progress software

Progress Software

Identity Management 101

Sarah MarshallOpenEdge QA Architect

May 2012

© 2011 Progress Software Corporation. All rights reserved.2

What is Identity Management?

About protecting your data

About verifying and controlling who accessing your data

About minimizing where and when you verify who is accessing your data

And what happens if your not authorized!


Edna Mode


Building blocks to IdM



Authentication systemsSystems you will use (or are using) to maintain your list of users



Domain configuration


Categories of users that have in common the data they can access




Authorization configuration



Configurations for individual users defining their access privileges




Architecture to support IdM





Single point of identity management for all systems


The CLIENT-PRINCIPAL

Built in ABL security token

Set current identity in any session db connection

Created by the AVM if not created explicitly

Manage a user’s login session

CREATE CLIENT-PRINCIPAL hCPhCP:INITIALIZE(…)

SECURITY-POLICY:SET-CLIENT(hCP)SET-DB-CLIENT(<dbname>, hCP)

SETUSERID(<userid>, <psswd>, <dbname>)cmd> $PROEXE –U <userid> -P <psswd>

rCP = hCP:EXPORT-PRINCIPALhCP:LOGOUT()


The Game Board

Login

START

Create C-PLDAP

OEDB

Expired!

Client

User Account System

Logged in

Logout

Game over

Authentication

FINISH

ASDB

ASCDB

LDAPLDAP


The Game Board

Login

START

Create C-PLDAP

OEDB

Expired!

Client

User Account System

Logged in

Logout

Game over

Authentication

FINISH

ASDB

ASCDB

LDAPLDAP

Authentication systems


LDAP

The Game Board

Login

START

Create C-P

OEDB

Expired!

Client

User Account System

Logged in

Logout

Game over

Authentication

FINISH

ASDB

ASCDB


KerberosLDAP

LDAPLDAP


LDAP

The Game Board

Login

START

Create C-P

OEDB

Expired!

Client

User Account System

Logged in

Logout

Game over

Authentication

FINISH

ASDB

ASCDB


LDAPKerberos

LDAPLDAP


LDAP

The Game Board

Login

START

Create C-P

OEDB

Expired!

Client

User Account System

Logged in

Logout

Game over

Authentication

FINISH

ASDB

ASCDB


KerberosLDAP

OpenID

LDAPLDAP


The Game Board

Login

START

Create C-PLDAP

OEDB

Expired!

Client

User Account System

Logged in

Logout

Game over

Authentication

FINISH

ASDB

ASCDB

LDAPLDAP


_Domain-type: _oeusertable_oslocal_extssoUser Defined

_sec-authentication-system


What are domains? Domain configuration


Defining domains

• Have roles and responsibilities in common

• Have level of security in common

• Have data access privileges in common

_Domain-name_Domain-type_Domain-description_Domain-access-code_Domain-runtime-options_Tenant-name

_sec-authentication-domain



Using domains

OEDB1


OEDB2

OEDB3

OEDB4

The client uses the domains defined in a database

Client

SECURITY-POLICY:LOAD-DOMAINS(DB1)

1. Each database can use it’s own domain registry2. Each database can share the session’s registry


User permissions Authorization configuration

• Authorization for individuals

• Table and field level permissions: CAN-* fields

• Runtime persmission: CAN-DO()function

CAN-DO(“*.Admin”)


The Game Board

Login

START

Create C-PLDAP

OEDB

Expired!

Client

User Account System

Logged in

Logout

Game over

Authentication

FINISH

ASDB

ASCDB

LDAPLDAP


Security Token Service

Security Token ServiceUser Credentials

• take login information

• runs authentication plug-in

• seals CLIENT-PRINCIPAL

• makes it available to the application

Create C-P

User Account System

Authentication

LDAPLDAPLDAPAS

CDB




Login

START

Expired!

Logout

Game overFINISH

OEDB

Client

Logged in

ASDB

ASCDB




Anatomy of an STS

ABLClients

OpenClients

AdapterClients

LDAP _User OpenID OEDB TBD…

ABL STS AppServer

OpenEdge Session DomainsAuditTrail

Login

Credentials

CCID

ASAS

AS

DBDB

DB

DB

Domains



ASAS

AS

DBDB

DB

DB

Domains

Anatomy of an STS

ABLClients

OpenClients

AdapterClients


ABL STS AppServer


Login

CCIDCCID = Client Context Identifier



Anatomy of an STS

ABLClients

OpenClients

AdapterClients


ABL STS AppServer


Login

CCID

ASAS

AS

DBDB

DB

DB

Domains



Anatomy of an STS


ABL STS AppServer


Login

CCID

ASAS

AS

DBDB

DB

DB

Domains


ABLClients

OpenClients

AdapterClients


ASAS

AS

DBDB

DB

DB

Domains

Anatomy of an STS

ABLClients

OpenClients

AdapterClients


ABL STS AppServer


Login



Anatomy of an STS


ABL STS AppServer


Login

ASAS

AS

DBDB

DB

DB

Domains


ABLClients

OpenClients

AdapterClients









Single point of identity management for all systems

progress software

Documents