This set of features will extend OpenSSO to now offer fine-grained authorization (FGA) for web applications out-of-the box. You will no longer need to use our custom API's to handle FGA decisions. The entitlements solution will add a killer policy management interface for defining policies/conditions and managing policies, a policy auditor to validate policies and REST-based web services that will allow developers to invoke authorization from their applications. The OpenSSO entitlement enforcement solution will leverage our currently available XACML request/response support, and be a fully standards-based implementation. In addition, the solution will support XACML import/export for fine-grained policy definitions.
Within the OpenSSO community we are actively working to develop robust monitoring features for large-scale deployments that allow system and network administrators to proactively manage important enterprise assets that range from physical devices to systems and applications. Through our new service level monitoring capabilities deployers will be able to monitor their deployment health, detect and diagnose problems and use reported metrics to size deployments.
The monitoring solution will use monitoring agents and leverage existing agents such as those provided with OpenDS, GlassFish and the Java Virtual Machine. The mosaic of agents will all report management data to a central console, which can aggregate the information and present a single consolidated view for administrators.
Data captured by the OpenSSO monitoring solution will fall into the following categories for each OpenSSO component:
* Configuration overview : number of servers, authentication modules, realms, agent types, etc.
* Metrics related to resource usage : cache sizes, connection pools, sessions, etc.
* Counts on operations : authentication success/failure, authorization success/failure etc.
* Faults and diagnostics : server/agent down, LDAP health, connectivity issues, etc.
* Thresholds and alerts : events emitted when certain configured limits are met -- number of authentication failures exceeds limit, number of in-memory sessions exceeds limit, etc.
This feature is focused on improving ease of use by allowing users to easily configure federated connections using any protocol via the OpenSSO 'Common Tasks' page. This is part of our effort to move all capabilities from an object-oriented approach to a task-based approach. We already support all the key federation protocols; this feature is focused simply on making it easier to configure and reducing time to deployment.
This feature is focused on improving ease of use by allowing users to easily configure Virtual Federation (Secure Attributes Exchange) feature via the OpenSSO 'Common Tasks' page. This is part of our effort to move all capabilities from an object-oriented approach to a task-based approach.
Our reverse proxy is being rewritten as a 100% Java proxy that also has the ability to capture and replay passwords for web applications not protected by your single sign-on solution. In short, this will allow Enterprise Single Sign-on (screen scraping) functionality for web applications. Applications that are not protected by OpenSSO can use password replay to do simple password capture and authentication.
Comments (6)
Mar 02, 2009
asheffey says:
There is a started issue (https://opensso.dev.java.net/issues/show_bug.cgi?id=39...There is a started issue (https://opensso.dev.java.net/issues/show_bug.cgi?id=3917) to enable OpenDS as a supported external data store. I see above that MySQL is on the docket for that purpose. Is that being pushed back to Enterprise 8.1 in 2010?
Mar 02, 2009
metadaddy says:
Hi Aaron - this schedule is pretty high level and doesn't cover every feature. I...Hi Aaron - this schedule is pretty high level and doesn't cover every feature. I'll pop your question onto users@opensso.dev.java.net; and report back here...
Mar 02, 2009
metadaddy says:
OpenDS support is planned for Express Build 7. Updated the schedule above accord...OpenDS support is planned for Express Build 7. Updated the schedule above accordingly. Thanks for the question!
Mar 03, 2009
asheffey says:
Good to hear. One more question - will there be a migration guide (for those pe...Good to hear. One more question - will there be a migration guide (for those people not following best practices
) to migrate user date from the embedded OpenDS instance to an external instance? Or is the assumption that you will simply need to export your users from the current LDAP, and import them into the new one?
Mar 03, 2009
metadaddy says:
Hi Aaron - export to LDIF then import, followed by some reconfiguration of OpenS...Hi Aaron - export to LDIF then import, followed by some reconfiguration of OpenSSO should do it, I think. It would be worth filing an RFE, though, at https://opensso.dev.java.net/issues/enter_bug.cgi so we explicitly test it and document the cutover process.
May 08, 2009
adsfsdfsdfg says:
Thanks for posting this. Is there a similar roadmap for "3.0 Agents"? In particu...Thanks for posting this. Is there a similar roadmap for "3.0 Agents"? In particular, the "apache 2.2" agent seems to have been pulled and am looking to see when it'll be back in the suite.