Identity Manager Communication and Data Store Encryption

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

Information regarding the specific stages and technical methods used to encrypt communications and sensitive data across the various tiers of a standard Identity Manager enterprise architecture.

Environment

Identity Manager 14.x

Resolution

Identity Manager provides encryption at every stage of processing. The following technical specifications detail the encryption employed throughout the solution architecture:

Data Entry and Web Tiers

1. Initial Credential Entry: Sensitive data (e.g., passwords) is masked during user entry using functioning templates.
2. Browser to Web Server/Portal: SSL/TLS is recommended. While Identity Manager does not directly control this tier, Web Agents support 40-bit and 128-bit encryption. CA SiteMinder specifically supports 128-bit SSL encryption.
   
   

Internal and Component Communications

3. Web Agent to Identity Manager Application: Communications are encrypted using RSA RC4 128-bit encryption over the proprietary TLI transport protocol.
4. Identity Manager to SiteMinder Policy Server: Traffic is secured via RSA RC4 128-bit encryption over the TLI protocol.
5. Identity Manager to Workflow Engine: All data and control information passed between these components is encrypted.
6. SiteMinder Policy Server to Provisioning Engine: Communications are conducted via LDAP over SSL (LDAPS).
   
   

Data Store and External Tiers

7. User Stores: Sensitive profile data (passwords, challenge/response) can be encrypted in the store using RSA RC4 128-bit encryption or by leveraging native user store encryption.
8. Policy Store: System and configuration data are natively encrypted using RSA RC4 128-bit encryption.
9. SiteMinder Policy Server to Identity/Policy Store: Transmissions occur over encrypted tunnels if the user directory or database is SSL/TLS enabled.
10. Provisioning Engine to Target Systems: Communication to managed namespaces is typically agent-less and occurs over secure channels provided by the namespace or via encrypted channels such as SSL/TLS.