This document discusses authorization services that provide claims-based and role-based access control for enterprise-wide security. It summarizes challenges with security and access management across multiple systems and locations. It then describes how the solution implements flexible role-based access control models to address these challenges.

1. Authorization ServicesClaims and Role-Based Access Control for Enterprise Wide Security Copyright © 2010. Dot Net Workflow is a trademark of The Dot Net Factory, LLC. |www.TheDotNetFactory.com 1

2. Security Challenges Copyright © 2010. empowerID is a trademark of The Dot Net Factory, LLC. |www.TheDotNetFactory.com 2 It should be easier to get access to the IT resources I need to work I want to delegate management but not lose control How can we report on who has access to what across all our systems

3. The “Make Like Bob” ProblemSecurity Based On a Moving Target Protected Resources Copyright © 2010. empowerID is a trademark of The Dot Net Factory, LLC. |www.TheDotNetFactory.com Year N Year 2 Day 1 New Access Granted New Access Granted ? Multiple sites and roles SharePoint Who are you? ? ? ? PO Approver ? AD User: CMH OU X ? Custom Applications CRM LDAP User Send As Bob Sales Executive” ? ? Payroll & Unix User Person ? Full Access ? ? Sales Share Conference Room 5401 New Hire: Jim “Sales Executive” New Hire: Sarah “Sales Executive”

4. The Challenge with an AD Groups-only Approach Copyright © 2010. empowerID is a trademark of The Dot Net Factory, LLC. |www.TheDotNetFactory.com Access Granted Protected Resources ? Groups Multiple sites and roles John’s User Accounts ? What can you access, when, and why? Who are you? SharePoint ? ? PO Approver Helpdesk Manager ? ? No Reportable or Auditable Link ? Custom Applications Mailbox Helpdesk I Send As John ? ? Person Full Access Shared Mailbox ? ? ? Conference Room 5401

5. Protected Resource TypesEmpowerID Is an Open Box System Supporting an Unlimited # of Resource Types Custom Applications Windows Servers SAP Microsoft SharePoint Types of Protected Resources Groups Groups Web Resources Mailboxes Dot Net Workflow is an authorization platform that can be extended to support any type of application and application resource. Protected systems containing resources are called “Resource Systems”. EmpowerID modules inventory Resource Systems and enforce permissions. Permissions Management = Copyright © 2011. empowerID is a trademark of The Dot Net Factory, LLC. |www.TheDotNetFactory.com

6. Protected Resource ObjectsEach Resource Type Is a Rich Strongly Typed Object That Flows in Processes Dot Net Workflow leverages strongly typed objects to enable drag and drop process design where objects can be passed between workflow steps and processes in a code free manner and bound to forms as live data. Copyright © 2011. empowerID is a trademark of The Dot Net Factory, LLC. |www.TheDotNetFactory.com

8. Decrease Quota

9. Edit SMTP

10. Enable OWA

11. Enable Calendar Auto-Accept

12. Edit Forwarding

13. Grant Send As

15. Send As

16. Send On Behalf

17. Full Access7

19. Decrease Quota

20. Edit SMTP

22. Decrease Quota

23. Edit SMTP

24. Enable OWA

25. Enable Calendar Auto-Accept

26. Edit Forwarding

27. Grant Send As

28. Grant Send On Behalf

30. Full Access

31. Send AsOutlook Full Control Resource Roles are convenient bundles of Rights and Operations specific for a type of resource and are used for delegation. Rights are permissions used in an external system that can be managed by EmpowerID. Operations are code-based actions protected by EmpowerID (usually in workflows). 8

32. The Bottom Line: Access = Person  Resource RolesAll Assignments Types Result in Matching a Person to a Resource Role Resource: John Doe’s Mailbox ? Person: Steve Smith Editor Via Any Possible Assignment Path Administrator Outlook Full Control All permissions management in EmpowerID occurs by some type of assignment that results in a Person being granted a Resource Role for a Resource.

33. The Measure of an RBAC System is its Flexibility in Obtaining Collections of People and Collections of Resources Left Side = People Right Side = Resources Resource Role ? The key is how to assign theproper people to the proper Resource Roles without creating and managing large numbers of static assignments

35. Right Side: Collections of ResourcesResource Roles are Assigned to Single Resources or By Location Collection of Resources: “Scope” Resource Role Actor Editor ? Direct to a Single Resource Any Actor Type Administrator By Location with Inheritance Resource Role assignments are limited or “scoped” by assigning the Resource Role only for a single Resource or for all Resources in or below a specific EmpowerID Location.

36. LocationsRepresent Logical and Actual Resource System Hierarchies Physical “Resource System” Trees Logical Trees Inheritance of Delegations Location of a Resource The Dot Net Workflow metadirectory supports both Logical and Physical trees within a single Location tree structure. Resources belong to their physical Location implicitly and can be assigned to any number of logical Locations to scope delegation assignments.

39. RBAC MappingMap Physical Directory Locations to Logical Locations 15 Copyright © 2011. empowerID is a trademark of The Dot Net Factory, LLC. |www.TheDotNetFactory.com Business Role and Location mappings allows existing physical directory Locations and roles to be mapped to a logical management structure. e.g. Multiple AD or LDAP directory containers for “London” can be visually mapped to a single virtual “London” Location for unified management and delegation.

40. Management Role InheritanceManagement Roles inherit Resource Roles assigned to their definitions IT Helpdesk Management Role Definition IT Helpdesk (North America) Management Roles (Children) IT Helpdesk (Asia) IT Helpdesk (Europe) Management Roles inherit Resource Role assignments from their definition and then include any assignments to the Management Role itself. The inheritance can only be 1 level deep from a definition to a Management Role. Management Roles cannot be children of other Management Roles or have more than 1 parent.

42. Viewer: Distribution Group @ %SpecifyLocation%

43. Password Self-Service User

44. …

45. Member: All Employees Group

46. Reader: SharePoint Home

47. Viewer: Workflow Catalog

49. Membership Manager: Distribution Group @ %SpecifyLocation%

50. Administrator: User Accounts @ %SpecifyLocation%

51. Administrator: Computers @ %SpecifyLocation%

52. Password Self-Service User

53. …

54. Member: All Employees Group

55. Reader: SharePoint Home

56. Contributor: IT SharePoint Site

57. Membership Manager: All Employees Group

58. Viewer: Workflow Catalog

59. Viewer: Group Manager Page

60. Initiator: Create Group Workflow

61. …IT Helpdesk Management Roles are job or responsibility-based bundles of Resource Roles to allow quick and consistent delegation of IT access needed to perform job responsibilities. 17

63. Viewer: Distribution Group @ NA Location and below

64. Password Manager User: Self

65. …

66. Member: All NA Employees Group

67. Viewer: Workflow Catalog

69. Membership Manager: Distribution Group @ NA Location and below

70. Administrator: User Accounts @ NA Location and below

71. Administrator: Computers @ NA Location and below

72. Password Manager User: Self

73. …

74. Member: All NA Employees Group

75. Membership Manager: All NA Employees Group

76. Viewer: Workflow Catalog

77. Viewer: Group Manager Page

78. Initiator: Create Group Workflow

79. …IT Helpdesk (North America) Management Roles are job or responsibility-based bundles of Resource Roles and Resource Type Roles to allow quick and consistent delegation of IT access needed to perform job responsibilities. 18