IAM has come of age and is now branching out in some very interesting ways. As organisations strive to provide better control to their protected resources they are increasingly relying on their identity management infrastructure. SharePoint should rely on AD groups to control access to documents, applications should externalise their authorisation to a central decision point and network devices should dynamically check a user’s permissions before granting access to a sub-net. This track will explore the ways in which infrastructure is developing to accommodate these trends: how we ensure we collect sufficient identity information to service relying applications, how we grant access to the appropriate identity repositories and how we manage the required interfaces. We will look at the impact that increased reliance on identity services has on organisations and the changes that we need to anticipate in our infrastructure planning.
Continuing Education Credits
Advance Preparation: None
Learning Level: Intermediate
Field: Computer Science
After attending this block of sessions you will be able to:
- Explain how IAM needs to adapt in order to satisfy the needs of the modern business.
- Explain how identity needs to be woven into the fabric of business services.
- Describe the state of the market for dynamic authorization standards and technology.
- Explain the relevance of RBAC and ABAC and how to make Dynamic Authorization Management a success.
- Describe the Open Source implementation of RBAC – OpenRBAC, and the related LDAP standardisation work.
This block qualifies for up to 2 Group Learning based CPEs depending on the number of sessions you attend.
Killing Identity Management in Order to Save It
IAM has not kept up with the time and has become less than optimal for modern business. In order to be invaluable, IAM has to radically adapt. This session will discuss:
- How current IAM is not well suited for the modern business
- What a truly modern IAM system would include
- What we as an industry can do to evolve.
Weaving Identity into Business Services – Is this the Future of Identity & Access Management?
The future of IAM is unwritten. Industry leaders will discuss, debate, and debunk potential approaches for IAM to evolve and its new relationship to business.
Dynamic Authorization Management: The Market and its Future
In this session, Graham Williamson of KuppingerCole will present on the current state of the Dynamic Authorization Management market based on the brand-new KuppingerCole Leadership Compass document on the subject. The session will discuss the direction of IAM solutions to externalise their authentication and authorisation decisions to a centrally managed decision point. The presentation will advise on the direction various vendors have taken and the degree to which standards such as XACML are supported. Graham will also advise on expectations for the future development of this market sector and the core requirements when selecting a product in this area. The presentation will position Dynamic Authorization Management in the context of a comprehensive IAM solution.
RBAC, ABAC, or Both?
There is an ongoing discussion about terms such as RBAC (Role Based Access Control) and ABAC (Attribute Based Access Control). However, is it really about either-or? Or isn’t it that most role concepts take other attributes such as the Organizational Unit into account, while the role is a major attribute for most ABAC concepts? Shouldn’t the discussion be more about the question on how to make the shift from Static Access Management, based on pre-determined ACLs (Access Control Lists) etc., towards Dynamic Access Management and especially Dynamic Authorization Management, where applications ask at runtime for authorization decisions? But how to make that shift, how to convince application architects and developers? The panelists will talk about both RBAC and ABAC and how to make Dynamic Authorization Management a success, based on their experience.
OpenRBAC: Why using an LDAP based Backend for Role Based Access Control Information
OpenRBAC is an open source implementation of the ANSI standard RBAC. It uses OpenLDAP as backend for storing information on user, roles, resources, priviledges, etc. This has a number of advantages and only very few limitations. Access decisions can be retrieved by simple ldap searches so that a OpenRBAC based Policy Decison Point can answer ten thousands of such queries per seconds. Since two other RBAC software products use LDAP, currently work is being done on an IETF Internet Draft to standardize the LDAP schema and a specific LDAP extended operation for interoparable implementations. The talk will introduce
RBAC, OpenRBAC and report on the LDAP standardisation work.