Domain 12 - Identity, Entitlement, and Access Management

Question 1

How is IAM different in the cloud?

Answer 1

1. Involvement of multiple organizations in the IAM process - i.e. cloud provider and cloud user.
2. Use of Federation to manage hundreds of clouds (Federation at scale)
3. Differences between cloud providers and platforms

Question 2

What is XACML?

Answer 2

• Extensible Access Control Markup Language
  Policy language for defining access controls at a Policy Decision Point and passing them to a Policy Enforcement Point.
  -Used with SAML and OAuth
• AWS has its own JSON based policy language; we don’t use XACML.

Question 3

What are the two architectures for managing identity providers and service provider relationships?

Answer 3

1. Hub & Spoke model - a broker is used to negotiate between multiple authoritative identity providers and service providers.
2. Free Form - each service provider connects to all the identity providers in a full-mesh network.

The user of brokers means that internal IdPs don’t need to be exposed to the Internet.

Question 4

What are key architectural decision regarding IAM that enterprises have to make?

Answer 4

• What kind of architecture to use?
• What is the provisioning process for new users and how to integrate that process with the use of cloud?
• How to integrate new cloud services into the IAM infrastructure? - e.g. new federation connections
• Managing identity lifecycle - registration/creation, provisioning, change, deletion/deregistration.
• Managing entitlements
• What standards to support (SAML? OAuth? OIDC?).

Question 5

What is authentication and who is responsible for it?

Answer 5

• AuthN is the process of proving or confirming an identity.
• The Identity Provider is responsible for AuthN.
• When using MFA, the MFA status is passed by the IdP to the relying party as an attribute.

Question 6

What’s Authorization, Access Control and Entitlement?

Answer 6

• Authorization is permission to do something - e.g. access a file
• Access Control - allows or denies an expression of that authorization. It may involve ensuring that the user is authenticated before allowing access.
• Entitlement - maps identities to authorizations (who is allowed to do what?).

Cloud providers responsible for Authorization and Access Control
Cloud user responsible for Entitlement.

Question 7

How does cloud affect Auth, Access Control and Entitlement?

Answer 7

• Cloud platform specific authorization language
• Cloud provider responsible for Auth and Access Control
• Cloud user responsible for Entitlement
• User of RBAC and ABAC
• Cloud Provider must provide ABAC and granular policy definitions and controls
• User of Federation for AuthN.