Hitachi ID Systems, Inc.

Hitachi

Documentation Identity Management Concepts and Terminology Identity Management Defined
certification

Defining Enterprise Identity Management

Abstract
Identity management is the combination of business process and technology used to manage data on IT systems and applications about users. Managed data includes user objects, identity attributes, security privileges and authentication factors.

This document defines the components of enterprise identity management. It describes the underlying business problem of managing user identity information on multiple, heterogeneous systems and applications. It then defines identity management in the context of this problem and describes technologies used to manage user identities more effectively.

Introduction

Identity management is the combination of business process and technology used to manage data on IT systems and applications about users. Managed data includes user objects, identity attributes, security privileges and authentication factors.

This document defines the components of enterprise identity management. It describes the underlying business problem of managing user identity information on multiple, heterogeneous systems and applications. It then defines identity management in the context of this problem and describes technologies used to manage user identities more effectively.

The remainder of this paper is organized as follows:

A variety of identity stores

Modern enterprises run a complex mix of IT infrastructure, including:

Many kinds of users access these systems, including:

Almost every system and application tracks its own users, how they sign in (i.e., their passwords) and their privileges (i.e., what they can see and do). This data about users must be managed, when users are hired, when their business roles or identifying information change and when they leave.

The diversity of these systems, each with their own security management user interface, administrators and change request processes creates complexity. This complexity impacts the IT operation -- the same human user must be managed by different IT staff on different parts of the infrastructure. The complexity also impacts users -- it can take a long time to make required changes and users are forced to memorize multiple login IDs, passwords and application sign-on processes.

This complexity leads to high IT cost, lower user productivity and security exposures.

Identity management technologies simplify the administration of this distributed, overlapping and sometimes contradictory data about users.

Enterprise-wide identity management: the challenge

In this document, "enterprise" refers simply to medium to large organizations, with thousands of internal users.

Different kinds of users

Enterprises manage identity data about two broad kinds of users:

The difference between insiders and outsiders and how this impacts identity management, may be illustrated by an example:

Consider a bank, with 15,000 employees, 5,000 contractors and 500,000 customers. Insiders at the bank are the 20,000 employees and contractors.

Insiders log into a network operating system, corporate Intranet, line-of-business applications, corporate mainframe, e-mail systems and Internet gateway. Their identity profiles include data relating to their employment and their many login IDs to internal systems. Insiders access components of their identity profile, in particular login IDs to various systems, many times each day.

Outsiders are primarily current and prospective bank customers. Their profiles may include from one to three login IDs and passwords -- for Internet-, telephone- and ATM-based electronic banking. Their profiles also include customer information such as a mailing address and account numbers. Outsiders only access their login IDs occasionally. Personal profile data provided by outsiders, such as full name, home telephone number, or e-mail address may be inaccurate.

Different kinds of identity data

Just as there are different kinds of users whose identity an enterprise must manage, there are different kinds of data about these users that must be managed:

Identity life cycle

The key problems of managing identity data in an enterprise can be understood by considering the life cycle of an identity profile:

Key identity challenges

Identity management presents several challenges in an enterprise-scale organization:

Relevant technologies: the solutions

Several types of technologies are available to manage user identity data across the enterprise. In general, these systems focus on streamlining the identity management process and managing data consistently across multiple systems.

Directories

A corporate directory is designed to consolidate the management of data about users, as well as other objects in the enterprise, such as user groups, servers, printers, etc.

Data is stored on one or more directory servers. These servers may replicate some or all of the data, to support scalability and high availability.

Client applications normally access data (read, write) through a standard protocol, such LDAP (light-weight directory access protocol) or X.500.

Using directories, it is possible to configure multiple applications to share data about users, rather than having each system manage its own list of users, authentication data, etc.

A key limitation of directories to simplifying identity management is integration with "legacy" systems. Mainframes, older applications, network operating systems and many other systems simply do not support the use of an external system to manage their own users.

Web access management / Web single signon

Once a directory is in place, it is possible to manage user identity, authentication and authorization data relating to multiple web-based applications using a web access management (WebAM) tool, also known as web single signon (WebSSO)

These systems replace the sign-on process built into multiple web applications with a single, shared infrastructure. For example, this may be accomplished using a plugin on each application web server or with a reverse web proxy front-ending one or more applications. They authenticate users once and maintain that user's authentication state in a cookie. As users click into and between applications, the WebAM inserts authentication information into their HTTP streams. WebAM systems may also provide some access control rules, for example to indicate which users may sign into which applications, or which fine-grained URLs are allowed.

WebAM systems provide effective authentication and some authorization capabilities for web-based applications. They do not, however, support signle signon or consistent authorization on "legacy" systems such as network operating systems, mainframes, client/server applications, e-mail systems, etc. They also usually have limited capabilities for managing users -- their strength is in runtime enforcement, rather than administration.

Password management

Users log into most systems with a login ID and password. Since passwords may be compromised over time (users write them down, attackers may guess them, etc.), it is prudent to periodically change passwords. Most modern systems and especially those that cater to insiders require users to change their passwords periodically. Most enterprises enforce a password change interval ranging from 30 to 90 days.

When users have multiple passwords, on multiple systems, that expire on different dates, they tend to write them down or forget them. To overcome these problems, it is desirable to provide users with a system to manage passwords consistently across multiple systems.

Password management systems generally support one or more of the following features:

Because insiders normally have more passwords and their passwords change more frequently, password management solutions are most relevant to them. Outsiders frequently have just one login ID and password to an enterprise's systems and in many cases that password does not expire.

Enterprise single sign-on

Users who log into many systems may prefer to sign into one master system and thereafter be able to launch applications having to type their ID or password again.

Most legacy and client/server systems cannot share authentication with modern infrastructures such as Kerberos or SAML. However, it is possible to store user credentials outside of the various applications and automatically enter them into applications when prompted.

Enterprise single sign-on (E-SSO) systems do just that: users sign into the E-SSO application, which stores every user's login ID and password to every supported application. Users launch various applications through the E-SSO client software, which opens the appropriate client program and sends keystrokes to that program simulating the user typing his own login ID and password.

Since they require the installation of client software, E-SSO systems are only appropriate for use by insiders.

E-SSO systems have had limited success in large production environments for a number of reasons:

Note that one E-SSO system does not store user passwords, but instead relies on password synchronization (P-Synch/SSO® -- http://Hitachi-ID.com/products/addons/psynchsso.html.

User provisioning

One of the most costly problems for enterprises is timely creation of new login IDs, adjustment of user privileges as user responsibilities change and deactivation of access once users leave.

These problems apply to the whole range of enterprise systems and applications -- directories, network operating systems, mainframes, database servers, ERP applications and more. These systems all manage internal user profiles and often cannot refer to an external directory to look up user identity, authentication and authorization data.

As a result, users must be provisioned access to such systems directly and their records in these systems must be individually adjusted or deleted when their responsibilities change, or they leave the organization.

User provisioning systems streamline the administration of user identities and privileges across multiple systems. They normally include one or more of the following features:

User provisioning systems typically focus on insiders, since outsiders may be well served by simpler processes -- for example self-service enrollment and termination handled by data scrubbing (removing inactive IDs).

Profile update

User identity normally includes personal information, such as name, telephone number, e-mail address, home address, date of birth, etc.

Some of this information changes over time. Changes to personal data should be easy to manage and be automatically reflected in systems such as the corporate directory and individual systems that users log into.

Most customer relationship management (CRM) systems include some facility to manage user profiles either administratively or using a self-service method. This capability is also available in some web access management systems, access management systems and password management systems.

It is helpful to allow users to enter and manage those parts of their own profiles where new data is either not sensitive or does not have to be validated. Examples of data that users should be able to enter themselves include their contact information outside of work, date of birth, etc.

Identity management: a simple definition

With the above sections in mind, we propose a simple definition to encapsulate the various capabilities of enterprise identity management technologies:

Identity management is defined as a shared platform and consistent processes for managing information about users: who they are, how they are authenticated and what they can access.

Beyond the enterprise

Identity management can extend beyond a single organization:

Federation enables applications in different domains to share information about users.

In order to work, federation requires that software at one site can communicate identity, authentication and authorization site to software at another site:

The problem with standards is that there are so many of them...

Conclusions

Identity management is a class of technologies intended to streamline the management of user identity information both inside and outside an enterprise. It includes:

References