Many units have only discovered when deploying WiFi wireless certification systems that they already have an identity system: staff have a work code, students have a school number, members have a cell phone number and offices have a domain account number. If the new certification system is to build another one, not only users will need two sets of passwords but IT will maintain two sets of data, which will be a mess for everyone for a long time. Whether or not to communicate with existing identification systems directly determines whether it is a cost-saving or disruptive one.
Let's take a look at the source of what kind of identity we have.
Before we can do this, we should make clear the identity systems that exist in the unit: is it just a cell phone number? Or is there a unified LDAP or AD domain? Is there a micro-business code, nails, business micro-credit? Is there a school site with a manual and a single identification? Is there an electronic health card or government account?
A master identity with multiple sources of binding is the most stable model.
The more mature approach is to build one in the certification system"Home account"Then we'll use the cell phone number, the factory number, the micro-mail, and the school-worker number."Tie the relationship"The advantage of this is that a future identity source, such as the AD domain, will change and re-tring it to no longer affect the user's history in WiFi. Conversely, if each way is allowed to generate an independent account, the data will be broken immediately. We usually recommend that clients set the master account field at the programme stage, and not wait until the account numbers are online.
LDAP and AD field dock pits in permission and synchronisation
The most common source of identity for the business landscape is AD domain or LDAP. Technically, the interface is not complicated. The difficulty is a synchronous strategy: full or incremental? The exit staff has blocked the domain account number and WiFi will be synchronized as long as it takes to do so. If the account status doesn't go up, someone can leave and even WiFi's safety risks. We met an enterprise where HR banned its employees from being separated at AD, but the certification system only synchronized once a week, while those who left during the intervening days were able to access the Internet and were audited as soon as they became real-time or quasi-real-time synchronization."Time delay for the transmission of state change"It's a clear indicator that goes into the program."Support LDAP docking"It's done.
The difference between the scenes of micro- and business-based micro-letters
The location of the external service is almost impossible to access. But the micro-credit personal and micro-business are two things: the personal code can only get an openid, which cannot be really named; the company's micro-letter can be linked to a specific employee and fit into the internal scene. Many businesses want to authenticate it with a real name, but they don't get their real identity. This is usually when the micro-mail plus cell phone number is rereaded and tied to the main account.
The special nature of campus status like the Schoolwork.
In the school scene, the Quakers have a number of systems attached to teaching, personnel and residential services. WiFi certifications can be used to connect with unified identifications, automatically open students' enrolments, automatically cancel their graduations, and with less than half of the transport volume. The difficulty is that the campus identity system is often long-term, non-standard interfaces are sometimes custom-made.
Visitors' accounts and internal accounts must be separated.
Visitors should not enter the internal identity system, otherwise a temporary visitor’s account is mixed with a work ID and is neither safe nor easy to clean. Visitors are advised to go through an independent anonymous or semi-real name channel, with short life cycles, limited access, and automatic clearance. We have seen one building of visitors into AD domain, which has resulted in thousands of long-disappeared visitors’ accounts that no one dared to delete and become a serious security risk. The internal and external division of accounts is the basic discipline for accounting design.
The docking failure needs a demotion.
When there is a winding up of stable sources, domain control machines, micro-mail interfaces and technic systems can be used to make certification impossible. The design says: the main source is dead, and users can access it normally? The usual downgrade is temporary to a mobile number authentication or a grace period for certified users. We have not seen any unit with an identity system that has no year-round breakdown, so this reduction is not redundant and necessary.