Managing Identities with Server Chaining and SmartBadges

discussion from Chevron at OpenWorld

Roger Raj – Oracle
Roy DeRenzi – Chevron

project connects badge with pin code into the database and identity server. The technology behind this is how to integrate the AD server, Applicaiton Server, and JD Edwards, and other Oracle app technology.

Most applications web based. Global IDs and Desktop Ids
SmartBadge is a common access card. It contains a Java Chip that has the user credentials. It authenticates you locally without passing passwords over the network. It also has the ability to lock/destroy itself if multiple passwords fail. The idea is to authenticate against the card and the card connects to Kerberos without passing the password across the network.

Server chaining  has identities stored in one server and referred to by another server. User entries are not replicated. The request is redirected to the other auth server. Oracle currently supports redirection to LDAP and Active Directory. It is available in the OID 10.1.4 and higher versions

Chevron uses AD for user provisioning and auth/authz. Smart badges presents a user certificate and passes the cert across the network. Kerberos is used for all IT services and tickets are passed between applications.

The unique part of this solution is that the Oracle 10gAS SSO server is linked into the Kerberos server and the ticket exchange is done with the AD server. The user is logged in to the web env without having to authenticate into the service.

Four major OID servers. One in US is master, others are primary for the site but replicas of the master. Each of the primary OID servers locally sync with the local AD server.

The mapping of an AD entry to an OID entry was relatively easy. There were some challenges and did require some sophisticated search filters to restrict the search to ensure that all of the information was not brought across with a user search.

Issues with sync – network bandwith caused backlogs in updates. Group entry changes caused a flurry of transactions in a short window. The capacity of the AD server lookups was not adequate at peak loads.

Server chaining allowed the directory to be virtualized and entries did not need to be replicated between AD and OID. The OID was populated with a reference. This did put more of a load on the AD server for simple queries but not for large search queries.

When a change occurs in AD, a reference is pushed out to the OID server and not the actual data. This was challenging at first but worked better once it was deployed. By default chaining is disabled. When you enable it it allows for bind, compare, modify, and search LDAP functions. Nothing needs to be changed in AD to make this happen.

Summary, two different options, Server chaining or Directory Integration Process. One or both can be used. Chevron used server chaining to reduce replication and delays involved in walking through the AD change logs (which include login events).

A good example of where the DIP component is needed is where a portal function is required that needs more attributes in the LDAP server where AD can not or does not want to store these attributes. In this example, DIP is required and chaining can not be used.

This solution does require alternate solutions for lost badges, badges left at home and temporary access for the day, and charge backs to the departments for help desk support.

280 thoughts on “Managing Identities with Server Chaining and SmartBadges”

  1. I am also commenting to let you be aware of what a brilliant discovery my cousin’s princess enjoyed going through your web page. She learned such a lot of issues, not to mention what it’s like to have an awesome helping spirit to let the others without hassle fully grasp specified problematic matters. You actually surpassed her desires. Many thanks for offering such useful, safe, explanatory not to mention unique thoughts on this topic to Tanya.

  2. I and also my pals happened to be looking at the good secrets and techniques found on your website while unexpectedly developed a horrible suspicion I had not thanked the web blog owner for those tips. The ladies had been so stimulated to read through them and have now extremely been using these things. Thank you for actually being so accommodating and for going for some wonderful resources most people are really desperate to be aware of. Our own sincere apologies for not expressing gratitude to you sooner.

  3. I would like to get across my respect for your kindness for individuals who should have assistance with that situation. Your personal dedication to getting the solution up and down had become extraordinarily effective and have always helped women much like me to arrive at their desired goals. Your personal invaluable suggestions implies much a person like me and especially to my office colleagues. Many thanks; from everyone of us.

  4. I precisely wished to thank you so much yet again. I do not know the things that I would’ve made to happen without the advice contributed by you relating to that theme. It truly was an absolute challenging dilemma in my position, nevertheless noticing a new specialized approach you resolved that made me to jump with contentment. Extremely happy for the support and wish you recognize what a powerful job you happen to be getting into teaching people with the aid of a blog. I’m certain you haven’t come across any of us.

  5. Thanks a lot for giving everyone an extraordinarily remarkable chance to read critical reviews from this web site. It’s always very nice plus jam-packed with a lot of fun for me and my office mates to visit your website at the very least 3 times in one week to study the newest issues you have got. Not to mention, I’m just always fulfilled with the fantastic tricks served by you. Selected 3 ideas on this page are surely the most suitable we have all ever had.

  6. I want to express my love for your kindness in support of people that absolutely need help with this one idea. Your personal commitment to passing the solution all-around appeared to be really good and has regularly enabled others like me to get to their objectives. Your amazing informative guideline can mean a whole lot to me and somewhat more to my peers. Warm regards; from all of us.

  7. I just wanted to make a quick comment to express gratitude to you for those lovely facts you are showing here. My time consuming internet look up has at the end of the day been rewarded with brilliant suggestions to exchange with my relatives. I would admit that most of us readers actually are rather lucky to exist in a great site with many perfect professionals with insightful suggestions. I feel pretty lucky to have come across the web page and look forward to many more amazing moments reading here. Thanks once more for everything.

  8. I simply needed to thank you so much yet again. I am not sure what I would’ve used without the tips and hints shown by you directly on this situation. It truly was the depressing scenario for me personally, nevertheless considering the skilled approach you solved that took me to leap for contentment. I’m just happier for this support and in addition expect you know what a powerful job that you are putting in instructing others by way of a site. I know that you’ve never come across all of us.

  9. I am only writing to let you know of the fabulous experience my wife’s child developed reading through your web page. She came to find a lot of issues, not to mention how it is like to possess a wonderful giving character to make other people smoothly know just exactly chosen advanced subject matter. You undoubtedly surpassed readers’ expectations. Many thanks for churning out these useful, safe, explanatory and also easy tips on your topic to Jane.

  10. I must voice my admiration for your generosity supporting persons who actually need guidance on the niche. Your special dedication to getting the solution along ended up being quite advantageous and has all the time allowed professionals much like me to realize their aims. The warm and helpful suggestions signifies a lot a person like me and further more to my mates. Warm regards; from all of us.

  11. I precisely wanted to say thanks once again. I’m not certain the things I would’ve achieved without the entire tips provided by you concerning such theme. Previously it was the intimidating case for me, nevertheless understanding the specialized manner you dealt with it took me to weep with happiness. Now i am happier for the help as well as trust you realize what an amazing job your are providing educating many people by way of your websites. I am sure you have never come across all of us.

  12. I and also my buddies came following the good pointers from your web blog and then immediately I got a terrible suspicion I never expressed respect to you for those tips. The young men had been absolutely warmed to study all of them and have now certainly been enjoying them. We appreciate you actually being so helpful and also for utilizing such magnificent information millions of individuals are really needing to understand about. Our honest apologies for not expressing gratitude to you earlier.

  13. I must express some appreciation to the writer just for bailing me out of this type of scenario. Right after browsing throughout the online world and coming across ideas which are not productive, I was thinking my entire life was over. Being alive devoid of the solutions to the issues you have sorted out all through your main site is a critical case, as well as those that might have badly damaged my entire career if I hadn’t discovered your web blog. Your main capability and kindness in taking care of every item was crucial. I’m not sure what I would’ve done if I had not discovered such a thing like this. It’s possible to now look forward to my future. Thank you so much for your skilled and results-oriented guide. I won’t be reluctant to propose the blog to any person who needs and wants support on this matter.

  14. I must express appreciation to you just for bailing me out of this problem. After searching throughout the the net and seeing recommendations which are not beneficial, I believed my life was done. Being alive minus the approaches to the issues you’ve solved all through your guide is a crucial case, and the kind that might have badly damaged my entire career if I had not discovered your blog. Your primary competence and kindness in handling every item was important. I’m not sure what I would’ve done if I had not discovered such a point like this. I can also at this time look ahead to my future. Thank you so much for your professional and effective guide. I won’t think twice to suggest your web blog to anybody who will need tips on this topic.

  15. I not to mention my pals were found to be going through the nice guidelines on the website then all of the sudden got a horrible feeling I had not expressed respect to the site owner for those strategies. My young boys were for that reason thrilled to see all of them and now have truly been taking advantage of those things. Thanks for indeed being well thoughtful and for making a choice on this form of high-quality areas most people are really wanting to learn about. My honest apologies for not expressing appreciation to you sooner.

  16. I precisely needed to appreciate you yet again. I’m not certain the things I would have undertaken in the absence of the methods documented by you concerning such a problem. It had become a terrifying difficulty in my opinion, however , discovering the specialized way you dealt with it took me to weep over gladness. Extremely thankful for this advice and then wish you are aware of a powerful job you are getting into training many people with the aid of your blog post. Probably you have never come across all of us.

  17. I have to express thanks to the writer for bailing me out of such a problem. As a result of looking out through the online world and getting proposals that were not beneficial, I figured my entire life was over. Existing devoid of the approaches to the issues you have fixed by means of this guide is a crucial case, and ones which might have badly affected my entire career if I hadn’t noticed your web site. Your primary training and kindness in controlling the whole lot was important. I’m not sure what I would have done if I had not come across such a step like this. I am able to at this point look forward to my future. Thanks a lot so much for your skilled and effective help. I will not hesitate to suggest your blog post to anybody who desires guidelines on this situation.

  18. I needed to put you this tiny word to thank you very much over again just for the pleasing ideas you’ve discussed on this website. It is extremely open-handed of people like you to offer openly precisely what a lot of folks could possibly have advertised for an ebook to help make some money on their own, most importantly given that you could have done it if you ever considered necessary. These strategies as well acted to become a fantastic way to realize that other people have similar dreams much like my personal own to understand way more on the subject of this condition. I am sure there are many more enjoyable times up front for many who looked at your blog.

  19. I simply wanted to appreciate you once again. I’m not certain the things that I would have created in the absence of the type of strategies documented by you regarding that situation. It had been a real frustrating scenario in my circumstances, however , coming across this specialized fashion you solved it made me to leap with delight. I am just happier for the work and in addition hope you know what a great job you are always putting in teaching the others thru a blog. I am certain you haven’t come across any of us.

  20. Thanks for your whole efforts on this site. My aunt enjoys going through internet research and it’s simple to grasp why. We all know all concerning the dynamic manner you give reliable thoughts through the web site and recommend participation from some other people on the concern so our princess is now becoming educated a whole lot. Enjoy the remaining portion of the new year. You are always carrying out a terrific job.

  21. I intended to send you the very little observation to thank you so much as before for these pretty strategies you’ve shown here. This is so seriously generous with you to make freely what most people would’ve marketed as an electronic book to generate some money on their own, and in particular considering the fact that you could have done it in case you considered necessary. Those principles also worked as a fantastic way to recognize that many people have a similar keenness similar to my personal own to understand somewhat more regarding this matter. I’m certain there are thousands of more pleasant times up front for individuals that examine your blog post.

  22. I’m just commenting to let you know what a brilliant discovery my wife’s princess developed reading yuor web blog. She picked up too many things, including how it is like to possess an incredible teaching nature to have certain people with no trouble thoroughly grasp a variety of advanced issues. You actually surpassed her expected results. I appreciate you for producing those priceless, dependable, informative and in addition fun guidance on that topic to Lizeth.

  23. I must express my appreciation to this writer for rescuing me from this situation. After researching throughout the the web and finding principles which were not helpful, I believed my entire life was over. Existing devoid of the approaches to the difficulties you have resolved all through your good report is a serious case, as well as ones that would have in a wrong way damaged my entire career if I hadn’t encountered the blog. Your primary understanding and kindness in controlling almost everything was crucial. I’m not sure what I would have done if I had not encountered such a point like this. I can also at this moment relish my future. Thanks so much for this high quality and effective guide. I will not hesitate to recommend the sites to anyone who should receive guide about this situation.

  24. I needed to send you a very small note to help thank you so much over again with the splendid ideas you have shown here. This is simply tremendously open-handed of people like you to present openly what exactly some people would’ve made available for an e book to help with making some cash on their own, most notably now that you might well have done it if you ever desired. The solutions as well acted as the fantastic way to understand that the rest have similar dream really like my personal own to grasp whole lot more in regard to this problem. I think there are many more fun occasions in the future for those who look over your website.

  25. I together with my friends were actually reading through the good things from the website and unexpectedly developed a terrible suspicion I never thanked the web blog owner for them. All the guys happened to be thrilled to see them and have definitely been taking advantage of them. Thank you for actually being very accommodating as well as for selecting variety of really good tips most people are really desperate to learn about. Our honest regret for not expressing gratitude to you earlier.

  26. My husband and i got so joyous that Raymond managed to complete his studies from your precious recommendations he gained in your web pages. It is now and again perplexing to just be offering solutions which often the others might have been trying to sell. We really see we have got you to appreciate for this. All of the explanations you made, the easy web site navigation, the friendships you will aid to engender – it is everything superb, and it is letting our son in addition to the family do think that topic is pleasurable, and that’s especially mandatory. Thank you for the whole thing!

Leave a Reply

Your email address will not be published. Required fields are marked *