• Abstract and Figures
• Public Full-text

Technical Data Sheet DirX Access V8.3 Web Access Management and Identity Federation DirX Access is a comprehensive, cloud-ready, scalable, and highly available access management solution providing policy-based authentication, authorization and federation for Web applications and services. DirX Access delivers single sign-on, versatile authentication, SAML- and OAuth-based identity federation and proxying, just-in-time provisioning, entitlement management and policy enforcement for applications and services in the cloud or on-premise. Your business technologists. Powering progress Web Access Management and Identity Federation Everything and everyone is always online, and securing access to applications provided either Protected Authentication Authorization Federation as on- and off-premise services or from the SAML, OAuth cloud has never been more important. Systems Businesses and government agencies are Web accelerating the formation of online partner- Entitlement Servers ships to respond quickly to potential revenue User Session Management Management Management HTTP opportunities, outsource non-core functions, XACML SOAP Application and deliver the widest variety of services to Servers their users. WS-* Web Policy Web Services To improve operational efficiency and respond Single Sign-On Management Security SAML Fine-grained WS-Trust, STS Web to user demand, they continue to put more and SSO policies Services more critical data and applications online for information sharing and self-service by con- sumers, mobile employees, channel partners Audit Delegated, Integration and and Role-Based Customization Applications and suppliers. Logging Administration Framework Cloud adoption has soared as it has proved to offer great economies of scale for many organi- zations by providing a lower-cost, flexible way to use applications and services. Figure 1: DirX Access Functionality Meanwhile, people have come to expect the online services they use to be always-available, users in each software as a service (SaaS) direc- Supports regulatory compliance with audit on-demand one-stop shopping experiences tory. Partners also need to consider security functionality, both within and across security accessible through a single login and providing models for online user transactions that move domains. them with the same look and feel no matter collection and control of identity information what business they are transacting. With the away from online service providers and into the Authentication, Authorization and Audit – recent news of massive security breaches of hands of their users and assign the manage- Core Functionality for Access Management online service databases and the rise in phish- ment of this data to online identity providers. Authentication is the process of verifying the ing, spoofing, and other fraudulent online activi- identity of a user requesting a service or a ties, users are also beginning to worry that they Next Generation Web Access Management resource, while authorization is the process of are giving up too much of their critical identity with DirX Access verifying that an authenticated user has the information to too many Web sites. While users These challenges are driving the design and right to access a requested service or resource. may want to have a few different identities to deployment of new security models for Web Authentication and authorization answer the protect their privacy, creating and maintaining a access management (WAM). Identity federation questions "Who are you?" and "What are you one-to-one identity relationship with each online and secure Web services are joining authentica- entitled to do?". service provider is a tedious chore that can lead tion, authorization, audit, and Web SSO as es- to poor access credentials. Authentication and authorization address the sential capabilities for protecting Web resources real-time enforcement of enterprise security against unauthorized use in a flexible way. policies, while audit automatically records these Building a business-agile virtual enterprise using DirX Access is a comprehensive Web access transactions and stores these records securely on-premise applications and private and public management, Identity Federation, and Web for later compilation in reports to provide ana- cloud or software as service offerings involves Services Security solution protecting resources lytical insight and transparency in the identity numerous security challenges to provide end- against unauthorized use. DirX Access: and access management processes. to-end security. The emergence of cloud, mo- bile and social computing has heightened the Provides for the consistent enforcement of The processes and technologies used to man- need for strengthened access controls to en- business security policies through external, age the users and their life cycles are referred sure compliance with organization authentica- centralized, policy-based authentication and to as identity management. The set of process- tion and authorization policies. Partners must authorization services. es and technologies to manage, deploy, enforce share or integrate their identity data, but they Enhances Web user experience through local and audit access control policies across multiple must do it without overloading their IT admin- and federated single sign-on (SSO). enterprise applications, services, and systems is istration or inadvertently creating security holes. Secures eGovernment and eBusiness initia- referred to as authorization or entitlement To maximize user satisfaction, they must pro- tives and provides seamless integration with management. vide for secure, seamless transactions between business and organizational partners through services offered by disparate sites in different identity federation. Authentication (Verifying security domains, and these transactions must Protects Web services and applications with Who You Are) be completely auditable from beginning to end authentication and authorization services, to prove regulatory compliance. To improve the both on the premises and in the cloud. With DirX Access, authentication is provided as an external, central service that supports a user experience and ease the user login bur- Provides just-in-time provisioning to automat- variety of well-known authentication methods, den, partners must offer single sign-on (SSO) ically create user accounts. capabilities to applications and services hosted such as passwords, X.509 certificates, Inte- Decouples security management such as internally or in the cloud. They must also pro- grated Windows Authentication, smart cards, authentication and authorization from appli- vide rapid onboarding of new users to cloud HTML forms, one-time-password (OTP) tokens, cation logic and ensures consistent, fine- services to avoid the daunting task of manually biometrics and callback/out-of-band authentica- grained entitlement management across mul- and individually provisioning and managing tion. Administrators can apply the method that tiple applications and services. best matches the security requirements of 1 DirX Access V8.3 each individual application or resource without Enrich request/response rewriting or even touching the application. HTTP/SOAP/other Protected PEP Decoupling authentication from the application Resource or resource allows the authentication service to scale easily – administrators can add new au- Client Client Security subjects e.g. application thentication methods without affecting the SSO Service SOAP applications that depend on the service. JGroups SSO SSO engine Web service Centralized authentication services also enable Clustered SSO. Users present their login credentials once, DirX Access servers Invoke and are then allowed to access all applications Authentication JAAS and resources within the enterprise security Service domain for which they are authorized without LoginModules having to re-authenticate/log in again. Query/ update (authn-related metadata in accounts) Client Finally, the DirX Access central authentication e.g. application service allows authentication management to User Service HTTP LDAP Provisioning SOAP be concentrated in one configurable compo- client Web service nent. Because an external, central service by- LDAP passes the need for per-application authentica- DirX Access Manager tion, users no longer need to keep track of Web Application multiple login credentials, and administrators no User longer need to maintain and support redundant Repository authentication mechanisms. The authentication services provided by DirX Figure 2: DirX Access Authentication/SSO Subsystem Access include initial user authentication, SSO and federated authentication. thentication authorities and leverage the exist- Single Sign-On and Session Management Initial User Authentication ing authentication infrastructure. Once successfully authenticated, users do not Initial authentication refers to the first time a Administrators can define the preferred authen- have to re-authenticate themselves when ac- user authenticates against the system. It is tication method to use for each distinct re- cessing other DirX Access-protected resources based on a user account established in DirX source of Web and Web services applications or (unless a resource explicitly requires step-up Access and uses standards-based initial authen- the DirX Access-protected resources of other authentication) on arbitrary servers within the tication mechanisms such as: applications. In this way, administrators can

Load more

  14

Copy Link