Gluu AD/LDAP Synchronization - Part IV

When configuring AD/LDAP Synchronization (Cache Refresh), it is very important to enable "Keep external persons".

Why? Because the administrator "uid=admin" resides in the same organization unit (ou=people) as the imported users from external AD/LDAP.

Be careful.

.

Gluu AD/LDAP Synchronization - Part III

After AD Synchronization (Cache Refresh) was configured, I realized the total number of people imported exceeded the number of actual users we had in office. 

There is a way to filter off the unnecessary users from Microsoft Active Directory. If an AD user is a staff, we will tag this user as a member of "Azlabs Staff" AD Group.

Then we can re-configure Cache Refresh in Gluu Server again -- "Customer Backend Key/Attributes". (Yes, I dislike this tab title. Very confusing.)

Do remember Custom LDAP filter has to be a proper LDAP Query. As such, the memberOf value has to be a full DN. e.g. cn=Azlabs Staff,cn=users, dc ....

Wait for the next Cache Refresh to kick in.

Done.

.

Gluu AD/LDAP Synchronization - Part II

This is a step-by-step configuration guide to configure AD Synchronization (Cache Refresh) in Gluu Server. 

There is a documentation available here, but I find it too generic and at times, confusing. Far too wordy with little graphical illustrations.

Step 1: Source Backend LDAP Servers

Click on "Add source LDAP server"

Fill in the detail for the backend MS AD server

Appears on top-right of screen when "Test LDAP Connection" is clicked

Step 2: Customer Backend Key/Attributes

( This is the screen that I have the most opinion on. Why use "Customer", not "Source"? Why "Source" Attribute? How about the rest? They are not from "Source"? It's not consistent.)

Take note that the above should reflect how a Person object is to be fetched from MS AD 

Step 3: Cache Refresh

Make sure "Keep external persons" is enabled

As per documented, "This will allow your default user 'admin' to log into Gluu Server after initial Cache Refresh iteration. If you do not enable 'Keep External Person', your 'admin' user including all other test users will be gone after first Cache Refresh iteration."

Left column refers to Source; Right column refers to Destination

Make sure "Cache Refresh" is enabled

Step 4: Manage LDAP Authentication

Remember this diagram from previous post?

What we have done so far is for (2) to work.


For (3) to work, we need to navigate to Configuration > Manage Authentication. Scroll to the bottom of the page, click on "Add source LDAP server".

Add MS AD detail. Click "Test LDAP Connection" to ensure connection is OK

Done.

.

Gluu AD/LDAP Synchronization

In Gluu Server, there is a concept called AD/LDAP Synchronization.

AD/LDAP Synchronization, a.k.a. Cache Refresh, is the process of connecting one or more existing backend LDAP servers, like Microsoft Active Directory, with the Gluu Server's local LDAP server. Syncing people and attributes from a backend server speeds up authentication transactions. It is possible to perform attribute transformations, changing the name of attributes, or even using an interception script to change the values. Transformations are stored in the Gluu LDAP service.

How does authentication take place?

Because there is no password stored in the "local copy" of the Gluu LDAP, authentication has to take place on the actual Microsoft Active Directory instead.

1. User attempts to authenticate with Gluu Server
2. Gluu Server searches if the user exists in "local copy" of the Gluu LDAP
3. If yes, Gluu Server will authenticate against the actual MS AD server with the username and password


Slightly different architecture from other SSO products.


.

Gluu Unexpected Error - login.errorSessionInvalidMessage

I was testing Cache Refresh in Gluu Server 3.1.6 with Microsoft Active Directory being my backend source server. 

After configuration, I hit into the following error when I wanted to simulate an end-user login.

So I went to /opt/gluu/jetty/oxauth/logs/oxauth.log and saw the following debug log:

(AuthorizeAction.java:253) - Failed to get CustomScriptConfiguration. auth_step: 1, acr_values: auth_ad_server

I'm stuck! No way to log in either as Gluu Administrator or end-user.

My last resort was to tweak the configuration database directly. In this case, OpenDJ directory server is the configuration database that Gluu Server is using.


The entry to search for looks similar to dn: inum=@!1E3B.F133.14FA.5062!0002!4B66.CF9C,ou=appliances,o=gluu

Quite obvious the configuration is screwed. I have no idea how auth_ad_server got set as the values for oxAuthenticationMode and oxTrustAuthenticationMode when it's enabled value is false!

Manually set them back to auth_ldap_server. Restart oxAuth server. Done!

The login page is back.

.

The Scope of IAM

The scope of IAM is getting bigger and bigger ...

.

No SSO

Many times during SSO presales or tender presentations, we will be asked the same question again and again - "What if the SSO infrastructure goes down?"

Ting ... Ting ...

Most of us who have been in this field long enough will respond that high-availability has to be in place for such a critical infrastructure. One could go further to elaborate about the the reliability of cloud infrastructure like AWS scale-out, AWS availability zone failover, VM Fault Tolerance etc...

Nothing beats application building its own local authentication as a last option.

It's a fact.

.

Implementing Web Policy Agent on with AWS - Part II

We know a Policy Server consists of 2 very important components - Authentication and Authorization.

The following diagram is a typical deployment diagram of a traditional SSO architecture with a Web Policy Agent deployed on a web server, that communicates with a Policy Server on the backend.  

How do we achieve the same in AWS world?

1. Authentication will be performed at the Login Page which integrates tightly with Amazon Cognito. (By the way, the pricing for Cognito is quite attractive!)

2. Authorization will be performed at the "Policy Server", which I discussed in my previous post.

In fact, we can do better than that for the Authorization.

In the modern world, API is everywhere. We can have a API Gateway that exposes a isAuthorized API. The "Policy Agent" will "ask" the API Gateway if a user is authorized or not.

In additional, we can implement fine-grained authorization by building entitlement microservices.

As long as we introduce a clean interface for the entitlement microservice, customers can own this piece of work to implement their own business logic and plug-in to the authorization framework anytime. 

.

Implementing Web Policy Agent on with AWS

In my previous post on Single Sign-On with AWS Cognito, my team successfully demo a way to implement Cross-Domain Single Sign-On with AWS Cognito. 

There are many ways to implement SSO. For a start, since Azlabs is very familiar with how Single Sign-On works, the team chose to minimize the changes required on existing applications that were protected by traditional web policy agents. 

The assumption is that if any of our customers were to port over to AWS, there is minimal impact during migration. 

How can we achieve this? 

Let's take a look at how traditional SSO works. 

1. There is a Policy Server where A+A (Authentication & Authorization) takes place

2. There is a Web Server where a web application (Web Resource) is deployed

3. There is a Web Policy Agent sitting on the same Web Server intercepting traffic to the Web Resource. 

4. The Web Policy Agent queries the Policy Server for A+A decisions.

Illustration 1

Illustration 2

Let's build a "Policy Agent + Policy Server" concept in AWS!

.

Cross-Domain Single Sign-On with AWS Cognito

We have been exploring how to implement cross-domain single sign-on (CDSSO) on AWS platform for a while.

The underlying user store is using Amazon Cognito User Pools. It provide a secure user directory that scales to hundreds of millions of users.

Using Cognito out of the box, Amazon Cognito lets you add user sign-up, sign-in, and access control to your web and mobile apps quickly and easily. Amazon Cognito scales to millions of users and supports sign-in with social identity providers, such as Facebook, Google, and Amazon, and enterprise identity providers via SAML 2.0.

That's it. In fact, it's mostly mobile-centric and support single domain for single sign-on.

To support CDSSO, we need more components from the AWS family to come into play - AWS Fargate acting as Session Validator, AWS Lambda acting as Cookie Generator/Destroyer  and AWS RDS acting as Session Store.

We demo to a customer yesterday and they were impressed.

To speed up the authentication process, Amazon ElastiCache can be used to replace or complement AWS RDS. That would be our next demo.


.

BeyondTrust Privileged Access Management Platform

I just realized it has been a long while since I last blogged. Have been super busy with new direction with the company and making customers happy.

Today, I tried to source for a PAM (Privileged Access Management) solution for my customer who has his infrastructure on AWS. As such, an appliance-based PAM solution does not make sense.

Then I came across BeyondTrust. Not totally new to me since I have friends working there. But there has been great changes in 2018.

2018 was a game-changing year for the Privileged Access Management market. Lieberman, Avecto and BeyondTrust were all acquired by Bomgar and, in 2019, we will launch the new BeyondTrust. Bringing together these best-of-breed technologies allows us to deliver the most comprehensive PAM solution to date.

Wow! 4-in-1!

Hope to do some businesses with BeyondTrust!


.

SSO Migration in 10 (+3) weeks ... People matters!

I have a long time SSO customer who came back to me after 6 months "ditching" us. Well, the actual fact was a new VP came in and we did not get along well. Anyway, he couldn't deliver after 6 long months and he was out of the game. The old VP called me immediately after she was reassigned  with the SSO infrastructure.

I'm very familiar with their environment and even though there is a lot of customization, I promised the whole migration will only take 10 weeks. Yes, a major jump in software version. A lot of code rewrites. A lot of Java code decompilation as the software has gone closed-source. It was real fun!

I brought in my best team. And we are going live this coming Sunday! (Ok, customer requested to delay go-live for another 3 weeks as there is 1 site that customer would not want to migrate to the new platform. Thus communication with their end-customers is required to shut down that site.)

Last mile and we are talking about Cut-Over Plan yesterday.

I joined in the discussion. Towards the end of the discussion, customer looked at me and asked me if I have any comment. My only request was: "Give me the same set of people who had performed the dry-run weeks before."

It is going to be a real long night this Sunday and a lot of eyes are on the whole team. I told the manager of the application teams not to assign people based on availability (you know, as this is a midnight job, the seniors will always find excuses not to be involved), but based on experience and capability. Don't give someone who has no idea what is going on.

People matters!

One Identity Cloud Access Manager - STS Windows Service

In One Identity Cloud Access Manager deployment, there is a STS host and Proxy host. The proxy host acts as the reverse proxy to protected applications, as well as serving as the Login Page.

On the Proxy host, if you ever need to restart the service, a quick search for One Identity Cloud Access Manager Proxy does the job. Fairly easy to locate.

On the STS host, if you need to restart the service, you are not in luck. It took me a while initially. I just could not locate any service that starts with "One Identity ...".

To do so, search for "Redistributable Secure Token Server" instead.


Weird and inconsistent naming convention indeed!


.

One Identity Cloud Access Manager - Notifications

I found a good feature in One Identity Cloud Access Manager today - Reminder to turn off detailed message logging.

So I was debugging something yesterday and totally forgotten to turn off detailed message logging. I was at admin console a while ago and I saw a new notification on the top right of the dashboard.

Being curious, I took a look and was reminded to turn off detailed message logging as "Keeping detailed message logging turned on impacts performance".

Not a hard feature to implement. But I seldom see this in other products. Good reminder to my team which is currently busy with their little product development.

.

One Identity Cloud Access Manager - Database Snapshot

Cloud Access Manager provides a utility feature for customers to download a snapshot of the CAM database. 

This could be helpful for raising a support ticket. Other products have similar feature to capture a snapshot of the current configuration. However, none is as convenient as this.

Pretty good!


.

Accredited Consultant

ForgeRock Access Management Accredited Consultant

ForgeRock sent me this yesterday. Nice gesture. I take.


Just few weeks ago, I was told by one of my consultant (btw, he is ForgeRock Identity Management Accredited Consultant) that a young punk from another company boasted to him that he is ForgeRock Access Management certified.

Nothing to be great of. Uncle me accredited keeping a low profile here.

When you are capable, you just dig in and work harder. You don't need to show off. Customers have bright eyes.

.

Magic Quadrant for Full Life Cycle API Management (2018)

The latest magic quadrant for Full Life Cycle API Management has been released a month ago. I just received a mailer from CA. 

Well done, CA Technologies remains in the Leaders quadrant. Not sure why Google (Apigee) is so high up, as we don't see much competition from them in this region. As long as you are totally cloud-based in this region, especially Singapore, you're basically out of the game. I'm saying if you are looking for large customers. The game is still very much on-premise.

Interestingly, Tyk has made it to the Niche Players quadrant. That's real hard work for a new player who has been in this market for less than 5 years. Really impressive! Kudo to the Tyk team!


.

What API is not about and about?

My team has been covering a potential customer for a while with regard to a API Gateway deployment. POC done. Presentation done. Then a competitor came in to disrupt ... it's common. Singapore is a saturated market. There are finite number of customers to chase after. If customers don't come to you and you hear that they are looking at a product from your competitor, you quickly go in to disrupt the market. 

If you are the product principal and you have the time and energy and you have a willing partner, then you will do this sort of things. I'm someone that is not too keen to do this. The pie is always big enough for everyone, that's my view. If you go in to disrupt the market, you're usually going into a price war. It's not about product superiority anymore. More importantly, the quality of the consultants are not considered.  

This is a vicious cycle. Nothing good will come out of it. Customers think they are getting a good deal. I say they are mostly blind. Partners/Vendors are not stupid either. If a partner bids with a superbly low price, you think the partner will give you his best consultants? You pay peanuts, you get monkeys. As simple as that. 

Anyway, I went in to make my last presentation. I only showed 2 slides. 

API is really not about Secure File Transfer, Security, Throttling and Message Queues. These are given. If a gateway has no such features, they will never get a chance into the board room in customers' place. 

Honestly, 80-90% of the API products out there in the market have similar features. All are equally good. Why? For most customers (80%), they only use a subset of features (20%). I can confidently say most API products meet the requirements of most customers. 

API is really about People - Customer & Vendor. 

I know that the competitor is partnering with a SI that does mostly systems related work - PAM, Secured File Transfer. 

In our experience, these type of people are only used 20% of the total time spent in a typical API projects. They are utilized during the Build phase and the Maintenance/Patching phase. In Build phase especially, my own experience told me that my API Consultants are of no use here. They simply do not understand networking, firewall, zoning, routing, high-availability, scaling, hardening, vulnerability assessment, security scanning. This is where a trained Systems Consultant is useful. They will be able to work with the Network Security team from the Customers' sides effectively. 

But as soon as the Build phase is over, the Systems Consultants become totally "useless". This is where API Consultants come in. They are there to help Customers with "Discover, Simplify, Transform, Add Values". In short, to provide API Design services. This usually takes up 80% of the total time spent in typical API projects.

API is all about proper thought process. It's not a simple "Oh, let's create a new API and map it 1-to-1 with your backend service". An intern will do! Why spend so much money?

.

SAML-message with NotBefore

I was integrating our corporate JIRA with One Identity Cloud Access Manager via SAML2. I chose the plugin from Resolution GmbH. 

Integration was a breeze. Their wizard is brilliant! I got the whole integration completed successfully within 15 minutes.

One issue I encountered was - "SAML-message with NotBefore xxx is not valid yet."

This was quite easily resolved. Do make sure the IdP (One Identity Cloud Access Manager) and SP (JIRA) are sync-ed with the same NTP server.

The error disappeared as soon as I have NTPd configured on my JIRA server.


.