Courion Blog

If you work in the IAM space, you should already know who Courion is – being one of the top password management and provisioning vendors for the past decade and now having morphed into a full Access Assurance offering with role management and compliance solutions.

Well, in case you haven't seen it, Courion now has a blog. And so far, there's a lot of good content being written there. It appears to be a nice combination of industry analysis, business-value, and technical insight that remains on-topic. ...thought you might enjoy the pointer.

ADAM Pass Through Authentication to AD

A few years ago, I wrote a post that referenced ADAM passthrough authentication to Active Directory without providing much info. Since then, people searching on that topic have found themselves on my blog (probably hoping for more information). So, I thought I'd cover it in more detail.

Disclaimer:
I haven't actually done this in a few years, so my information may be out of date, but I'm sure someone will speak up if I'm wrong. ...they always do ;) I will assume you know what ADAM is, why you'd use it, where to get it, and how to install & configure it.

Why:
A few quick scenarios where pass through authentication is useful:

1. You want to put a portion of your Active Directory users into the DMZ for authentication by publicly-facing applications, but you don't want to expose an AD DC in the DMZ. In this scenario, the app can leverage a DMZ'ed ADAM for authentication. ADAM will still need to make a request to a DC, so AD is partially exposed, but in a more controlled way.
2. You want to leverage AD credentials for application authentication, but the app wants to store information about users that is not currently in AD and you don't want to extend the schema. You could stand up an ADAM instance, extend its schema however you want, enable passthrough authentication, and point the app to ADAM instead of AD.
3. You have an app that is used by people that have an AD account AND people that don't. And your app only accepts a single authentication store.

Here's what you need to know about using ADAM for pass through authentication to AD:

• The ADAM installation process gives you the ability to import the schema for UserProxy objects from a file called ms-userproxy.ldf – you'll need to import that object to enable the passthrough functionality. You can do it after the install if you need to.
• For an account to perform a passthrough authentication (aka a bind redirection) from ADAM, the account must be configured as a UserProxy object. A standard user account can not authenticate through to Active Directory.
• The UserProxy object has an attribute called ObjectSid, which is critical to this functionality. For passthrough authentication to work, the account's ObjectSid must be populated with the SID of the associated Active Directory user account (this will actually work with any security principal object).
• When a UserProxy account attempts to bind to the ADAM instance, ADAM recognizes the account as a proxy and forwards the authentication request to Active Directory.
• Passthrough authentication only works for accounts that live in the forest to which the ADAM server is joined (or to a trusted domain or forest). So, that's how ADAM knows where to send the request.
• Passthrough authentication only works with simple binds. So, the password is being passed to ADAM in clear text. You'll want to be aware of that and use SSL as appropriate.

That's pretty much all you need to know to get passthrough authentication working. As I recall, it's that simple.

Comments/Corrections:
PLEASE leave a comment if you're here because you want to do this for a reason I haven't mentioned above or if you have additional information. Am I wrong? Did I leave anything out?

More Information:
Microsoft refers to this as Bind Redirection for ADAM Proxy Objects. So, that's the terminology you'll want to use to find more information.

IAM as a Service - 20% of the Market

Today, Gartner identified their Identity and Access Management predictions for 2009 and beyond. First on the list is:

By 2011, hosted IAM and IAM as a service will account for 20 per cent of IAM revenue.

I've discussed managed services for Identity Management in previous posts. I think it's a natural progression. Identity and Access Management is an extremely complicated technology-set. Any given IT shop's ability to maintain the right skills to support an IAM environment is probably more costly (in effort and dollars) than outsourcing that function to specialists. And this certainly appears to be the beginning of an Era of Cost where cost has moved up the list of decision influencers.

I'm honestly a bit surprised and impressed to see Gartner come out on this one. I tend to think of them as a bit more conservative – making predictions that follow a trend that has already begun. Has this trend started to take shape or is Gartner a bit agressive on this one?

Sara: I’m sort of a hero

In addition to keeping up with general topics, there are a number of specific blogs that I try to stay on top of. One is CSI's Security Provoked. where Sara Peters just posted two entertaining stories about how her work in security has left her less secure. I can relate.

Last night, I wasted four hours manually removing a virus that I pretty much knew would come back, but I had to try just to see if I could identify the how-to. (Kudos to Microsoft for XP's restore feature building a restore point without me having to enable it.)

If you've ever purposely went to a phishing site or intentionally opened an email attachment that you knew was malicious, you might want to give it a read. And next time it goes bad, just remind yourself that you're sort of a hero.

...and good job Kristen pushing Sara to deliver the goods!

Security Bloggers Network

The Security Bloggers Network (SBN) is a network of security professionals. Many are briliiant. And many are opinionated. That makes for an entertaining and informative combination. If you're in the security field, the SBN is a great place to go each day to stay up-to-date on real world security trends, technologies, and experience.

NetVision believes in the value of the SBN and its members. We backed that up by signing on in early 2009 as an advertiser. Go check it out. And Happy Reading!

Project Communication

Matt P makes some good points about project communication.

I agree with each of his four bullet points. And I would add that when they collectively fail, the #1 reason is that people aren't being honest with each other. Sometimes, consultants aren't honest with clients about lack of expertise or resources. Other times, someone on the client side isn't being honest with the consultant because of some defensiveness (they don't want to admit inability to get something done, or they're playing CYA).

The reality is that we're all human. Clients shouldn't expect consultants to be super heroes. And if both sides set realistic expectations and allow for faults, imperfections, and mistakes, it's much easier to achieve an honest dialog toward success. Consultants need to avoid both (1) the arrogant assumption that client personnel is less capable and (2) the assumption that client personnel should know everything they do. And clients need to be forgiving of human/imperfect consultants who can't possibly know everything about everything.

There is a very human side to project management. It's not just charts and methodology. It's about making the problems, roadblocks, and challenges expected and OK. ...instead of trying to cover them up. So, don't just have regular status meetings, demand open and honest dialog and create an environment where it's OK to make mistakes. It's all part of the process.

NetVision - Actionable Intelligence

When I last wrote about SIEMs and Actionable Intelligence, I promised to tell you how NetVision sees the problem. ...post available at the NetVision blog:

Actionable Intelligence

Verisign's File Vault

Today, I configured my File Vault at Verisign's Personal Identity Portal.

Secure

If you read this blog, you probably know that nothing is 100% safe. And you probably distrust this type of offering. But, Verisign knows encryption as well as anyone. Verisign spun off from RSA (then RSA Data Security) in 1995 with some of RSA's public- and private-key cryptography technologies. They're really good at authentication and encryption which are exactly the two specialties I expect from an online storage vendor.

Convenient

They're giving you 2GB of storage space free - it requires Two-Factor authentication to get in and encrypts data on the back end. And it's an easy-to-use UI with no software install. It's probably a better option than backing up my docs on a USB key (subject to damage and loss) or using some other non-security-focused vendor.

Smart Business

I also like the business model. We all wonder how OpenID providers will make a profit. Verisign seems to be ahead of the pack in providing value-add to users. You get more than just an OpenID credential. You get strong authentication, secure storage, and a personal identity page (probably the least interesting, but still somewhat fun and on the right track).

So, they can sell 100 million tokens to customers who get real value above and beyond reducing the number of credentials they need to remember. And of course, Verisign can license this technology to banks, governments, or anyone else who wants to resell online safety deposit boxes along with secure two-factor authentication solutions under their own brand. Paypal already re-brands the token to protect their customer accounts.

I could easily imagine brick and mortar banks handing out tokens with every new on-line bill pay account and/or offering a virtual safety deposit box to every physical box customer. It's value for the customer and a business model that makes sense. I'd even pay for a new token every few years just to maintain a secure place to archive my important files.

I knew there was a reason I never setup that Amazon S3/JungleDisk account.