Guest post by Alex Vakulov .
Identity and Access Management (IAM) technologies provide all your applications with a single identity management service, which significantly simplifies users’ lives and increases systems’ security. To avoid common mistakes, you should start building an access control system in a company by introducing IAM services.
Quite often, information technologies copy familiar situations from life. For example, let us imagine an access control system in an ordinary business centre. Usually, an employee of the tenant company creates a guest pass request. The visitor shows his ID card, and the security officer issues him a one-time pass card.
In the digital world, information systems and applications are like office tenants in business centres. Applications need their own access system. In this system, accounts must be created, and different permissions should be assigned to users.
Each user must be identified and authenticated, similar to going through the security post in a business centre. But instead of an ID card, the user will need a login and password to enter, and instead of a pass card, a session will be created, and a security token will be issued.
Then the application will have to check that the security token presented by the user is not expired, not revoked, and the rights specified in it correspond to the requested access level.
Companies use many different applications in their work, including desktop, mobile, and web applications. They can be deployed on company servers or cloud services. Often, each application approaches access control tasks on its own.
So, users are forced to remember plenty of passwords and go through the identification/authentication process again and again. Some prefer to use password managers but that can be unsafe too.
Let us imagine that all tenants in a business centre suddenly decide to install their own turnstiles, create their own pass bureaus, and issue their own passcards. This seems absurd but this is often the case in the digital world.
With the growing number of applications in use and the development of password chaos, companies realise the need for centralised access control. What should such a system consist of?
Access control system elements
An access control system can include the following services:
Identity Management (IDM) services provide synchronisation of user accounts in applications, automate the creation and deletion of accounts, and assign and revoke permissions.
Identity and Access Management (IAM) services provide Single Sign-On (SSO) and authentication, multi-factor authentication, and access control to web applications and services (API gateway, web proxy).
Directory Services provide storage of user accounts, their attributes, permissions, and passwords.
How to start?
Many of you start with the implementation of IDM solutions, but projects within this approach have drawbacks:
They usually take a long time.
They have high organisational complexity.
They require a deep study of the company’s business processes.
The best alternative to such time-consuming procedures would be to implement IAM solutions and Directory Services. Again, IAM is the gateway system for users of the company’s applications. It unifies identity management, authentication, and user access control. Such projects do not take a lot of time and provide results very quickly, allowing the company to identify the requirements for new applications.
Prior to implementing IAM, a company might not even be aware of the importance of having external service sign-in functionality in applications. This functionality can be achieved by supporting the SAML or OpenID Connect standards.
What should you pay attention to when choosing IAM services?
We can distinguish two AIM approaches:
Enterprise single sign-on (ESSO)
Identity provider (Web SSO, IDP)
In the first case, when implementing the technology, an ESSO agent is installed on each user device. When the device is turned on, E...
