Windows Azure Active Directory (Identity) Overview
-
Upload
windows-azure -
Category
Documents
-
view
855 -
download
3
Transcript of Windows Azure Active Directory (Identity) Overview
Windows Azure Active Directory
90 Day Free Trial: http://aka.ms/vs4rdw
Public
Commontechnologie
s
Identity ▪ Virtualization ▪ Management ▪ Development
Private
Broad & deep array of solutions enables customers to use cloud in their own way, at their own pace
Microsoft approach: hybrid cloud
What if we could?
RESPONDING to the needs for interoperability, social networking, flexibility, and simplicity
REINVENTED for the cloud with modern protocols
PROVIDE the enterprise capabilities of Active Directory
Windows Azure Active Directory is a modern cloud service providing identity management and access control capabilities to cloud applications.
Identity Solution: Cloud Single Sign-on with Access Control
Windows Live ID
On-PremisesActive Directory
ADFS 2.0
Third Party Apps
Windows AzureActive Directory
Microsoft Apps
Your Apps
Active Directory in IaaS
• Through Virtual Networking connectivity, on-premises Active Directory allows domain join and single sign-on for applications in Azure
• Windows Server Active Directory can now be hosted in a Virtual Machine in Windows Azure to support SharePoint or SQL Server and for performance and redundancy
On-premise subnets
DCDNS
Active Directory
Persistent VM Role
DC DNS
Active Directory
Persistent VM Role
Persistent VM Role
SQL
SharePoint
Windows Azure Active Directory
Windows Azure Authentication
LibraryDeveloper library to make authentication in Azure apps easy
Windows Azure AD Graph
Developer Restful API for the cloud directory
Windows Azure AD
Access ControlCentralized
authentication and authorization hub
Windows Azure AD
DirectoryCloud-based identity
store / provider
WHAT IT ISWHAT IT DOES USE IT TO
Access Control
Claims-based, Federated authorization management service
Simplify user access authorization across organizations and ID providers
Perform claims transformation to map identities with access levels
Secure Service Bus communications
Secure web services
Secure web applications
Access Control
Identity Challenges
UserDoesn’t want to use different identity for every app
DeveloperDoesn’t want to write code to support multiple identity providers
AdministratorWants to easily grant access to apps to Active Directory identities
Active Directory
Cloud App
Identity Challenges
Identity Solution: Cloud Single Sign-on with Access Control User
Can use his preferred Identity Provider
DeveloperWrites one set of code to accommodate multiple Identity Providers
AdministratorGrants access to all AD users by establishing trust between AD and ACS
Access Control Active
Directory
ADFS 2.0
Identity Solution: Cloud Single Sign-on With Access Control
WHAT IT ISWHAT IT DOES USE IT TO
Access Control
A multi-tenant cloud directory
Stores identities, group and role information that can be used for authentication and authorization
Control access to Microsoft online services such as Office 365, Dynamics CRM Online and Windows Intune, as well as Windows Azure applications for a true single sign-on experience
Directory
Directory• Cloud authentication, authorization multi-tenant
directory for Microsoft and 3rd party cloud services
• “Organization-owned” identity provider
• Easily federates and synchronizes with on-premises AD
• Central “hub” to provision/de-provision/manage users and their computers/devices
• Support for multi-factor authentication
PREVIEW IN JULYUser accounts in Windows Azure AD can access Azure and 3rd party applications with a simple configuration through Windows Azure AD Access Control
Currently requires Office 365, Dynamics online, or InTune. Will open up later to general Azure usage.
SAML
WHAT IT ISWHAT IT DOES USE IT TO
Access Control
An enterprise social graph service
Provides a way for applications to query the Directory and other sources for identity information and relationships, to provide a richer experience for users
Build social enterprise apps
Graph
Windows Azure AD GraphPREVIEW IN JULY
New enterprise social graph for Active DirectoryREST interfaces and explorer to read and modify – secure and easy
Enterprise people picker for applications
Extensible AD graph – links to external resources enabling discovery – enables an “enterprise social graph”
Applications publish information in Windows Azure AD
RESTful interface supporting OAuth, JSON and OData
WHAT IT ISWHAT IT DOES USE IT TO
Access Control
A developer library Provides a way for developers to easily take advantage of Windows Azure AD from their rich client applications and services
Add authentication capabilities to your rich client applications
Authenticate incoming calls to your services
Windows Azure Authentication Library
Windows Azure Authentication LibraryPREVIEW IN JULYNew library for helping developers to authenticate against Windows Azure AD
First release supports rich clients and services, web pages will follow in the near future
First release on .NET: Node.JS, Java, PHP will follow
Rich clients:
• Add authentication experiences for users from AAD, ADFS2 and any other IdP type supported by AAD with as little as two lines of code
Services:
• Easily add validation logic in just few lines of code
Single sign-on across all your cloud applications
ScenariosWindows Azure Active Directory enables:
Build social enterprise apps in the cloud
Build Secure Applications that integrate with multiple web identity providers
For ISVs and organizations of all sizes
Enterprises
CSVs
• Centralized policy and access control• Single sign-on for users to Microsoft and 3rd
party applications running in the cloud• Easy administration – sync and federate to on-
prem AD• Deliver SaaS solutions in Azure with single-
sign-on from users in Windows Azure AD (Office 365)
• Write applications using a new enterprise social graph
Small Business• Provide access control with no on-prem identity
infrastructure required• Easy to use with little IT skills required
How it works
ACCESS CONTROL
YOUR SERVICE CUSTOMER
1 Define access control rules
0 Establish trust via key exchange
2Request token(pass input claims)
4 Return token (receive output claims)
5 Send messagewith token
3 Map input claims to output claims based on access control rules
6 Process
token
How it Works
Now
Access Control GA
July 2012
Preview• SSO against Directory• Graph API• WAAL
GA• SSO against Directory• Graph API• WAALWindows Azure Portal uses WA AD for authentication and authorization
Q4 CY12
Roadmap and Timeline
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to
be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.
90 Day Free Trial: http://aka.ms/vs4rdw