3

A question has been on my mind lately. Say you have a global organization with intranet which does not exist, but it is supposed to be developed.

This organization has offices in maybe 50+ countries, and each office basically functions as a small company. The intranet is used to share transaction numbers between the different offices and sharing other knowledge.

This means that the individual offices may have different e-mail domains and servers, and may even operate under a different company name.

Say an employee leaves the company, we can assume that a country leader closes their e-mail account. Let's assume that the communication in the organization is not so great, so the system administrator of the intranet is not informed that the employee has left the organization... so the employee still has access to the knowledge inside the intranet.

My question is - is there a method to track whether an e-mail exists on the server side? Because if you could verify that the e-mail has become inactive, you could just revoke their access when they try to login again with a user that has been registered with that e-mail.

I've been doing some research, but as far as I can see, it is only possible to check whether a domain exists or not. If it is not possible to check this, how would one go about this?

One solution I can think of is that the intranet sends out an e-mail, for example, weekly confirming whether the e-mail is active or not. However, the employee could potentially still have access for a week. Another solution is a daily special code that is sent out to everyone in the organization, but this seems sub-optimal.

How is an issue like this solved in real-life? All input is greatly appreciated.

  • 2
    You may find useful this question stackoverflow.com/questions/3024819/… – A. Darwin Apr 8 '16 at 19:22
  • 2
    Consider the case (which happens often in orgs that I have been a part of) where you want to actually leave the email active because you want to capture any contacts from the outside still using it. The valid-email-as-semaphore is a nonstarter, imo. – Jeff Meden Apr 8 '16 at 19:33
4

I think that if you continue down that line of thinking towards a rock-solid solution, you're going to have to consider things like "what if the weekly email is spoofed?" ... "Maybe I need to digitally sign those lists", etc and you are going to end up inventing something very similar to a Certificate Authority.

Use an in-house Certificate Authority

I think the simplest (and cheapest) way to accomplish your goal is to use a VPN with client certificates to grant employees access to the intranet. To issue and manage the certificates, set up a hierarchy of Certificate Authorities (for example with openssl): the root would be operated by the parent company and each local branch office would run an Issuing CA to actually issue and manage the certificates of employees at that office.

CA Hierarchy

Configure the VPN to use client-certificates

Set up the firewalls for the intranet servers to only accept connections from inside the network, requiring users to VPN in. Configure the VPN server to require client certificates that trace back to the root CA operated by the parent company. Because of how certificates work, every time a user tries to log in, the VPN server will check with their Issuing CA to make sure their certificate is still valid - so each office manages their own database of employees. This means that local administrators at each office can add (aka "issue") or remove (aka "revoke") employees at their leisure and the VPN will automatically accept / reject their logins. I believe that most commercial and open-source VPNs support the client-cert mode of operation.

Another option: buy a COTS authentication product

A slightly more complex (and expensive) option is to purchase a certificate-based authentication web application that acts as a gatekeeper to your intranet and requires users to provide their certificate and a proof-of-possession of private key. I won't mention any specific products because my company sells one and I don't want to be accused of conflict of interest.

  • Very helpful! I think the in-house CA is very interesting, but I don't know if this is possible to do, since the individual offices consist only of HR people, and creating certificates needs be to done on their machines if I understand correctly. – Rasmus Apr 9 '16 at 9:56
  • 1
    Yes, unfortunately managing a CA would require an IT guy at each office, since it's a little bit tricky. If you only have IT people at your central office, then maybe you want to consider commercial authentication software. As an example, the solution that my company sells is called Identity Guard. – Mike Ounsworth Apr 9 '16 at 11:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.