Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My company has applications on cloud and intranet. Also, we have various roles such as employee, customers, partners etc. We would like ID federation between services hosted on public cloud and internal applications. Following scenarios are possible

  1. Employee accessing cloud services from intranet
  2. Employee, customers, partners accessing cloud services from internet
  3. Cloud hosted services accessing data services hosted internally on corporate network
  4. Employee, customers, partners accessing web applications/services hosted internally on corporate network from internet.
  5. Employee, customers, partners accessing web applications/services hosted internally on corporate network from intranet.

Whenever access is from internet to either internally hosted applications or cloud based applications, SSO should be created via multi-factor authentication, but if same applications are accessed from intranet, either userid-password is enough or if user is an employee, company SSO should be federated to cloud based services/applications.

We are debating if there are any pro or cons of having two Identity providers, one deployed in DMZ and other in internal network. The one in DMZ will enforce access going from intranet to cloud based services or users accessing cloud based services from internet will get federated to this IDP. Also, users from internet trying to acccess internal applications will get multi factor authenticated by this IDP in dmz. The IDP inside the internal network is used only for employees accessing intranet applications.

My question is that is the above kinda dual IDP a standard way to allow access? What is the harm of having only one IDP ?

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.