User Authentication for Enterprise Applications - The

Future in Transitions

2

Thesis• Well-managed, trustworthy authentication and

authorization are important today and will be vital in the future

• Moving the authentication and authorization functions to the Web layer allows rapid deployment of newer tools and technologies

• The services needed are largely available today, and will be complete within 18 months

• The work must now shift to the applications and business processes

3

Agenda

• Trends in User Authentication

• NUIT Plan

• How Should Applications Prepare?

• Transitions

• Wrap-up

4

Agenda

• Trends in User Authentication

• NUIT Plan

• How Should Applications Prepare?

• Transitions

• Wrap-up

5

Trends in User Authentication

• Defining clear business rules for identity creation and lifecycle management

• Requiring stronger passwords

• Requiring multi-factor authentication for high-value transactions

• Moving to universal identity tokens and federated domains

6

Business Rules for Identity Lifecycle Management

• Document the necessary and sufficient conditions for identity creation

• Define the lifecycle and especially what authorizations are granted and revoked at each transition

• Grant authorizations in manners that fit business goals and minimize risks

• Log and audit the management processes

7

Stronger Passwords

• Password cracking technology is advancing beyond our ability to remember passwords

• Because attacks are automated, risks are greater and defenses must be stronger

• Passwords must become longer and more complex.

8

Stronger PasswordsNumber of characters

A..Z A..Z, a..z A..Z, a..z, 0..9, symbols

6 5 mins 6 hrs 8 days

8 58 hrs 21 mons 196 yrs

10 5 yrs 4648 yrs 1.7M yrs

• Assumes 1M password tests per second• Stated figures are 100% surety, 50% would be half, 25% one-quarter, etc.• Source: http://lastbit.com/pswcalc.asp

9

Multi-Factor Authentication• Factors: something you …

– Know (passwords)– Have (swipe card, USB token)– Are (thumbprint, handprint, retinal pattern)– Do (typing pattern, walking gait)

• How many factors are needed to be POSITIVE that the attempted access is by the real person?– What is the risk of being wrong?– What is the inconvenience?

10

Universal Identity and Federation• If multi-factor authentication is needed then

everyone should have two or more factors available

• Certification attests to the level of confidence which a third party puts into the association of a factor to a particular person

• Federation is not giving another institution access to our authentication services, it is based upon trust in our assertions of authentication. That trust is built upon their knowledge of our identification and management practices

11

Agenda

• Trends in User Authentication

• NUIT Plan

• How Should Applications Prepare?

• Transitions

• Wrap-up

12

NUIT Plan• Single identity for each person• Remove authentication from applications and

place it in the surrounding service environment• Four network-wide authentication services but

only one and one-half authorization services• Workflow-based identity management• Federated authentication • Smartcards, USB tokens, etc.

13

Four Services

• LDAP 3.x: authentication and authorization attributes

• MSFT Active Directory: authentication and some authorization attributes

• MIT Kerberos 5: authentication

• Web SSO: authentication and coarse-grained access control through LDAP authorization attributes

14

Agenda

• Trends in User Authentication

• NUIT Plan

• How Should Applications Prepare?

• Transitions

• Wrap-up

15

How Should Applications Prepare?

• Move user authentication into the Web server

• Use identity management workflow to control access to the application

• Use institutional roles or other attributes for coarse-grained access control

• Optional: Employ first-access provisioning to simplify management of user profiles within the application

16

Authenticating at the Web Server

• Applications must give up internal passwords and programming logic to check NetID passwords

• Moving this function to the Web server level allows new functions (Web SSO) to be deployed without wide-spread effects

• If the application is invoked, then the user was successfully authenticated

17

Approve Access Through IdM

• The Identity Management (IdM) system must know if a NetID has been granted access to an enterprise application.

• Using IdM-based workflow to request, authorize, approve and grant access can support this easily.

• The IdM system can enforce business rules subject to entitlements granted.

18

Coarse-Grained Access Control

• Through Web SSO and access rules, any NetID attribute can be used to allow or deny access to an application Web page.– Role: “faculty”, “employee”– Entitlement: “access to HRIS”

• Session environment can also be used– IP address– Level of authentication

19

First-Access Provisioning• Avoid provisioning user profiles within the

application until the user attempts access.• Recognizing no user profile exists:

– Invoke an IdM workflow to request access– Create a place-holder profile and allow

access– Automatically create a profile from attribute

information (institutional roles)

• Result: savings in administrative time

20

Agenda

• Trends in User Authentication

• NUIT Plan

• How Should Applications Prepare?

• Transitions

• Wrap-up

21Step

1

U s e rp ro file s

D a ta b a s e

Ses

sion

set

-up

Pro

cess

ing

A p p lic atio n

A d min is t ra to r

E -m ail &w o rk flo w

Aut

hent

icat

ion

& A

utho

riza

tion

ID &

Rol

eM

aint

enan

ce

22Step

2

U s e rp ro file s

D a ta b a s e

Ses

sion

set

-up

Pro

cess

ing

LD A P Re g is t ry

Id e n t ity M a n a g e me n tS y s te m

A p p lic atio n

A d min is t ra to r

E -m ail &w o rk flo w

Aut

hent

icat

ion

& A

utho

riza

tion

ID &

Rol

eM

aint

enan

ce

A u th o rity

23Step

3

U s e rp ro file s

D a ta b a s e

Ses

sion

set

-up

Pro

cess

ing

LD A P Re g is t ry

Id e n t ity M a n a g e me n tS y s te m

A p p lic atio nW e b S e rv e r

A d min is t ra to r

E -m ail &w o rk flo w

A u th o rity

Aut

hent

icat

ion

Aut

hori

zati

on

ID &

Rol

eM

aint

enan

ce

24Step

4

U s e rp ro file s

D a ta b a s e

Ses

sion

set

-up

Pro

cess

ing

LD A P Re g is t ry

Id e n t ity M a n a g e me n tS y s te m

A p p lic atio nW e b S e rv e r

A c c e s s p o lic yd a ta b a s e

W e b S S O

A c c e s s Co n t ro lS y s te m

A d min is t ra to r

E -m ail &w o rk flo w

c ookie

A u th o rity

Aut

hent

icat

ion

Aut

hori

zati

on

ID &

Rol

eM

aint

enan

ce

25Step

5

U s e rp ro file s

D a ta b a s e

Ses

sion

set

-up

Pro

cess

ing

LD A P Re g is t ry

Id e n t ity M a n a g e me n tS y s te m

A p p lic atio nW e b S e rv e r

A c c e s s p o lic yd a ta b a s e

W e b S S O

A c c e s s Co n t ro lS y s te m

A d min is t ra to r

E -m ail &w o rk flo w

c ookie

A u th o rity

Aut

hent

icat

ion

Aut

hori

zati

on

ID &

Rol

eM

aint

enan

ce

26Step

6

U s e rp ro file s

D a ta b a s e

Ses

sion

set

-up

Pro

cess

ing

LD A P Re g is t ry

Id e n t ity M a n a g e me n tS y s te m

A p p lic atio nW e b S e rv e r

A c c e s s p o lic yd a ta b a s e

W e b S S O

A c c e s s Co n t ro lS y s te m

A d min is t ra to r

E -m ail &w o rk flo w

c ookie

A u th o rity

Aut

hent

icat

ion

Aut

hori

zati

on

ID &

Rol

eM

aint

enan

ce

27Step

7

U s e rp ro file s

D a ta b a s e

Ses

sion

set

-up

Pro

cess

ing

LD A P Re g is t ry

Id e n t ity M a n a g e me n tS y s te m

A p p lic atio nW e b S e rv e r

A c c e s s p o lic yd a ta b a s e

W e b S S O

A c c e s s Co n t ro lS y s te m

Ro le e n g in e

A d min is t ra to r

E -m ail &w o rk flo w

c ookie

A u th o rity

Aut

hent

icat

ion

Aut

hori

zati

on

28Step

8

U s e rp ro file s

D a ta b a s e

Ses

sion

set

-up

Pro

cess

ing

LD A P Re g is t ry

Id e n t ity M a n a g e me n tS y s te m

A p p lic atio nW e b S e rv e r

A c c e s s p o lic yd a ta b a s e

W e b S S O

A c c e s s Co n t ro lS y s te m

Ro le e n g in e

A d min is t ra to r

E -m ail &w o rk flo w

c ookie

A u th o rity

Aut

hent

icat

ion

Aut

hori

zati

on

Fir

st-a

cces

spr

ovis

ioni

ng

29Step

9

U s e rp ro file s

D a ta b a s e

Ses

sion

set

-up

Pro

cess

ing

LD A P Re g is t ry

Id e n t ity M a n a g e me n tS y s te m

A p p lic atio nW e b S e rv e r

A c c e s s p o lic yd a ta b a s e

W e b S S O

A c c e s s Co n t ro lS y s te m

Ro le e n g in e

A d min is t ra to r

E -m ail &w o rk flo w

c ookie

A u th o rity

Aut

hent

icat

ion

Aut

hori

zati

on

Fir

st-a

cces

spr

ovis

ioni

ng

S m a rt c a rd

C a rdm a na ge m e nt

30

Agenda

• Trends in User Authentication

• NUIT Plan

• How Should Applications Prepare?

• Transitions

• Wrap-up

31

Wrap-Up• “Abstraction” frees the application from

any particular authentication technology• Identity workflow orders the approval

process, allows audit controls, and flags the user’s identity for other business rules

• First-access provisioning saves time and effort for the application administrator

• Just as secure, with just as much control, just using different tools

Questions?

Tom Board

teb@northwestern.edu

847-467-4120