Ministry of Infrastructure and Transport
PA
In 2021, the Directorate-General for Digitalization of the Ministry of Infrastructure and Transport has decided to update its infrastructure for accessing IT services by integrating it with strong authentication systems based on Digital Identity in order to further improve the technical security level and to avoid any possible risk of attacks or negligence deriving, for example, from the presence of obsolete components. With the support of Tirasa s.r.l., a company long established in the Open Source community and specialized in Identity & Access Management (IAM), an upgrade process was begun which then resulted in a broader solution for managing identities and accesses.
The solution
MIT's first request for Tirasa was, in fact, to update Apereo CAS to the latest version available, in order to guarantee greater reliability and a high security level within its authentication infrastructure. Later, thanks to Tirasa's experience in the IAM field and given its great ability to perceive the needs and expectations of its customers, MIT decided to extend its infrastructure by introducing a digital identity management system based on Apache Syncope, the Identity Manager Open Source conceived and developed by Tirasa and donated to the Apache Software Foundation in 2012.
This system represents a centralized solution for managing permissions and access control and it is integrated with different applications to which it guarantees Single Sign-On (SSO) access, protection from unauthorized/unrecognized requests and centralized management of sessions and permissions.
The given solution allows users to authenticate themselves using classic credentials verified on the Active Directory resource (internal users), or via SPID/CIE/CNS/eIDAS credentials, verified by delegating authentication to an external gateway for authentication via Public Digital Identity, or using verified credentials in Multi-Factor Authentication (MFA) through an integration with Microsoft Azure Active Directory.
In particular, the integrated use of a gateway for authentication via Public Digital Identity with policies for granting authorizations and access to all the applications that can be implemented via Apereo CAS and Apache Syncope allows to manage cases in which the access to specific applications must be guaranteed to personnel which is off-duty because in leadership or detached position or because he’s retired.
The access to integrated applications occurs in SSO, in compliance with the authorizations, defined centrally, according to Group-Based Access Control (GBAC) and/or Attribute-Based Access Control (ABAC) policies. In practice, the assignment to certain groups and/or the value of certain attributes, specific to the user or relating to a group assignment, may involve access, or not, to certain application services.
Reported benefits
The authentication infrastructure based on Apache Syncope allows dynamic management and continuous monitoring of access permissions to the application services offered by the Ministry.
The possibility of using a centralized and user-friendly administration console brings a huge benefit to the system administrators who, delegated to monitor and configure the system as a whole, can leverage on valid and reliable help for quickly implementing complex business logics, aimed at guaranteeing greater security and detailed controls.
Thanks to the given solution, today MIT can boast a complete and integrated IAM platform, easy to manage and monitor, absolutely robust and secure and totally in line with the specific needs of the Ministry.
The Ministry is fully satisfied with the new authentication infrastructure and recognizes all the potential due to the Open Source technology. It is also aware that Tirasa's skills, experience and support have allowed it to build a tool with great flexibility and simplicity of integration.
The Ministry of Infrastructure and Transport (MIT) is the competent Italian governing body that plans and manages infrastructures, network systems and national information systems, which deals with public works and all those projects aimed at improving the quality of life of people and to overcome territorial disparities, and which addresses the challenge of sustainable mobility in the management of the entire transport system (road, rail, air and maritime). Furthermore, thanks to the collaboration with the Italian Port Authority-Coast Guard, it monitors maritime traffic and regulates the main safety mechanisms at sea.
Moreover, MIT provides several online services which can be accessed by different users, both internal and external to the Ministry. Therefore, MIT has its own authentication infrastructure to control access to resources and to safely manage the users. This infrastructure is based on Apereo CAS and, then, it has all the advantages of an Open Source product, from openness and adaptability to the guarantee of data portability.
With the proposed solution, ASL CN1 has achieved a scalable, robust and secure authentication and identity management system that meets the needs of thousands of users.
The Open Source selection resulted in Apache Syncope and Tirasa, which provided ts activities to support the Army staff in building the best IdM system possible, for their own specific needs.
Being aware of how fundamental it is to manage identities and user permissions on applications at the core of our infrastructure, we have started a long-running process to rebuild our approach on top of Cloud Computing and best-of-breed software components, with help by Tirasa to streamline Apache Syncope. (Team Lead at Gordon Food Service)
After a PoC built by Tirasa and based on Apereo CAS and Apache Syncope, the Institute decided to proceed on this path by engaging Tirasa itself to realize the whole infrastructure.
Provisioning is involved with managing the internal data sources and external via specific connectors for representation of users, groups and attributes. This component often needs to be tailored to meet the requirements of a specific deployment. The enterprise support of Tirasa, gave us the manageability, scalability and flexibility to connect and protect millions of consumers at enterprise customers
Tirasa built for Nivo1 a full-blown, integrated, IAM platform based on the Open Source tools as Apache Syncope and Apereo CAS, granting full control, on customer base, to both user lifecycle and differentiated authentication and authorization. This combination of tools gives Nivo1 a distinct competitive advantage.
Currently the whole infrastructure, based on Apache Syncope, manages about 5.000 users, periodically synchronized with HR.
We choose Apache Syncope to carry out the provisioning and account management role as part of our authorization platform, due to its simplicity and flexible adoption to the product needs. Another important consideration was the knowledge and excellent support provided by the Tirasa team
Tirasa provided timely support and always followed up to ensure that all issues were resolved to satisfaction.
Stichting Bibliotheek.nl is very content with Apache Syncope as a product and intends to extend its services based on it.
SURFnet is currently planning how to include Syncope it in its identity management and collaboration middleware for provisioning / deprovisioning needs.
SWM is very satisfied with both the community and the commercial support of Tirasa.
We have had a few years to get to know Apache Syncope and have gained some in-depth knowledge of its use. For this, the support provided by Tirasa has been a vital aid. We have received help in the form of, for instance, code examples providing a preview of the implementation, as well as solutions to configuration problems and quick fixes to any errors we have discovered.
Users can log in via SPID, thanks to the functional extension developed by Tirasa.
Currently, the U.Porto is the most international of Portugal’s universities thanks to its active cooperation with hundreds of higher education institutions worldwide. The ambition now is to establish the U.Porto as one of the top 100 universities in the world by 2020.
The UShareSoft UForge Identity management service, is based on Apache Syncope, which was expressly chosen for it's richly defined and complete RESTful API.
Managing the complexity of identity flows across ships and shore is an extremely delicate and involved task: we did choose Open Source software to rule them all. Trusting Tirasa to build our Identity and Access Management system was simply refreshing.