Get Cloud Ready: Secure Access to Google Apps and Other SaaS Applications

(1)

Get Cloud Ready:

Secure Access to Google Apps and Other SaaS Applications

Matt Weisberg

Vice President & CIO, Weisberg Consulting, Inc.

[email protected]

Mike Weaver

IDM Practice Lead, Concensus Consulting [email protected]

Paul McKeith

(2)

2

• Provisioning and Management of Accounts

• Single Sign-On using Secure Assertion Markup

Language (SAML)

(3)

(4)

4

NetIQ/Identity Manager (IDM)

• Event-Based Identity Provisioning and Management • Near real-time data synchronization between

connected systems

• User Password Management • Password Self-Service

• Multiple hosting platform support

• Out of the box support for a wide array of connected

(5)

5

IDM Connector for Google Apps

Enterprise Identity Data IDM Connector for

(6)

6

IDM Connector for Google Apps

• IDM Integration Module for unidirectional

synchronization into Google Apps

• Native Java code

– Utilizes several published Google APIs

(7)

Features

• Synchronize (provision): – Users – Groups – Shared Contacts – Containers (OUs) • Move between OUs

• Supports Secondary Email domains • Support for Alias and Send-As settings • Supports RBE and RBPM entitlements • Account Tracking Support

(8)

8

(9)

9

Implementation

• Requires

– Google Apps for Business – Google Apps for Education – API Access Enabled

– Network access to Google

(10)

10

Implementation

• Install the driver modules

– Download the latest from the Novell® Patch site

• Add the Schema extensions Novell_Google_Schema.sch

• Be sure to update Designer Packages!

(11)

11

Futures

• Move user mailbox between email domains within the

same Google Apps domain

• Resource Objects • Postini Driver

(12)

(13)

13

Google Apps Single Sign-On (SSO)

• Google Supports Two Methods of Single Sign-On: • Open ID

– Simple implementation – Auto discovery of identities

– Service Provider Initiated SSO only

• Secure Assertion Markup Language (SAML) – More Complex

– Better end-user experience – Faster

– Flexible

(14)

14

What is SAML?

Security Assertion Markup Language (SAML) is an

XML-based standard for exchanging authentication and authorization data between security domains, that is, between an identity provider (a producer of assertions) and a service provider (a consumer of assertions).

(15)

15

SAML - Service Provider Initiated SSO

Google Apps (Service Provider) Access Manager (Identity Provider) 1 2 5 3 4 User/Browser

1. User accesses Google Apps

2. Google generates SAML request and redirects user to IdP. 3. User logs into IdP and gets SAML response (assertion)

(16)

16

Access Manager –

Quick Overview • Reverse Proxy

– Course Grained Access Control – Agent-less Web SSO via Form Fill

• J2EE Web Agents

– Fine Grained Access Control

• SSLVPN

• Loosely Coupled Identity Stores

– LDAP Directories e.g. Active Directory, Sun One, eDirectory™

• Open Standard Federation and Web SSO Support

(17)

17

Access Manager – Identity Provider

• Base URL is the Identity Provider URL • Must be accessible by clients

(18)

18

Access Manager – User Store

• eDirectory™, AD or

SunOne supported out of the box. Other

(19)

19

(20)

20

(21)

21

Access Manager – SP Metadata

• Not supplied by Google! You must create.

• entityID can be domain specific to support multiple Google Apps

instances with the same IdP.

(22)

22

(23)

23

(24)

24

Access Manager –

(25)

(26)

26

(27)

27

(28)

28

Google Apps – Example SSO URLs

Sign-in page URL:

https://ids1.samlexperts.com:8443/nidp/saml2/sso

Sign-out page URL:

https://ids1.samlexperts.com:8443/nidp/app/logout

Change Password URL:

https://pwm.samlexperts.com/pwm/private/ChangePassword

Access Manager IdS Metadata URL:

(29)

(30)

30

Password Self Service

• Password Management Servlets (PWM)

– Open Source

http://code.google.com/p/pwm/

• IdM User Application

• Novell® Self-Service Password Reset (SSPR)

http://download.novell.com/Download?buildid=PLBqMVIDc80~ http://www.novell.com/documentation/sspr10/

(31)

(32)

(33)

This document could include technical inaccuracies or typographical errors. Changes are

periodically made to the information herein. These changes may be incorporated in new editions of this document. NetIQ Corporation may make improvements in or changes to the software described in this document at any time.