One Identity Cloud Access Manager - STS Windows Service

In One Identity Cloud Access Manager deployment, there is a STS host and Proxy host. The proxy host acts as the reverse proxy to protected applications, as well as serving as the Login Page.

On the Proxy host, if you ever need to restart the service, a quick search for One Identity Cloud Access Manager Proxy does the job. Fairly easy to locate.

On the STS host, if you need to restart the service, you are not in luck. It took me a while initially. I just could not locate any service that starts with "One Identity ...".

To do so, search for "Redistributable Secure Token Server" instead.


Weird and inconsistent naming convention indeed!


.

One Identity Cloud Access Manager - Notifications

I found a good feature in One Identity Cloud Access Manager today - Reminder to turn off detailed message logging.

So I was debugging something yesterday and totally forgotten to turn off detailed message logging. I was at admin console a while ago and I saw a new notification on the top right of the dashboard.

Being curious, I took a look and was reminded to turn off detailed message logging as "Keeping detailed message logging turned on impacts performance".

Not a hard feature to implement. But I seldom see this in other products. Good reminder to my team which is currently busy with their little product development.

.

One Identity Cloud Access Manager - Database Snapshot

Cloud Access Manager provides a utility feature for customers to download a snapshot of the CAM database. 

This could be helpful for raising a support ticket. Other products have similar feature to capture a snapshot of the current configuration. However, none is as convenient as this.

Pretty good!


.

Accredited Consultant

ForgeRock Access Management Accredited Consultant

ForgeRock sent me this yesterday. Nice gesture. I take.


Just few weeks ago, I was told by one of my consultant (btw, he is ForgeRock Identity Management Accredited Consultant) that a young punk from another company boasted to him that he is ForgeRock Access Management certified.

Nothing to be great of. Uncle me accredited keeping a low profile here.

When you are capable, you just dig in and work harder. You don't need to show off. Customers have bright eyes.

.

Magic Quadrant for Full Life Cycle API Management (2018)

The latest magic quadrant for Full Life Cycle API Management has been released a month ago. I just received a mailer from CA. 

Well done, CA Technologies remains in the Leaders quadrant. Not sure why Google (Apigee) is so high up, as we don't see much competition from them in this region. As long as you are totally cloud-based in this region, especially Singapore, you're basically out of the game. I'm saying if you are looking for large customers. The game is still very much on-premise.

Interestingly, Tyk has made it to the Niche Players quadrant. That's real hard work for a new player who has been in this market for less than 5 years. Really impressive! Kudo to the Tyk team!


.

What API is not about and about?

My team has been covering a potential customer for a while with regard to a API Gateway deployment. POC done. Presentation done. Then a competitor came in to disrupt ... it's common. Singapore is a saturated market. There are finite number of customers to chase after. If customers don't come to you and you hear that they are looking at a product from your competitor, you quickly go in to disrupt the market. 

If you are the product principal and you have the time and energy and you have a willing partner, then you will do this sort of things. I'm someone that is not too keen to do this. The pie is always big enough for everyone, that's my view. If you go in to disrupt the market, you're usually going into a price war. It's not about product superiority anymore. More importantly, the quality of the consultants are not considered.  

This is a vicious cycle. Nothing good will come out of it. Customers think they are getting a good deal. I say they are mostly blind. Partners/Vendors are not stupid either. If a partner bids with a superbly low price, you think the partner will give you his best consultants? You pay peanuts, you get monkeys. As simple as that. 

Anyway, I went in to make my last presentation. I only showed 2 slides. 

API is really not about Secure File Transfer, Security, Throttling and Message Queues. These are given. If a gateway has no such features, they will never get a chance into the board room in customers' place. 

Honestly, 80-90% of the API products out there in the market have similar features. All are equally good. Why? For most customers (80%), they only use a subset of features (20%). I can confidently say most API products meet the requirements of most customers. 

API is really about People - Customer & Vendor. 

I know that the competitor is partnering with a SI that does mostly systems related work - PAM, Secured File Transfer. 

In our experience, these type of people are only used 20% of the total time spent in a typical API projects. They are utilized during the Build phase and the Maintenance/Patching phase. In Build phase especially, my own experience told me that my API Consultants are of no use here. They simply do not understand networking, firewall, zoning, routing, high-availability, scaling, hardening, vulnerability assessment, security scanning. This is where a trained Systems Consultant is useful. They will be able to work with the Network Security team from the Customers' sides effectively. 

But as soon as the Build phase is over, the Systems Consultants become totally "useless". This is where API Consultants come in. They are there to help Customers with "Discover, Simplify, Transform, Add Values". In short, to provide API Design services. This usually takes up 80% of the total time spent in typical API projects.

API is all about proper thought process. It's not a simple "Oh, let's create a new API and map it 1-to-1 with your backend service". An intern will do! Why spend so much money?

.

SAML-message with NotBefore

I was integrating our corporate JIRA with One Identity Cloud Access Manager via SAML2. I chose the plugin from Resolution GmbH. 

Integration was a breeze. Their wizard is brilliant! I got the whole integration completed successfully within 15 minutes.

One issue I encountered was - "SAML-message with NotBefore xxx is not valid yet."

This was quite easily resolved. Do make sure the IdP (One Identity Cloud Access Manager) and SP (JIRA) are sync-ed with the same NTP server.

The error disappeared as soon as I have NTPd configured on my JIRA server.


.

One Identity Cloud Access Manager - Backend SSO Method

Out of the box, One Identity Cloud Access Manager provides the traditional credential SSO methods like IWA (Integrated Windows Authentication) and HTTP Header. I like that it provides Form Fill, though I would keep this as a "hidden secret weapon" in the event customers have some legacy applications that I have no choice but to perform password replay.

In the same box (yes, same box. some other vendors require you to add-on :>), the trendier Federated SSO Methods like SAML2 and OpenID Connect/OAuth 2.0 are provided. No additional add-on. No additional cost. SAML2 IdP is enabled out of the box. OpenID Connect Provider is enabled out of the box. Very easy to integrate with any 3rd party federated clients. 

I was trying to integrate our in-house JIRA via SAML2 and it took me less than 15 mins for the first try. 

. 

One Identity Cloud Access Manager - Not Authorized

I was playing with One Identity Cloud Access Manager this afternoon and hit into "Not Authorized - Sorry, but it seems as if you're not authorized to access the selected application".

This is what I have observed. If the administrator configured a new protected application after you have logged in to the Application Portal (a one-stop landing portal for you to single sign-on to multiple protected backend applications), the new application link (e.g. Web SVN (Management)) will immediately appear on the portal.

However, as soon as you click on the new link, you'll hit into "Not Authorized" error.

To workaround this, log out and log in again. The new link is now accessible.


Simple!

.

CA SSO Access Gateway

I met with a potential customer today and he was interested to deploy CA SSO Access Gateway in the DMZ, while keeping CA SSO Policy Server in the Intranet.

He was not sure what were the possible integrations provided by CA SSO Access Gateway with his backend applications.

I showed him the diagram below. Self-explanatory.

• SAML (Federation)
• REST/JSON 
• OpenID Connect
• HTTP Header (Web Agent)

.

Password Meter

We have been in the Security & Identity business for a long time. Recently, we have been engaged in a number of Identity Management projects in the Asia region.

In some projects, we build our own Access Request Portal on top of Identity Management products out there in the market.

Reason is simple - To Increase User experience!

From our observation, some IDM products are just too complex, too heavy; some IDM products lack features required by customers.

And since more and more IDM products are exposed by REST, it makes it compelling to build our own Access Request Portal.

We build a Access Request Portal that is lean and fast. No unnecessary features just to make Gartner happy. (You don't agree? Ha! )


In one of our projects, the CIO took a look at the User Profile tab and explore how we build the Password module. He didn't like what we have built. He has a strong view on what is a Strong Password. He even sent my team this to read up - Science Can Help You Choose a Better Password. Complexity isn't as important as you think.

So we stripped the original Password module and incorporated Password Meter.

Password Meter is pretty cool. It will "score" your password quality as you type in and give you advice immediately.

My team did it better! As Password Meter is open-source and published in GitHub, we enhanced it to support multi-languages.  

What's next is for the team to tidy up the sources and offer them back to the community.

That's the beauty of open-source! Some just don't get it. Money is never enough. 

.

One Identity Manager - Access Request History

Having implemented numerous IDM projects and seen multiple IDM products, all will provide a Access Request History view in a table format.

Besides providing the default table format, One Identity Manager provides a timeline view. 

Important feature? No. Wow feature? Yes, indeed. I like it a lot personally.

. 

Tyk API Designer

I was playing around with Tyk API Designer the other day and I noticed there are 2 ways to edit an API - API Designer or Raw API Definition.

  

API Designer View

Raw API Definition View

I'm not too sure you belong to which camp. I have team members who belong to both camps. The juniors will definitely prefer the API Designer view, while the seniors will go for the Raw API Definition view.

When we go to customers' sites, it's quite obvious. Customers will prefer API Designer view, while my team will most likely configure using the Raw API Definition view, especially when there are a lot of APIs to configure.


That's cool!

.

Data-model driven API - Good or Bad?

I came across this blog from Tyk - Your data model is not an API, while I was lying on my bed ready to sleep. 

To me, this is taking a dig at CA Live API Creator. :)

Very insightful article, indeed. This is coming from API consumers' (Customers) perspective, rather than from API developers.

Sometimes, we keep forgetting who our pay-masters are. This is why I keep reminding my team - they have to make our customers happy, not me.


I totally agree with the conclusion:

• Your API consumers want an API that is familiar to them, not to your implementation team 
• Your API consumers want an API that is fast to integrate for them, not for your internal team to implement 
• Your API consumers want an API that is flexible by offering capabilities to get things done, without creating lots of HTTP calls and stitching data together to achieve their desired outcomes 

Finally, it is important to remember that 5 hours saved by your team may cost 10s to 100s of hours by your API consumers. ... A great API design makes it easy for API consumers by hiding internal implementation details, leading to faster integration and happy developers.

It is definitely not easy to design an API.

From our experience with a large insurer in Singapore, we know it could take weeks to design a useful API. Sometimes, we could end up having heated arguments with our customer's application teams, because we do not agree with certain design methodology. But the end result is great! There's nothing wrong with disagreements, as long as it's for the good of the project.


.

Kong CE 0.13.0 - Services and Routes

Kong CE 0.13.0 has a new feature - Services and Routes.

The introduction of Services and Routes as new core entities. Those entities replace the “API” entity and simplify the setup of non-naive use-cases. They provide better separation of concerns and allow for plugins to be applied to specific endpoints.

With the introduction of Services and Routes, duplicates plugin definition can be avoided.

This is much cleaner and leaner in operation, especially if we are talking about tons of APIs in the micro-services world. Detailed read here.



.

PAM ranking in Kuppercole

During meet-up with customers, when we introduce One Identity PAM (either the older TPAM or the newer SafeGuard), we'll more than likely be directed to this following ranking. The one below is from Kuppercole. Some customers use Gartner.

In any case, One Identity ranking for PAM is not fantastic, especially for SafeGuard as it is a total rewrite. It is primarily due to the fact that the product line for TPAM is aging. With SafeGuard, you can add in REST, Analytics and more importantly, sexy UI. (Have you used TPAM before? Oh man, the UI is shitty! But honestly, it works like a charm!)

Interestingly, One Identity bought Balabit (https://www.balabit.com/) few months ago. The session recording feature in SafeGuard is OEM from Balabit. With Balabit under the umbrella of One Identity, more features from Balabit will be added to SafeGuard. The most exciting one will be Privileged Account Analytics.

Let's see how will the ranking be in a year's time! :)

.

APIs Design, Development & Management

I have forgotten where I have captured this diagram, but it really reflects the truth on the ground.

90% of APIs rely on developers to code! Of which, 60% rely on developers to create and manage their own APIs. Only a tiny 23% did developers use a proper API Management tool to create and manage their APIs.

There is still a big market for API Management tools.  :)


.

CA SiteMinder - Drawbacks

Common to all Single Sign-On products that have been out there in the market for the past 10 years, most provide agent-based solutions. 

Agent-based solutions have been working like a charm. But they have been a pain operationally.

1. Cost of Agent management grows as the deployment grows
2. Application owners and developers concerned about time to deploy
3. Need to coordinate with application owners for upgrades

These are very true points from our experience deploying multiple large-scale SSO solutions in the past.

One of the workaround is not to deploy agent on every application server. Instead, deploy a Reverse Proxy farm (RP farm). This is a centrally controlled farm with Apache HTTPd server with agents deployed.

Of course, bad points aside, there are benefits to having agent-based solutions.

1. Broad application coverage
2. Security
3. Scalability

.

AliCloud ECS Web Hosting

I have been playing a bit of Tencent Cloud and Ali Cloud lately due to some projects in China. 

And I was experimenting how easy it is to host a sample web site on Ali Cloud. It should be a 5-mins job. It took longer for me last night.

I kept hitting into this error - "This site can't be reached".

I ssh into the server and found there wasn't any iptables enabled. The Apache HTTPd daemon was up and running. 

I just couldn't figure out why. I google for some clues.

Pretty good documentation here from Alibaba Cloud documentation team. (Yes, pretty surprised! The English was good.)

• https://www.alibabacloud.com/getting-started/projects/deploy-and-host-a-wordpress-website
• https://www.alibabacloud.com/help/doc-detail/27550.htm

The steps by steps were clear and concise. It made me look like a clown for not being able to make my sample website work!

I had no choice. I paid 1 year upfront, so I must get value out of it. I raised a support ticket and while I was waiting for a response, I came across a sub-menu "Security Groups". No harm taking a look.

Bingo! The "firewall" is not configured within the server via the iptables. It is to be configured via the ECS console.

I added a new rule to accept Inbound HTTP 80 traffic and that did the trick!

What's the point of documenting so much when the essential point is not covered?

.

Identity Governance of Unstructured Data

I received an email from SailPoint this morning. It has just published a white paper on how to secure access to unstructure data. 

It examines each of the organizational and technical barriers to securing unstructured data and provides practical advice on how IAM managers should respond to this risk. It explains how identity governance can be extended to better secure unstructured data to meet privacy and compliance requirements.

So far, there are only 2 products that can govern unstructured data. 1 from SailPoint (I think they bought over a product called WhiteBox). The other is One Identity Manager - Data Governance.

Identity Manager - Data Governance Edition protects your organization by giving access control to the business owner rather than the IT staff. The business owner can grant access to sensitive data. With the Identity Manager restricted access functionality, you define access policies for your organization. You have the power to analyze, approve and fulfill unstructured data access requests to files, folders and shares across NTFS, NAS devices and SharePoint, ensuring that sensitive, unstructured data is only accessible to approved users.

The primary targets are Windows Shared Folders/Files, especially within SharePoint.

I know there is already a project on-going in Australia that adopts Identity Manager - Data Governance Edition. Wishing them a successful implementation!


In my opinion, Data Governance is quick to win (for Sales), but very hard to exit (for Implementers).

Will I take this up? :)


.