Dirx Access V8.10
Total Page：16
File Type：pdf, Size：1020Kb
Evidian DirX Access V8.10 Trusted Collaboration Identity Federation and Access Management for the Connected World Everything and everyone is always online and While users may want to have a few different Partners also need to consider security securing access to applications or devices identities to protect their privacy, creating and models for online user transactions that provided either as on- and off-premise services maintaining a one-to-one identity relationship move collection and control of identity or from the cloud has never been more im- with each online service provider is a tedious information away from online service pro- portant. chore that can lead to poor access credentials. viders and into the hands of their users and Businesses and government agencies are assign the management of this data to accelerating the formation of online partner- Building a business-agile virtual enterprise using online identity providers. ships to respond quickly to potential revenue on-premise applications and private and public opportunities, outsource non-core functions, cloud or software as service offerings involves Users of Web or cloud services often share and deliver the widest variety of services to numerous security challenges to provide end- personal and sensitive information. This is their users. to-end security. The emergence of cloud, mo- associated with an increasing risk of poten- To improve operational efficiency and respond bile and social computing has heightened the tial security and privacy issues. Once a user to user demand, they continue to put more and need for strengthened access controls to en- has submitted such information, he has more critical data and applications online for sure compliance with organization authentica- only limited ability to control access to such information sharing and self-service by con- tion and authorization policies. Partners must information. To alleviate this problem, there sumers, mobile employees, channel partners share or integrate their identity data, but they is a clear need for new approaches and and suppliers. must do it without overloading their IT admin- methods, to allow users to manage access Cloud adoption has soared as it has proved to istration or inadvertently creating security holes. to their Web resources and data. offer great economies of scale for many organi- To maximize user satisfaction, they must pro- zations by providing a lower-cost, flexible way vide for secure, seamless transactions between to use applications and services. services offered by disparate sites in different Meanwhile, people have come to expect the security domains, and these transactions must online services they use to be always-available, be completely auditable from beginning to end on-demand one-stop shopping experiences to prove regulatory compliance. To improve the accessible through a single login and providing user experience and ease the user login bur- them with the same look and feel no matter den, partners must offer single sign-on (SSO) what business they are transacting. With the capabilities to applications and services hosted recent news of massive security breaches of internally or in the cloud. They must also pro- online service databases and the rise in phish- vide rapid onboarding of new users to cloud ing, spoofing, and other fraudulent online activi- services to avoid the daunting task of manually ties, users are also beginning to worry that they and individually provisioning and managing are giving up too much of their critical identity users in each software as a service (SaaS) direc- information to too many Web sites. tory. Trusted partner for your Digital Journey Next Generation Identity Federation and Access Management with DirX Access Federation Protected These challenges are driving the design and Authentication Authorization SAML, OAuth, UMA, Systems OpenID Connect deployment of new security models for access Web management. Identity federation and secure HTTP User Entitlement Session Servers Web services are joining authentication, author- Management Management Management REST ization, audit, and Web SSO as essential capabili- XACML Application ties for protecting Web resources against unau- SOAP Servers thorized use in a flexible way. Web Policy WS Security Single Sign-On Management WS-Trust, WS-* DirX Access is a comprehensive access man- Web SSO Fine-grained policies WS-Federation agement, identity federation, and Web services SAML Services security solution protecting resources against Audit, Delegated, Integration and Other unauthorized use. DirX Access: Monitoring, Customization Role-Based Applications Provides for the consistent enforcement of Logging Administration Framework business security policies through external, centralized, policy-based authentication and Figure 1: DirX Access Functionality authorization services. Enhances Web user experience through local and federated single sign-on (SSO). Authentication Access and uses standards-based initial authen- Secures eGovernment and eBusiness initia- With DirX Access, authentication is provided as tication mechanisms such as: tives and provides seamless integration with an external, central service that supports a SSL/TLS client authentication through X.509 business and organizational partners through variety of well-known authentication methods, certificates including path validation, OCSP identity federation. such as passwords, X.509 certificates, FIDO- and CRL support Protects access to Web applications and based authentication, Integrated Windows Username/password authentication via HTTP devices with authentication and authorization Authentication, smart cards, HTML forms, one- basic or HTML form services, both on the premises and in the time-password (OTP) tokens, biometrics and call Second-channel OTP mechanism enabling cloud. back/out-of-band authentication. Administrators mobile push, SMS, and e-mail-based authenti- Supports versatile authorization scenarios can apply the method that best matches the cation via HTML form including user-managed access. security requirements of each individual appli- Standardized OTP algorithms IETF RFC 4226 Decouples security management such as cation or resource without rewriting or even (HOTP) and IETF RFC 6238 (TOTP) via HTML authentication and authorization from appli- touching the application. Decoupling authenti- form cation logic and ensures consistent, fine- cation from the application or resource allows Integrated Windows Authentication (IWA) grained entitlement management across the authentication service to scale easily – using the SPNEGO, Kerberos and NTLM au- multiple applications and services. administrators can add new authentication thentication protocols via HTTP Enables enterprises and service providers to methods without affecting the applications that W3C WebAuthentication based on FIDO2 deploy strong authentication solutions that depend on the service. including authentication with Microsoft Win- reduce reliance on passwords. Centralized authentication services also enable dows Hello Supports regulatory compliance with audit SSO. Users present their login credentials once, FIDO U2F (Universal 2nd Factor) functionality, both within and across security and are then allowed to access all applications domains. and resources within the enterprise security FIDO UAF (Universal Authentication Frame- work) domain for which they are authorized without having to re-authenticate/log in again. DirX Access enables to strengthen the authen- Authentication, Authorization and Audit – Finally, the DirX Access central authentication tication process by combining two or more Core Functionality for Access Management service allows authentication management to be concentrated in one configurable compo- authentication methods sequentially. This rep- Authentication is the process of verifying the nent. Because an external, central service by- resents a reasonable way of achieving a multi- identity of a user requesting a service or a passes the need for per-application authentica- factor authentication within simple deploy- resource, while authorization is the process of tion, users no longer need to keep track of ments; for example, combining verifying that an authenticated user has the multiple login credentials, and administrators no username/password with additional verification right to access a requested service or resource. longer need to maintain and support redundant via OTP values or username/password plus an Authentication and authorization answer the authentication mechanisms. external validation. The combination mecha- questions "Who are you?" and "What are you nism provides a conditional configuration of the entitled to do?" A not-yet-authenticated user’s interaction with a system protected by DirX Access leads to an authentication method sequence, i.e., failure in Authentication and authorization address the initial user authentication process. Subsequent the first method may lead either to an overall real-time enforcement of enterprise security interactions employ the single sign-on mecha- authentication failure or to invocation of a policies, while audit automatically records these nism. Risk-based authentication is applied in different method. Hence, DirX Access is able to transactions and stores these records securely both mentioned cases enabling to ask the user provide more sophisticated scenarios, such as for later compilation in reports to provide ana- about additional authentication, when strength- account locking