Authorization Principles
Organizations who integrate the STS with their legacy applications always adequate precautions in ensuring that the security controls are in place. While authentication (e.g. UserContextModes) is the primary method by which unauthorized access is managed, the other aspect that needs to be considered is authorization. Authorization takes the additional step to verify or make the decisions if a user should have access to the external application. There are three tiers in managing access to external service providers:
- At the legacy application level: in this case the application itself determines if the user is authorized (typically via roles) to access the external service providers. Most implementations will have the logic in the application decide if the link to the external service provider should be displayed or rendered.
- Leveraging Orbital Lite STS: using it's Allow/Deny rules and leveraging group memberships on directory services. Here the STS will check if the users is a member of a specific group and grant access to the external provider accordingly
- Using Service Provider access controls: some service providers control the provisioning based on an approved user list or designated roles. In federated identifies with authenticated identity providers (based on contractual stipulations), the role assignment and its managements may be delegated to the source system; e.g. a hospital has 3 roles defined with the SP and will assign them accordingly in the source application.
Ideally all three tiers should be implemented to ensure a highly-controlled access model. Realistically, there may be undue operational overhead and complexity. In additional performing unnecessary access control validation may add latency and impact performance. Here we present the recommended minimum access controls per UserContext Mode.
Recommended Access Control Tiers
| UserContextMode | Tier 1: Source Application | Tier 2: Orbital Lite STS | Tier 3: Service Provider |
|---|---|---|---|
| 1: Individual Hash | Yes, display link for authorized users | Optional | Optional |
| 2: Organizational Hash | Yes, display link for authorized users | Optional | Optional |
| 3: Individual Plaintext Password | Yes, display link for authorized users | Yes, check for authorization | Optional |
| 4: Windows Authentication | Optional, display link for authorized users | Yes, check for authorization | Optional |
| 5: Client-side Certificates | Optional, display link for authorized users | Yes, check for authorization | Optional |
| 6: SSO Cookie | Optional, display link for authorized users | Yes, check for authorization | Optional |
| 7: ADFS Integration | Optional, display link for authorized users | Optional, leverage ADFS to assign assertions | Optional |
Additional Compensating Controls
Organizations are strongly encouraged to review logs and audit user activity at least monthly. If possible, the activity at the Service Provider level should be reviewed and authorized access validated. This should be done in collaboration with both parties, as the SP typically has no visibility into the userbase at the organization, and the organization may not have the knowledge to interpret the activity generated by the SP logs/reports.
