Identity Management with Active Directory - Part 1

Introduction

This post discusses managing identities with Active Directory and Access Management with Microsoft Authorization Manager.

This gives a small introduction of Active Directory components used for Identity Management and this also explains ideal scenarios in Identity Management and Access Management.

What’s Identity Management?

Identity management is a set of systems which manages the users, their accesses, roles etc for enterprises, with significant implications to security and risk strategy. And it is not just a technology discussion as much as it is a process about the role of “roles” in enterprises — how people and applications access.

Identity management is comprised of both technology components and business strategies and policies

The benefits of identity management solution can be gained by consolidating identity, policy and infrastructure management into a single centralized solution, thereby saving time and money in administrative overhead, lowering training requirements and increasing productivity.

Why Active Directory

Since Active Directory is an integral part of Windows infrastructure and networking, it has already become an important and irreplaceable component within the IT environment. And many organizations have already made investments to migrate to Active Directory and deploy it companywide. It makes good business sense to fully leverage those investments by extending Active Directory to other platforms, versus the cost of trying to maintain different solutions for different platforms.

UNIX, Linux and Mac platforms are the second largest base of systems in many large companies, so the ability of Active Directory in integrating with these systems made it a best choice in Enterprise Identity Management.

The solid support from Microsoft – the largest software company in the world is also one of the main reasons to use Active Directory. Microsoft is firmly committed to Active Directory and continues to invest in enhancing and expanding its capabilities.

Considering these strong reasons, Active Directory would be an excellent choice to provide centralized, cross-enterprise directory and infrastructure services for Identity Management in enterprises. The only demerit is that, it does not include capabilities to easily support non-Windows client systems. However, the solution landscape has recently changed, and there is now a way to extend the features and benefits of Active Directory to non-Windows systems and applications. Centrify’s DirectControl suite includes all of the necessary software to allow UNIX, Linux, Mac and Java environments to use Active Directory as a central user identity, infrastructure and policy engine.

And Active Directory’s highly secure, token-based authentication, using industry standard Kerberos, can be used across Windows, UNIX, Linux, Mac and Java platforms. This results in a single sign-on experience that spans all Windows, UNIX and Linux systems.

Active Directory is based on proven enterprise-ready technologies – LDAP for directory services and Kerberos for secure authentication. Microsoft has uniquely combined the strengths of these two technologies to best leverage the open extensibility of LDAP and the highly secure, ticket-based authentication of Kerberos.

For example, a key advantage of Active Directory’s ticket-based authentication system is that, once the user has successfully logged into a system, his or her credentials can be used to automatically access other systems and applications based on established security access rights.

Microsoft’s Group Policy capability extends Active Directory beyond identity and access management to policy and configuration management, which is crucial for meeting regulatory requirements. Administrators have full multi-level control over applying policies to accounts and systems through the Group Policy system.

Active Directory is highly scalable and secure. Active Directory’s distributed model automatically replicates information to other sites, even over slow links, thereby ensuring both fault tolerance with automated failover and increased performance through automated discovery of the closest Active Directory server.

Active Directory has following advantages:

The followings are some of the key advantages of Active Directory.

 ·         Centralized user and group account management

It can store the organizational relationships such as manager - worker relationships.

 ·         Full control over password management

This include password aging, password complexity, and forced password resetting, as well as the ability to temporarily disable an account. Active Directory can also easily manage hours of use for each user and computer.

·         A distributed model for high availability, increased performance and organizational compartmentalization

It has the ability to manage cross domain relationships and trusts. This means that users in each part of the organization can always access their systems, even in the event of a server failure.