1. OpenSource Identity
Management with
Apache Syncope
Viale D'Annunzio, 267 - 65127 Pescara
Partita IVA 01974100685
N. REA 143460
Tel +39 0859116307 / FAX +39 0859111173
http://www.tirasa.net
info@tirasa.net

2. Agenda
● Identity and Access Management
● Vendor Vs Open Source solutions
● Apache Syncope
● Tirasa: Apache Syncope Enterprise support

3. What's IdM about?
● Data records that contains a collection of data about a person
● “Data record” → Account
● “A person” → Identity
● The joint effort of business
process and IT to manage user data on systems and applications.

4. IdM technologies
● Identity Stores
● Storage of user information
● Provisioning
● Synchronize account data across identity stores and a broad
range of data formats, models, meanings and purposes
● Access Management
● Security mechanisms that take place when a user is accessing a
specific system or functionality

5. Identity Stores
● Examples
● LDAP / Active Directory
● RDBMS
● Meta and Virtual Directories
● Accounts can be created and managed in one place only
● Each application manages authentication separately
● Users may use the same password for all connected applications

6. Aren't Identity Stores enough?
● Heterogeneity of systems
● Lack of a single source of information
● HR for corporate id, Groupware for mail address, ...
● Need for a local user database
● Inconsistent policies
● Lack of workflow management
● Hidden infrastructure management cost, growing with
organization size

7. Provisioning
● Keeping identity stores as synchronized as possible
● Need to be customizable and flexible
● Priority: non-intrusiveness
● Focused on application
back-end
● Communication:
● Connectors
● Agents

8. Identity Lifecycle

9. Access Management
● Mediator to all access to all applications
● Focused on application front-end
● Aspects
● Authentication (Single SignOn)
● Authorization
● Federation (SAML, Liberty, OAuth, OpenID, ...)
● Mainly applicable to web applications
● Difficult integration with pre-existing apps

10. IdM in practice: before...

11. IdM in practice: ...after!

12. Vendor products
● Oracle (with addition of ex-Sun suite)
● Novell
● IBM (Tivoli)
● Microsoft (Forefront)
● Niche players
● Ping
● NetIQ
● SailPoint
● Quest (now Dell)

13. Open Source non-ASF products
Identity Stores
Access Management
Provisioning

14. Open Source ASF projects
● Identity Stores
● Apache Directory
● Provisioning
● Apache Syncope
● Access Management
● Apache Shiro

15. Apache Syncope
● Inception by Tirasa in 2010
● Entered ASF incubator in February 2012
● Graduated as TLP in November 2012
● Active community
● 13 committers, 5 contributors
● ~130 mailing list subscribers, stable traffic

16. Syncope: features
● Workflow-based provisioning engine
of users and roles
● Account / Password policies
● Agentless connection
with Identity Stores
● Auditing & Reporting
● Shining admin console
● Customizable and
extensible by design

17. Syncope: architecture

18. Syncope: mapping

19. Syncope and the external world

20. Syncope: connectors
● Based on ConnId, hosted at GitHub, new home of Sun's Identity Connectors
● Ready-to-use bundles:
● LDAP
● Active Directory
● Database
● CSV Directory
● SOAP
● Google Apps
● UNIX
● Write your own bundle
PPrroovviissiioonniinngg
EEnnggiinnee
AAPPII
SSPPII
Common
Code
Objects
& Utils
Using Connectors

21. Syncope: roadmap
● Security realms (multi-tenant scenarios)
● SCIM interface
● Concurrent / Asynchronous communication with
external resources
● Access Management features
● More at http://s.apache.org/SyncopeRoadmap

22. Syncope: (some) success stories

23. ● Italian limited company established in 2011
● Small, highly skilled staff
● Deliverying IAM solutions for Sun Microsystems for 10 years
● Instructors of IdM, Access Manager and Directory Server for Sun
Microsystem's courses
● Creates and leverages Open Source tools for Enterprise
Integration
● ConnId
● Hippo Cocoon Toolkit

24. Syncope: enterprise services
● Product evaluation
– Introductory workshop
– Proof of Concept (PoC)
● Development support
● Production support
● Syncope Compliance Dashboard
● More at http://syncope.tirasa.net

25. Syncope: trying it out
● Online http://syncopedemo.tirasa.net
● Virtual Machine image
● Ubuntu Juju / Microsoft Azure
● .deb packages
● Standalone distribution
● Quickstart projects on GitHub
● Maven Archetype

26. Questions?