Securing Information in SharePoint Search

When it comes to securing access to content in SharePoint, a question that often comes up is "Can you secure access in Search as well?". 

The search capability within SharePoint, whether its native search or FAST search, is a really critical component for end users because it helps them find the information they're looking for in what is always (for all organizations) an ever growing SharePoint repository.  It helps end users more quickly access the information they need to get their work done.  So, the topic of securing access to senstive information when searching in SharePoint is important.

The answer to this question is YES.  One method of doing this is through SharePoint permissions.  As we know, permissions applied at any level (site, library/list, folder or item) can be used to secure access to sensitive content. SharePoint permissions or ACLs are respected by both native search and FAST search so that if a user does not have permissions to access an item, when they search for that content it will not be presented as part of their search results either.  However, there are some important details that need to be considered when generally configuring the native search capability.

A few weeks ago, I came a across a great post by Veronique Palmer, SharePoint MVP from South Africa and founder of Lets Collaborate, that goes into some detail about how to configure SharePoint search in order to secure access to content. 

Veronique states:

As a Site Owner or Site Collection Administrator, you can decide if the content on an entire set of sites can be available in search results or not; or the content of a specific list or library; or the data that exists in columns and web parts – all without setting permissions.

She discusses various options available in SharePoint for configuring the native search capabilities, including:

• Search and Offline Availability Settings for sites
• Search options for web parts
• Searchable Columns for libraries/lists

Veronique goes on to make another important point:

You need to have governance in place as to what is considered sensitive or confidential content – that must be clearly define.  You need to decide what the security levels all your content needs to be and tag all your content accordingly. This is also a legislative requirement in many industries. All this needs to be clearly communicated to your user base.

Her post is definetly worth a read and the full article can be found here: Restrict What Content Can Be Searched in SharePoint (for Business Users).

-Antonio

The Laws of Identity - Kim Cameron & His Identity Blog

A collegue recently pointed me to Kim Cameron, the former Chief Architect of Identity and Access at Microsoft, as a source of information about federated digital identity and claims.  Despite my readings into claims based identities and authorization over the last 2 years, I'll admit that I had not heard of him.  The more I read the more I found that his contributions were fundamental to the development of digital identities and related technologies.  As a fellow Canadian and Blues Brothers fan, I decided to write a short article discussing some of his contributions and point you to his excellent blog (which he still maintains).

Kim Cameron started at Microsoft in 1999, and he left in May 2011.  It turns out that during his time there he led all things to do with identity. He is credited with contributing greatly to the development and popularization of Claims as an intrisic part of digital identities.

One of his most significant contributions has been The 7 Laws of Identity.  Published in January 2006, I find it amazing how relevent they are today in 2012 - even more so today in fact.  These 7 laws helped to codify in real-world terms what we in the industry should build in order to enable robust use digital identities for authentication, authorization and federation.  I'm reprinting them here with the sole purpose of helping to spread the word, in the hopes that this helps educate people in the industry about how identities should be managed in the digital world.

You can find Kim's full description of the 7 Laws here: Kim Cameron's 7 Laws of Identity. The following are the 7 Laws in point form, reprinted as Kim wrote them, with a little annecdote from me. 

1. User Control and Consent - Digital identity systems must only reveal information identifying a user with the user’s consent.

[My Comment] Absolutely - if a system is going to reveal details about me to another system (or to other users or other developers) I want to ensure that its only with my consent.  For me to use an identity system I need to trust it, and in order to trust it the system must put me in control of my identity.  In order for me to feel that the system is maintaining the privacy of my personal information, I need to be in control of what information is shared, and with whom.  Facebook and Facebook Apps are a great example - when a user accepts use of a Facebook App, they are prompted with a message warning them that if they proceed they are permitting that app to have access to their user profile information.  Although I personally find that this message does not go far enough in warning the user, it is a step in the right direction.  Facebook has gone further in recent years towards enabling privacy of user data by allowing users to turn off access to certain portions of the user profile in their privacy settings.

Although many in the identity management industry might say that my Facebook profile is not my digital identity but rather a version of my digital identity, for many people out there (especially many young people) it is in fact their main digital identity.

2. Limited Disclosure for Limited Use - The solution which discloses the least identifying information and best limits its use is the most stable, long-term solution.

[My Comment] This law can also be described as "need to know" - in other words, only release information to systems which have a well defined need to know; as well, only release the specific attributes about me which a system has a need to know.  For example, to purchase something online a vendor needs to know my credit card number, but they do not need to know my social insurance number (social security number in the US), but both may be part of my digital identity.  The full text of this law also includes the notion that systems should only retain personal information on a need to know basis. 

3. The Law of Fewest Parties - Digital identity systems must limit disclosure of identifying information to parties having a necessary and justifiable place in a given identity relationship.

[My Comment] I personally find this law similar to #1 and #2, but there is an important nuance - for me, this law is more about if a system is authenticating and that system is to receive information about my identity (so attributes about me) then that system should be required to present a policy as to why the information is needed and how it will be used... then the identity management system managing my attributes can make decisions about how much personal information is disclosed to this system that's requesting information about me.  This to me is really important, in terms of helping keep my personal information private - the importance of this is becoming more and more apparent to the average person as identity theft grows.  Its also something that Microsoft technologies do not do well yet.

4. Directed Identity - A universal identity metasystem must support both “omnidirectional” identifiers for use by public entities and “unidirectional” identifiers for private entities, thus facilitating discovery while preventing unnecessary release of correlation handles.

[My Comment] The way I read this one is that we can each have multiple versions of our Digital Identity - some that we make public (like my Twitter account) and some that we keep private (like my corporate domain account).  A public representation of my digital identity is said to be Omnidirectional because I can and wish to transmit it to multiple public systems.  A private representation of my digital identity however is said to be Unidirectional because I want to transmit it in only one direction - for my corporate domain account at work, I only want my work place's servers to have access to it.  Today, this is dealt with by my having multiple accounts that I maintain.  However, if we are ever to have a unified way of managing our digital identities, where I have 1 digitial identity and multiple representations of it to use for different purposes, then this concept becomes very important.

5. Pluralism of Operators and Technologies - A universal identity metasystem must channel and enable the interworking of multiple identity technologies run by multiple identity providers.

[My Comment] We will always need multiple ways to present an identity.  The example used in Kim's 7 laws talks about having a government identity for when I file my taxes, and having a different identity for when I log into my employer's corporate network, and that makes sense.  This law, I believe, speaks to having multiple operators which manage our identities being able to interoperate in an open and standards-based way in order to allow us as individuals to control who and what has access to which parts of our digital identities.  This is presented as a more viable alternative to having 1 single operator that manages our identies and provides access to them for all purposes.

6. Human Integration - A unifying identity metasystem must define the human user as a component integrated through protected and unambiguous human-machine communications.

[My Comment] Its very worth reading the full text about this law, in Kim's document about these laws. This law comes down to us in the industry doing a better job of bringing the end user into our identity management systems in a more integral way... which I believe would be a very good thing to help fight phishing attacks and other attempts to steal our identities.

7. Consistent Experience Across Contexts - A unifying identity metasystem must provide a simple consistent experience while enabling separation of contexts through multiple operators and technologies.

[My Comment] In this law, Kim talks about various examples of identities that individuals may have, some public (for web browsing, for community interactions, for corporate collaboration) and some private (for personal web-based relationships, for purchasing, for government related activities).  He talks about the need to turn our digital identities into "things" that computers users can see and interact with - each of these digital identities revealing different aspects or attributes about us.  Different online services we interact with will (referred to as Relaying Parties) require us to reveal different information about ourselves - some require simply an email address, while others require a credit card number.  End users will need to understand the different options available to them and thereby select the best options for the given service or the given context.  Again, I believe this law is more important now that ever, as we conduct more and more of our activities online and they require important and detailed information about us.
Overall, these 7 laws provide a framework for us in the identity, access and security space to use when building our online services which intrinsicaly require digital identities.

In order to read Kim's writings directly, please see his web site here:  Identity Blog.

Various Microsoft technologies have made some great strides in recent years towards adopting or enabling some of these concepts.  In particular, Microsoft SharePoint 2010, with its support for Claims-Based-Authentication and Claims-Based-Authorization has gone a long way at starting people down the road of adopting claims and integrating digital identies into their business process in a more detailed and fundamental way.  As well, Microsoft Active Directory Federation Services 2.0 is a key enabler of claims in the Microsoft stack.
There is a great interview with Gartner and Kim from 2007 found here where he discusses Claims and the 7 Laws of Identity, and its again amazing how such much of this is more relevant today when you think about how you want your digital identity managed and accessible: http://www.gartner.com/research/fellows/asset_187313_1176.jsp.

Kim's 7 Laws are very relevant today with the use of digital identities growing more and more, for both consumer use and business purposes.  Technology is getting there, in terms of providing appropriate support for privacy and security related to our digital identities, albeit rather slowly. We've seen some great progress in recent years with the popularization of SAML and OAUTH, and their use by leading software and online service providers.  I'm hopeful that we'll continue to see a continued adoption of Kim's 7 laws in the coming years, as we see ever increasing use of digital identities in our online world.

-Antonio

Welcome - Launching TrustSharePoint.com

Hello and welcome to my new blog at www.TrustSharePoint.com.  This is my first post on this blog and I thought I would share a little bit about myself and talk about some of my technology interests as they relate to SharePoint.  As well, I'll point to some of my recent blog postings at TITUS where I work.  Going forward I'll contribute both to this blog, and to the TITUS SharePoint blog.

I am a first time Microsoft MVP for SharePoint Server.  I just recently received this award which was a big surprise and a great honour!  I'm a Senior Product Manager at TITUS responsible for the TITUS Security Suite for SharePoint and for the common information protection platform across all the TITUS solutions.

My technology interests include information security, assertions/claims and the trusted identity space, cryptography, federated identity, SAML, OAUTH and the like.  I'm also interested in information protection policy, a number of technologies available around that, and how they might be used to provide better security within SharePoint and the Windows desktop.  My personal interests include oil painting, my family, and some outdoor projects around my home.

Over the last 2 years, I have been blogging about information security in SharePoint 2010, the use of claims for authentication and authorization, permissions management in SharePoint, using Active Directory Federation Services version 2.0, and federated identity topics.  I've given several conference sessions at SharePoint conferences in North America and Europe, including the Microsoft SharePoint Conference in October 2011 in Anaheim, CA.  Here are just a few of my favorites from my previous blog postings:

What are Claims – Using Claims in SharePoint

Sometimes claims are referred to as metadata about a user – I’ve been guilty of this one myself.  To over-simplify the topic, we sometimes hear them spoken about as Active Directory attributes or LDAP attributes. People often talk about the concept of claims in a very simple manner, saying that claims represent user attributes or attributes about a user.  To understand the concept, you have to view claims as an assertion that I make about myself.  In other words, a claim is an attribute that I claim to have or be.  For example, I can tell you that I am Canadian.  I can tell you I’m a Canadian of Italian heritage.  You may or may not believe me.  This is something that I’m claiming about my identity.  If you were to look at my passport, perhaps you’d be more inclined to believe this claim, because my passport is an official document that many agencies trust.  If you were to ask someone that you trust about me, and that person happens to know me well, then you would likely be inclined to trust what they say about me. In the digital world, a claim must be trusted by the dependant application or relying party application.  

To read more, check out the full blog here.

An Architecture for Claims Based Authorization in SharePoint

I’ve spoken to many people recently about enabling Microsoft SharePoint 2010 to work with Claims to enhance both Authentication and Authorization in SharePoint. I’m finding that many people are still trying figure out where all the pieces fit in a SharePoint architecture that makes use of claims – there are new concepts to understand and often new infrastructure to be configured. Overall the concepts tend to be easier to understand than people realize once they dig into them a little. This article is designed to explain the concepts and applications required in one example of a SharePoint 2010 architecture which enables Claims Based Authentication and Authorization. Lets start with a diagram of what a SharePoint server architecture that uses Claims can potentially look like. 

To read more, check out my full blog here.

 

Configuring SharePoint 2010 with ADFSv2 to Retrieve Claims

When configuring SharePoint 2010 for claims based authentication or authorization you typically need to connect to an identity provider to retrieve user attributes as claims. To really see all the benefits of claims in the enterprise, we need to ensure that our SharePoint Server trusts the claims its receiving, and that often means configuring it to connect to a “trusted identity provider”. One such server application that can act as a trusted identity provider is Microsoft Active Directory Federation Services version 2.0 (ADFSv2). ADFSv2 is often also referred to as a ’secure token server’ because it plays the role of retrieving user attributes from Active Directory (or some other LDAP directory or data store), wrapping them up in a SAML token, digitally signing that token and returning it to the calling application – in this case SharePoint 2010. Configuring ADFSv2 in such scenarios can be tricky and unforgiving, and this article focuses on 1 particular part of that configuration – the Realm.

To read more, check out my full blog here.

Part 1: Claim Rules - Claims Based Security in SharePoint 2010 with ADFSv2

In general, claim rules can be used to centrally evaluate, transform or augment claims before they are returned to a relying party application like SharePoint. Microsoft Active Directory Federation Services version 2.0 (ADFSv2) can act as a trusted identity provider to SharePoint and other relying party apps.  It provides a great interface with templates for creating and editing claim rules as part of its management console.  As well, it provides a ‘claim rule language’ that can be used to configure detailed policies with very specific conditions. This allows us to configure specific claims to be retrieved under very specific conditions, and thereby enforce very specific security policies for authentication and authorization.
This series of articles talks in detail about how to use this mechanism to enforce dynamic access control policies within SharePoint 2010 and, it illustrates how these policies relate to particular industries and regulations in SharePoint.

To read more, check out my full blog here.

Part 2: Claim Rule Language - Claims Based Security in SharePoint with ADFSv2

In a recent post I introduced the concept of claim rules within Microsoft Active Directory Federation Services 2.0 (ADFSv2) and the templates it provides.  Claim rules can be used to easily evaluate, transform or augment claims before they are returned to a relying party application like SharePoint.  In this post, the second in the series, we dive into ADFSv2’s Claim Rule Language and how it can be used to issue claims under more specific conditions, retrieve attributes from external data sources and implement some unique scenarios. This post is only going to deal with ‘issuing outgoing claims’.  These are claims that ADFSv2 will return to a relying party application.  It is important to note that ADFSv2 has a set of incoming claims (and those can be configured) that our claim rules will refer to as part of their conditions, and it has a set of outgoing claims that will be returned to SharePoint in this case.

To read more, check out my full blog here.

Part 3: Checking Multiple Groups - Claims Based Security in SharePoint with ADFSv2

Implementing claims based authorization in SharePoint 2010 provides great alternatives to using security groups in order to control access to sensitive content in SharePoint.  Traditionally, security groups have been used to restrict access to content or to enforce a role based security mechanism.  However, organizations are quickly finding that security groups, whether they are SharePoint groups or Active Directory groups, do not scale well in large enterprise environments.  Many enterprises already have large numbers of groups deployed, so how can those organizations still make use of those groups to enforce advanced security policies without complicating group management further?  As well, how can they check membership to multiple groups in order to allow access to sensitive content? This article focuses on using claim rules in Active Directory Federation Services version 2 (ADFSv2) as an efficient mechanism to enforce security policies in SharePoint based on group membership.

To read more, check out my full blog here.

Building a Custom Claim Provider to Manage Security Clearances

Microsoft SharePoint 2010, with its built-in support for retrieving trusted attributes about a user upon login (or what is commonly referred to as claims), can be used to authenticate users and authorize access to content. As I’ve written about previously, this allows businesses to implement new and interesting information protection policies. SharePoint also allows us to build and deploy custom claim providers that can retrieve attributes from a wide variety of sources and transform them in order to enforce specific policies within SharePoint. This article will walk through a simple example of building a custom claim provider and review some of the technical considerations that need to be taken into account.

To read more, check out my full blog here.

Using AD Groups in a Claims Based Web Application

I ran across an interesting little side effect of altering my claims enabled web application in SharePoint 2010 the other day I thought would be useful for others to know about. The situation has to do with accessing AD Groups from within the SharePoint people picker in a claims enabled environment.

To read more, check out my full blog here.

RSA 2012 Wrap Up and Observations – Identity is Critical for Authorization

Reflecting on the incredible conference that was RSA 2012 last week, you can easily see how Identity has become critical to implementing real-world authorization scenarios in many businesses and government/military departments. There were many hot topics at RSA this year including: Cloud, Mobile and of course APTs (advanced persistent threats). With 22,000 attendees it was easy to get overwhelmed with the myriad of sessions and solution providers. However, Identity or using aspects of a user’s identity specifically for authorizing access to information or resources was everywhere. I gave session at RSA this year entitled Using Claims for Authorization in SharePoint, MS Outlook, Windows 8 and the Cloud. Thanks to everyone that attended. Keep reading to access my presentation deck from that session.


To read more, check out my full blog here.

Thanks for reading.  Let me know if you find any of the topics particularly interesting, if you have any comments, or if you'd like to see some specific topics covered in new articles.
-Antonio