Enterprise SSO & Identity management / recommendations

Question

Hello Friends,

We've discussed SSO before. I would like to re-enhance the conversation with defined requirements, taking into consideration recent new developments.

In the past week I've been doing market research looking for answers to the following key issues:

The project should should be:

Requirements

• SSO solution for web applications.
• Integrates into existing developed products.
• has Policy based password security (Length, Complexity, Duration and co)
• Security Policy can be managed using a web interface.
• Customizable user interface (the password prompt and co. screens).
• Highly available (99.9%)
• Scalable.
• Runs on Red Hat Linux.

Nice to have

• Contains user Groups & Roles.
• Written in Java.
• Free Software (open source) solution.

None of the solutions came up so far are "killer choice" which leads me to think I will be tooling several projects (OWASP, AcegiSecurity + X??) hence this discussion.

We are ISV delivering front-end & backend application suite. The frontend is broken into several modules which should act as autonomous unit, from client point of view he uses the "application" - which leads to this discussion regrading SSO.

I would appreciate people sharing their experience & ideas regarding the appropriete solutions.

Some solutions are interesting

• CAS
• Sun OpenSSO Enterprise
• JBoss Identity IDM
• JOSSO
• Tivoli Access Manager for Enterprise Single Sign-On

Or more generally speaking this list

Thank you, Maxim.

Answer 1

Oracle Enterprise Single Sign-On is not what you're after - it requires a Windows executable to be deployed. Oracle Access Manager is closer to what you're after (though it's not free or Java-based).

Answer 2

The major commercial players in the Identity and Access Management (IAM) market space are CA, Oracle, IBM, Sun and Novell. None of these are free solutions but they have many of the features that you are looking for.

For free software, I recommend DACS: The Distributed Access Control System. I know that one department where I work has implemented this with great success. It doesn't have as many features the commercial IAM products but otherwise is a good solution.

Answer 3

I have used Tivoli Access Manager backing onto Websphere and IIS boxes - the way it writes access information into the page headers is very useful. On the downside, I didnt find the DB2 Ldap backend very scalable or reliable, and you know with IBM this isn't going to come cheap.

Also the asynchronous paths (junctions) used to identify different servers is a bit of a hack really eg http://mysite/myserver/myapp - a very bad idea and not thought through very well.

Answer 4

What about FreeIPA?

"FreeIPA is an integrated security information management solution combining Linux (Fedora), 389 (formerly known as Fedora Directory Server), MIT Kerberos, NTP, DNS. It consists of a web interface and command-line administration tools."

If you focus on web applications, check out http://oauth.net/.

Answer 5

CAS has strong adoption, user-base, and a strong lead (who recently switched jobs, but is still comitted to the project). It is straightforward to integrate (if you're comfortable writing Java code/configuring Spring beans), and can do all your requirements, noteably:

SSO solution for web applications.

YES

Integrates into existing developed products.

YES (though some cleaner than others - but many modules are available for major products, and it supports common standards (SAML, OpenID).

has Policy based password security (Length, Complexity, Duration and co)

*YES - can easily be implemented, and some extensions to integrate with LDAP (probably the most common user store) are supported

Security Policy can be managed using a web interface.

NO - though one could be build fairly simply - if you're comfortable with development, and given that this is likely to be a non-trivial project, I'd recommend considering this a non-blocker given that the product is open-source

Customizable user interface (the password prompt and co. screens).

YES - easily customized through some basic HTML/CSS editing

Highly available (99.9%)

YES - both reliable, and can support multiple node/failover scenarios easily

Scalable.

YES - used in many high-traffic environments both intranet and internet

Runs on Red Hat Linux.

YES