Regulatory requirements (i.e. SOX, HIPAA, GLBA, ISO 17799) requires companies to control the access to critical and sensitive information. Single Sign-On (SSO) can be an important part of this strategy, in particular a solution that leverages your existing infrastructure can eliminate the use of generic or shared user IDs and passwords, whether they are manually entered by end users or hard coded into applications. For many platforms, including WebSphere, there are two challenges that must be addressed. The first challenge is that most organizations user IDs are different across various servers and applications, and the second challenge is the proliferation of additional user IDs and passwords that end users must remember and enter.
A simple solution to these problems is to leverage IBM's Enterprise Identity Mapping (EIM) infrastructure. EIM is a set of APIs that provide the ability to map employees to their various user identities across many different registries (operating systems, middleware and applications). EIM is integrated into all IBM eServer operating systems, including OS/400 and i5/OS. This addresses the first challenge. With these mappings or associations established, passwords can be eliminated and replaced with other native authentication mechanisms, such as Kerberos tickets. This addresses the second challenge.
TriAWorks, an Identity Management and SSO ISV, has developed a WebSphere plug-in that enables WebSphere to accept an end user's Windows domain credentials, which is actually a Kerberos ticket. The use of Kerberos tickets for authentication eliminates the need to use passwords for authentication. Furthermore, once authenticated to WebSphere, application developers can use a number of different authentication infrastructures to access other registries without being challenged again with a user ID and password prompt. For example, Identity Tokens can be used to access an iSeries, Lightweight Third-Party Authorization (LTPA) tokens can be used to access a Domino Web server, and the Generic Security Services Application Programming Interface (GSSAPI) can be used to access another database, like Oracle.
The end result is the elimination of hard-coded generic or shared application user IDs and passwords, significantly improved transaction control and auditing, and the availability of a very valuable employee mapping to their user identities across the enterprise.
There are a couple of great resources for providing checklists for setting up EIM. You can check out this article that overviews implementing EIM. Additionally, IBM's Pat Botz, eServer Security Architect who invented EIM has given at least two educational webcasts this year on EIM. The first webcast focused on and the second webcast focused on configuring EIM hosted on an iSeries. Lastly, ISV TriAWorks, Inc. has a created a free utility ('SSO Inspector') that an administrator can download to check their systems. The report takes a few minutes to run and will report what each system requires as far as operating system version and PTF levels.
==================================
MORE INFORMATION ON THIS TOPIC
==================================
The Best Web Links: tips, tutorials and more.
Search400's targeted search engine: Get relevant information on security.
Ask your systems management questions--or help out your peers by answering them--in our live discussion forums.
Check out this Search400.com Featured Topic: Top ten security tips
Visit the ITKnowledge Exchange and get answers to your security questions fast.
