►
Description
In this Briefing Marc Boorshtein, CTO of Tremolo Security will give an overview of OpenUnison, and show how to use it in tandem with applications running on OpenShift.
OpenUnison is lightweight enough to deploy alongside J2EE and non-J2EE projects, while still being powerful enough to provide the identity features enterprise applications need.
For the latest information on OpenShift 3.1 and available briefings, please visit http://commons.openshift.org or subscribe to the OpenShift Blog (https://blog.openshift.com).
The OpenShift Commons exists to provide a platform for customers, partners, developers and other open source technology initiatives to collaborate, share and accelerate the pace of innovation and adoption of OpenShift globally. The OpenShift Commons represents a new open collaborative community model designed to facilitate communication and sharing of best practices, feedback and development across the many open source initiatives that integrate with OpenShift. The best way to get involved is to join the conversation today at http://commons.openshift.org
A
A
Well,
welcome
everybody
to
this
openshift
Commons
briefing
with
tremolo
security,
we're
going
to
get
the
inside
scoop
on
open
unison,
and
they
did
any
management
open
source
projects
that
criminal
security
is
backing
and
has
been
working
on.
I
have
with
us
today.
The
CTO
of
terminal
security
mark
or
shine
and
he's
going
to
introduce
himself
and
his
topic
and
we'll
have
Q&A
in
the
chat
section,
will
try
and
do
the
preservation
and
the
demo
first.
A
Unless
something
is
really
press
only
comes
up
in
the
QA
and
I
stopped
him
from
rattling
on
and
interrupting,
but
otherwise
what
we'd
like
to
do
is
have
the
presentation
for
the
first
20
or
30
minutes
and
then
do
QA
right
afterwards.
So
try
and
get
your
questions
into
the
chat
and
I'm
going
to.
Let
mark
introduce
himself
on
this
topic
today
and
thank
you
again
mark
for
joining
us.
Thanks.
B
Diane
so,
like
Diane
said,
my
name
is
Mark
Borstein
I'm,
the
CTO
tremolo
security.
You
know
real
quick
want
to
talk
about
who
we
are.
We
were
found
in
2010,
built
on
the
experience
of
our
co-founders,
so
I
start
off
as
an
engineer
docked
at
stirring
now
owned
by
oracle
and
have
been
an
open
source
developer,
pretty
much
my
entire
professional
career.
In
fact,
I
got
my
job
at
octet
string
based
on
a
open
source
project.
That's
now
part
of
openldap,
the
JDBC
ldap
bridge
and
then
over
the
years
have
been
a
consultant
and
contractor.
B
We
want
to
give
you
a
set
of
building
blocks
that
are
small
enough
pieces
that
you
can
assemble
into
what
you
need,
and
so
we
want
to
have
a
very
modular
system
where,
if
you
need
user
provisioning
you
you
can
use
it.
If
you
need
SSO,
you
can
use
it.
If
you
need
an
additional
data
store,
you
can
use
it.
But
if
you
don't
need
those
functions,
you
don't
need
to
add
the
extra
infrastructure
to
support
them.
B
Additionally,
we
go
with
a
virtual
directory
approach.
So
I
start
a
project
called
my
virtual
directory
back
in
2007.
I
believe-
and
that's
really
at
the
core
of
open
unison.
And
so
what
that
allows
us
to
do
is
to
connect
to
a
whole
range
of
different
directories
and
be
able
to
do
things
in
a
way
very
quickly
that
a
synchronization
based
identity
management
platform
might
not
be
able
to
do
and
then
finally
we're
open
source.
Today
we're
going
to
be
talking
about
open
unison,
which
is
our
open
source
project.
B
B
Does
the
reporting
provides
the
web
services
all
the
functional
aspects
and
we
migrated
into
a
generic
j2ee
application
that
you
can
deploy
on
tomcat,
wildfly
jetty
now
pick
your
favorite,
and
so
that's
what
we
open
sourced
and
that's
what
we're
going
to
talk
about
today
so
before
we
kind
of
get
into
open
unison
want
to
talk
about
what
makes
identity
management
hard.
You
know
the
first
question
is
authentication
and
SSO.
B
You
know
most
applications,
you
know,
you've
got
users,
you've
got
a
nap,
you
know
whether
it's
j2ee
lamp
or
even
dotnet,
and
you
got
a
database
and
that's
you
know,
that's
that's
easy
enough.
But
how
are
you
handling
your
users?
How
are
you
handling
your
groups
and
how
are
you
authenticating
users?
Well,
you
know,
but
the
users
in
the
table
put
a
password
in
there.
If
you
really
savvy,
you
can
go
ahead
and
hash
it
up
and
you're
good
to
go
right
except
you're
in
an
enterprise
environment
and
so
there's
active
directory
and
their
policies.
B
You've
got
to
have
passwords
have
to
reset
every
90
days
have
to
have
a
certain
complexity
and
you
you
don't
want
to
start
handling
that
inside
your
application,
so
you're
just
going
to
talk
to
active
directory-
and
you
know
most
application
platforms
have
a
way
of
talking
to
active
directory.
So
that's
kind
of
easy
type
of
the
fact
that
since
2000
Microsoft
has
been
telling
everybody
to
break
up
your
Active
Directory
infrastructure
to
multiple
forests.
B
Now,
if
you're
living
in
a
Microsoft
world,
this
isn't
that
big
of
a
deal
it
all
just
kind
of
automatically
happens,
but
in
a
non-microsoft
world
you
have
to
know
how
to
talk
to
those
different
directories,
even
their
cross
forest
trusts.
That's
not
the
same
thing
as
a
virtual
directory.
You
still
need
to
know
how
to
talk
to
them,
and
so
now
you're
starting
to
build
a
lot
of
logic
into
your
application.
You
might
look
at
something
like
SSO
system.
B
You
know
commercial
ones
out
there,
a
lot
of
open
source
ones
out
there,
and
so
you
somebody
says
all
right:
we're
going
to
stand
up
an
sso
service.
Most
SSO
services
know
how
to
talk
to
multiple
directories,
so
it
makes
life
a
little
bit
easier,
but
here's
the
catch
you've
got
this
line
here
between
your
SSO
service
and
your
application,
you
know,
is
an
agent.
You
know,
is
your
application.
B
Is
it
something
you're
SSO
team
is
doing
who's
going
to
be
doing
the
integration
so
and
from
a
DevOps
perspective
you
want
to
be
in
a
you
know:
branch
develop,
merge
branch,
develop,
merge,
not
branch,
develop,
wait
for
an
agent
installation
debug,
it
figure
out
what's
wrong
code,
it
merge
move
on.
So
that's
one
of
the
first
aspects
that
makes
an
Andy
management.
Hard.
B
B
You
know
there's
really
two
aspects
of
that
question:
it's
the
ability
to
add
users,
so
you
can
on
board
them
quickly,
but
it's
also
the
ability
to
provide
a
report
to
auditors,
especially
if
you're
talking
about
in
an
enterprise
where
you
have
sarbanes-oxley
hip
other
types
of
regulations
that
you
need
to
worry
about,
and
so
you
want
to
be
able
to
provide
a
report
that
says
who
has
access?
Well,
you
know
your
application.
B
If
it's
using
a
database,
you
know
kind
of
standard
model,
users
groups,
you
link
them
together
with
the
table
and
their
variations
on
this
theme.
So,
for
instance,
WordPress.
Does
it
a
little
bit
different
duple
kind
of
goes
with
this
sugarcrm
has
its
own
model
entirely,
but
you
know
you
can
always
do
reporting
off
of
that.
But
problem
with
that
is
it's
not
centralized.
So
you
know,
maybe
you
want
to
work
off
of
a
directory
again.
You
know.
Maybe
you've
got
somebody
with
some
ldap
skills
or
there's
a
web
service.
B
B
There
are
central
directory,
maybe
you're,
using
Active,
Directory
I
active
directory
might
make
a
lot
of
sense,
except
for
the
fact
that
folks
who
manage
your
active
directory
are
a
lot
more
worried
about
windows,
workstations
and
they
are
about
your
apps
authorizations
and
then
the
applications
can
cause
some
issues
so,
for
instance,
AWS
integration
that
we're
going
to
show
and
yeah
I
build
this
funky
string
and
send
it
up
to
the
application,
depending
on
what
your
identity
provider
can
do.
That
might
be
real
easy
to
do
on
the
fly.
B
Might
not,
and
so
you
know
you
might
be
storing
this
as
a
role
well
or
an
attribute
somewhere.
Where
are
you
storing
that
attribute
finally
hanging
a
report
on
all
this?
How
do
you
generate
a
report
that
says
mark
has
access
to
these
roles?
This
is
the
reason
why
he
has
that
access.
This
is
a
person
who
approve
that
access,
and
this
is
why
it
matches
with
our
corporate
policies.
B
Identity
management
can
really
provide
a
boost
in
your
development
life
cycle
because
now
you're
taking
away
the
need
to
manage
those
identities
in
the
same
way
and
you're,
also
providing
that
central
reporting
function
to
get
the
auditors
off
your
back
so
has
open
unison,
help.
So,
first
off
on
sso,
we
have
a
lot
of
sson
authentication
features
stuff
that
you'd
expect
username
password
Federation.
We
do
an
IDP
broker
multi-factor
using
totp.
We
also
have
integration
with
Symantec
VIP
and
then
some
ones
that
you
might
not
expect.
We
have
a
just-in-time
provisioning
provider.
B
B
Oh,
and
also
on
the
SSO
system,
is
our
application.
Integration,
which
really
is
I,
think
one
of
our
biggest
strong
suits.
We
run
as
a
reverse
proxy
for
the
most
part,
and
we
have
multiple
ways
of
doing
last
mile
we
could
do
header
injection,
but
you
know
kind
of
the
biggest
issue
with
header
injection
is
there's
no
way
to
validate
it.
It's
just
that
some
text.
So
what
we've
done
is
we've
created
a
last
mile
token
system
that
integrates
a
attributes
not
before
not
after
and
a
nonce
and
gets
encrypted.
B
Oh
and
the
URL
that's
been
authorized
so
that
gets
sent
down
to
the
downstream
application.
Then
we
have
integrations
for
Apache
net
and
Java
and
multiple
java
application
servers
that
will
validate
that
token
and
set
the
context
for
you
and
there's
no
phone
home
the
way
you
get
with
an
agent.
So
we
could.
B
We
don't
call
them
agents
for
that
reason,
and
so
that
gives
us
the
ability
to
since
we're
cutting
out
that
network
hop
to
validate
a
cookie
to
be
able
to
validate
every
request
individually,
and
so
what
that
actually
allows
us
to
do
is
have
a
set
of
trusted
attributes
coming
from
the
reverse
proxy.
We've
also
recently
added
the
ability
to
do
Kerberos
constrained
delegations.
B
Now
for
authorizations,
we
have
a
lot
of
different
ways
to
do
authorizations
kind
of
your
standard.
Directory
groups,
dynamic
groups
filters.
We
also
have
a
custom
authorization
mechanism,
so
the
ability
to
write
a
rule
that
requires
a
little
bit
of
logic
in
your
authorization
path.
Examples
of
custom
authorizations,
we've
built
supervisor
authorizations.
We
built
that
as
a
custom
authorization.
So
your
supervisor
must
authorize
you
to
be
able
to
do
this
or
your
supervisors
supervisor
must
authorize
you
a
couple
different
variations
there
and
then.
Finally,
we
allow
you
to
do
reporting
on
this.
B
We've
got
a
very
simple
database.
That's
relational
we're
not
right
now
doing
anything
with
or
other
object
databases,
but
it's
a
published
schema.
So
we
provide
a
simple
reporting
interface,
but
there's
no
reason
you
can't
use
whatever
your
favorite
reporting
or
business
intelligence
system
is.
With
this
we've
got
customers
using
jasperreports,
you
know,
but
there's
no
reason
any
other
reporting
system
could
be
used
so
now
for
the
fun
stuff,
the
demo
architecture.
B
So
what
we've
done
is
we
want
to
set
up
a
demo
that
showed
off
a
lot
of
unis,
open,
Unison's
biggest
benefits,
especially
to
open
shift,
so
I've
got
open
shift.
Origin
latest
running
here
in
my
lab
and
I've
got
two
applications
set
up
now:
I'm
going
to
be
spending
a
lot
of
time
on
this
particular
slide,
because
when
I
actually
do
show
the
demo,
it's
a
really
good
identity
management.
Demo
is
holy
unspectacular
because
things
just
kind
of
work.
B
So,
first
off,
on
the
left
hand,
side
here:
I
have
active
directory
and
right
now,
I
only
have
one
active
directory
for
setup,
but
there's
no
reason
why
this
couldn't
be
three
four
or
five
active
directory
for
us.
Whatever
you
want
to
see,
I
think
the
most
I've
ever
seen
in
an
organization
is
eight
individual
forests
organization
had
one
set
up
for
each
individual
continent,
a
big
global
company,
but
no
reason
why
we
couldn't
handle
that,
and
so
this
is
going
to
be
our
source
of
truth
for
identity
data.
B
So
this
is
where
we're
going
to
get
your
first
name,
your
last
name,
your
email
address,
your
object
quid
and
your
display
name
now
object
with,
is
an
interesting
one.
That's
that
is
your
unique
identifier.
Inside
of
Active
Directory,
it's
a
binary
attribute,
but
it's
one
that
if
you
can
turn
it
into
text,
is
really
useful.
So
one
of
the
benefits
of
virtual
directory,
we
can
do
data
manipulation
and
one
of
those
manipulations
we
do
is
convert.
The
binary
object
would
attribute
into
a
text-based
object.
B
So
we've
got
two
applications
set
up
inside
of
open
chef.
The
first
is
what
we
call
our
ID
as
our
identity
as
a
service,
so
we've
got
two
pods.
We
have
an
open,
unison,
pod
that
handles
authentication.
It
handles
the
web
services
for
provisioning
that
we
host,
and
it's
also
acting
as
a
reverse
proxy
for
scale,
which
is
the
application
we've
built
to
use
those
web
services.
B
And
finally,
it's
also
acting
as
an
identity
provider.
It's
using
database
data
from
external,
my
sequel
server,
and
then
it's
also
storing
its
configuration
data
on
an
external
NFS
server.
Persistently.
We
also
have
scale
like
I
said
that
is
our
open
source.
It's
set
of
applications
really,
but
the
main
app
is
the
one
that
we've
deployed,
that
leverages
are
different
web
services
to
provide
an
identity
service.
B
So
when
a
user
log
is
in,
they
will
be
able
to
request
access
to
applications,
see
a
dynamic
set
of
links
to
be
able
to
log
in
two
applications
update
the
profile
if
they
wish
view
reports
etc,
and
then
over
here.
Our
second
application
is
where
we
have
WordPress,
so
we've
got
another
open,
unison
instance.
This
one
is
primarily
or
is
really
responsible
only
for
sso
into
open
or
into
WordPress
and
for
just-in-time
provisioning
into
the
WordPress
database.
So
there
is
no
extra
database
or
directory
here
with
this
unison
instance.
B
So,
like
I,
said
before
about
being
modular,
we're
not
using
the
different
services
that
would
require
an
external
data
store,
so
no
need
to
deploy
it
so
again,
we're
very,
very
lightweight,
and
then
we
have
a
wordpress
instance.
This
is
the
stock
official
WordPress
instance
off
of
off
of
docker
hub
with
the
addition
of
our
last
mile
integration
for
Apache.
B
So
what
will
happen
is
when
a
user
logs
in
all
the
bouncing
mouse,
when
a
user
logs
in
they're
going
to
hit
open
unison
open
years
and
doesn't
know
who
they
are
going
to
request
you
to
put
in
your
username
password.
Now
we
have
chains
set
up,
so
you
know
this
could
be
a
username
password.
This
could
be
Federation
of
some
kind.
You
know
any
of
our
different
options,
at
which
point
the
user
will
put
in
their
username
password
and
a
login
will
happen
into
active
directory
to
validate
that
credential.
B
Now,
here's
where
the
virtual
directory
comes
into
play,
we're
storing
our
authorizations
down
here
in
this
database,
but
in
order
to
make
it
recognizable,
we
need
to
be
able
to
merge
that
data
with
what's
coming
from
Active
Directory.
So
the
first
thing
we
do
is
we
do
adjust
in
time
provisioning
into
this
user
database,
so
that
will
provision
just
the
users,
uid
or
samaccountname
in
ad
world
and
object
with,
and
that's
what
we
use
to
link
the
account
into
active
directory.
B
Then
what
we
do
is
all
directory
operations
go
through
a
joiner
that
Joyner
creates
a
profile
based
on
the
active
directory
attributes
and
the
local
data
attributes.
So
if
we
need
to
add
additional
attributes
not
managed
by
active
directory,
we
could
do
that
here
and
provide
it
without
issue
to
applications
due
at
that
point,
we
go
ahead
and
we're
going
to
get
SSO
into
scale.
Using
the
last
mile
system.
Quest
comes
into
scale
which
is
running
on
Tomcat
8.
B
We've
got
a
valve,
that's
running
that
will
validate
the
request
and
set
the
user
context
at
which
point
web
service
calls
will
come
into
unison
to
be
able
to
load.
Your
profile,
what
you
have
available,
etc
so
users
going
to
request
access
that
access
gets
approved,
at
which
point
they
then
log
back
in
and
they'll,
see
a
couple
of
Link's
come
up
for
the
different
applications
that
they've
requested.
So
let's
say
we
click
on
the
link
for
amazon
that
will
bring
us
to
the
console
before
it
does.
B
Though,
it's
going
to
translate
our
internal
groups
into
that
crazy
string
that
amazon
wants
so
we're
getting
the
best
of
both
worlds.
We
get
to
have
a
consistent
way
to
manage
our
groups,
but
we
also
get
to
tailor
things
so.
The
way
applications
need
to
see
them.
We
come
back
and
we
click
on
WordPress.
This
is
where
the
application
integration
really
becomes.
Powerful
click
on
that
link
to
WordPress
and
a
sam'l
integration
starts
with
this
application.
B
The
open
unison
over
here,
so
an
assertion
gets
digitally
signed,
sent
through
the
users
browser
down
to
open
unison
in
this
application.
Open
unison,
validates
the
assertion
first
off
and
then
based
on
the
attributes
in
there
we'll
run
a
just-in-time
provisioning
workflow
against
the
WordPress
database.
So
if
you
don't
exist
to
create
your
profile,
if
it
does
exist,
it
makes
sure
that
your
profile
matches
what's
in
the
authoritative
data
source
over
here.
B
So
this
provides
you
the
ability
to
get
both
a
centralized
way
of
managing
your
data,
but
not
having
to
recertify
that
access
on
a
consistent
basis.
It
helps
eliminate
a
bit
of
that
risk
between
recertifications.
Now
what
that
the
practical
side
of
that
is
is
let's
say:
I
have
subscriber
or
contributor
role.
An
administrator
tries
to
make
me
another
admin
for
some
reason
through
the
WordPress
interface.
B
Once
that
happens,
so
the
Conte,
the
data
is
set
here.
Wordpress
is
kind
of
an
interesting
application,
because
it's
not
necessarily
designed
to
always
have
to
be
authenticated.
You
really
only
have
to
authenticate
if
you're
going
to
do
things
that
are
authenticated,
but
because
this
is
a
enterprise
deployment
of
WordPress.
We
want
users
to
always
be
authenticated.
So
before
you
actually
log
in
before,
we
send
your
initial
request
to
WordPress.
We
do
a
pre
authentication.
B
We
have
the
ability
to
manage
an
internal
cookie
store
inside
of
our
reverse
proxy,
and
so
what
we
actually
do
is
we
go
and
we
do
a
login
to
WordPress
behind-the-scenes
response
comes
back.
We
take
those
cookies
and
inject
it
into
your
cookie
jar.
So
that
way,
when
you
hit
wordpress
for
the
first
time
your
pre
logged
in
so
there
is
no
quote:
unquote
anonymous
access
to
wordpress
so,
like
I
said
that
was
a
lot
and
we'll
go
ahead
and
go
through
the
the
demo
and
actually
show
kind
of
how
that
all
comes
together.
B
Cool,
so
this
is
my
origin
deployment.
Here
are
my
two
applications,
real
quick
just
to
show
you
there's
nothing
up
my
sleeves
and
then
we've
got
two
pods.
Each
pod
has
its
own
set
of
services
and
you
know
potentially
a
router
if
it's
an
external
pod
and
then
the
same
is
going
to
be
true
here
of
scale
and
we've
also
got
everything
is
configured
through
the
environment
variable.
So
there
are
no
passwords,
no
certificates
nothing's
being
stored
on
these
images.
B
Outside
of
you
know,
application
logic,
so
I'm
going
to
go
ahead
and
log
in
so
first
thing,
I'm
going
to
do
is
log
in
as
M
mostly
now
customizing.
These
pages
is
very
easy.
It's
just
stock,
JSP
and
so
I'm
logging
in
and
so
that
background
process
is
happening
where
I'm
talking
to
Active
Directory
I'm,
coming
back
I'm
checking
to
make
sure
that
my
object
exists,
and
this
is
kind
of
my
super
user
Matt
Mosley.
So
he
has
a
lot
of
capabilities,
a
few
of
which
are
going
to
be
you'll,
see
that
I've
got
links.
B
These
links
are
dynamically
generated
and
then
I'll
also
show
you
that
oops
back
here.
We're
going
to
show
the
responsiveness
here,
so
this
is
built
on
Twitter
bootstrap,
so
it
works
great
on
mobile
devices,
ads
generic
Twitter
bootstrap,
there's
nothing.
There
are
no
special
themes
put
on
top
of
it,
so
we've
got
a
couple
apps
if
I
want
to
come
in
here.
B
Here's
my
profile
and
roles
now
I've
got
set
up
right
now
for
read-only,
but
we
can
also
configure
this
to
show
certain
attributes
as
read,
write
and
then
execute
a
workflow,
so
that
would
save
it.
So
let's
say
we
want
you
to
let
users
specify
their
twitter
handle
here.
For
some
reason
we
could
add
a
twitter
handle
attribute
and
when
the
user
hit
save
execute
a
workflow,
they'll
write
it
to
the
local
database
that
we're
using
and
then
any
application
that
wants
to
access
it
now
can
without
having
to
store
it
in
active
directory.
B
And
over
here
in
the
reports
we
allow
you
to
build
out
an
organization
model
totally
arbitrary.
However,
you
want
to
set
up
one
of
the
things
that
we
let
you
do,
those
we
let
each
organization
have
authorization
rules
on
it.
So,
for
instance,
this
identity
management
reports.
You
have
to
be
authorized
to
access,
so
some
of
these
different
reports
that
will
kind
of
show
you
once
we
get
going
I'll,
show
some
of
them
now
so,
like
the
single
user,
changelog.
B
Nope,
oh
that's
right!
I
did
this
wrong
last
time
to
the
single
user.
Changelog
lets
you
see
all
the
changes
that
have
happened
to
a
user.
So,
for
instance,
I'm
going
to
pick
the
mat
mosley
on
his
own
right
here
and
just
run
the
report
and
up
we're
going
to
do
change
log
for
a
period
that
may
be
a
little
bit
easier.
So
today
is
the
25th,
so
we're
going
to
do
that.
B
B
So
now
I'm
signed
in
as
Jennifer
and
here
my
attributes,
you'll
see
I,
have
no
roles
assigned.
So
let's
go
ahead
and
first
I'll
show
that
there
are
some
reports
that
we
can
run
but
you'll
notice
that
identity
management
group
is
no
longer
here.
That's
because
I'm
not
authorized
even
see
anything
in
there,
so
you
can
do
interesting
things
like.
B
So
first
thing
I'm
going
to
do
is
I'm
going
to
request
access
to
Amazon
and
I'm,
also
going
to
request
access
as
an
editor
for
WordPress
you'll
see
that
we've
got
a
cart
based
service
for
this.
You
know
if
I
log
out
some
error
checking
Tamara
checking
there.
So
I'm
going
to
go
ahead
and
submit
my
request.
So
that's
going
to
go
ahead
and
submit
a
login,
a
workflow
request.
Now
our
workflows
are
asynchronous
and
we're
built
on
top
of
JMS
and
cues.
So
every
task
in
our
workflow
goes
on
to
a
JMS
queue.
B
B
B
Then,
when
I
look
at
the
second
request,
we
can
already
see
that
the
user
has
been
provisioned.
So
typically,
workflow
will
look
something
like
maybe
load
some
data.
Do
some
data
manipulation
get
an
approval?
Maybe
two
we
support
escalations
and
approval,
so
you
can
say
all
right
if
this
hasn't,
you
know
if
this
hasn't
been
acted
on
in
you
know
six
days,
you
know,
go
ahead
and
escalate
it
to
the
next
level
and
change
who
the
approver
set
is
and
will
be
supporting
delegation
in
the
not-too-distant
future.
B
B
B
And
you'll
now
see
I've
got
these
dynamic
links
have
now
been
generated.
I
have
these
roles
and
I'm
going
to
go
ahead
and
you
know
go
ahead
SSO
into
AWS,
and
you
know
if
you
take
a
look:
1f
a
44
d
7
one
f8,
447
I
use
the
object
grid
because
I
really
like
the
fact
that
it's
immutable,
you
know
if
names,
change,
etc,
that
id
never
changes
in
Active
Directory,
whether
it
gets
moved
around
reorganized,
etc.
B
B
B
And
then
you'll
also
notice.
When
we
go
to
the
wordpress
dashboard,
we
don't
have
all
any
of
the
administrator
stuff.
That
is
because
we're
not
in
the
ministry
we're
a
subscriber
and
so
we're
going
to
go
ahead
and
show
the
just-in-time
provisioning
kind
of
changing
that
right
on
the
fly.
So
I'm
going
to
log
out
I'm
going
to
log
back
in
as
my
super
user
oops.
B
And
I'm
going
to
go
right
into
wordpress,
so
I
logged
in
as
Matt
Mosley
and
I'm
going
to
come
down
to
users
and
there
is
miss
Stanton.
Our
user
is
an
editor,
so
we're
going
to
go
ahead
and
change
her
over
to
a
administrator
we're
going
to
hit
update
user.
So
now,
when
Miss
Stanton
logs
back
in
again
she's
going
to
see.
B
B
B
B
You
know
just
some
sequel,
you
need
to
know
and
our
publish
schema
and
you
can
also
go
ahead
and
you
know
we
allow
parameters
the
current
user.
We
let
you
specify
user,
we
let
you
specify
a
date
range.
We
showed
you
a
couple
of
those
before
you
know
some
other
things
that
you
can
do
with
open
unison.
B
B
So
that's!
That's
really.
The
demo
like
I,
said
everything.
You
know
my
couple
of
old,
which
is
there.
You
know
kind
of
just
came
together
from
a
deployment
time
standpoint.
Once
we
had
openshift
up
and
running,
you
know
getting
that
first
open
unison
instance
took
the
longest
that
probably
took
me
bad
day,
just
trying
to
tailor
the
image
correctly,
but
scale
was
very
easy.
That
probably
took
me
a
couple
of
hours.
B
All
right,
let's
come
back
to
our
so
questions,
going
to
come
up.
How
does
open
unison
and
key
cloak
relate?
There's,
certainly
some
overlap.
You
know
kind
of
in
this
slide
can't
give
either
project
you
know
can't
do
either
project
justice
and
in
the
breadth
of
features
that
they
have.
You
know
in
common
there's
a
lot
of
SSO
functionality
in
common.
We
can
both
do
identity
provider
brokers.
We
can
both
do
federation,
social
login
and
a
couple
of
different
multi-factor
methods.
B
You
know
we
can
both
integrate
using
sam'l
to
reverse
proxies
and,
and
there
are
mechanisms
to
be
able
to
do
just
in
time,
provisioning.
You
know
kind
of
where
we
really
separate
I
was
on
the
user
provisioning
side,
we're
not.
We
go
beyond
SSO
SSO,
certainly
one
of
our
capabilities,
but
really
I.
Think
our
most
powerful
capability
is
in
the
user
provisioning
aspect
of
things.
You
know:
we've
got
a
very
simple
workflow
engine.
We
specifically
didn't
go
with
a
standard
like
BPM
or
Bibble,
because
we
want
to
keep
the
workflow
is
very
simple.
B
You
saw
our
reporting
integration.
What
you
didn't
see
behind
the
scenes
is
our
cue
integration
kind
of
touched
on
this.
We
ship
with
activemq
embedded.
However,
we
can
integrate
with
any
JMS
base
q.
That
makes
us
very.
Very
scalable.
Task
can
be
run
on
one
server
and
then
next
task
can
be
run
on
another
server.
Next
desk
can
be
run
on
a
third
server
and
I
mean
you
know.
This
is
open,
shift
right
and
open
shift
leverages
that
same
type
of
Q
infrastructure.
B
So
you
know
how
well
that
helps
things
scale,
and
then
we've
also
got
the
ability,
because
of
that
to
retry.
So
we
can't
get
a
network
connection
for
some
reason.
It
can
go
off
into
a
dead-letter
queue
and
when
you're
ready
and
the
system
comes
back
up
and
running,
you're
able
to
go,
and
then
we
also
have
integrated
a
distributed
scheduler
to
built
on
quartz,
and
what
this
actually
lets
us
now
do
is
anything
that's
time-based.
So,
for
instance,
reminders
you
know
every
you
know
every
morning.
B
We
want
to
remind
folks
that
have
open
requests
that
have
been
open
for
more
than
a
week,
send
them
an
email.
You
know
the
ability
to
change
who
the
allowed
approvers
are
for
a
given
requests
are
a
couple
of
examples.
Some
other
examples
are
automatically
disabling
users
after
a
certain
amount
of
time.
Well,
this
user
hasn't
Authenticator
has
been
disabled
for
a
certain
amount
of
time.
We
actually
want
to
delete
them.
Things
like
that.
B
So
what
are
we
up
to
you
know?
What's
next
in
for
open
unison
and
trim?
Oh
security!
Well,
right
now
we're
working
on
a
white
paper
on
cloud
server
management
with
open
unison
and
free
IPA,
the
idea
being
that
you've
got
this
great
tool
in
free
IPA
for
managing
servers.
But
what,
if
you
can't
build
a
Kerberos
trust
with
Active
Directory,
usually
for
policy
reasons?
You
know
we.
We
provide
a
very
powerful
mechanism
to
be
able
to
do
that.
Integration.
A
disconnected
fashion,
makes
it
a
great
tool
for
managing
servers
up
in
the
cloud.
B
You
know
which
roles
have
the
ability
to
one
on
which
hosts,
but
we
can
also
add
that
capability
to
say:
okay
well,
instead
of
having
to
manually,
add
them
or
rely
on
Active
Directory
administrators
admins
can
log
in
and
request
access
to
these
different
services
get
it
approved,
and
you
know
you've
got
an
audit
report.
We're
also
going
to
have
a
white
paper
on
building
a
open-source
identity
as
a
service
with
open
unison.
B
So
what
you've
seen
here,
a
little
more
generic
built
on
on
on
just
generic
docker,
with
a
more
open
shift
focus
coming
once
we
have
a
source
to
image,
build
so
now
that
we've
gotten
it
up
and
running,
we've
kind
of
you
know:
we've
got
generic
docker
builds
for
everything,
but
now
that
we've
gone
through
open
shift,
you
know
there
are
certainly
updates.
We
can
make
to
make
that
process
easier.
B
You
know
we're
looking
at
on
the
the
y
think
is
a
little
more
concrete
side
of
being
able
to
have
an
SPI
where,
if
you've
got
key
coke
set
up,
you
can
leverage
our
just-in-time
provisioning
solution
to
be
able
to
go
ahead
and
update
downstream
applications,
so
broaden
key
cokes
ability
to
access
those
systems
and
provide
reporting
and
whatnot,
and
then
on
the
the
more
theoretical
side.
I
think
it
would
be
really
cool
to
have
a
virtual
directory
on
top
of
key
cloak.
B
B
So
that's
one
that
I'm
hoping
to
be
able
to
do
and
then
we're
going
to
build
a
annular,
j/s
version
of
scale
and
that's
in
process
now,
and
you
can
see
our
progress
on
on
github,
and
so
the
idea
will
be
is
instead
of
having
the
poi
separate,
j2ee
application,
you
can
sit
directly
on
open
unison,
running
angularjs,
we're
not
going
to
retire
scale.
You
know
we're
just
want
to
offer
multiple
options,
and
finally,
this
is
all
in
weed
up
will
be
we're
proud
to
announce
that
will
be
sponsoring
Red
Hat
summit.
B
Again
this
year
we
had
a
great
time
in
Boston
last
year
and
we're
looking
forward
to
seeing
everybody
in
San,
Francisco
and
June.
If
you'd
like
to
get
in
touch
with
us,
you
can
catch
us
at
on
twitter.
At
remote
security,
the
web
at
tremolo
I,
oh
and
our
github
repositories,
tremolo
security,
the
open
unison
project
itself
is
open,
unison.
We
have
an
open
for
open
source
first
mentality.
B
So
whenever
we
add
a
feature,
it
goes
straight
into
github
you'll
see
a
lot
of
repositories
in
there
of
stuff
we
haven't
yet
merged
into
the
main
system.
The
only
time
we
don't
start
with
open
source
is,
if
we
don't
own
the
code,
so,
for
instance
like
Symantec
that
we
don't
we
don't
own
the
code
to
do
that
integration,
and
so
we
didn't
want
to
open
source
it
without
really
making
sure
that
we
could
so,
but
you
know
we're
all
in
on
on
open
source.
From
that
standpoint,.
A
A
We
were
go
back
and
forth
in
the
in
the
chat
and-
and
you
have
really
covered
off
pretty
much
everything
that
I
was
going
to
ask
you
a
question
on
so
the
Key
Club
def
was
one
of
the
key
things
that
I
was
curious
about,
because
there's
a
lot
of
discussion
about
key
code
around
openshift
as
well
so
and
there
will
be
an
upcoming
presentation.
I
think
I've
got
someone
lined
up
in
April
to
do
a
talk
on
key
club.
A
So
we'll
get
you
back
on
at
that
time
to
have
that
conversation,
but
this
is
this,
isn't
really
great.
I
love
the
open
source
first
ethos
at
tremolo
security.
It's
really
wonderful
to
see.
We've
had
whole
bunch
of
people
on
the
call
today
so,
but
I'm
not
seeing
any
questions,
which
means
you
just
did
an
awesome
job
covering
off
identity
management
for
me.
So
thank
you
very
much
for
coming
and
doing
this
talk
today
will
have
many
more
I'm
sure,
with
tremolo
security
and
on
identity.
A
Manageable
I
am
thoroughly
impressed
with
the
production,
readiness
and
especially
the
auditing
reports
that
are
available
because
I
think
I
come
from
a
long
time
ago
on
auditing
the
IT
background
and
having
those
compliance
things,
there
is
really
a
necessary
evil
or
goodness,
depending
on
your
outlook
on
life
and
they're,
often
an
afterthought
and
an
add
on
two
different
projects.
So
this
it's
really
nice
to
see
how
thorough
your
UI
is
and
your
reporting
is
and
your
coverage
of
different
applications,
identity
management
practices.
A
So
thanks
again
mark
and
we
look
forward
to
seeing
you
at
Red
Hat
summit.
Thank
you
for
sponsoring,
and
if
people
have
questions
you
can
post
them
on
the
open
shift.
Comedies
mailing
list
and
Mark
will
pick
them
up
there
or
pick
them
up
that
terminal
of
security
and
we'll
make
sure
we
keep
him
in
the
loop
on
our
further
identity
management,
questions
and
free
hint.
But
thanks
again
mark
and
we'll
talk
to
you
all
soon
next
week,
very.
B
A
Book
will
be
having
one
more
open
shift
briefing
I
think
in
on
march
10th
as
the
next
one.
We
may
slip
one
in
between
next
week,
if
the
speaker
that
I
have
lined
up
mystery
speaker
decides
to
commit,
but
I
think
the
next
one
is
on
March
tenth
and
it
will
be
with
Andi
ghosting
on
the
service,
catalog
and
service,
linking
with
open
shift
so
again
mark.
Thank
you
very
much.
Thank.