CA SSO Access Gateway

I met with a potential customer today and he was interested to deploy CA SSO Access Gateway in the DMZ, while keeping CA SSO Policy Server in the Intranet.

He was not sure what were the possible integrations provided by CA SSO Access Gateway with his backend applications.

I showed him the diagram below. Self-explanatory.

• SAML (Federation)
• REST/JSON 
• OpenID Connect
• HTTP Header (Web Agent)

.

CA SiteMinder - Drawbacks

Common to all Single Sign-On products that have been out there in the market for the past 10 years, most provide agent-based solutions. 

Agent-based solutions have been working like a charm. But they have been a pain operationally.

1. Cost of Agent management grows as the deployment grows
2. Application owners and developers concerned about time to deploy
3. Need to coordinate with application owners for upgrades

These are very true points from our experience deploying multiple large-scale SSO solutions in the past.

One of the workaround is not to deploy agent on every application server. Instead, deploy a Reverse Proxy farm (RP farm). This is a centrally controlled farm with Apache HTTPd server with agents deployed.

Of course, bad points aside, there are benefits to having agent-based solutions.

1. Broad application coverage
2. Security
3. Scalability

.

Token for Application Access

When dealing with CA API Gateway (aka Layer 7) and CA Single Sign-On (aka SiteMinder), especially how to gain access to the backed protected applications, one has to differentiate the types of token required.

CA API Gateway accepts OAuth2 tokens, while CA SiteMinder traditionally accepts SM Session cookies.


In the mobile world, if there is a hybrid app that needs to communicate with an API-enabled application behind CA API Gateway and with a web application behind CA SiteMinder, it would be easier if both PEP (Policy Enforcement Point) "talk" OAuth2.

It saves the application developers time to handle SM Session cookies.

Is this achievable? Yes, a bit painful.

1) Need a new authentication scheme on SiteMinder to act as OAuth2 client.
2) This OAuth2 client needs to communicate with an OAuth2 Provider, which is the CA API Gateway

* Note: CA SiteMinder cannot act as OAuth2 Provider. Mobile deployment aside, if one has a pure web deployment and requires OAuth2 integration, CA SiteMinder is not able to fulfill the requirement singly. It has to integrate with some other OAuth2 Providers out there.

If customers choose to have everything under the same family, CA API Gateway will satisfy the need. However, it would be a real white elephant if there is no API Management requirement. :)

By the way, my team tested. CA SiteMinder OAuth2 authentication scheme is able to integrate with OpenAM whereby OpenAM acts as the OAuth2 Provider. Works like a charm!

.

Adaptive Risk Authentication

Adaptive Risk Authentication has been built into most SSO products these days. Should I say all? It used to be an add-on module or by-product, which customers have to pay extra. However, these days, we are seeing that this feature is shipped by default.


So, what makes a good authentication of choice? I found this slide from a CA webinar.

.

Device Identification to prevent Session Hijacking

This slide was from a webinar from CA I attended. It talked about how to prevent session hijacking by using device identification techniques.

So, besides ensuring the user is coming in from a "trusted" device during initial authentication, each access to a protected application is validated again. 

This can be quite resource intensive, but if an application is sensitive and of highest importance to customers, then it makes sense.

.

Mobile . Social Login . Single Sign-On

I was attending a webinar by CA - Enabling and Securing Multi-Channel Customer Interactions. 

Some points caught my attention:

• replace traditional channels with mobile apps if the same customer service features were available
• consumers prefer to use a company's mobile app for routine inquiries rather than calling the company on the phone
• consumers have a more positive view of a company if they have a customer service app

 Social Login benefits:

• access to large volume of social media users
• higher level of conversion to internal prospect list
• more targeted marketing opportunities

Now, based on the facts above, more and more decision makers will move businesses towards the Mobile and will offer Social Login.

Single Sign-On solutions in the market has to get:

• easier to deploy (Cloud ?)
• easier to integrate with Social Login providers
• more secured
• to scale even better and quicker

It's an exciting time to be in now!

.

Open Web Application Security Project - Top 10 for 2013

I came across OWASP Top 10 for 2013 and found it to be informative.

The OWASP Top 10 focuses on identifying the most serious risks for a broad array of organizations. For each of these risks, we provide generic information about likelihood and technical impact using the following simple ratings scheme, which is based on the OWASP Risk Rating Methodology.

So, here's the link to Top 10 for 2013. Quite alarming that Injection and XSS are still on top of the list year in year out.



.

CA SiteMinder 12.52 release

CA has just released SiteMinder 12.52 with the launch of Enhanced Session Assurance with DeviceDNA™feature.

In this new release we’ve taken a significant step forward in security – something that all too often gets overlooked in the rush for SSO. The latest release of CA SiteMinder addresses the challenge of session stealing and replay with a new patent-pending technology that leverages the proven capabilities from our CA Advanced Authentication product line to map a CA SiteMinder session to a particular device. We can then detect if a session is stolen and replayed through a different device, at which time the session is invalidated and security is preserved.

The product that has been plugged into SiteMinder is CA RiskMinder. This product has been there for years.

If customers wanted to integrate SiteMinder with RiskMinder, they had to pay. With SiteMinder 12.52, everything comes free!

Now, I hope there is no need to install RiskMinder separately in 12.52 in order to use the Enhanced Session Assurance with DeviceDNA™feature.


By the way, this reminds me that OpenAM has similar feature since version 10.0.0 - Adaptive Authentication Module. In OpenAM 11.0.0, the adaptive authentication capability has been enhanced with Device Print authentication module.

OpenAM adaptive authentication capabilities now include the Device Print authentication module (OPENAM-1375). The Device Print module uses characteristics of a system, including installed fonts, screen resolution, timezone, and also geolocation to uniquely identify the system. The Device Print module includes all of the functionality associated with the HOTP authentication module.

Nothing extra to install. The new module comes built-in by default.

.

Where to store Password Policy?

Any Single Sign-On product in the market will need to talk to a back-end User Store for authentication purpose. A User Store can be a traditional LDAP server or a modern Microsoft Active Directory Server.

Now, the SSO product fronts the end-users and this is where Password Policy is enforced. (Of course, if a corporate environment is using Microsoft platform, then password policy can be enforced during the Windows logon process)

Today, I talked to a Product Pre-Sales engineer and was pretty pissed off. She knew my team is managing the SSO product, as well as the LDAP server for a customer. We have a migration exercise going on at the moment.

My customer wants us to make use of the out-of-the-box features from the SSO product as much as possible - to the extend of making sure the Password Policy implemented on the LDAP server can be seamlessly integrated with this SSO product.

We spent a few days reading up and setting up a POC in our labs. We confirmed that this SSO product is not able to "interact" with any underlying LDAP server with regard to Password Policy management. It is only able to implement its own password policy.

She insisted that the RIGHT WAY of doing thing is for the SSO product to enforce password policy for the corporate.

This is "vendor-lock-in" strategy. You think customer is stupid?

I have implemented many SSO projects. In Sun's days, when the old Sun Access Manager and OpenSSO server could not integrate seamlessly with Microsoft Active Directory, we did not tell our customers that was the wrong way of enforcing password policy and they should use Sun AM/OpenSSO built-in password policy instead.

We stripped the codes and implemented custom authentication module for our customers.

User Store (LDAP server or Microsoft Active Directory Server) should be the authoritative password policy enforcer.

Wake up, lady!

.

Internet of Things

Everyone is talking about "Internet of Things" these days … Today, I came across an article from CA which talks about the same topic. The same article makes reference to ISACA - 2013 IT Risk/Reward Barometer.

The following chart is interesting as it also highlights the consumers' concern ("Not knowing who has access to information collected by connected devices"), which is quite alarming high to me - 44%.

The survey also captures the type of Governance Issues that comes with Internet of Things.

The top 3 are:

1. Increased security threats

2. Data privacy

3. Identity / access management

Yes, IAMS has a room to play in the Internet of Things ….  As I always say,  Cloud, Mobile, Social is not going to go away anytime soon. They will just get bigger, and we should better prepared ourselves for them.

.

Mobile Device Management

I blogged about New Paradigm for the Modern Web few months ago when I came back from ForgeRock Open Identity Summit in San Francisco. 

Few weeks after I came back from the US, I attended the 1st Compuware APM User Conference in Singapore. I then blogged about New Paradigm for the Modern Web - Part II. 

I concluded that Cloud, Mobile, Social is not going to go away anytime soon. They will just get bigger, and we should better prepared ourselves for them.

Mobile - yes, this is the tiny little gadget that is getting very hot these days. Every company is finding ways to have corporate applications installed on the mobile devices so as to increase the productivity and mobility of their workforce. 

But security is the top issue. 

This morning, I came across an article from Citrix and looked further into XenMobile.

XenMobile delivers enterprise grade MDM with role-based management, configuration, security and support for corporate and employee-owned devices. Users enroll their devices, enabling IT to provision policies and apps to those devices automatically, blacklist or whitelist apps, detect and protect against jailbroken devices, troubleshoot device and app issues, and wipe or selectively wipe a device that is lost, stolen or out of compliance. Users can use any device they choose, while IT can ensure compliance of corporate assets and secure corporate content on the device.

This is the Mobile Device Management (MDM) offering from Citrix. Quite typical of any MDM product out there in the market.


But XenMobile attempts to offer more features…

The XenMobile App Controller is a SAML-compliant identity provider that connects to the enterprise directory, reads the authorization policies configured and provides the appropriate secure SAML tokens for user sign-on to federation-enabled applications. To interoperate with older applications that do not support SAML, XenMobile can act as a password manager, storing user credentials and providing them securely so users don’t have to remember their app credentials. Built into XenMobile is a long list of “connectors” for applications that have all the required interaction logic leveraging APIs that the applications expose; for example, APIs to create user accounts within those applications based on authorization policies. With App Controller, authorized applications are exposed to users through Worx Home, forming an enterprise app store and providing users a single place to authenticate and get access to all their enterprise applications. 

Pretty cool.

This gets me thinking … currently, we have ForgeRock Bridge SPE (of course, there is now the famous SalesForce Identity Connect) that helps Cloud Service Providers to federate identities between enterprise customers and the services they offer.

The next feature will definitely be able to bridge the gap between identities from enterprise customers (most likely, in-house Microsoft Active Directory) and MDM products. I do not think we should cross the path of building a MDM product from scratch. That would be too far-fetching.

This would be a one-stop solution.

Just my thought. What's your view?


.

Mobile Access Gateway

So CA has bought over Layer 7 Technologies in April.2013. How time flies?

While waiting for a friend in Paris CDG airport, I came across an article from CA Layer 7 regarding its recently released Mobile Access Gateway 2.0.

Secure Backend Systems & Ensure Seamless Access for Authorized Users
The Gateway comes with a Mobile SDK for enterprise app developers, which enables:

•  Secure consumption of backend APIs through configuration of mutual SSL between the Gateway and the mobile device
  
•   Single Sign‐On (SSO) to mobile apps via enterprise IAM systems or social login, to maintain a seamless end user experience
  The Mobile SDK uses key standards like OAuth, OpenID Connect and JWT to leverage the underlying security in mobile operating systems, making it simple for developers to add SSO to their apps. The SDK offers client‐side libraries for iOS 6 and Android 4, plus sample code and documentation. 
  

Mobile SSO is definitely a hot topic these days. Watch out!


.

Defense In Depth

I came across this article from CA that talks about security threats and attacks.

At the end of the article, it mentioned briefly on how to defense in depth against threats and attacks. I find it a good reminder for everyone of us.

• Least privilege access
 – to help ensure that users have the minimum access to do their job

• Decouple security from administration
 – don’t allow non-security personnel to change security settings

• Fine-grained control over admin access
 – helps contain the damage if a system is breached

• Shared account management
 – to eliminate shared passwords and improve accountability

• User activity auditing
 – track and audit all access to help identify potential attack attempts

• Information protection
 – control not only access to information, but its use

Very common-sense advice, but how many of us really practice it at all times? :)

.

How to upgrade CA SiteMinder deployment?

By now, everyone should know that I am a "diagram" guy. I do not like to read words after words, if a simple diagram can do the job. That's just me. :)

So, how do we go about upgrading CA SiteMinder to the latest r12.5?

The strategy is simple:

0. Do not touch the Policy/Key Store

1. Start with Policy Server upgrade

2. Proceed with Web Agent upgrade (Note: This new agent must talk to the new Policy Server)

3. Repeat until all components are upgraded

4. We are now ready to replace the Policy/Key Store

That's it! Simple.

.

CA SiteMinder Profiler - something to learn from

This is another tool I like about CA SiteMinder - Profiler.

What's this actually? Nothing fanciful.. A log capturer and presenter - to say it in layman term.

But is it useful? Yes, pretty much.

Have you ever tried debugging from OpenAM debug logs? You'll know what I mean. :)


.

SiteMinder Test Tool

This is a very cool test tool from CA SiteMinder. How I hope we can have one for OpenAM!

Yes, I'm hoping. No harm having a hope right? Maybe, some days it'll materialise. :)


.

CA SiteMinder r12.5 supports CA Directory as Session Store

Yes, it's true - CA Directory configured as Session Store from r12.5 onwards is FOC!

CA SiteMinder r12.5 introduced support of CA Directory as a Session Store. Customers can take advantage of CA Directory free of charge as a repository for Session Data, Policy Data, and/or encryption Keys Data (commonly referred to as Session Store, Policy Store, and/or Key Store respectively). This provides a great opportunity for CA SiteMinder customers to take advantage of the unparalleled performance and scalability of CA Directory for these critical repository needs.

isProtected, isAuthenticated, isAuthorized

This is how most Policy Agent works, be it CA SiteMinder or ForgeRock OpenAM.

Policy Agent always go through these 3 processes:
1. isProtected?
2. isAuthenticated?
3. isAuthorized?

Simple.

.

SiteMinder Mobile Application Authentication Solution

So SiteMinder provides a Mobile Application Authentication Solution to allow customers to leverage their existing SiteMinder infrastructure to secure mobile apps.

How does it work?

1. Configuring a Web Agent or Secure Proxy Server to expose SiteMinder authentication operations as REST web services.

2. Mobile apps can send requests to these services to do the following operations:
■ Log in a user using Basic (username and password) authentication.
■ Verify the status of a SiteMinder session.
■ Log out a user.

Simple? REST, that's it.

.

Cross Domain Single Sign-On

In an environment where there are multiple domains and single sign-on across the domains is required, CDSSO (Cross Domain SSO) shall be utilized. This is a good article to kick-start.

When using CA SiteMinder, the same can be achieved via Cookie Provider. The concept is pretty similar to that in OpenAM.

OpenAM uses iPlanetDirectoryPro as its cookie name; SiteMinder uses SMSession.

.