22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

322 Lotus Security Handbook<br />

Multiple identities<br />

Terry Howell, Navy Enterprise Portal program manager for Space and Naval<br />

Warfare Systems Command (SPARWAR), was recently quoted in press articles<br />

as saying “Users could have 100,000 identities, all with their own way of granting<br />

authorizations...”. He was referring to the estimated 720,000 users of the U.S.<br />

Navy’s intranet portal, and the effort required to tie together some 200,000<br />

existing applications to use a single, common identity. Perhaps “100,000<br />

identities” for each user might be the extreme end of the spectrum; however, it is<br />

not uncommon today for different legacy applications to each have their own<br />

dedicated user authentication directories. So before you consider your own<br />

organization “better off than the U.S. Navy,” have you really counted up all those<br />

old servers and applications you still use that have dedicated user IDs registered<br />

on them? When you start looking at separate hosts like shared UNIX boxes and<br />

various applications that were deployed at departmental levels, the number of<br />

IDs for any given user can indeed be overwhelming.<br />

Multiple identities can consist of name variations and different logon IDs and<br />

passwords. And we do not limit the variations to just the name attributes<br />

themselves: differences in hierarchical tree structures can present similar<br />

difficulties (or even compound them). For example, a user might have the<br />

following directory entry DNs (distinguished names):<br />

LDAP Directory: cn=Brendan C Hinkle,ou=West,o=Acme,dc=acme,dc=com<br />

Domino Directory: CN=Brendan Hinkle/OU=Finance/O=Acme<br />

Active Directory: uid=bhinkle,cn=users,dc=corp,dc=acme,dc=com<br />

This shows that we can not only have different common names, but different<br />

distinguished names, and no inherent way to match them to the same person<br />

with 100% confidence.<br />

So what can we do when users essentially have two similar, but not necessarily<br />

matching identities by which they are known? The answer is we must identify<br />

correlating data, or correlation keys that can be used to match user records with<br />

guaranteed certainty. If we expand the previous example to show some<br />

additional attributes, we can see some options for correlation.<br />

Example 8-1 Multiple directories in LDAP example<br />

LDAP Directory: cn=Brendan C Hinkle,ou=West,o=Acme,dc=acme,dc=com<br />

uid=bhinkle<br />

empid=10543<br />

mail=”“<br />

Domino Directory: CN=Brendan Hinkle/OU=Finance/O=Acme<br />

internetaddress=b_hinkle@acme.com<br />

employeeid=BC10543

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!