I'm just using a secure global desktop product to get into a remote instance of Windows, because I'm using my Mac and we have this thing out on the web. So what I'm going to do is go into the fam demo, and that should get us into some... So I've got to remember the super secure password. So you can speed this up so it looks like I can actually type and I know the password, can't you? Okay, so now we're in. So we've just logged into Windows exactly as anybody might do in any enterprise around the world. So what we've got is an icon to go to our company portal. Our fictitious company is called IDENTRIC. So we can just double click there and we go into our portal page. And it's recognized us as John Smith. We've actually done a single sign-on using WS federation from ADFS, which is Microsoft's federation solution, Active Directory Federation Services, into OpenSSO. And OpenSSO is supporting this little portal here. So what we'll do is we'll just go through the usual user experience of, okay, I need to go to my Google Mail and I just click the link and the mail will come up. And, oh, look, I've got an email today. My goodness. What a surprise. So somebody called Pat Patterson saying hi to John Smith. And then, you know, I've checked my email. I can go into Salesforce and it's just exactly the same. I click on the Salesforce icon and I'm into Salesforce. And I have my John Smith desktop here. And, oh, my goodness, we're doing some video with these guys.
2:01Redmonk at Hello in the Clock today. And you haven't even had to log in. That's sort of the point of what's coming up here, right? That's right. Everything here is driven from that original login to Windows. So what we can do is if we get out of here and we turn, we can turn on a little program called IE HTTP headers to see all the communications as they fly by. What we can do is we can repeat that and actually have a little look under the covers. So you see a whole lot of stuff well by down here. But if we scroll up, scroll up, scroll up, scroll up, scroll up. What we can actually see here, if you're an absolute techie and you've got really good eyes, is that this is a WS Federation sign-in message. So it says W sign-in 1.0, request security token response. There's a SAML assertion in there. A little bit further down somewhere it says JS1234identric.org. So that's my UPN, my principal name at, as far as AD is concerned, that's gone over the wire in this signed message to OpenSSO to say, this is John Smith. And this is the portal software doing this, right? This is what happens is the portal software is based on OpenSSO. So the portal software says, OpenSSO, you've got to tell me who this user is. OpenSSO says, I have no idea, but I've been told to go and ask ADFS. So it sends a WS Federation authentication request to ADFS, and ADFS comes back with this response, which says, this is JS1234. And then OpenSSO is able to look that up and say, ah, it's John Smith, and he's allowed access. And then exactly the same thing happens when I go to Google Mail, that we have this hail of messages fly by. Google Mail's particularly good because it's requesting whole hosts of little images and stuff.
4:05But if we go back up to the top, if we go up there, somewhere there's a really big message that's got that SAML encoded. So we're doing, there it is there, SAML encodes it a little bit more, but you can see SAML response there. So we're doing exactly the same interaction with Google. This time, the user clicks on the Google icon, and Google says, I don't know who you are, but I know that I can ask IDENTRIC who you are, sends a SAML authentication request, and IDENTRIC comes back with that signed response again to say, this is JS1234. And the user gets into his email, and nobody else can. And nobody can get into that email via any other mechanism than coming from the Enterprise IDENTRIC. You can't just log in from home and say, oh, yeah. Right. And that helps with the, as we were talking about earlier, the deauthorization, or de, not deauthorization, but the deprovisioning. Yeah, in fact. Because the IDENTRIC thing can take care of that. That's right. That's right. You've almost got like a double check. As soon as the IDENTRIC goes out of IDENTRIC, you lose the ability to single sign on. So even if you're, you know, a few minutes, a few hours, a couple of days before you actually close down that account at Google itself, you've got no way to get at it because you can only go through the IDENTRIC systems. So it's another layer of security. And I've got to resist saying the password. So here we're going to like check out configuring it, if you will. Yeah, yeah. We're just going to have a little look. So this is the Federated Access Manager admin console. And we can go in here and we can see all this configuration here. And this is actually quite an old build of OpenSSO. So it's got a few things that have changed. One thing is that the product name is now OpenSSO Enterprise rather than Federated Access Manager. But we can see the Google SAML service provider.
6:08We can see the IDENTRIC SAML identity provider. And then the WS Federation counterpart. So it's almost like OpenSSO is a bridge between these two protocols. And we can go in and we can kind of really get down and dirty and start clicking around and looking at endpoints and URLs and everything. So this is just where you would configure the different things you would need to interact with different services. Correct, yeah. And you would just say, okay, I want a new service and kind of click through there to add new service providers. I mean, it seems like the admin stuff we saw, you don't interact with that all the time. It's just an initial setup. Correct, yeah. Yeah, yeah. Yeah, well, that looks like interesting stuff. Yeah, this is about it. I mean, the thing is we've worked hard on making this so seamless and easy to do that there's very little left to show. Right, right. This is, you know, the classic plumbing where if everything's going right, there really isn't anything to see. We better not shut down, we'll just say log off. Yeah, that's where the whole concept of federated mashups is really intriguing. Because if you forget about the technology and you just think about, I want to have these services embedded in my corporate portal. You know, you should be able to pick and choose from anything. Right. It shouldn't matter if it's in-house or out-of-house. Right. Out-house. Yeah.