Comments on: Enterprise Content Management and Security http://apoorv.info/2006/12/17/enterprise-content-management-and-security/ Random Thoughts Thu, 26 Apr 2012 07:41:57 +0000 hourly 1 http://wordpress.com/ By: Steve http://apoorv.info/2006/12/17/enterprise-content-management-and-security/#comment-4307 Sun, 25 Feb 2007 18:42:09 +0000 http://www.apoorv.info/index.php/2006/12/17/enterprise-content-management-and-security/#comment-4307 Great article…wrote some others on ECM and Security at http://www.scanguru.com

http://www.scanguru.com/page.php?9

]]> By: Munish K Gupta http://apoorv.info/2006/12/17/enterprise-content-management-and-security/#comment-4310 Tue, 02 Jan 2007 12:27:29 +0000 http://www.apoorv.info/index.php/2006/12/17/enterprise-content-management-and-security/#comment-4310 Having a centralized authentication and authorization model always leads to problems. Every new application that comes in, usually have its own authorization model. Now, a centralized model will mean, creating more roles/groups to manage this new set of privileges. After some time, the admin will go bonkers trying to create a new user and assigning him privileges across 10 applications.

My advise, keep the authentication central via your AD system and let each application, manage its own authorization model. Organizations can standardize on the tools/model to be used for authorization. This can provide a good delegated admin model also where an application admin can manage privileges for his/her set of application users

]]> By: Ijonas Kisselbach http://apoorv.info/2006/12/17/enterprise-content-management-and-security/#comment-4309 Mon, 18 Dec 2006 08:48:46 +0000 http://www.apoorv.info/index.php/2006/12/17/enterprise-content-management-and-security/#comment-4309 Hi Apoorv,

My two cents on ECM security, having dealt with many implementations from a migration
point-of-view, is that access rights to content (be thay ACL-Role, Asset-ACL or whatever) should be maintained by the ECM.

That is to say… I’m a great believer in keeping the metadata alongside the content and
to me access right information is nothing more than metadata. So I guess I take an
asset-centric point-of-view.

I think what is needed is industry standardisation around accesss rights. You right in
pointing out that security is more than just providing connectors into LDAP directories
to perform authentication requests.

Efforts like SAML are still “authentication-focused”, which is disappointing. I’m surprised not more is being done in this area to standardise the “access-rights” problem. There’s hardly any competitive edge to be found in the security implementations from one CMS to another.

I guess vendors are taking the “walled garden”-approach and hoping to cash-in on lock-in through lack of standardisation.

]]> By: Pranshu http://apoorv.info/2006/12/17/enterprise-content-management-and-security/#comment-4308 Mon, 18 Dec 2006 06:38:52 +0000 http://www.apoorv.info/index.php/2006/12/17/enterprise-content-management-and-security/#comment-4308 Good take apoorv. Externalizing Authorization has been a highly debated topic, especially when you are looking at integrating application access and possibly provisioning using portals.

I believe that Centralizing Authorization is not such a good idea. It creates a “cyclic dependancy” between the portal and the applications.
The Central Authorization Server needs to know all roles which exist in all the accessed application in order to do that.

Also the applications hardly ever agree on the security model – and we find the applications using a mix of ACL-Role , Role-Resource-Operation, and a unix style Asset-ACL authorization model.
Even if all the systems were using JAAS – centralizing authorization will require a dependance during application maintenance and administration.

]]>