1. Secure Connected Infrastructure
Identity Management
Allan Hvass
Senior Consultant
Microsoft Services

2. Identity Management Challenges
Directories everywhere
Too many passwords
Passwords are weak
Unmanageable security
Allowing some outsiders access
Reduce costs through directory integration
Increase productivity with single sign-on
Reduce risk through strong authentication
Strengthen security with centralized management
Extend the trust model

3. Secure Connected Infrastructure
Secure Network Connectivity
Secure Internet connectivity (MSA & ISA)
Secure remote access (VPN, IAS)
Secure wireless networks (PKI x)
Integrated Solution for Identity Management
Directory Services (AD & MMS)
Authentication (PKI, Kerberos, Passport)
Authorization (ACLs, Roles, Federation)
Policy based management (GP, and GPMC)
Comprehensive Security Management & Operations
Tools (MBSA, MSUS)
Guidance (MOC, PAGs, Security Best Practices)
Services (MSQS, PSS, & professional services)

4. Active Directory Common store for identity management Wireless LAN VPN
Gateway
Exchange
SQL
Server
File Sharing
LAN
UNIX
App
Common store for identity management
Application and NOS identities
Repository for security principles
Integrated policy-based management
Scales to the Internet
Web
Services
Active Directory
Identity Repository

5. Flexible Authentication Mechanisms
Authenticate
Internet
Smart Card
X.509 / SSL
Password
Biometrics
Active
Directory
Windows 2000
Server
Applications
Computers
Devices
Files
People
Credentials
Many other authentication options than passwords

6. Authentication Services
Wireless LAN
VPN
Gateway
Exchange
SQL
Server
File Sharing
LAN
UNIX
App
Integrated Security Services
Kerberos Authentication & Authorization
Integrated PKI for authentication and encryption
Interoperable with UNIX via Kerberos & SFU
Interoperable with mainframes via HIS
Interoperable with Netware via SFN
Web
Services
Active Directory

7. Options for Single Sign-on
Single Sign-on Experience
True SSO
Single Identity
Multiple Identities
MMS can help keeping multiple directories synchronized, easing the authorization process
Central
Authentication
Distributed
Authentication
Password
Synchronization
Client
Managed
Strategy
Short
Lived
Long
Lived
Server
Side
Client
Side
Examples
NTLM
Kerberos
Passport
Certificates
SfN
SfU (pSync, NIS)
HIS
Credential Manager (XP)
Extend to multiple directories with trusts

8. Directory Integration and Synchronization
Wireless LAN
VPN
Gateway
Exchange
SQL
Server
File Sharing
UNIX
Application
LAN
Web
Services
Microsoft Metadirectory Server:
Reduces the cost of managing ids
Simplifies directory synchronization
Automates user account provisioning
Active Directory
Non-AD
Directory
Active Directory

9. Windows 2000 Authorization
Owners manage resources
Access control lists (ACLs)
Granular permissions & scope, Inheritance
Admins manage users
Groups
Indirection & nesting simplify ACL management
Privileges
System-wide operational permissions
System enforces access control
Impersonation & delegation

10. Integrated Management
Delegate Management Tasks to Office Admins
Policy: Use Standard Security Template
Company
Users
Machines
Applications
Marketing
Extranet
Devices
Restrict Access to Color Printer
Must Use Smart Card
Integration with Active Directory provides a central consistent place to manage user and resource security

11. Active Directory Security Administration
Forcing security settings to all users and systems with group policies
Delegation of administration
Grant permissions at organizational unit (OU) level
Who creates OUs, users, groups, etc.
Fine-grain access control
Grant or deny permissions on per-property level, or a group of properties

12. .NET Server Improvements
Directory Services
Kerberos transitive trusts with constraining
PKI cross-certification and qualified subordination
Metadirectory Services optimized for multiple forests
Authentication
Passport authentication
Smart Cards improvements
Protocol transition
Delegation improvements
Authorization
Authorization Manager (roles, tasks, rules, scope)
Management
Group Policy Management Console

13. Identity Management Challenges
Directories everywhere
Too many passwords
Passwords are weak
Unmanageable security
Allowing some outsiders access
Metadirectory Services, Authorization Manager
AD (Kerberos, PKI), SfU, SfN, HIS, CredMan
Smart Cards, Biometrics, AD policies
Group Policies, AD delegation, GPMC
Certificate or Passport based web client login

14. © 2001 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.