1 00:00:00,000 --> 00:00:11,000 I'm just using a secure global desktop product to get into a remote instance of Windows, 2 00:00:11,000 --> 00:00:15,000 because I'm using my Mac and we have this thing out on the web. 3 00:00:15,000 --> 00:00:24,000 So what I'm going to do is go into the fam demo, and that should get us into some... 4 00:00:24,000 --> 00:00:32,000 So I've got to remember the super secure password. 5 00:00:32,000 --> 00:00:37,000 So you can speed this up so it looks like I can actually type and I know the password, can't you? 6 00:00:37,000 --> 00:00:38,000 Okay, so now we're in. 7 00:00:38,000 --> 00:00:46,000 So we've just logged into Windows exactly as anybody might do in any enterprise around the world. 8 00:00:46,000 --> 00:00:51,000 So what we've got is an icon to go to our company portal. 9 00:00:51,000 --> 00:00:54,000 Our fictitious company is called IDENTRIC. 10 00:00:54,000 --> 00:00:59,000 So we can just double click there and we go into our portal page. 11 00:00:59,000 --> 00:01:02,000 And it's recognized us as John Smith. 12 00:01:02,000 --> 00:01:08,000 We've actually done a single sign-on using WS federation from ADFS, 13 00:01:08,000 --> 00:01:14,000 which is Microsoft's federation solution, Active Directory Federation Services, 14 00:01:14,000 --> 00:01:15,000 into OpenSSO. 15 00:01:15,000 --> 00:01:20,000 And OpenSSO is supporting this little portal here. 16 00:01:20,000 --> 00:01:25,000 So what we'll do is we'll just go through the usual user experience of, 17 00:01:25,000 --> 00:01:32,000 okay, I need to go to my Google Mail and I just click the link and the mail will come up. 18 00:01:32,000 --> 00:01:36,000 And, oh, look, I've got an email today. 19 00:01:36,000 --> 00:01:37,000 My goodness. 20 00:01:37,000 --> 00:01:38,000 What a surprise. 21 00:01:38,000 --> 00:01:43,000 So somebody called Pat Patterson saying hi to John Smith. 22 00:01:43,000 --> 00:01:46,000 And then, you know, I've checked my email. 23 00:01:46,000 --> 00:01:49,000 I can go into Salesforce and it's just exactly the same. 24 00:01:49,000 --> 00:01:53,000 I click on the Salesforce icon and I'm into Salesforce. 25 00:01:53,000 --> 00:01:58,000 And I have my John Smith desktop here. 26 00:01:58,000 --> 00:02:01,000 And, oh, my goodness, we're doing some video with these guys. 27 00:02:01,000 --> 00:02:03,000 Redmonk at Hello in the Clock today. 28 00:02:03,000 --> 00:02:05,000 And you haven't even had to log in. 29 00:02:05,000 --> 00:02:06,000 That's sort of the point of what's coming up here, right? 30 00:02:06,000 --> 00:02:07,000 That's right. 31 00:02:07,000 --> 00:02:12,000 Everything here is driven from that original login to Windows. 32 00:02:12,000 --> 00:02:18,000 So what we can do is if we get out of here and we turn, 33 00:02:18,000 --> 00:02:27,000 we can turn on a little program called IE HTTP headers to see all the communications as they fly by. 34 00:02:27,000 --> 00:02:31,000 What we can do is we can repeat that and actually have a little look under the covers. 35 00:02:31,000 --> 00:02:36,000 So you see a whole lot of stuff well by down here. 36 00:02:36,000 --> 00:02:40,000 But if we scroll up, scroll up, scroll up, scroll up, scroll up. 37 00:02:40,000 --> 00:02:45,000 What we can actually see here, if you're an absolute techie and you've got really good eyes, 38 00:02:45,000 --> 00:02:49,000 is that this is a WS Federation sign-in message. 39 00:02:49,000 --> 00:02:53,000 So it says W sign-in 1.0, request security token response. 40 00:02:53,000 --> 00:02:55,000 There's a SAML assertion in there. 41 00:02:55,000 --> 00:03:00,000 A little bit further down somewhere it says JS1234identric.org. 42 00:03:00,000 --> 00:03:08,000 So that's my UPN, my principal name at, as far as AD is concerned, 43 00:03:08,000 --> 00:03:14,000 that's gone over the wire in this signed message to OpenSSO to say, this is John Smith. 44 00:03:14,000 --> 00:03:17,000 And this is the portal software doing this, right? 45 00:03:17,000 --> 00:03:22,000 This is what happens is the portal software is based on OpenSSO. 46 00:03:22,000 --> 00:03:27,000 So the portal software says, OpenSSO, you've got to tell me who this user is. 47 00:03:27,000 --> 00:03:32,000 OpenSSO says, I have no idea, but I've been told to go and ask ADFS. 48 00:03:32,000 --> 00:03:39,000 So it sends a WS Federation authentication request to ADFS, and ADFS comes back with this response, 49 00:03:39,000 --> 00:03:43,000 which says, this is JS1234. 50 00:03:43,000 --> 00:03:49,000 And then OpenSSO is able to look that up and say, ah, it's John Smith, and he's allowed access. 51 00:03:49,000 --> 00:03:59,000 And then exactly the same thing happens when I go to Google Mail, that we have this hail of messages fly by. 52 00:03:59,000 --> 00:04:05,000 Google Mail's particularly good because it's requesting whole hosts of little images and stuff. 53 00:04:05,000 --> 00:04:13,000 But if we go back up to the top, if we go up there, somewhere there's a really big message that's got that SAML encoded. 54 00:04:13,000 --> 00:04:19,000 So we're doing, there it is there, SAML encodes it a little bit more, but you can see SAML response there. 55 00:04:19,000 --> 00:04:23,000 So we're doing exactly the same interaction with Google. 56 00:04:23,000 --> 00:04:33,000 This time, the user clicks on the Google icon, and Google says, I don't know who you are, but I know that I can ask IDENTRIC who you are, 57 00:04:33,000 --> 00:04:42,000 sends a SAML authentication request, and IDENTRIC comes back with that signed response again to say, this is JS1234. 58 00:04:42,000 --> 00:04:48,000 And the user gets into his email, and nobody else can. 59 00:04:48,000 --> 00:04:54,000 And nobody can get into that email via any other mechanism than coming from the Enterprise IDENTRIC. 60 00:04:54,000 --> 00:04:56,000 You can't just log in from home and say, oh, yeah. 61 00:04:56,000 --> 00:04:57,000 Right. 62 00:04:57,000 --> 00:05:03,000 And that helps with the, as we were talking about earlier, the deauthorization, or de, not deauthorization, but the deprovisioning. 63 00:05:03,000 --> 00:05:04,000 Yeah, in fact. 64 00:05:04,000 --> 00:05:06,000 Because the IDENTRIC thing can take care of that. 65 00:05:06,000 --> 00:05:07,000 That's right. 66 00:05:07,000 --> 00:05:08,000 That's right. 67 00:05:08,000 --> 00:05:10,000 You've almost got like a double check. 68 00:05:10,000 --> 00:05:16,000 As soon as the IDENTRIC goes out of IDENTRIC, you lose the ability to single sign on. 69 00:05:16,000 --> 00:05:24,000 So even if you're, you know, a few minutes, a few hours, a couple of days before you actually close down that account at Google itself, 70 00:05:24,000 --> 00:05:29,000 you've got no way to get at it because you can only go through the IDENTRIC systems. 71 00:05:29,000 --> 00:05:32,000 So it's another layer of security. 72 00:05:32,000 --> 00:05:36,000 And I've got to resist saying the password. 73 00:05:36,000 --> 00:05:39,000 So here we're going to like check out configuring it, if you will. 74 00:05:39,000 --> 00:05:40,000 Yeah, yeah. 75 00:05:40,000 --> 00:05:41,000 We're just going to have a little look. 76 00:05:41,000 --> 00:05:46,000 So this is the Federated Access Manager admin console. 77 00:05:46,000 --> 00:05:51,000 And we can go in here and we can see all this configuration here. 78 00:05:51,000 --> 00:05:56,000 And this is actually quite an old build of OpenSSO. 79 00:05:56,000 --> 00:05:58,000 So it's got a few things that have changed. 80 00:05:58,000 --> 00:06:04,000 One thing is that the product name is now OpenSSO Enterprise rather than Federated Access Manager. 81 00:06:04,000 --> 00:06:08,000 But we can see the Google SAML service provider. 82 00:06:08,000 --> 00:06:11,000 We can see the IDENTRIC SAML identity provider. 83 00:06:11,000 --> 00:06:13,000 And then the WS Federation counterpart. 84 00:06:13,000 --> 00:06:17,000 So it's almost like OpenSSO is a bridge between these two protocols. 85 00:06:17,000 --> 00:06:26,000 And we can go in and we can kind of really get down and dirty and start clicking around and looking at endpoints and URLs and everything. 86 00:06:26,000 --> 00:06:32,000 So this is just where you would configure the different things you would need to interact with different services. 87 00:06:32,000 --> 00:06:33,000 Correct, yeah. 88 00:06:33,000 --> 00:06:39,000 And you would just say, okay, I want a new service and kind of click through there to add new service providers. 89 00:06:39,000 --> 00:06:42,000 I mean, it seems like the admin stuff we saw, you don't interact with that all the time. 90 00:06:42,000 --> 00:06:43,000 It's just an initial setup. 91 00:06:43,000 --> 00:06:44,000 Correct, yeah. 92 00:06:44,000 --> 00:06:45,000 Yeah, yeah. 93 00:06:45,000 --> 00:06:47,000 Yeah, well, that looks like interesting stuff. 94 00:06:47,000 --> 00:06:49,000 Yeah, this is about it. 95 00:06:49,000 --> 00:06:58,000 I mean, the thing is we've worked hard on making this so seamless and easy to do that there's very little left to show. 96 00:06:58,000 --> 00:06:59,000 Right, right. 97 00:06:59,000 --> 00:07:07,000 This is, you know, the classic plumbing where if everything's going right, there really isn't anything to see. 98 00:07:07,000 --> 00:07:10,000 We better not shut down, we'll just say log off. 99 00:07:10,000 --> 00:07:13,000 Yeah, that's where the whole concept of federated mashups is really intriguing. 100 00:07:13,000 --> 00:07:20,000 Because if you forget about the technology and you just think about, I want to have these services embedded in my corporate portal. 101 00:07:20,000 --> 00:07:22,000 You know, you should be able to pick and choose from anything. 102 00:07:22,000 --> 00:07:23,000 Right. 103 00:07:23,000 --> 00:07:24,000 It shouldn't matter if it's in-house or out-of-house. 104 00:07:24,000 --> 00:07:25,000 Right. 105 00:07:25,000 --> 00:07:26,000 Out-house. 106 00:07:26,000 --> 00:07:27,000 Yeah.