Microsoft Identity & Access Plattform. Jörg Schanko Technologieberater Forschung & Lehre Microsoft Deutschland GmbH joergsc@microsoft.

Größe: px

Ab Seite anzeigen:

Download "Microsoft Identity & Access Plattform. Jörg Schanko Technologieberater Forschung & Lehre Microsoft Deutschland GmbH joergsc@microsoft."

Lioba Maier
vor 9 Jahren
Abrufe

1 Microsoft Identity & Access Plattform Jörg Schanko Technologieberater Forschung & Lehre Microsoft Deutschland GmbH

3 Herausforderung Identity & Access Management Wie und wo verwalte ich Benutzer? Wo lege ich Berechtigungen fest? Wie implementiere ich ein einheitliches System in einer heterogenen Umgebung????

4 Urlaub Bali, Indonesien

8 Identity Provider Relying Party Vorname Application Name Ort Geburtsdatum Application

9 Claim-based Authentication Identity Provider Relying Party STS Trust STS STS STS STS = Security Token Server Application Application

10 Geneva Identity Provider Relying Party STS Trust STS STS STS Geneva Server STS = Security Token Server Application CardSpace Geneva Application

11 Geneva Server Security Token Server zur Ausgabe und Umwandlung von Claims und Token Weiterentwicklung von ADFS 1.0 Unterstützt WS-Federation und SAML 2.0 Aktive und passive Clients Einrichten und Verwalten von Vertrauensstellungen (Trusts) Automatische Erneuerung von Zertifikaten Getrennte Speicher für Konten und Attribute möglich

0 Aktive und passive Clients Einrichten und Verwalten von Vertrauensstellungen

12 Geneva Server Geneva Server Account Provider - Active Directory - LDAP (AD LDS) -... STS Attribute Provider - Active Directory - AD LDS - SQL Server -...

13 CardSpace Geneva Benutzerbezogener Speicher für Identitätskarten Identitätskarte=XML-Datei, die eine Verbindung zu einem STS repräsentiert Ermöglicht dem Benutzer visuelle oder automatische Auswahl des passenden STS zu einer Anwendung Kann vom STS befüllt werden InformationCards können mit PIN geschützt werden Unterstützung von roaming Benutzern

dem Benutzer visuelle oder automatische Auswahl des passenden STS zu einer Anwendung

14 Geneva Framework Unterstützt Entwickler bei der Erstellung von Claims-aware Anwendungen Verifizierung von Token Extrahierung der Claims aus einem Token Umgang mit Claims (Type, Value, Issuer,...) Erlaubt das Erstellen eigener STSe Geneva Server basiert auf Geneva Framework

Claims aus einem Token Umgang mit Claims (Type, Value, Issuer,.

Identity and Access Management Retire De-provision identities Revoke credentials Create Provision user Provision credentials Provision resources De-provision resources Policy Management Policy

15 Identity and Access Management Retire De-provision identities Revoke credentials Create Provision user Provision credentials Provision resources De-provision resources Policy Management Policy authoring Policy enforcement Approvals and notifications Audit trails Update Role changes Password and PIN reset Resource requests Credential Management Identity validation Smart Card/Certificates Issuance Access Entitlements established Integrated Workflow

Approvals and notifications Audit trails Update Role changes Password and PIN reset Resource requests Credential

Forefront Identity Manger - Feature areas Policy Management SharePoint-based console for policy authoring, enforcement & auditing Extensible WS * APIs and Windows Workflow Foundation workflows

16 Forefront Identity Manger - Feature areas Policy Management SharePoint-based console for policy authoring, enforcement & auditing Extensible WS * APIs and Windows Workflow Foundation workflows Heterogeneous identity synchronization and consistency Credential Management Heterogeneous certificate management with 3rd party CAs Management of multiple credential types, including One Time Passwords Self-service password reset integrated with Windows logon User Management Integrated provisioning of identities, credentials, and resources Automated, codeless user provisioning and de-provisioning Self-service profile management Group Management Rich Office-based self-service group management tools Offline approvals through Office Automated group and distribution list updates 16

Passwords Self-service password reset integrated with Windows logon User Management Integrated provisioning of identities, credentials, and resources Automated, codeless user provisioning and

Management Credential Management User Management Group

17 Forefront Identity Manager in Action FIM Portal Self-Service integration Windows Log On LOB Applications Policy Management Credential Management User Management Group Management Custom Databases ISV Partner Solutions Directories IT Departments

Customizable Identity Portal SharePoint-based Identity Portal for Management and Self Service How you extend it Add your own portal pages or

18 Customizable Identity Portal SharePoint-based Identity Portal for Management and Self Service How you extend it Add your own portal pages or web parts Build new custom solutions Expose new attributes to manage by extending FIM schema Choose SharePoint theme to customize look and feel

pages or web parts Build new custom solutions Expose new attributes to

19 Forefront Identity Manager 2010 Architecture Solutions Group Mgmt User Mgmt Credential Mgmt Policy Mgmt Custom FIM Client Experiences Outlook FIM Portal Windows Custom ILM-CM Portal FIM Service and Portal FIM Service ILM Sync ILM-CM Request Processor Delegation & Permissions AuthN Workflow AuthZ Workflow App DB Action Workflow Sync DB Adapters ILM-CM DB Cert Mgmt Identity and data stores Directories Applications Databases Systems

Service ILM Sync ILM-CM Request Processor Delegation & Permissions AuthN Workflow AuthZ Workflow App DB

Sync DB Service DB Management Agents AuthN & AuthZ Workflows FIM synchronizes updates with external

20 FIM 2010 In Action HR-driven provisioning a of new employee New user added in HR app Sync receives request FIM manages manager and dept head approvals Once approved, changes committed to FIM app store Sync DB Service DB Management Agents AuthN & AuthZ Workflows FIM synchronizes updates with external identity stores FIM sends welcome and confirmation s Sync DB Identity Stores Management Agents Action Workflow

FIM 2010 In Action Self-service password management User forgets password Requests password reset at Win logon and answers Q/A FIM receives XML Does user have permission to reset password?

21 FIM 2010 In Action Self-service password management User forgets password Requests password reset at Win logon and answers Q/A FIM receives XML Does user have permission to reset password? FIM validates Q/A response from user Request Processor Delegation & Permissions AuthN & AuthZ Workflows FIM syncs new password to external identity stores FIM makes call to reset password in AD Changes committed to FIM app store Sync DB Service DB Identity Stores Management Agents Action Workflow

FIM 2010 In Action Self-service smart card provisioning New user added in HR app Sync receives request Does user have permission to add user to FIM?

22 FIM 2010 In Action Self-service smart card provisioning New user added in HR app Sync receives request Does user have permission to add user to FIM? FIM manages manager and dept head approvals Sync DB Management Agents Delegation & Permissions AuthN & AuthZ Workflows FIM syncs to external identity stores FIM sends welcome and confirmation s Once approved, changes committed to ILM app store Sync DB Service DB Identity Stores Management Agents Action Workflow FIM CM Approval workflows Card created & printed Certificates requested Self-service notification and One Time Password sent to end user End user downloads certificates onto smart card

23 Management Agents Active Directory ADAM iplanet SQL Oracle DSML 2.0 LDAP Directory Interchange Format (LDIF) Delimited Text Fixed-Width Text Attribute-Value Pair Text NT4 Exchange 5.5 Lotus Notes Novell edirectory IBM DB2 IBM Directory Manager SAP OpenLDAP Management Agent SDK (für eigene Erweiterungen)

24 Webcast "Geneva" Server and Framework Overview (Level 300) Tuesday, November 04, :00 PM Pacific Time (US & Canada) steventdetails.aspx?eventid= &e ventcategory=5&culture=en- US&CountryCode=US

25 Hilfreiche Links Geneva x?siteid=642 FIM ity-manager.aspx

Ähnliche Dokumente

IT-Symposium. 2E04 Synchronisation Active Directory und AD/AM. Heino Ruddat

IT-Symposium. 2E04 Synchronisation Active Directory und AD/AM. Heino Ruddat IT-Symposium 2006 2E04 Synchronisation Active Directory und AD/AM Heino Ruddat Agenda Active Directory AD/AM Möglichkeiten der Synchronisation Identity Integration Feature Pack Microsoft Identity Integration