Identity Management with Active Directory - Part 2

Identity Management with Active Directory

AD User

When using AD as Identity store, each identity in the organization will have a AD User account created in AD. Properties such as organizational hierarchy, membership details, telephone and other contact details etc can be assigned to an AD user account.

AD Group

Groups are Active Directory (or local computer) objects that can contain users, contacts, computers, and other groups. Groups can be nested, that is, a group can be a member of another group.

There are two types of groups, Distribution groups and Security groups. Distribution groups are used to create e-mail distribution lists. Distribution groups are used with e-mail applications (such as Microsoft Exchange) to send e-mail to the members of the group. Security groups are an essential component of the relationship between users and security. Security groups are used to manage user and computer access to shared resources and to filter Group Policy settings.

Security Groups are used to create roles and this will be used at the time of access provisioning.

Authorization Manager (AzMan)

Authorization Manager (commonly known as AzMan) is a general-purpose role-based security architecture for Windows. Azman can be used in any application that needs role-based authorization, including ASP.NET Web apps or Web Services, client-server systems based on .NET Remoting etc.

The benefit of using AzMan is that it enables you to define operations, group them into tasks, and then authorize roles to perform specific tasks. It also provides an administrative console for managing roles, tasks, operations, and users.

AzMan supports platform features such as Active Directory (AD) groups, Windows security auditing, and MMC. AzMan assures the proper integration of system access control objects such as the NT access token and better alignment for future Windows access control features such as provisioning and entitlement engines.

Identity Management Life Cycle

When a new employee is recruited in an organization, an identity is created in Active Directory in the form of AD user account. All the roles will have corresponding AD Security Groups created.

When a new role is created in the enterprise application, a corresponding AD Group will be created in AD. And in AzMan policy store, tasks for that particular role will be created.

The provisioning will be done thru a provisioning application which takes the user’s request for access and route the request thru a pre-defined workflow (which is developed and maintained by BizTalk server or any custom .net application built using Windows Workflow (WF in .net framework 3.5). After the approval the user’s AD user account will be added in the corresponding AD Group by the provisioning application using LDAP.

When the user ask for an access in the enterprise application, the Access Management module which used to check the access for the user for the requested functionality will use the AzMan to verify his access rights to the requested functionality.

The Access Management module can be de-coupled from the application logic and can be a stand-alone application. This will give a benefit of a centrally managed Access Control mechanism. And this will help if there is a need of any other way managing access/identity other than AD/AzMan for some set of non-Microsoft applications.