|
FUNCTIONALITY
Web applications are used for a wide range of requirements, from delivering financial transactions and line of business applications to pure information dissemination, as well as delivering services to both an internal audience and external partners and customers. Organisations need to control access to Web applications, which often deliver high-value and sensitive data that is subject to regulatory control. Traditionally, user authentication and authorisation mechanisms were built independently and inflexibly for each major Web application, an approach that reduces visibility as well as being cost inefficient. Also, a typical user requires access to multiple Web applications, and without a mechanism for forwarding the user’s credentials to multiple applications (which could be owned by different commercial entities), user fatigue arising from the requirement to log into each application or Web site could set in, leading to lost customers or to security risks such as users resorting to writing passwords down. In addition, Web access technology needs to incorporate authentication tasks performed by partner entities, again to reduce user fatigue and reduce development duplication. Therefore, organisations require a centralised and scalable approach for authenticating users and authorising access to multiple applications, supported by the federation of authentication tasks in a standards-based way.
Product Analysis
CA provides CA SiteMinder Web Access Manager (CA SiteMinder WAM), a Web access management solution that provides fine-grained, policy-governed authentication and authorisation, administrative delegation, identity federation, and Single Sign On (SSO) capabilities. The solution is aimed at large and medium sized organisations with a large portfolio of Web applications and often a significant external Web audience. A part of CA’s Identity and Access Management (IAM) suite, the solution integrates with related solutions such as CA Identity Manager, CA SOA Security Manager for controlled access to Web services and CA Single Sign On for advanced SSO capabilities for non-Web applications.
At its core, the SiteMinder solution comprises two functional components: the Policy Server, and SiteMinder Agents. The Policy Server engine is the Policy Decision Point (PDP) for policies related to authentication and authorisation. The SiteMinder Agents are the Policy Enforcement Points (PEPs) and are deployed on Web servers or via a reverse proxy server to control access to Web server content and application servers. They also regulate access to Java 2 Platform Enterprise Edition (J2EE) components. The Policy Server provides a valuable audit capability which can be used to analyse access history and to aid regulatory compliance
CA SiteMinder WAM supports a wide range of authentication technologies, including X.509 certificates, one-time password (OTP) tokens, and Smart Cards, in addition to the ubiquitous user ID and password. With Web transactions increasingly conducted through multiple steps involving a web of commercially distinct entities, federation capabilities are important and in Butler Group’s opinion CA SiteMinder WAM scores well on this front. The solution supports identity federation through Security Assertion Markup Language (SAML) tokens, and WS-Federation via Microsoft’s Active Directory Federation Services (ADFS)
Regulatory compliance and the mitigation of risks related to loss of reputation from incidents of identity theft (among other security breaches) are key factors driving consolidated Web access management. For large companies, the aforementioned objectives necessitate a solution with high user scalability, careful monitoring of access patterns, and support for a wide range of common applications and Web and application server platforms. In Butler Group’s opinion, CA scores well on all of the aforementioned requirements.
|
