¿Tu identidad está a salvo?
•Transferir como PPTX, PDF•
0 gostou•306 visualizações
Charla impartida por César Moro de la empresa Quest Software, en el evento "Asegura IT Camp2" que tuvo lugar los días 22, 23 y 24 de Octubre de 2010 en El Escorial.
Recomendados
Recomendados
Mais conteúdo relacionado
Semelhante a ¿Tu identidad está a salvo?
Semelhante a ¿Tu identidad está a salvo? (20)
Mais de Eventos Creativos
Mais de Eventos Creativos (20)
Último
Último (14)
¿Tu identidad está a salvo?
- 1. © 2009 Quest Software, Inc. ALL RIGHTS RESERVED Asegur@IT: ¿Tú identidad está a salvo? Simplificando la Gestión de Identidades
- 2. 2 ¿Tienes múltiples identidades? • La mayoría de la gente tiene varias identidades • No es fácil poder gestionarlas todas sin que alguna se ponga en riesgo
- 3. 3 El Complicado Mundo de las Identidades BlackBird Laptops Sala X
- 4. 4 Vulnerabilidades en la Gestión de Identidades • Un exceso de identidades, puede suponer el olvido de usuarios y contraseñas, o que estén expuestos a descuidos (apuntar la contraseña, etc…) • Distintos entornos pueden suponer distintas políticas de contraseñas • La suplantación de la identidad es una tarea más sencilla
- 5. 5 ¿Qué es la gestión de accesos e identidades? • ¿Se trata de autenticación? • ¿Se trata de autorización? • ¿Es un aprovisionamiento? • ¿Es una gestión de contraseñas? • ¿Es un single sign-on? • ¿Es algo relacionado con auditoria y normativas? • ¿Es una sincronización de contraseñas? • ¿Es posible lograrlo verdaderamente? ¡Es todo lo anterior!
- 6. 6 Definición de Gestión de Identidades • define la gestión de identidades como algo que “te permite integrar, gestionar y controlar la información distribuida de las identidades, para poder otorgar los permisos apropiados a la gente adecuada, en cualquier momento y en cualquier lugar”. • define la gestión de identidades como: combinación de “procesos, tecnologías y políticas para gestionar las identidades digitales y especificar cómo son usadas para acceder a los recursos.”
- 7. 7 Definición de Gestión de Identidades • Administrador: “Además, la organización es capaz de trabajar de forma efectiva como una solución, por lo que la monitorización, la auditoría y la realización de informes es fácilmente realizable.” • Usuario Final: “La organización sabe quien soy y cual es mi rol, y basándose en esa información, automatiza mi acceso a los recursos. Esto me permite acceder a todo lo que necesito y así realizar mi trabajo en muy poco tiempo.”
- 8. 8 El estado de la Empresa
- 9. 9 ¿Qué podemos hacer para simplificar el entorno? • ¿De dónde surge esta complejidad? – Muchos sistemas heterogéneos – Muchas aplicaciones – Muchas y diversas: • Infraestructuras de autenticación • Infraestructuras de autorización • Políticas e interfaces de administración • ¿Cuantos Directorios diferentes existen? • ¿Cuantos login de inicio de sesión tiene? • ¿Cuál es el esfuerzo de administrar este escenario? • ¿Se puede certificar que el entorno es seguro y cumple con todas las normativas?
- 10. 10 Solución… Get to One! • Consolidar todo lo posible en el Directorio Activo – Eliminando otros directorios – Unificando la identidad • Extender lo máximo el Directorio Activo – Autenticación Kerberos contra Windows – Enterprise Single Sign-On – Administración centralizada en un único punto • Utilizar el Directorio Activo como un repositorio autoritativo para – Todos los sistemas – Todas las aplicaciones – Roles, reglas y políticas – Aunque no es posible integrar todo en el Directorio Activo…
- 12. 12 Los usuarios necesitan tener acceso a los recursos Deben poseer los minimos privilegios posibles Se debe minimizar la utilización de cuentas como Admin y Root Provisión, reprovisión y deprovisión de usuarios Creación de reglas y workflows Definición y aplicación de politicas de acceso Control de la actividad Control de cambios Notificación en tiempo real de eventos críticos Análisis del nivel de cumplimiento Separación de las funciones de auditoría ¿Qué problemas podemos solventar? Cada Sistema y Aplicación requiere un User ID y una password Cada acceso debe ser controlado En algunos entornos puede ser necesaria una autenticación más segura
- 13. 13 Secure. Efficient. Compliant. Quest One utiliza el Directorio Activo para consolidar la identidad, garantizar la seguridad y simplificar la gestión de normativas y regulaciones
- 14. 14 Gestión de Contraseñas Provisionamiento Gestión de Accesos UNIX/Linux Integración con Microsoft ILM 2007/FIM 2010 Consolidar la identidad Tareas de Autogestión Lotus UNIX/Linux en Active Directory Group Policy y Microsoft SCCM Java/J2EE Single Sign-On Sync con Directorios & Mainframe Gestión del Lifecycle y Administración de la actividad operative Gestión automatizada de accesos y delegación Provisioning/de-provisioning para AD, AD LDS Sync bi-direccional con Data Sources Gestión de la password para AD/AD LDS Autenticación basada en Q&A Estensión de la GINA opcional Autonomía para modificar la propia cuenta y la password Auditoría de las operaciones sobre UNIX/Linux Log de la sesión del usuario Control de la actividad anómala Definición de politicas operativas (QuéCosa/Dónde/Cuando) Meta Directory Services para Directorios, Applicaciones y Bases de datos
- 15. 15 IAM FRAMEWORK / METADIRECTORY La solución: Quest One
- 16. 16 El Objetivo Reforzar la autenticación con Kerberos Reforzar las políticas de password Definir los accesos basados en roles Combinar SSO con autenticación fuerte basada en el standard OATH Control de accesos eficiente Definir políticas de gestión de Password y autenticación fuerte Implementare la “separación de funciones” Confirmar el cumplimiento de normativas a través de auditorías, informes y alertas en tiempo real Eliminar la necesidad de los usuarios de recordar múltiples contraseñas Consolidar directorios e identidades Simplificar la administración de identidades
- 17. 17 & Privilege Management Los 7 proyectos en los que Quest puede ayudarte… ID Provisioning1 User Self Service2 Single Sign-On3 Strong Authentication4/5 Automated Change6 Robust Auditing7 Secure. Efficient. Compliant.
- 18. 18 Membership Security Access Groups Authoritative Data Source (HR/ERP System, Meta-Directory) Creación cuenta Exchange Creación Mailbox Adjuntar Listas de Distribución AD LDS/ ADAM Midrange AS/400 (iSeries) Mainframe z/OS (zSeries) DB2 Linux IAM Framework Creación de la cuenta de AD Nombre único Password única Pertenencia a Grupos Workflow de aprobación
- 19. 19 CreateConfigureInform 65 minutes Add user to groups Security and Distribution Groups 10 minutes Assign administrative permissions 10 minutes Create user accounts connected systems Send to metadirectory, Unix/Linux, etc. 10 minutes Inform the Business E-mail to IT, Service Desk, Management Facilities, etc. 10 minutes Automatic Automatic Automatic 5 minutes Automatic Automatic Automatic Automatic Effort: Elapse Time: 5 minutes Hours / Days 5 minutes Add employee to HR system 5 minutesHR Create user account in Active Directory Location, Unique Name, Strong Password Generation 10 minutes Create Exchange mailbox Controlled Store Selection, Alias Generation 5 minutes Create home directory Location, NTFS permissions, Share permissions 5 minutes Step Without Rules With Rules
- 20. 20 Provisiong, re-provisiong y de-provisioning
- 21. 21 HR System
- 22. 22
- 23. 23
- 24. 24
- 25. 25
- 26. 26
- 27. 27
- 28. 28
- 29. 29
- 30. 30
- 31. 31
- 32. 32
- 33. 33
- 34. 34 Los 7 proyectos…. paso a paso… ID Provisioning1 User Self Service2 Secure. Efficient. Compliant.
- 35. 35 ?
- 36. 36
- 37. 37
- 38. 38
- 39. 39
- 40. 40
- 41. 41
- 42. 42
- 43. 43
- 44. 44
- 45. 45
- 46. 46
- 47. 47
- 48. 48
- 49. 49
- 50. 50
- 51. 51
- 52. 52
- 53. 53
- 54. 54
- 55. 55
- 56. 56
- 57. 57
- 58. 58
- 59. 59 ID Provisioning1 User Self Service2 Single Sign-On3 Los 7 proyectos…. paso a paso… Secure. Efficient. Compliant.
- 60. 60 • Consolidar y utilizar el Directorio Activo para: – Windows – UNIX – Linux – Mac OS – Java – Aplicacones Kerberos-aware (ex. SAP, Oracle paraUNIX) – Aplicaciones LDAP-enabled (ex. Siebel) – Aplicaciones API-enabled (ex. GSSAPI) – sistemasPAM-aware (ex. DB2) Single Sign-On en Directorio Activo
- 61. 61 Esfuerzo para Administradores y Usuarios • Single Sign-On – Un ID – Un Directory – Un Login – Una Password – Gestión simplificada • Centralizada • Escalable • Controlada • Reportable
- 62. 62 • Enterprise Single Sign-On para – Otras aplicaciones (ex. Oracle para Windows) – Aplicaciones con sistema de autenticación propietario – Sistemas Legacy (ex. AS/400, RACF) – Logon de sistemas de terceros (ex. web-based login) – Client Based – … ¿y que hacemos con el resto?
- 63. 63 • Single Sign-On – Un ID – Un Directory – Un Login – Una Password – Gestión simplificada • Centralizada • Escalable • Controlada • Reportable • ESSO (Logon Automation) – Múltiples ID´s – Múltiples Directorios – Un Login – Una password – Gestión compleja Esfuerzo para Administradores y Usuarios
- 64. 64
- 65. 65
- 66. 66
- 67. 67
- 68. 68 GENERAR ZOOM
- 69. 69
- 70. 70
- 71. 71
- 72. 72
- 73. 73
- 74. 74
- 75. 75
- 76. 76
- 77. 77
- 78. 78
- 79. 79
- 80. 80
- 81. 81
- 82. 82
- 83. 83 & Privilege Management ID Provisioning1 User Self Service2 Single Sign-On3 Strong Authentication4/5 Los 7 proyectos…. paso a paso… Secure. Efficient. Compliant.
- 84. 84 HR System
- 85. 85
- 86. 86
- 87. 87
- 88. 88
- 89. 89
- 90. 90
- 91. 91
- 92. 92
- 93. 93
- 94. 94
- 95. 95
- 96. 96
- 97. 97
- 98. 98
- 99. 99
- 100. 100
- 101. 101
- 102. 102
- 103. 103
- 104. 104
- 105. 105
- 106. 106 HR System
- 107. 107
- 108. 108
- 109. 109
- 110. 110
- 111. 111
- 112. 112
- 113. 113
- 114. 114
- 115. 115
- 116. 116
- 117. 117
- 118. 118
- 119. 119
- 120. 120
- 121. 121 & Privilege Management ID Provisioning1 User Self Service2 Single Sign-On3 Strong Authentication4/5 Automated Change6 Los 7 proyectos…. paso a paso… Secure. Efficient. Compliant.
- 122. 122 HR System
- 123. 123
- 124. 124
- 125. 125
- 126. 126
- 127. 127
- 128. 128
- 129. 129 & Privilege Management ID Provisioning1 User Self Service2 Single Sign-On3 Strong Authentication4/5 Automated Change6 Robust Auditing7 Los 7 proyectos…. paso a paso… Secure. Efficient. Compliant.
- 130. 130 130 HR System ?
- 131. 131
- 132. 132
- 133. 133
- 134. 134
- 135. 135
- 136. 136
- 137. 137
- 138. 138
- 139. 139
- 140. 140
- 141. 141
- 142. 142
- 143. 143
- 144. 144
- 145. 145
- 146. 146
- 147. 147
- 148. 148
- 149. 149 & Privilege Management ID Provisioning1 User Self Service2 Single Sign-On3 Strong Authentication4/5 Automated Change6 Robust Auditing7 Los 7 proyectos…. paso a paso… Secure. Efficient. Compliant.
- 150. 150 Quest One Identity Solution permite a las compañías simplificar la gestión del acceso y las identidades por medio de • Mejorar la Eficiencia a través de una administración automatizada de identidades y la consolidación de una infraestructura de identidades basada en un despliegue existente de Active Directory • Aumentar la Seguridad implementando una autenticación más fuerte para múltiples sistemas, incluyendo smart cards y tokens así como habilitando el control de cuentas con privilegios • Cumplimiento de Normativas con una auditoría más fuerte e integrada, informes, herramientas para forzar el cumplimiento, consolidación de identidades y dominios para el control de acceso y segregación de obligaciones
- 151. 151 Más información sobre Quest One Identity Solution y Quest Software en las siguientes direcciones: • Quest One Identity Solution: http://www.quest.com/identity- management/ • Blog Quest Spain: https://questsoftware.wordpress.com/
- 152. 152 Muchas Gracias!! Dudas o consultas a: cesar.moro@quest.com
Notas do Editor
- Return to the slide deck and review the scenarios they have seen in the demo.
- Many groups of administrators are involved when provisioning with native tools – and some of these admin groups are highly-paid people. Typically there are only a few high-level administrators that have the “know-how” to do this. It often takes hours to set the correct access per user, andIt’s human intensive, and with so many humans involved, it is error-prone and expensive.
- Maximize the HR Work Station and click the “New Record” button to start a new employee record.
- Fill in the following fields for your new user:First: Whatever value you like (may be best to use a new one each time)Last: Whatever value you like (may be best to use a new one each time)Department: Always start with EngineeringJobTitle: Always start with Production DBAPhone Number: whatever 7 digits you likeLocation: Pick one from the menuStatus: Leave this at ActiveThe rest of the fields leave as is. Click the “Save Record” button.
- You can be sure your record saved properly when the EmpID appears.Now it is time for Quick Connect to sync. This is set to happen every 2 minutes. There is also a delay in the actual process of creating a new user since it involves many steps that take some time. So at this point it’s good to talk a bit. Explain this is just a stand in HR application. It’s written in Access and back ended by SQL Server. It is being replicated by Quick Connect using one of the out of the box connectors. Go back to the slide and complete the animations.
- Back to the demo, minimize you HR Workstation and click on the ARS Console.
- On the console, you may have to hit refresh to show your user has shown up. Explain how the sync rules put the user in the right OU based on their job title.
- Double click your user and show how the attributes have been populated.
- Click the Account tab and show the account properties also generated.
- Click the Unix Account tab and show how even this was done automatically and extrapolated from the HR attributes passed over.
- Click the AR Server Policy tab at the bottom of the screen to show the policies enforced on the Production DBA OU.
- Double click the QSC User Provisioning Policy.
- Show the Policies tab and go down the list of steps taken for the provisioning.
- Double click the first step and show how the rules used are very simple and menu driven as opposed to coding.Exit the dialogue boxes you have opened and minimize the ARS Console.
- Return to the slide deck and review the scenarios they have seen in the demo.
- Go back to the slides and go to scenario 2. Go through the animations and explain the user will now logon, set up their own account properties which are under their control and also be able to reset their own password when they forget it.
- Double click the “User Workstation” link on the desktop.
- Enter the username for your new user and the password for your new user. The credentials will be:Username: <First Initial of First Name>+<Whole Last Name>Password: Pa$$word
- You will be prompted to change your password for the first login.
- Enter your current and new passwords. You will enter:Old Password: Pa$$wordNew Password: Pa$$word1 (suggested value, you may put what you like)
- Your password change is confirmed.
- You will be prompted by Password Manager for Forced Registration. Click the Yes button.
- Enter the password you just changed.
- Enter answer to the questions for your user. It is suggested to use your actual birth year and your own last name in all lower case to ensure you recall it later. Don’t worry, no one will see it.
- You will have to wait for at least 45 seconds while the session initializes for the first time. It is good for users to see this so thay can tell it is really the first time the user is logging in.
- Once you see the BGInfo on the desktop and you have seen the QESSO banner, the session is fully initiailzed.Double click the “Self Service Portal” link on the desktop.
- Point out the first link to the password site they already saw. Click on the “My Account” link.
- Show how some fields are darkened since they are read only. Explain how the more permissions they are given to different attributes in AD, the more this screen will populate. Also point out this is not done with code but rather by a point and click policy much like what they saw in the provisioning scenario.
- Fill in the Cell Phone number. Pick any 7 digits you like. Click the Save button at the bottom of the form.
- Show the operation succeeded notice at the top of the screen and then click the Home link at the top.
- Mention they can manage groups they are delegated control of, approve tasks that are sent to them via workflows and review and attest to state of groups they manage from here. Click on the Token Self-Registration link.
- You will now log off to show the password self service reset.
- Confirm the logout.
- Enter the username for your new user and the password for your new user. The credentials will be:Username: <First Initial of First Name>+<Whole Last Name>Password: Pa$$word
- Enter your user’s username, but put in the incorrect password (e.g. ‘abc’). When you receive the error for the wrong password, explain the user haas forgotten their password, clock OK and then click the “Forgot My Password” button.
- Click the the “Forgot My Password” link. Do this quickly as you can to keep from getting too much into this screen.
- Enter the answers you gave during the registration step.
- Enter a new password. Suggested value:Password: Pa$$word2
- Click the Close this window link.
- Return to the slide deck and review the scenarios they have seen in the demo.
- Now go back to the slide show and advance to the third scenario. Click for the first animation and explain SSO was always possible in the Microsoft world thanks to AD. Then click again to expand this to the rest of the infrastructure and note that now Quest lets you extend this to all your other infrastructure and applications in a variety of ways. Recall that the animations are done when the red dot appears. When you’ve gone through the slide, awitch back to the demo explaining they will now see SSO in action.
- Enter your new password.
- On the User Workstation, which should still be logged in and maximized from the password reset actions, double click the Shortcut to Putty on the desktop. In the host name box, enter the hostname:Linux Hostname: alvschl01Explain they could save that value this time and not ever have to enter it again, and feel free to save it if you wish by putting sa name in the saved session box and clicking save. When you’re done, click the Open button at the bottom, or simply hit enter.
- The session should launch and you should be logged into the linux box as your user with now prompt for a password.
- Enter the command ‘pwd’, hit enter and show the user has a home directory. Explain this was created in the normal method by Linux on first logon. Enter the command ‘id’ and explain how the uid, gid and groups all came from AD. Point out that ProductionDBA is an AD group and there is no local information about that on the linux server at all.Then either type ‘exit’ or simply close the window.
- Double click the Shortcut to toad on the desktop.
- On the login window, select the “EXTERNAL” user. Explain this is the name Oracle gives to using a source of authentication that is not it’s own, in this case AD via Quest’s Authentication Services. Point out there is no password in the password field and click Connect.
- You will be connected as your user and that user session is shown in the window, which is highlighted in red above.
- Click on the Database menu and click the Schema Browser.
- In the browser, drop down the schema selector (highlighted with red) and select the HR schema.
- Show that the user has access to see the data.
- Click the Session menu and click on the “New Connection” item.
- Explain that the Production DBA also requires access to the SYSTEM user of the Oracle database. Double click on that user in the session window.
- SSOWatch will pop up. Explain that the desktop agent has been given a “technical definition” from AD that knows when someone in the ProductionDBA group from AD is clicking on the SYSTEM user access in Toad. When it sees that, it will automate the password entry. Since this is the very first time this user has done it, they are being asked to enter the account information. Explain that the username and password can also be stored centrally in AD so that the user does not need to know it. This has not been done for this demo so that this feature can be shown. Enter the following information:User Name: SYSTEMPassword: qscadminClick OK. The username and password will be very quickly entered into the orginal window and you will be logged on as the SYSTEM user.
- Point out now the user has both his own session going that was authenticated via kerberos and AD integration and the SYSTEM session which was authenticated with the logon automation via the desktop agent which is also integrated into AD as it’s datastore.Close Toad.
- Log off of the User workstation.
- Confirm the logoff.
- Return to the slide deck and review the scenarios they have seen in the demo.
- The animation with the user icons and the arrow is a means to discuss Quick Connect again. Then the blue transparent arrow shows the account granting access. Explain that since this is a Production DBA account, there will be extra security for it in the form of a one time password token as well as the normal username and password. You’re basically trying to make sure you take at least two minutes to be sure sync happens.Note that you’ll know you’ve reached the end of the animations on each slide when the red dot appears in the middle of the eye at the upper right hand corner of the slide. This extra animation is there to be sure you have a one click buffer at the end and don’t run over to the next slide too quickly.
- Point out this is a separate UI that was integrated in simply by making an entry in a wizard. Point out how this could be done for any web based set of forms they like.Click the Next button.
- Enter your token’s serial number and click next.
- Enter a one time password from your token and click Next.
- Once you reach this screen, either return to the home screen via the home link and close the browser and exit, or simply exit.
- On the Home Computer desktop, show the lack of the BGInfo and customized background color and explain this is possible since this is not a computer joined to the domain and controlled via group policy.
- Double click the OWA link on the desktop and show that the access to webmail required the use of their token since it’s being done from outside the corporate network. Enter your user’s username, password and the response from your token.
- Once in webmail, show the message from the helpdesk requesting the user look at a problem on their linux server.
- Double click the VPN link on the desktop and enter your user’s username, password and the domain:Domain: QSCEXAMPLEHit enter or the Connect button.
- The VPN will prompt for a response from your token.
- Note the VPN connects. Please be aware that factors outside of this lab, i.e. the networking setup in the wider ESX environment where the images run, can affect the ability of the VPN to connect. If this fails for any reason, please note you can continue with the scenario unchanged. The VPN connection is not actually needed to make the other network connections work.
- Go back to the slide show and advance to the next scenario. On the first animation when the cloud appears, explain that the user will now attempt to access the network from their home computer, which policy dictates requires two factor authentication with a one time password token. Also, they will be logging onto the network in order to address a production issue that has cropped up and that will involved them using delegated administrative access on the linux box they manage.
- Double click the shortcut to putty and either hit enter or click Open to connect to the Linux host.
- Since you are not on the domain, you do not have an AD credential already. You will be prompted for your user name and you will enter your AD username. Then enter your AD password.
- You should now be connected.
- Now you will look for the troublesome process. To do this, enter the following command: ps –ef | grep –v grep | grep broken‘ps –ef’ will list processes, the ‘|’ takes that process list and hands it to the next command to process the output, ‘grep –v grep’ gets rid of any command with grep in the name so your own search for broken does not show up in the results, the second ‘|’ hands over the ‘ps –ef’ output without anything saying ‘grep’ in it and finally the ‘grep broken’ lookks for and returns any lines with the word ‘broken’ in them.You should get one result. Point out that result is a process running as the root user.
- Now you attempt to get rid of the troublesome process using a kill command. You will type ‘kill’ followed by the process ID which is the number right after the word ‘root’ on the single line of results you got from your first command. In the screen shot, the command entered was: kill 18179That will fail with an error saying you don’t have permissions. Explain this is because that process is running as root. But point out that the rights to kill this process has been granted to the user via our privilege delegation solution. Run the kill command again but this time put the command ‘pmrun’ in front of it, like so:pmrun kill 18179This will succeed and tell you it was your group membership that allowed it. Explain this is in fact membership in the AD group, ProductionDBA. Run the first command again, which you can access by using the up arrow so you don’t need to type it, and show thsat the process is indeed gone.
- Close the putty window and confirm you want it closed.
- Log off of the Home computer.
- Confirm the log off.
- Return to the slides and advance to the next scenario. Explain that now they will see how all these integrated systems can work together to make changes go smoothly. Advance the animation until the point where all the items appear red, but not so far as the small user items are crossed out. Once the systems on the right are red you can stop. Explain the first part is to see what happens when a user’s role changes.
- Go to the HR Workstation. Your user should be displayed in the HR application. Move quickly to make the changes so you can get them into AD.
- Select the Job Title drop down and change it to read Testing DBA and click Save record.
- Now you are waiting for Quick Connect to pick up and replicate the change. It could be up to two minutes. The change itself id small so it should take little time but there is still the interval. You can take this time to point out that the Mobile number entered via the Self Service Portal and the email address created during the provisioning process have now appeared in the HR Application. This is due to Quick Connects two way sync capabilities. Note that sync can be done attribute to attribute so that HR can be the authority on some pieces of data while AD is the authority on others.
- Once you’ve talked for a bit, minimize the HR Workstation RDP session and return to the ARS Console. Select the Testing DBA OU on the tree. You may have to hit the refresh button for your user to show up. You may also have to wait a bit longer. If you end up waiting explain again that the interval is two minutes.
- Once your user appears in the Testing OU, double click the user to show their properties. Show the description has changed.
- Show the Member Of tab and point out that the user is no longer a member of the ProductionDBA group, which had granted them access to many of the things they used throughout the demo.
- Double click on the User Workstation link on the desktop.Login as your user.
- Once logged in, launch Toad.
- Once logged in, launch Toad.
- Double click the External user.
- Show that you have lost access.
- Double click the SYSTEM user and show that the SSO Watch client does not attempt to log you in since you’re no longer in the right group. Note the SSO Watch icon in the tray showing it is running.Exit Toad.
- Log off of the User Workstation.
- Confirm your logoff.
- Return to the slide deck and review the scenarios they have seen in the demo.
- Return to the slide show and advance the scenario 5 slide to the last animation. Again, the red dot will appear in the upper right before it is done. Explain that now the user will be terminated and their access will all be removed by virtue of their account in AD being disabled during deprovisioning.
- Return to the HR Workstation.
- Select the Status drop down and set the value to Terminated and then click Save.
- You are again waiting for the Quick Connect interval for sync. You are also waiting for the deprovisioning policies in ARS to run. These are some of the longest activities as they do a lot and touch everything. You can take this opportunity to explain that even though all the examples of automation used in this demo are about provisioning, that is not the only kind of automation you can use. ARS can automate using it’s policies based on the change of just about any attribute, movement of objects, creation of objects and even on regularly set schedules. You are trying to fill at least two minutes.
- Once you’ve waited some time, minimize the HR Workstation RDP session and then go back to the ARS Console. Click on the zDeprovisioned OU. If you do not see your user yet, click the refresh button in about 30 seconds.
- Once your user appears in the zDeprovisioned OU, double click the user to show their properties. Show how the description has changed.
- Click on the account tab and show how the logon has been scrambled by ARS. Point out the ARS also has an Undo Deprovisioning feature that will restore all the data scrambled except for the password. This can be ideal for temp workers or consultants who go in and out of the company.
- Return to the slide deck and review the scenarios they have seen in the demo.
- Return to the slide deck and advance to the scenario 6 slide. Advance the animation and explain that a lot had happened and that it all has been audited the entire time. Explain we have auditing interfaces for each of the products, a platform to gather and catalog all those logs along with all native logs from the various platforms we’ve used and we also have a free add on to that platform to supply a single place to report on all those audit sources using SQL Server Reporting Services.
- Return to the ARS Console, which should still be focused on the zDeprovisioned OU. Right click your user and select “Change History”. Explain this is a sample of auditing done at one of the end points touching the environment.
- Maximize the Change History window and show how it’s captured everything from the creation of the user through to the eventual deprovision.
- Expand the deprovision and show how it has details for every attribute and every step and even shows steps in the process that are pending like the eventual deletion of the user object. When you’re done, close the change history window.
- Click on the Knowledge Portal IE window to maximize it. Show how there is a wide array of reports and explain some have been group together for the demo, but they were all out of the box reports simply put in a folder. The Change Breakdown report should be selected from the prep steps at the start of the demo. Click on the “View Report in New Window” link. It will take some time for the new window to appear.
- Once the report window is there, select a value, suggection is “Last 3 weeks” for the Interval. Click the View Report button.
- Generating the report will take at least 45 seconds (likely more). While waiting, maximize the window. Use the two up arrow icon on the bottom right of the banner at the top to hide the options.
- Once the report shows up, explain it shows all the changes to AD made from any source.
- Expand the domain details by clicking on the plus sign on the left of the QSCExaple.com domain entry. Show how the report details the changes per container.
- You can also show how the user column will also expand to show who was responsible for the different changes to user objects.
- Lastly, show the export formats available by dropping down the selection menu to the left of the Export link. Then close this window.
- Click on the “User created or deleted by Domain” report on the left.
- The report will take a bit to come up. When it does, click on the “View Report in New Window” link.
- When the report appears, immediately click the View Report button to start it’s generation. It should go a bit faster then the first. Discuss how this report has many more customizable option and how they can build reports with many or few customizable field using the SQL Reporting Services platform.
- When the report comes up, show the info. If you user is not yet listed, explain the report engine is collected every 15-35 minutes and then the report database is updated after that on another interval. It’s possible the data has not yet reached the interface. We are not collecting logs that give the click through information for the links due to constraints on space and power. So attempting to click on them will fail.
- Click on the PMC window that was minimized. Explain that this is a console specific to the privilege delegation tool used when the process was killed during the demo. Explain that the Event and Trend data can all be sent to the central logging platform. Explain that you are going to show them the keystroke logging feature that shows what users did down to the keystroke when it’s applied. Explain it can be applied based on specific users, groups, command or shells and more based on a flexible set of policies and that set of policies can all be controlled centrally including being controlled via group policy when used in conjunction with Quest’s AD integration for their Unix and Linux hosts. Explain we are looking at this console on a master server that is potentially used to house policy and logs for many others, though it only has one in this lab. Explain that one is the alvschl01 host that is shown on the tree. Explain that the tree is organized in the default way, but could be done other ways as well with files for hosts groups by BU or other qualities.
- Expand the alvschl01 folder and show that there are many IO logs, which are where the command line keystrokes are stored for later viewing.
- Select a log and wait for it to load, this may take 30 seconds or more. The one selected on the screen is a good candidate.
- Hit the play button and show how the commands are replayed.
- Return to the slide deck and review the scenarios they have seen in the demo.