation Trusted way to change one set of claims into another regardless of format User Experience Consistent user interface across multiple systems and technologies © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

WS-* Metasystem Architecture 4/21/2017 6:03 PM WS-* Metasystem Architecture ID Provider Relying Party ID Provider Relying Party Kerberos SAML x509 … Security Token Service WS-SecurityPolicy Security Token Service WS-SecurityPolicy WS-Trust, WS-MetadataExchange Identity Selector Subject © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Microsoft Support for Identity Metasystem 4/21/2017 6:03 PM Microsoft Support for Identity Metasystem “Indigo” Runtime for building distributed applications supporting identity metasystem “InfoCard” Identity selector for Windows to visualize user’s digital identity Active Directory Infrastructure for identity and access End-Users Developers “InfoCard” “Indigo” WS-* Active Directory IT Organizations © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Preview – “InfoCard” 4/21/2017 6:03 PM © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Preview – “InfoCard” 4/21/2017 6:03 PM © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Microsoft’s Implementation 4/21/2017 6:03 PM Microsoft’s Implementation Data stored for each card in card collection Name, logo, names of claims available (not values) Address of identity provider Reference to required credential (e.g. smartcard) Data stored in simple identity provider Name, address, email, telephone, age, gender User must opt-in InfoCard data not visible to applications Stored in files encrypted under system key User interface runs on separate desktop No information stored in online service © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

4/21/2017 6:03 PM Summary © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Product Offering User Experience Logon & credentials Self-service 4/21/2017 6:03 PM Product Offering User Experience Logon & credentials Self-service Developer Experience Directory APIs Access APIs Integration APIs IT Pro Experience Management consoles MOM integration Identity and Access Platform Integration Services Metadirectory Workflow Audit and Reporting Enterprise SSO Directory Services Active Directory ADAM UDDI Access Services Federated SSO Integrated PKI CBAC & RBAC Rights Management Connectors Directory, Database, Flat file, Mainframe, ERP, and SDK to build more © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Roadmap Windows Server 2003 R2 Longhorn wave 4/21/2017 6:03 PM Roadmap Windows Server 2003 R2 Active Directory Federation Services ADAM with one-way sync from AD Additional management agents for MIIS Longhorn wave Continued directory services refinements PKI, credential management and usability enhancements “Gemini” automation and control platform © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Call to Action Build on Active Directory 4/21/2017 6:03 PM Call to Action Build on Active Directory Single sign on and directory consolidation Intranet and extranet We will help you build on this investment Use MIIS 2003 for provisioning, de-provisioning, and policy enforcement Try ADFS in R2 Beta 2 Learn about WS-* Web services Join identity metasystem discussion © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

4/21/2017 6:03 PM Resources “The Laws of Identity” and the Identity Metasystem: http://msdn.microsoft.com/webservices/ Identity Management: http://www.microsoft.com/idm Kim Cameron’s Identity Blog: http://www.identityblog.com © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Your Feedback is Important! 4/21/2017 6:03 PM We invite you to participate in our online evaluation on CommNet, accessible Friday only If you choose to complete the evaluation online, there is no need to complete the paper evaluation © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

4/21/2017 6:03 PM © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

© 2005 Microsoft Corporation. All rights reserved. 4/21/2017 6:03 PM © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary. © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

4/21/2017 6:03 PM © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.