1. Enterprise Identity Steve Plank – Microsoft Hugh Simpson-Wells – Oxford Computer Group Dave Nesbitt – Oxford Computer Group

2. Agenda Overview of Enterprise Identity Challenges/Solutions Individual Group Discussions (led) Large Group “Debate”

3. 3 The Digital Identity Lifecycle Roles Director Service Manager Product Manager PA Sales Person Customer Service Engineer HR Admin Call Handler

4. 4 Access Management Joining Identities Identity Data Aggregation Identity Data Enforcement Identity Data Brokering Hire/Fire Scenario The Digital Identity Lifecycle Role 1Role 3Role 4Role 5 Roles are defined People are hired People change role People are fired They leave of their own accord too! Role 2 They access critical assets A business owns critical assets

5. 5 Hire Scenario HRSystem Provisioning System or Metadirectory E-mail ContractorSystem LOB App Database ApplicationDirectory InfrastructureDirectory E-mail Δ LDAP SQL API

6. 6 Fire Scenario HRSystem Provisioning System or Metadirectory E-mail ContractorSystem LOB App Database ApplicationDirectory InfrastructureDirectory E-mail Δ LDAP SQL API

7. 7 Metadirectory Join on employeeID Join on mail Join, Attribute Flow, Enforcement… HRSystem ApplicationDirectory InfrastructureDirectory E-mailSystem givenName sn title mail employeeID telephone Klarek Cenntt 008 givenName sn title mail employeeID telephone Clark Kennttt Clark@contoso.com 007 givenName sn title mail employeeID telephone Klarke Kent 867-5309 Reporter Clark@contoso.com Reporter givenName sn title mail employeeID telephone Clark Reporter Kent 007 JOINED Join on employeeID givenName sn title mail employeeID telephone Clark Kent 007 Project to Metadirectory JOINED 007 Clark@contoso.com Superhero +44 123 456 7890 Manual Join JOINED +44 123 456 7890

8. 8 Metadirectory Identity Joining Scenario HRSystem ApplicationDirectory InfrastructureDirectory E-mailSystem givenName sn title mail employeeID telephone Klarek Cenntt 008 givenName sn title mail employeeID telephone Clark Kennttt Clark@contoso.com 007 givenName sn title mail employeeID telephone Klarke Kent 867-5309 Reporter Clark@contoso.com Reporter givenName sn title mail employeeID telephone Clark Reporter Kent 007 givenName sn title mail employeeID telephone Clark Kent 007 Clark@contoso.com Superhero +44 123 456 7890 givenName sn title mail employeeID telephone+44 123 456 7890 Clark Superhero Clark@contoso.com Kent 007 +44 123 456 7890 Clark Superhero Clark@contoso.com Kent 007 +44 123 456 7890 Clark Superhero Clark@contoso.com Kent 007 +44 123 456 7890 Clark Superhero Clark@contoso.com Kent 007 +44 123 456 7890 Clark Superhero Clark@contoso.com Kent 007 +44 123 456 7890 Clark

9. 9 Single Sign On Simple SSO Single Authentication Authority, Single Server Single Authentication Authority, Multiple Server Complex SSO Single Credential Set Token Based SSO PKI Based SSO Multiple Credential Set Credential Sync (Consistent Sign On) Client-side Credential Mapping Server-side Credential Mapping

10. 10 Simple SSO Resource Server Trust Token Validation AuthN Exchange AuthN Exchange Authentication Service Credential Store (probably LDAP directory) Replication

11. 11 No SSO Authentication Service Credential Store (probably LDAP directory) Authentication Service Credential Store (probably LDAP directory) AuthN Exchange AuthN Exchange

12. 12 Complex SSO: 1 Credential, Token-based Authentication Service Credential Store (probably LDAP directory) Authentication Service Credential Store (probably LDAP directory) AuthN Exchange Temp Token Temp Token Trust

13. 13 Consistent Sign On: Password Sync Authentication Service Credential Store (probably LDAP directory) Authentication Service Credential Store (probably LDAP directory) AuthN Exchange AuthN Exchange Password Copy Service plaintext pwcyphertext pw Password Crypto System plaintext pw PW trap cyphertext pw Password Crypto System Normalize identities - metadirectory

14. 14 Complex SSO – Client Cache Authentication Service Credential Store (probably LDAP directory) Authentication Service Credential Store (probably LDAP directory) AuthN Exchange AuthN Exchange Password Cache

15. 15 Complex SSO – Server Cache Authentication Service Credential Store (probably LDAP directory) Authentication Service Credential Store (probably LDAP directory) AuthN Exchange AuthN Exchange Client Installed SSO Agent password

16. 16 Client SSO Agent detects login dialog Retrieves credentials from ID store & fills in dialog Login User-id: Password: ID Store User object SSO Attributes : User-id: Password: FSmith ***** Client-side SSO Agent Understands password change dialogs Auto-generates new passwords Single Sign-On Complex SSO – Server Cache

17. Review Overview of Enterprise Identity Challenges/Solutions Individual Group Discussions (led) Large Group “Debate”