Managing user access in businesses today is something like playing traffic cop in an intersection of a thousand roads. From Web-based applications to homegrown programs, from desktop PCs to the latest crop of smartphones, IT has to be able to control access to every sort of resource while allowing users to access them from anywhere and any platform.
A bigger challenge is providing seamless access to applications and systems across corporate or network boundaries. It’s no trouble for IT to define and manage user names and passwords on their own network, but it takes more work — or is nearly impossible — to extend access to internal systems to numerous external users or to manage local user access to a system outside of their control.
Microsoft has updated Forefront Identity Manager (FIM) 2010 and Active Directory Federation Services (ADFS) to aid IT in applying identity management across domains and business boundaries. Both of these tools are intended to extend user access control across the enterprise; FIM uses a common platform to tie user, certificate, group, and policy management together, while ADFS provides trust accounts between different networks or organizations. Together, they provide a powerful platform for extending user management beyond the company domain or network edge.
Through the use of ADFS, it is possible to facilitate a wide range of managed access. It makes it easy for users to access an Internet-accessible application on another company’s network or to allow outside contractors access to internal resources for the duration of a specific project. The key advantage is that neither domain need contain any of the other domain’s user information; no user information is shared, and each side remains responsible only for its own user management.
A claims-based system, like many others, uses digital tokens that contain information about the user. But unlike a request made directly against Active Directory and generating a Kerberos token, the resource being accessed doesn’t interact directly with the user data store. Instead, it talks to a Security Token Service, such as ADFS, which performs the check against the user information store and creates a claims token based on the result of the lookup. The claims token can contain as much — or as little — information as needed to access the particular service.
Using claims-based authentication between two different domains requires a Security Token Service in each domain. Each domain’s Security Token Service must trust the other one, and based on this trust, a policy is defined that specifies if access is granted or denied to a specific resource. For example, when a user on Network A attempts to access a Web portal on Network B, an authentication request is made to the user’s Security Token Service on Network A. After validating the claims for the user against the local user directory, Network A’s Security Token Service provides a token to Network B’s Security Token Service, which then issues its own token to the requesting user in order to access the Web portal. There is a lot of back and forth behind the scenes, but once the remote domain gets the all-clear from the user’s Security Token Service, the user gets a new token as if they were a member of the remote domain.
Within a single domain — such as when you want to extend user access to a cloud service without implementing a direct authentication connection to Active Directory or another user database — a single Security Token Service will do the job. In addition to supporting claims-aware ASP.Net applications and (through an IIS Web server agent) Windows NT token-based applications on the resource side, ADFS 2.0 can communicate with third-party federation services and cloud services using SAML 2.0.
The great advantage of claims-based authentication — and ADFS 2.0 — is that no changes are made to either domain’s users and no confidential information is sent between domains. When a claims-based request is made from the resource, it simply performs an “is allowed?” request against the issuing claims server. The claim token returns a Yes or No response regarding the user and nothing more. This gets the application out of the user authentication business. It simply asks a trusted partner if it is OK to allow this person to access its resources. All the heavy lifting is done behind the scenes.
Active Directory Federation Services 2.0 provides an extensible platform for handling claims-based authorization between local and remote domains. Here we see a list of the claims offered by the ADFS server to any other trusted Security Token Service provider. Each trust can have a different set of claims associated with it, allowing ADFS to fit in any situation.
To get started with ADFS, make sure you have a valid SSL certificate (self-signed is sufficient but not recommended for a production environment), Windows Server 2008 R2, Microsoft SQL Server 2008 (for the policy store), and Active Directory Domain Services. The ADFS 2.0 software is available as a free download from Microsoft through the Download Center.
Setting up ADFS takes quite a few steps, most of which involve importing the SSL certificate, exporting certificates, and creating shared certificates. Each ADFS server has to import the other’s SSL certificate in order to authenticate the external lookup request. The end result is that a trust relationship between the two federation servers (Security Token Services) is established using SOAP messages and SAML metadata. The last step is generating the claims rules appropriate for the exposed resource.
Claims rules can come in many forms and vary greatly based on the target resource or application. For the most part, each rule or policy must know the Uniform Resource Identifier (URI) of the application, which claims are being offered, which claims the application requires, the URL the application should expose to the user, and finally, if the token should be encrypted or not. Some rules might require user name, email address, and group affiliation, while others may only need first and last name. Rules can simply pass information through to ADFS or transform the data into something recognizable. For example, if ADFS talks to an LDAP server, it might need to reformat the user name so that the other ADFS (or Security Token Service) can properly process it. ADFS provides a very flexible rule engine that can handle most every situation.
Active Directory Federation Services is a great way to extend trusted authenticated access between domains using claims-based authentication. The fact that it works with other open Web standards allows it to extend its reach into non-Microsoft domains, while still allowing trusted access and single-sign-on capabilities. It does require a little work to get set up, but once in place, the benefits really pay off.
To get a feeling for how FIM 2010 fits into a real-world situation, I tested it in a highly virtualized environment made up of Active Directory domain controllers, SharePoint 2007 servers, Exchange 2007 servers, and two FIM 2010 and ADFS 2.0 servers in two domains, for a total of 13 virtual clients and servers. I was able to create and execute FIM 2010 policies on one server and see the results across both domains. I found the SharePoint-based UI easy to use, and after a couple of false starts, I had little trouble with the policy engine. The workflow wizard did a good job of walking me through workflow generation even though I had never created a workflow before.
A good portion of defining trusts in Active Directory Federation Services 2.0 is spent importing, exporting, and creating certificates through the ADFS management utility.
The previous release, Microsoft Identity Lifecycle Manager 2007, provided a platform for identity synchronization, basic certificate and smart card management, and user provisioning. Forefront Identity Manager 2010 takes these base features and enhances them to reduce the time, effort, and cost of managing a user’s account throughout its lifecycle.
One area that got a lot of attention in FIM 2010 is policy management. The administration UI is a SharePoint-based system that uses natural language queries and menu-driven controls to generate rules and policies for managing users. The rules can be applied automatically to other users and groups based on various criteria. For example, you can create a rule to automatically add a new user to a group, issue a one-time password for a smart card, and push the user’s email address and telephone number to another user directory while flagging HR to issue a request for a new health insurance policy.
One of the most powerful policy management features is the inclusion of Windows Workflow Foundation (WF). With WF, IT can create a multistep policy to easily automate user management. Workflows can be simple or complex with multiple branches depending on need. During my tests, I was able to create workflows to send approve or disapprove notifications to a specific manager whenever a user account was added to a certain group. FIM 2010 can also import and reuse existing WF-based workflows so that IT doesn’t have to re-create the workflow wheel and can speed up deployment.
Another very nice feature in FIM 2010 is that it will synchronize user information between heterogeneous systems. Forefront Identity Manager 2010 integrates with a wide range of systems, including Active Directory, Novell, Sun, IBM, Lotus Notes, Exchange, Oracle and SQL Server databases, SAP, and even flat file systems — in most cases with no additional software agent installed on the target system. A synchronization service takes care of passing user information in and out of FIM 2010.
A good example of this would be the scenario in which a new user is added to the company. HR creates the new user in FIM 2010. The synchronization service pushes the new user info into the enterprise’s Active Directory, and following the workflow, once the manager gives approval, this same user information is then sent to the company’s insurance provider (an external system, secured by ADFS) to add them to the health insurance plan.
Note that the synchronization isn’t merely a one-way street; when the insurance company creates a new account in their system and assigns the new employee an account ID, that information can be sent back into FIM on a subsequent synchronization and stored in the employee’s AD record or in FIM 2010 alone. Any update to the user record in any of these systems — FIM 2010 or AD or the external insurance system — is automatically updated in the others. With the multibranch capabilities of the policy engine, one change can create a cascade effect on other pertinent systems.
Forefront Identity Manager 2010’s intuitive SharePoint-based Web interface (above) provides access to all aspects of user identity management. Among the many new identity management features is user self-service password resets (below), with definable lockout thresholds and challenge-and-response prompts.
A couple of nice enhancements to user management are built into FIM 2010. In addition to simply creating the user account, FIM 2010 can automatically provision resources, such as an email account or a one-time PIN for a smart card. This automation becomes especially important when the time comes to de-provision a user. By allowing the proper policies to automatically take the user out of the system, FIM 2010 helps maintain compliance and minimizes the chance of leaving a user account active and failing a compliance audit.
Another nice feature is the ability for end-users to manage portions of their own user profile. For example, FIM 2010 can be set up to allow users to update telephone numbers, addresses, or other personal information without being able to change email address or logon name.
Along these same lines, users can manage their own distribution and user groups. This can be done through the FIM Web portal or, via integration with Office 2007 or Office 2010, right from inside Outlook. Group managers can approve or disapprove user requests via Outlook, making user group management even easier.
In a world where users are not always the exclusive management property of one domain, Forefront Identity Manager 2010 offers a way to bridge the gaps between systems. The bi-directional synchronization between heterogeneous identity systems extends FIM 2010’s reach beyond Microsoft-only networks, while the use of policy and workflows helps keep the compliance train on track. If you have to work with multiple domains or authentication systems, Forefront Identity Manager 2010 is definitely one tool to check out.
Greatly extends user management capabilities beyond local domains
Supports traditional Windows-based authorization in addition to claims-based authentication
No changes or additions to user directories required
No confidential information is passed between domains
Based on open Web standards (SAML 2.0, WS-Federation, WS-Trust)
Powerful policy engine
Extremely flexible workflow engine
User self-support features
Works with non-Windows directories and user data stores via synchronization engine
