| <?xml version="1.0" encoding="UTF-8"?> |
| <!-- |
| Licensed to the Apache Software Foundation (ASF) under one |
| or more contributor license agreements. See the NOTICE file |
| distributed with this work for additional information |
| regarding copyright ownership. The ASF licenses this file |
| to you under the Apache License, Version 2.0 (the |
| "License"); you may not use this file except in compliance |
| with the License. You may obtain a copy of the License at |
| |
| http://www.apache.org/licenses/LICENSE-2.0 |
| |
| Unless required by applicable law or agreed to in writing, |
| software distributed under the License is distributed on an |
| "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| KIND, either express or implied. See the License for the |
| specific language governing permissions and limitations |
| under the License. |
| |
| --> |
| <document xmlns="http://maven.apache.org/XDOC/2.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" |
| xsi:schemaLocation="http://maven.apache.org/XDOC/2.0 http://maven.apache.org/xsd/xdoc-2.0.xsd"> |
| |
| <properties> |
| <title>IAM Scenario</title> |
| <author email="dev@syncope.apache.org">Apache Syncope Documentation Team</author> |
| </properties> |
| |
| <body> |
| <section name="Identity and Access Management - Reference Scenario"> |
| |
| <p style="text-align:center;"> |
| <img src="docs/images/iam-scenario.png" alt="IAM Scenario" width="700"/> |
| </p> |
| |
| <p> |
| The picture above shows the tecnologies involved in a complete IAM solution: |
| <ul> |
| <li> |
| <strong> |
| <em>Identity Store</em> |
| </strong> |
| <br/> |
| (as RDBMS, LDAP, Active Directory, meta- and virtual-directories), the repository for account data |
| </li> |
| <li> |
| <strong> |
| <em>Provisioning Engine</em> |
| </strong> |
| <br/> |
| synchronizes account data across identity stores and a broad range of data formats, models, meanings and |
| purposes |
| </li> |
| <li> |
| <strong> |
| <em>Access Manager</em> |
| </strong> |
| <br/> |
| access mediator to all applications, focused on application front-end, taking care |
| of <u>authentication</u> |
| (<a href="https://en.wikipedia.org/wiki/Single_sign-on" target="_blank">Single Sign-On</a>), |
| <u>authorization</u> |
| (<a href="https://oauth.net/" target="_blank">OAuth</a>, |
| <a href="https://en.wikipedia.org/wiki/XACML">XACML</a>) and <u>federation</u> |
| (<a href="https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language" target="_blank">SAML</a>, |
| <a href="https://openid.net/connect/" target="_blank">OpenID Connect</a>). |
| </li> |
| </ul> |
| </p> |
| |
| <hr/> |
| |
| <subsection name="Aren't Identity Stores enough?"> |
| One might suppose that a single identity store can solve all the identity needs inside an organization, but few |
| drawbacks are just around the corner: |
| |
| <ol> |
| <li>Heterogeneity of systems</li> |
| <li>Lack of a single source of information (HR for corporate id, Groupware for mail address, ...)</li> |
| <li>Often applications require a local user database</li> |
| <li>Inconsistent policies across the infrastructure</li> |
| <li>Lack of workflow management</li> |
| <li>Hidden infrastructure management cost, growing with organization</li> |
| </ol> |
| </subsection> |
| </section> |
| </body> |
| </document> |
