What Does OpenSSO Enterprise Do?

The following types of interactions occur daily in a corporate environment.

• An employee looks up a colleague’s phone number in the corporate phone directory.

• A manager retrieves employee salary histories to determine an individual’s merit raise.

• An administrative assistant adds a new hire to the corporate database, triggering the company’s health insurance provider to add the new hire to its enrollment.

• An engineer sends an internal URL for a specification document to another engineer who works for a partner company.

• A customer logs into a company’s web site and looks for a product in their online catalog.

• A vendor submits an invoice to the company’s accounting department.

• A corporate human resources administrator accesses an outsourced benefits application.

For each of these transactions, the company must determine who is allowed to view the information or use the application. Some information such as product descriptions and advertising can be made available to everyone in a public online catalog. Other information such as accounting and human resources data must be restricted to employees only. And other sensitive information such as pricing models and employee insurance plans is appropriate to share only with partners, suppliers, and employees. This need for access determination is met by Sun OpenSSO Enterprise, an access management product with authentication, authorization, and single sign-on (SSO) services provided out of the box.

When a user or an external application requests access to content stored on a company’s server, a policy agent (available in a separate download and installed on the same machine as the resource you want to protect) intercepts the request and directs it to OpenSSO Enterprise which, in turn, requests credentials (such as a username and password in the case of a user) for authentication. If the credentials returned match those stored in the appropriate identity data store, OpenSSO Enterprise determines that the user is authentic. Following authentication, access to the requested content is determined by the policy agent which evaluates the policies associated with the authenticated identity. Policies are created using OpenSSO Enterprise and identify which identities are allowed to access a particular resource, specifying the conditions under which this authorization is valid. Based upon the results of the policy evaluation, the policy agent either grants or denies the user access. Figure 1–1 illustrates a high-level deployment architecture of OpenSSO Enterprise.

Figure 1–1 High-level Deployment Architecture of OpenSSO Enterprise