1 / 37

virtual techdays

INDIA │ 18-20 august 2010. virtual techdays. Secure Collaboration: All You Need to Know about Extending Active Directory Rights Management Services (AD RMS) Protected Content to External Parties. Venkatesh Swaminathan │ Solution Specialist, Microsoft. virtual techdays.

aric
Download Presentation

virtual techdays

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. INDIA │ 18-20 august2010 virtual techdays Secure Collaboration: All You Need to Know about Extending Active Directory Rights Management Services (AD RMS) Protected Content to External Parties Venkatesh Swaminathan│ Solution Specialist, Microsoft

  2. virtual techdays INDIA │ 18-20 august2010 S E S S I O N A G E N D A • Overview of Active Directory Rights Management Services (AD RMS) • AD RMS within an Enterprise environment • Enable secure collaboration using AD RMS • www.safeguardingyourinfo.com • AD RMS Trusted User Domains • AD RMS Integration with Active Directory Federation Services • ADRMS Integration with the Microsoft Federation Gateway • Questions

  3. Secure Collaboration Enable more secure business collaboration from virtually anywhere and across devices, while preventing unauthorized use of confidential information PROTECT everywhere ACCESS anywhere INTEGRATE and EXTEND security SIMPLIFY security, MANAGE compliance • Secure, seamless access • Protect sensitive information in documents • Best-in-class anti-malware • Deep Microsoft SharePoint and Office integration • Standards-based interoperability across organizations and cloud • Enterprise-wide visibility • Easier partner management

  4. Session Objectives • Overview of Active Directory Rights Management Services (AD RMS) • AD RMS within an Enterprise environment • Enable secure collaboration using AD RMS • www.safeguardingyourinfo.com • AD RMS Trusted User Domains • AD RMS Integration with Active Directory Federation Services • ADRMS Integration with the Microsoft Federation Gateway • Questions

  5. Encryption AD Rights Management Services Persistent Protection + • Provides identity-based protection for sensitive data • Controls access to information across the information lifecycle • Allows only authorized access based on trusted identity • Secures transmission and storage of sensitive information wherever it goes – policies embedded into the content; documents encrypted • Embeds digital usage policies (print, view, edit, expiration etc. ) in to the content to help prevent misuse after delivery • Access Permissions • Use Right Permissions Policy:

  6. How does RMS work? • Author receives a client licensor certificate the first time they rights-protect information Active Directory SQL Server • Author defines a set of usage rights and rules for their file; Application creates a “publishing license” and encrypts the file RMS Server • Author distributes file 4 1 • Recipient clicks file to open, the application calls to the RMS server which validates the user and issues a “use license” 2 5 3 • Application renders file and enforces rights Information Author The Recipient

  7. Active Directory Rights Management Services • AD RMS is a server role in Windows Server 2008 and 2008 R2 • The AD RMS client supports Windows XP- Windows 7 • Microsoft IRM enabled applications include: • Office 2003- 2010 • Exchange Server 2007 & 2010 • SharePoint 2007 & 2010 • Sharing protected content is disabled by default • ADRMS requires additional configuration to share content outside of the protection domain • Provides control to the IT administrator to determine sharing relationships

  8. Session Objectives • Overview of Active Directory Rights Management Services (AD RMS) • AD RMS concepts and deployment within the Enterprise • Enable secure collaboration using AD RMS • AD RMS Trusted User Domains • AD RMS Integration with Active Directory Federation Services • ADRMS Integration with the Microsoft Federation Gateway • Questions

  9. 1 7 6 2 3 4 5 CLC RAC CLC RAC PL UL Basic AD RMS Deployment The Internet Corporate Network RMS Cluster

  10. Session Objectives • Overview of Active Directory Rights Management Services (AD RMS) • AD RMS within an Enterprise environment • Enable secure collaboration using AD RMS • www.safeguardingyourinfo.com • AD RMS Trusted User Domains • AD RMS Integration with Active Directory Federation Services • ADRMS Integration with the Microsoft Federation Gateway • Questions

  11. Sharing Sensitive Content – The Default Today

  12. Enable sharing of IRM Protected Content • Allow users to securely collaborate • Enable users to share sensitive information in a seamless manner. • Sharing securely should not interfere with collaboration. • Enterprises can retain control of their data • Enterprises can create policies determining who has access to content • Enterprises can manage partnerships between organizations • AD RMS supports several mechanisms to enable sharing of IRM protected Content • www.safeguardingyourinfo.com • Trusted User Domains • Integration with Active Directory Federation Services • Integration with the Microsoft Federation Gateway

  13. Session Objectives • Overview of Active Directory Rights Management Services (AD RMS) • AD RMS within an Enterprise environment • Enable secure collaboration using AD RMS • www.safeguardingyourinfo.com • AD RMS Trusted User Domains • AD RMS Integration with Active Directory Federation Services • ADRMS Integration with the Microsoft Federation Gateway • Questions

  14. Session Objectives • Overview of Active Directory Rights Management Services (AD RMS) • AD RMS within an Enterprise environment • Enable secure collaboration using AD RMS • www.safeguardingyourinfo.com • AD RMS Trusted User Domains • AD RMS Integration with Active Directory Federation Services • ADRMS Integration with the Microsoft Federation Gateway • Questions

  15. AD RMS Trusted User Domains • AD RMS Trusted User Domains (TUD) • An AD RMS domain refers to the scope of an AD RMS certification cluster: the Active Directory forest • Not to be confused with an Active Directory domain • Allow Trust to be established between AD RMS domains. This is completely independent from AD forest or domain trust • Scenario: • Enables sharing of AD RMS protected content within enterprises that have with multiple forests where users accounts are located. • AD RMS Trusted User Domains are recommended for sharing content within the Enterprise

  16. AD RMS Trusted User Domains • Two entities (forests within a company) have their own AD RMS installation • By default, AD RMS will not license content to users from other AD RMS installations • TUD enables users from one AD RMS domain to acquire a license from a server in another domain • An AD RMS licensing server will issue a use license to a RAC issued by another trusted AD RMS cluster. • RAC validation can occur after importing a trusted Server Licensor Certificate • Authentication to the licensing service must be addressed

  17. AD RMS Trusted User Domains AD RMS Forest B AD RMS Forest A Monica in Forest B sends PL and RAC with request for UL from Forest B John in Forest A sends RM content to Monica in Forest B

  18. How AD RMS Trusted User Domains Work AD RMS Forest A AD RMS Forest B 1) Export TUD from Forest 2 2) Import TUD from Forest 2 5) Server uses imported SLC to verify Monica’s RAC and returns UL 4) Monica in Forest B sends PL and RAC with request for UL 3) John in Forest A sends RM content to Monica in Forest B

  19. Session Objectives • Overview of Active Directory Rights Management Services (AD RMS) • AD RMS within an Enterprise environment • Enable secure collaboration using AD RMS • www.safeguardingyourinfo.com • AD RMS Trusted User Domains • AD RMS Integration with Active Directory Federation Services • ADRMS Integration with the Microsoft Federation Gateway • Questions

  20. AD RMS Integration with Active Directory Federation Services (ADFS) • AD RMS native scope is the AD forest • Can be extended to other forests via directory federation • ADFS is a standards-based directory federation system • Natively supported by AD RMS • Scenarios: • Extending AD RMS usage to External Parties • No AD RMS is required in the external party • AD and AD FS required • AD RMS/ADFS is recommended for sharing IRM content outside of the Enterprise when using Office clients(Outlook, Excel, Word etc…) and SharePoint

  21. New AD RMS Features in Windows Server 2008 R2 • Group Expansion • Allows organizations to collaborate with groups of people instead of identifying external users individually • Groups are defined in the publishing organization’s directory • ADRMS will access the local Active Directory to look up the group membership • 3rd Party Federation Support • Enables AD RMS to work with non-ADFS Security Token Services • Uses Forms Based Authentication

  22. AD AD FS-A CLC RAC CLC RAC 10 8 7 6 5 3 12 2 9 11 1 4 PL UL AD RMS Integration with AD FSScenario Assume author is already bootstrapped Author sends protected mail to recipient at Fabrikam Recipient contacts RMS server to get bootstrapped WebSSO agent intercepts request RMS client is redirected to FS-R for home realm discovery RMS client is redirected to FS-A for authentication RMS client is redirected back to FS-R for authentication RMS client makes request to RMS server for bootstrapping WebSSO agent intercepts request, checks authentication, and sends request to RMS server RMS server returns bootstrapping certificates to recipient RMS server returns use license to recipient Recipient accesses protected content Contoso Fabrikam FS-R WebSSO RMS

  23. AD RMS Integration with AD FS Tips for enabling AD FS integration with AD RMS • Both organizations must have ADFS installed and deployed • Grant Security Audit Privileges to the AD RMS Service Account • Add an Extranet URL • Ensure SSL has been enabled for the AD RMS cluster • Install the ADFS Sub-role for AD RMS • Provide the uri to the ADFS server during this step • Enable the feature via the ADRMS MMC Console\ • Remember Home Realm discovery registry key must be deployed to clients.

  24. Session Objectives • Overview of Active Directory Rights Management Services (AD RMS) • AD RMS within an Enterprise environment • Enable secure collaboration using AD RMS • www.safeguardingyourinfo.com • AD RMS Trusted User Domains • AD RMS Integration with Active Directory Federation Services • ADRMS Integration with the Microsoft Federation Gateway • Questions

  25. AD RMS Integration with the Microsoft Federation Gateway • Microsoft Federation Gateway (MFG) • Identity service that runs in the cloud (over the Internet and beyond your corporate network domain) • Allow users from one federated organization to be trusted by another federated organization. • Scenarios: • Extends AD RMS usage to External Parties for Exchange 2010 Sp1 IRM features • No AD RMS is required in the external party • Enables IRM in OWA, Transport Decryption, Journal Decryption for B2B Scenarios • Requires AD RMS Windows Server 2008 R2 Sp1

  26. AD RMS Integration with MFG Fabrikam may also have their own RMS deployment MFG Contoso Fabrikam Marcus Exchange 2010 Jane

  27. AD RMS Integration with MFG Contoso enrolls their RMS cluster with MFG 1 MFG Contoso Fabrikam Marcus Exchange 2010 Jane

  28. AD RMS Integration with MFG Fabrikam federates their Exchange 2010 server with MFG 2 MFG Contoso Fabrikam Marcus Exchange 2010 Jane

  29. AD RMS Integration with MFG Jane sends message to Marcus. Message gets automatically protected 3 Jane could have protected the message at OWA/OLK MFG Contoso Fabrikam Marcus Exchange 2010 Jane

  30. AD RMS Integration with MFG Fabrikam makes a SAML token request to MFG for their federated identity 5 MFG Contoso Fabrikam T Marcus Exchange 2010 Jane

  31. AD RMS Integration with MFG Fabrikam makes a Certify call to Contoso 6 Fabrikam will cache the RAC to use in future requests MFG Contoso Fabrikam RAC Marcus Exchange 2010 Jane

  32. AD RMS Integration with MFG Fabrikam makes a SAML token request to MFG for their federated identity 8 All proxy addresses of the federated Identity are included in the Token MFG Contoso Fabrikam T Marcus Exchange 2010 Jane

  33. AD RMS Integration with MFG The Use License call is batched and a single MFG token is presented for all recipients Fabrikam makes a Use License call to Contoso, presenting the RAC and MFG token 9 MFG Contoso Fabrikam UL Marcus Exchange 2010 Jane

  34. AD RMS Integration with MFG The Use License will be used to decrypt the message for OWA, Transport Decryption, Journal Report Decryption Marcus views the RMS message in OWA, and can reply to Jane MFG Contoso Fabrikam Marcus Exchange 2010 Jane

  35. AD RMS Integration with MFG • Tips for enabling MFG integration within RMS • Install Windows Server 2008 R2 Sp1 on all AD RMS front end machines • Remember to back-up the database prior to upgrade • Add MFG support via the AD RMS MMC console • Creates new IIS virtual directories and updates configuration of AD RMS • Register the AD RMS cluster with the MFG • Requires RMS to be deployed with SSL • SSL Certificate use to authenticate with the MFG • Enable the Feature

  36. Questions?

More Related