Partially Cloudy
July 15th, 2009 Ivan LevendyanLet’s talk about such trendy thing as Cloud Computing. Now it is hardly to find an ITPro who had not heard about cloud and new potential it gives to the enterprise. Let’s put away all positive things and take a closer look at some technical aspects people are used to underestimate.
What about Identity and access management for the cloud? As companies are going to build their business applications in the cloud the essential problem appears: centralized authorization and solution for access management.
Let’s take Microsoft Azure Platform as an example. As you might know, there are two components for the Platform:
Windows Azure allows you to store data remotely and provides runtime for your applications. Pretty clear, right? Now, what about Azure Services? It is formed by several components that you can use in a way you need:
- .NET services
- Access Control Services – authentication and authorization engine, remote decision point for applications (claim-based)
- Service Bus – application messaging exchange
- Workflow Services - manage and execute the interactions between services
- SQL Services
- Live Services – for using Live identities and framework
- Sharepoint Services (future) - write code in SharePoint that uses Web Services to make calls to Azure services.
We have particular interest in the Access Control Services. Authentication in Azure is based on claims. So if you present superadmin claim and target application trusts your claim provider you are assigned superadmin role in the application. But the world is cruel. Application owners do not want users to wear superadmin’s hat, they just want to allow them only what they are supposed to do. And users simply do not know what tokens target application consumes. All that they have is a claim with group membership in Active Directory.
In this case Azure team suggests using claim transformation for authentication and authorization. That is, when you present your ‘group=Sales’ claim it gets transformed to ‘role=Salesman’ application-specific claim. There is a special MMC snap-in that allows you to define these transformations in drag-and-drop fashion:
You can find a detailed description of this technique here:
http://blogs.msdn.com/vbertocci/archive/2009/03/17/a-visual-tour-of-the-net-access-control-service-part-2-fun-with-scopes-and-issuers.aspx
This method works well for applications with few roles defined but I dare not speak about centralizing authorization of ten apps with thousands of scopes defined, because in this case you will end up with a classic problem which is known since the beginning of identity management trend – role proliferation, also known as “role explosion” (where the number of roles exceeds the number of users). Tools for identity management are critical for success – you will probably need workflow to approve role membership or periodically verify it.
So, what we have is a lack of authorization mechanisms for identity and access management for cloudy applications. There is a standard called XACML that seems to solve authorization tasks, but is needs a lot of work to suite cloud IAM tasks.
To become a really useful solution, cloud needs to be “identity management aware” - externalize authentication, authorization, and even audit data. Identity and access management tools for Cloud is an unoccupied niche for both cloud vendors and ISV, so you are to expect solutions in this area pretty soon, as Cloud gains maturity. Stay tuned!
