Overview & Concepts
Overview and Concepts
Building a Unified IAM Infrastructure
In large organizations, consolidating Identity and Access Management (IAM) systems from different vendors across various locations is a daunting and often impractical task. This is especially challenging for corporate groups and companies that frequently acquire new subsidiaries, resulting in fragmented information systems. Consolidation projects are typically long, costly, and rarely yield the expected results, leaving behind a mix of well-integrated systems and legacy systems that still need to function.
RCDevs addresses these challenges by offering a federated approach to IAM and Identity Provider (IdP) management. The RCDevs solution federates multiple IAM systems, integrating them into a cohesive meta-IAM platform. This top-level meta-IAM provides a unified view of all the underlying IAM systems, allowing seamless integration with cloud or on-premises services like email, VPNs, and OpenID Connect (OIDC). With this approach, there's no need for complex IdP cascading or password management, simplifying the IAM consolidation process.
For example, consider a corporate group, MyCorp, which has acquired two companies—one using Okta and the other using local Active Directory (AD) systems—while MyCorp itself uses OneLogin. RCDevs creates a meta-IAM that aggregates these disparate systems into a unified platform. This enables cross-IAM application access policies, unified UPN naming conventions, and centralized IdP services across the entire organization.
WebADM and External IAM Integration
With the introduction of WebADM version 2.3.20, RCDevs enhanced its platform with native integration capabilities for external IAM providers. This feature allows organizations to synchronize accounts and groups from their cloud IAM providers into WebADM’s LDAP tree. The synchronization is one-way—from the external IAM provider to WebADM—preserving group memberships and allowing external identities to be added to locally defined groups within WebADM.
This functionality is especially beneficial in scenarios like mergers and acquisitions, where multiple IAM systems need to be unified. By synchronizing identities from various sources, WebADM creates a centralized user directory, enabling consistent security policies, seamless IT management, and group-based access control across the entire organization.
The benefits of this approach include simplified identity management, enhanced security and compliance, flexible group management, cost efficiency, scalability, and an improved user experience through a unified access platform.
In summary, RCDevs and WebADM provide powerful tools for overcoming the complexities of managing multiple IAM systems, enabling a cohesive, secure, and scalable identity management infrastructure.
Actions/permissions required on OneLogin
To perform operations such as locking a user account, checking or changing a OneLogin user's password, and retrieving user and group information using OneLogin APIs from WebADM, you will need specific API permissions. These permissions must be granted via API credentials
in the OneLogin Administration Console.
API Credentials
From the OneLogin admin console, go to Developers
-->API Credentials
.
Click on the New Credential
button which is located at the top right of the page.
Provide a name, and select Manage users
. Then, click on Save
button.
Take note of the Client ID and the Client Secret, these will be used in the WebADM configuration.
Permissions & Roles
Creating an API Credential is sufficient to obtain all the permissions required to enable full WebADM synchronization. Related permissions are:
- Synchronize Users and Groups Information: synchronize users and groups from OneLogin within the WebADM Framework
- Password verification with Salesforce: validate a user's password using OneLogin for authentication that started with OpenOTP and a synced OneLogin account.
- User Account Lockout: this permission is essential when using the Account Lockout feature in OpenOTP Badging. It is required if you've implemented an account lockout policy that prevents access when the user is not badged-in. The account will remain locked at the OneLogin level, until the user badges-in with the OpenOTP Token application or from the User Self-Service Desk web application.
- Password Reset/Update: passwords for OneLogin accounts synced in WebADM can be changed through the WebADM Framework. The system supports applying password policies, leak protections, and weak password detection to OneLogin accounts. Resetting a user's password from a third-party application requires admin rights due to the sensitivity and potential impact of this operation. In OneLogin, the permissions required to perform these actions generally involve administrative privileges.
OneLogin configuration on WebADM
The OneLogin configuration on WebADM consists of:
- Creating a Container, Organizational Unit, or Organization object in your LDAP tree where the OneLogin tenant will be synced.
- Creating a WebADM
User Domains
and configuring the tenant information of your OneLogin tenant.
Container Creation
Let's first create the container where objects will be synced in.
Login on the WebADM Administrator Portal with a super_admin
account, and click on the Create
tab.
In this example, we create an OrganizationalUnit
named OneLogin
inside an existing Organization
object named External Providers
.
Click Proceed
and select the location of the OU. I created it within an organization
object named External Providers
, but you can place it wherever you prefer. Name your object, optionally provide a description, and click Proceed
, followed by Create Object
.
Your Organizational Unit should then be created and visible at the location you specified.
Domain Creation and Configurations
Username/UPN Concepts
The WebADM User Domain creation involves configuring the following key settings:
- The
User Search Base
- The
UPN Mode
and optionally theUPN Suffix
when the UPN Mode is set toExplicit
. - The
Directory Synchronization
settings
When configuring the UPN Mode
, you are determining how the login name value will be synced in the login attribute.
Example for Clarification
Consider the UPN (User Principal Name) of a OneLogin account: testaccount@xxxxx.onmicrosoft.com
.
testaccount
is the UPN prefix.xxxxx.onmicrosoft.com
is the UPN suffix.
UPN Mode: Implicit vs Explicit
The UPN Mode
can be set to either Implicit
or Explicit
. Here's how each mode works:
-
Implicit Mode:
In this mode, thetestaccount
value (the UPN prefix) will be stored in the login attribute. With this mode, users can authenticate using two different methods:- By providing
username=testaccount
anddomain=WebADM_Domain_Name
to the OpenOTP APIs. - By constructing a UPN with the WebADM Domain Name they belong to and logging in as
username@WebADM_Domain_Name
.
- By providing
This mode is the most flexible.
The UPN suffix can also be configured to work with the full UPN, even if it's not synced into the uid
attribute.
With Active Directory backend configured with WebADM, you must set UPN Mode
to Implicit
. Explicit
mode can not work, as the UPN prefix is synced into the sAMAccountName
and the full OneLogin UPN is synced into the UserPrincipalName
.
- Explicit Mode:
In this mode, the full UPN (testaccount@xxxxx.onmicrosoft.com
) will be stored as the login attribute. In this case, users must use the full UPN as their username to log in. Thetestaccount
value (UPN prefix) alone cannot be used for authentication.
If the directory backend configured with WebADM is Active Directory, and you attempt to sync OneLogin accounts into Active Directory, the prefix of the UPN will be synced into the sAMAccountName
attribute, while the entire OneLogin UPN will be synced into the UserPrincipalName
attribute.
Now that you fully have the concepts, we can continue by creating the WebADM User Domain
object and configuring the information for OneLogin.
Go to the Admin
tab, select User Domains
, and click Add Domain
. Provide a common name to identify the cloud provider, such as OneLogin, and optionally add a description. Then, click Proceed
followed by Create Object
.
The domain object will be created, and you will enter the User Domain
configurator. In the first section, configure the User and Group Search Bases
to point to the Organizational Unit (OU) you previously created. In the UPN Suffix
field, enter your OneLogin UPN ending with onmicrosoft.com
. This information can be retrieved from your tenant.
Scroll down to the Directory Synchronization
section.
- In the
Provider
setting, selectOneLogin
. - In the
Tenant ID
setting, enter your tenant identifier, which can be retrieved from your OneLogin directory. - In the
Client ID
setting, enter the unique identifier assigned to your registered application within the directory. - In the
Secret Key
setting, enter the private key associated with the application. This key, used together with the client ID, verifies the application's identity. - Choose the
Sync Options
that best suit your preferences for password synchronization, ensuring they align with the permissions granted to the application. - Finish by setting the
Sync Period
. By default, synchronization occurs every hour.
When the configuration is complete, click Apply
to save your settings. You will be redirected to the Registered LDAP Domains
menu, where your OneLogin domain should appear with a Sync Now
button.
Click this button to start the synchronization process.
If any objects cannot be synced for any reason, an error message will appear in the synchronization output. For more details, consult the WebADM Server logs.
Objects that have been successfully synced will appear in the left LDAP tree, as shown in the screenshot below:
That's it. The synced identities and groups can now be used with WebADM, along with its dependencies and integrations.