Identity Management and Enterprise Single Sign-On (ESSO) ICT Strategy Identity Management and Enterprise Single Sign-On (ESSO)

Introduction Follows on from other related themes: Unified Operator Interface (UOI) Network Convergence Network Security and Domains Circles of Trust Federated Identities Security as a Service Location transparency Virtualisation

Identity Management Business Value “Identity management projects are much more than technology implementations — they drive real business value by reducing direct costs, improving operational efficiency and enabling regulatory compliance.”

Explosion of ID’s Business Automation # of Digital IDs Time Internet Intra-Agency (B2E) Partners (B2B) Customers (B2C) Mobility # of Digital IDs Internet Client Server Applications Mainframe Time Pre 1980’s 1980’s 1990’s 2000’s

The Disconnected Reality Authentication Authorisation Identity Data HR System Authentication Authorisation Identity Data NOS Authorisation Identity Data Authentication Web Apps Enterprise Directory Authentication Authorisation Identity Data Infrastructure Application Authentication Authorisation Identity Data COTS Application Authentication Authorisation Identity Data In-House Application Authentication Authorisation Identity Data In-House Application “Identity Chaos” Lots of users and systems required to do business Multiple repositories of identity information; Multiple user IDs, multiple passwords Decentralised management, ad hoc data sharing

Multiple Contexts Our SUPPLIERS Our CUSTOMERS Our AGENCY and EMPLOYEES Customer satisfaction & customer intimacy Cost competitiveness Reach, personalisation Collaboration Outsourcing Faster business cycles; process automation Value chain Our AGENCY and EMPLOYEES Our PARTNERS Our REMOTE and VIRTUAL EMPLOYEES Mobile workforce Flexible/temp workforce

Pain Points Too many user stores and account admin requests IT Admin Developer End User Security/ Compliance Business Owner Too many user stores and account admin requests Unsafe sync scripts Redundant code in each app Rework code too often Too many passwords Long waits for access to apps, resources Too many orphaned accounts Limited auditing ability Too expensive to reach new partners, channels Need for control

To-Be Authentication Should only have to login once Identity is federated across domains Access permissions determined by Role(s), Groups and Policies Automated provisioning linked to ERP Systems Employees joining/leaving (HR) Contractors (Procurement)

Federated Identities Cross domain trust using: Security Access Markup Language (SAML) Liberty Alliance (ID-FF)/WS-Federation protocols Digital Certificates

IAM Architecture