The unit has access to the WiFi real name certification system, often not starting from scratch. Staff have a uniform identification system, students have a school code and members have a CRM account, which is long running. If the new real name authentication system has another set of accounts, users will need two passwords, administrators will maintain two data for a long time or two, and questions are raised as to how to connect the WiFi authenticated system with the existing identity system.
We'll sort out who we should be on the docking line and which we should be anonymous.
Not all WiFi users have to connect to the internal identity system."Known identity"The first step in our approach is to stratification the user: the first level is internal known identity, which links the existing system; the second level is a partner, frequent client, who can pre-screen an account or temporary documents; and the third level is a full visitor, using a mobile phone. After the layer, the interface of the account number system is clear, no flow will be pumped into the internal identification system, nor will it be leaked.
The way you're connected, don't listen to one side of the story.
The identity system is common for LDAP, RADIUS, OAuth, SAML, databases and several different settings. Some suppliers say it's a matter of economy."We're supporting the docking."But it is not clear which way, if one or two ways, the synchronization is going to be delayed. We have encountered projects where a real name certification system reads the unified identity database directly through a database and results in an upgrade of the UIS table structure and full authentication. The interface is set at protocol level and allows the heads of both systems to confirm interface details in person. WiFi authenticated support multiple docking agreements is good, but it depends on the capabilities and transport habits of existing identification systems, not on which fashion styles are used.
The account synchronisation is a hidden pit.
Staff separations, student drop-outs, and member cancellations. These changes in status are reflected in the WiFi real-time certification system, otherwise those who leave can be at great risk even with WiFi."Check it on authentication."The right thing to do is to create a status-promotion or time-twice mechanism, with account number 1 disabled in the identity system and WiFi side disabled. We suggest that critical scenes be pushed in real time, with ordinary scenes at least incremental daily syncs, and synchronized logs kept for check. Many of these items are offline, and it is much more expensive to wait for security incidents to come out.
The code and the documents are processed to secure the boundary.
The most taboo thing about the identification system is that WiFi authenticated has a password for another user."Authentication is through."This result and the necessary identification do not touch the original password. We've seen a project where the real name authentication system synchronizes the code for unified identities into its own vault, which is an additional password leak point that is directly judged by a security audit as non-compliant."Password is not available."The principle is that you can use RADIUS to transmit it, or the OAuth, without passwords.
The field map must be aligned, not necessarily.
The field names, formats, meanings and the WiFi real name authentication system in the unified identity system may not be consistent. The manual could be string-banded letters, the school number might be pure numbers, mobile phone numbers had no tags. Field mapping is not fine, it can pass when authenticated, but then by checking logs and counting. We ask for two prefix dictionaries to align fields, map rules files and run them with real sample data. There was a school project where the school number was a string with lead zero in the identification system, which was counted as a number that lost nothing, thousands of records were never matched, and it took two days to check the pits, so the document was blocked.
Priority in multi-identity sources
One unit may have both employee status, membership status, visitor identity, and one person may have multiple identities."Same people from multiple sources."We suggest that each identity source be given priority, that the authentication be prioritized and that the logic of consolidation be clearly defined to avoid a person appearing in two online accounts or logs. Multi-source coexistence is not terrible, and there are no rules.
Keep the downgrade path when the docking fails.
Identity systems can be stung, upgraded, and network broken. The whole network is paralyzed if WiFi authenticated with it. We need to design downscaling: when the identity system is not available, internal users can temporarily take backup authentication (e.g. the last valid local cache) or cut to a visitor's physical access channel, at least to ensure Internet access. The downscaling is not bypassing compliance, but is basically available in case of source system failure. We suggest that critical identification sources are examined for health, automatically cut off and recorded during an anomaly, and then re-synced. This path must be followed by rehearsal before being connected, otherwise no one knows how to cut them when they really do.
If you can get through, where do the accounts come from?
The identity checks are done well, and the audit of transportation is easy. A WiFi account can trace its origin, real identity, when it's synchronized, and how it is now. This link is retraceable. Controls check, internal security retrievals, all this. We go with our clients as we finish the project."Account retroactively"Exercise, confirm that the logs track source ID systems all the way. The point of access is not just to save user passwords, but to make the whole identity system manageable, manageable and accessible. This is done so that the account number system really works, not connected.