For an enterprise, a key decision factor in selecting a good Cloud Identity Management service, is the ability of the service to connect to on-premise & cloud endpoints. Enterprises normally have User data stored in their endpoints. User data would range from the groups (segregation of users into a classification needed for the endpoint) the user belongs to, to the roles(a classification that allows the user to perform a particular function in that endpoint when the user is part of that classification) of the user and access privileges(permission levels to access resources) for that particular endpoint.<\/p>\n
The same user in an enterprise, can have different types of access, can perform different roles and can be part of different groups in different endpoints. We normally witness the fact that, once the number of endpoints grows in an enterprise this User data & the related objects like groups and roles become unmanageable and untraceable. Enterprise want to have this problem fixed.<\/p>\n
Any enterprise would love to know what types of access each user has in each of the endpoints at a given point in time. It would be key for them to have this information in one central place. Having this data in a single location, would help enterprise managers to look out for improper access, redundant roles in each of the endpoints on a periodic basis.<\/p>\n
EzIAMTM<\/sup> (a Cloud Identity Management Service from SecureKloud Inc.) offers something called a provisioning directory, where relevant data (User, groups, roles) from the endpoints can be stored and accessed by the enterprise administrator. (Please refer to my previous blog \u2013 EzIAM FAQ \u2013 to know about the origins and capabilities of EzIAMTM<\/sup>). This data can then be imported to an Identity Access Governance Service, that would then analyze the roles, groups & access permissions during periodic certification campaigns conducted by the business managers. That can be a topic for a future blog. Now, let us dwelve into the various facets of endpoint connectivity options available within EzIAMTM<\/sup>.<\/p>\n EndPoints:<\/strong><\/p>\n Endpoints are Directories, databases, LDAPs, applications, OS user stores etc. Almost any endpoint in an enterprise would have a data store where the users of that particular endpoint would be stored. Sometimes the endpoint themselves could be applications, in which case there would be an application database where the user information would be stored. Almost any system that contains user information could act as an endpoint for EzIAMTM<\/sup>. The endpoints could reside either on-premise or in a cloud.<\/p>\n Typically, an endpoint is a specific installation of a platform or application, such as Active Directory or Microsoft Exchange, which communicates with Identity Management to synchronize information (primarily attributes of a user stored in the endpoint). An endpoint can be:<\/p>\n \u25a0 An operating system (such as Windows) Connectors:<\/strong><\/p>\n A connector is the software that enables communication between EzIAMTM<\/sup> and an endpoint system. A connector server (an EzIAMTM<\/sup> Server Component) uses a connector to manage an endpoint. One can generate a dynamic connector using Connector Xpress (an EzIAM Tool), or one can develop a custom static connector in Java. For each endpoint that you want to manage, you must have a connector. Connectors are responsible for representing each of the managed objects in the endpoint in a consistent manner. Connectors translate add, modify, delete, rename, and search LDAP operations on those objects into corresponding actions against the endpoint system. A connector acts as a gateway to a native endpoint type system technology. For example, to manage computers running Active Directory Services (ADS) install the ADS connector on a connector server.<\/p>\n Three Types of Connectors:<\/strong><\/p>\n EzIAMTM<\/sup> has a rich set of On-premise connectivity options. There are 3 primary ways of connecting to endpoints;<\/p>\n C++ Connectors (managed by C++ Connector Server (CCS)) The endpoints (in the diagram, courtesy: CA) the Connectors connect to range primarily from PeopleSoft, SalesForce (IAM CS) to AD, DB2 (C++ Connector), RACF(Prov. Server Plugin). These are just examples of connectors. A list of out-of-the-box connectors is given in \u201cConnecting to endpoints\u201d sub-section below.<\/p>\n One cannot use both CA IAM CS and CCS to manage the same endpoint type.<\/p>\n What Connectors Can Do:<\/strong><\/p>\n EzIAMTM<\/sup> has a number of out-of-the-box Connectors that help to connect to popular endpoints. Each connector lets Identity Management within EzIAMTM<\/sup>, perform the following operations on managed objects on the endpoint:<\/p>\n \u25a0 Add For most endpoint types, all of these operations can be performed on accounts. These operations can also be performed on other managed objects if the endpoint permits it.<\/p>\n Connecting to Endpoints:<\/strong><\/p>\n Popular out-of-the-box Connectors in EzIAMTM<\/sup>: Ways to Create a New Connector:<\/strong><\/p>\n One can connect to an endpoint that is not supported out-of-the-box in EzIAMTM<\/sup>, also. To do this, an enterprise needs to create its own connector in one of these ways:<\/p>\n \u25a0 Use Connector Xpress to create the connector. Set Up Identity Management Provisioning with Active Directory:<\/strong><\/p>\n One can use Active Directory Server (ADS) to synchronize attribute data to supported endpoints. This could be done by configuring CA IAM CS to propagate local changes in Active Directory to a cloud-based identity store using a connector. For example, assume that you have a GoogleApps installation in the cloud. You could create an ADS group named \u201cGoogleApps\u201d and then configure the CA IAM CS to monitor that group. CA IAM CS synchronizes any changes to the GoogleApps environment in the cloud. If you add a user to the ADS GoogleApps group, CA IAM CS uses the GoogleApps connector to trigger a \u201cCreate User\u201d action in the GoogleApps environment proper.<\/p>\n To set up directory synchronization: Custom Connectors:<\/strong><\/p>\n Custom Connectors are connectors that can be programmed (mostly from pre-available template structures) that enables an enterprise to connect to custom endpoints (i.e endpoints that are not supported out-of-the-box in EzIAMTM<\/sup>).<\/p>\n Custom Connector Implementation Guidelines:<\/strong><\/p>\n It would help the developers to consider the following guidelines when designing and implementing a connector:<\/p>\n \u25a0 Drive as much of the connector implementation logic as possible using metadata. In summary, connection to endpoints is a critical aspect of modern Cloud Identity Management systems. The crucial Connector properties to look for from your Cloud Identity Management system would be,<\/p>\n EzIAMTM<\/sup> is an ideal candidate in this regard as it has a rich set of on-premise and cloud connectivity options. It has all the ideal connector properties that an enterprise would need to connect to their favourite endpoints.<\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" For an enterprise, a key decision factor in selecting a good Cloud Identity Management service, is the ability of the service to connect to on-premise & cloud endpoints. Enterprises normally have User data stored in their endpoints. User data would range from the groups (segregation of users into a classification needed for the endpoint) the […]<\/p>\n","protected":false},"author":5,"featured_media":236,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[40],"tags":[],"class_list":["post-235","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-identity-access-management"],"yoast_head":"\n
\n\u25a0 A security product that protects an operating system (such as CA Top Secret and CA ACF2)
\n\u25a0 An authentication server that creates, supplies, and manages user credentials (such as CA Arcot)
\n\u25a0 A business application (such as SAP, Oracle Applications, and PeopleSoft)
\n\u25a0 A cloud application (such as Salesforce and Google Apps)<\/p>\n
\nJava Connectors (managed by CA IAM Connector Server (CA IAM CS)).
\nProvisioning Server Plugins<\/p>\n
\n\u25a0 Modify\u2014Changes the value of attributes, including modifying associations between them (for example, changing which accounts belong to a group).
\n\u25a0 Delete
\n\u25a0 Rename
\n\u25a0 Search\u2014Queries the values of the attributes that are stored for an endpoint system or the managed objects that it contains.<\/p>\n
\nCA Access Control Connector
\nCA ACF2 v2 Connector
\nCA Arcot Connector
\nCA DLP Connector
\nCA SSO Connector for Advanced Policy Server
\nCA Top Secret Connector
\nIBM DB2 UDB for z\/OS Connector
\nGoogle Apps Connector
\nIBM DB2 UDB Connector
\nIBM RACF v2 Connector
\nKerberos Connector
\nLotus Domino Connector
\nMicrosoft Active Directory Services Connector
\nMicrosoft Exchange Connector
\nMicrosoft Office 365 Connector
\nMicrosoft SQL Server Connector
\nMicrosoft Windows Connector
\nOracle Applications Connector
\nOracle Connector
\nIBM i5\/OS (OS\/400) Connector
\nPeopleSoft Connector
\nRSA ACE (SecurID) Connector
\nRSA Authentication Manager SecurID 7 Connector
\nSalesforce.com Connector
\nSAP R\/3 Connector
\nSAP UME Connector
\nSiebel Connector
\nUNIX ETC and NIS Connector<\/p>\n
\n\u25a0 Use the CA IAM CS SDK to create the connector.
\n\u25a0 Ask SecureKloud to create a connector.<\/p>\n
\n1. Install CA IAM CS in your environment.
\n2. Acquire the endpoints that you want to synchronize with. You must acquire endpoints in order to create templates in step 4.
\n3. Create one or more directory monitors. Monitors capture changes that you make in your local Active Directory, and report them for the synchronization.
\n4. Create one or more synchronization templates. Templates control settings for the directory synchronization.<\/p>\n
\n\u25a0 Write code that takes advantage of the service provided by the CA IAM CS framework, like pluggable validators and converters, and connection pooling support classes.
\n\u25a0 Write custom connector code to address any additional specific coding requirements.<\/p>\n\n