Latest / The Identity Blueprint / Okta and Ping Promise Freedom From Active Directory. Do They Deliver?

Transcript

Okta and Ping Promise Freedom From Active Directory. Do They Deliver? · The Identity Blueprint

0:00
SPEAKER_01: Welcome back to the Identity Blueprint, Beyond the Domain.
0:03
SPEAKER_01: I'm Ernie with Jose.
0:05
SPEAKER_01: We just walked through how Microsoft does this.
0:08
SPEAKER_01: Today we run the identical stress test on Okta and Ping.
0:12
SPEAKER_01: Attribute level source of authority switching down to a single field, the SP Nego handshake that lets a cloud authenticated user walk straight into a Kerberos app without ever seeing a login screen, and why a layer 7 access gateway kills lateral movement in a way a VPN never could.
0:30
SPEAKER_01: We also get into Justin Time Elevation, ephemeral certificates that mint themselves in under four seconds and evaporate on a timer.
0:39
SPEAKER_01: If you're evaluating Okta or Ping against Microsoft for this exact migration, this is the episode that actually shows you the wiring.
0:47
SPEAKER_01: Let's get into it.
0:49
SPEAKER_00: Imagine trying to replace um the foundational concrete of a massive like 80-story skyscraper.
0:56
SPEAKER_00: But, and here's the real catch, you have to do it while 10,000 people are actively working at their desks inside.
1:02
SPEAKER_01: Right, which sounds completely insane.
1:04
SPEAKER_00: It is.
1:05
SPEAKER_00: I mean, the elevators have to keep running, the lights cannot flicker, uh, the coffee machines and the break rooms need to stay on because one wrong move, you know, one load-bearing beam removed out of sequence, and the entire enterprise just collapses in on itself.
1:18
SPEAKER_01: Aaron Powell Yeah, total structural failure.
1:20
SPEAKER_01: Trevor Burrus, Jr.
1:20
SPEAKER_00: Exactly.
1:21
SPEAKER_00: And today we are looking at the digital equivalent of that exact terrifying scenario.
1:26
SPEAKER_00: We are talking about decoupling an enterprise from legacy on-premises active directory.
1:32
SPEAKER_01: Aaron Powell And I mean, historically, the IT industry has handled migrations with a completely different mindset.
1:37
SPEAKER_01: Like the standard approach was always the weekend cutover.
1:40
SPEAKER_01: Trevor Burrus, Jr.
1:40
SPEAKER_00: Oh, the dreaded weekend cutover.
1:42
SPEAKER_01: Trevor Burrus, Jr.: Right.
1:42
SPEAKER_01: You'd send out this company-wide email warning everyone you know, shut down the old system on Friday night at midnight, migrate all the data over a highly stressful 48 hours, fire up the new system, and then well, you just hold your breath when everyone logs in on Monday morning.
1:56
SPEAKER_00: Aaron Powell The classic forklift upgrade.
1:58
SPEAKER_00: But when you step into the world of enterprise identity, I mean when you are talking about the very fabric of who is allowed to touch billions of dollars of corporate data, that forklift approach is completely impossible.
2:10
SPEAKER_00: You just cannot turn off the directory.
2:11
SPEAKER_01: Aaron Powell You absolutely cannot.
2:13
SPEAKER_01: If you attempt a hard cutover with identity architecture, you are just guaranteeing a massive outage.
2:19
SPEAKER_01: Modern businesses run globally 24-7.
2:21
SPEAKER_01: There's no quiet weekend window anymore.
2:24
SPEAKER_01: So the real challenge becomes uh how do you perform open heart surgery on a live enterprise network while the patient is literally sprinting a marathon?
2:32
SPEAKER_00: That is the exact question we are answering today.
2:34
SPEAKER_00: Welcome to this deep dive.
2:36
SPEAKER_00: Our mission today is a true mechanics masterclass.
2:39
SPEAKER_00: We've got a massive stack of architectural blueprints, vendor specifications, and deployment guides focusing on two industry titans today, Okta and Ping identity.
2:49
SPEAKER_01: And we're going deep today.
2:50
SPEAKER_00: We really are.
2:51
SPEAKER_00: We are moving entirely past the marketing fluff, skipping the high-level conceptual overviews.
2:56
SPEAKER_00: We are going directly into the engine room to look at the exact technical architecture that allows an enterprise to break its dependency on on-premises AD without disrupting a single user.
3:07
SPEAKER_01: Yeah, and the path ahead of us requires a pretty profound shift in how you think about state management and network boundaries.
3:13
SPEAKER_00: Right.
3:14
SPEAKER_00: And whether you are actively architecting a massive cloud migration for your company right now, or you know, you're just wildly curious about how enterprise security actually works under the hood, this deep dive is built specifically for you.
3:27
SPEAKER_00: Think of a legacy AD infrastructure like that old load-bearing concrete in the center of the skyscraper I mentioned.
3:34
SPEAKER_00: You can't just smash it with a sledgehammer.
3:35
SPEAKER_01: Definitely not.
3:36
SPEAKER_00: You need to install a steel support beam, which in this case is modern identity and access management from Arcta or Ping first.
3:44
SPEAKER_00: Then you transfer the weight pound by pound from the old foundation to the new steel.
3:49
SPEAKER_01: And we are going to trace the precise journey of that exact weight transfer.
3:54
SPEAKER_01: We have to start at the foundational level, right?
3:56
SPEAKER_01: Profile mastering.
3:57
SPEAKER_01: That acts as that pound by pound switch.
4:00
SPEAKER_01: From there, we need to examine the nervous system of the operation, which is the outbound sync agents.
4:04
SPEAKER_00: And then we have to tackle the massive elephant in the room, the legacy applications.
4:08
SPEAKER_01: Oh yeah.
4:09
SPEAKER_01: We will dissect the intricate mechanics of Kerberos bridging.
4:12
SPEAKER_01: We will look at how HR systems actually trigger identity creation at machine speed.
4:16
SPEAKER_01: And finally, we'll explore exactly how modern layer seven gateways are systematically replacing those traditional network VPNs that we have, well, relied on for decades.
4:26
SPEAKER_00: I want to jump right into the deep end here.
4:28
SPEAKER_00: Before we can move a single byte of data, before we even talk about syncing or gateways, we have to determine who actually owns the data.
4:36
SPEAKER_00: We have to start with the Identity Foundation and look at source of authority or SOA switching.
4:42
SPEAKER_00: Like how do we start moving away from AD without breaking everything on day one?
4:46
SPEAKER_01: Well, to understand the solution, we really have to understand the historical monopoly of Active Directory.
4:52
SPEAKER_01: Since gosh, since Windows 2000 was released, AD has been the undisputed heavyweight champion of identity.
4:59
SPEAKER_00: It was everything.
4:59
SPEAKER_01: It held all the cards.
5:01
SPEAKER_01: If you wanted to change a user's phone number, their title, or their group membership, you did it in AD.
5:06
SPEAKER_01: And AD told every other system what to do.
5:08
SPEAKER_01: A D was the sole source of authority.
5:10
SPEAKER_00: The ultimate boss of the network.
5:12
SPEAKER_01: Right.
5:13
SPEAKER_01: But if your goal is to move to the cloud, you have to break that monopoly.
5:18
SPEAKER_01: And the trucks of the entire decoupling strategy relies on something called attribute level mastering.
5:23
SPEAKER_01: If we look at Okta's universal directory and ping identity's equivalents, which are Ping an Advanced Identity Cloud and Ping Directory, the core mechanism is highly, highly granular.
5:35
SPEAKER_01: An administrator doesn't just flip a giant switch for the whole company.
5:39
SPEAKER_00: Let me stop you there, because I want to make sure I understand this mechanically.
5:42
SPEAKER_00: Are you saying they don't even flip a switch for a whole user?
5:44
SPEAKER_01: That is the beauty of it.
5:46
SPEAKER_01: They don't have to.
5:46
SPEAKER_01: Decoupling can happen down at the level of a single database field.
5:50
SPEAKER_01: They explicitly designate whether Legacy Active Directory or the Cloud Directory is the authoritative source for specific user attributes on a user-by-user basis.
5:59
SPEAKER_00: Okay, wait, I need to visualize this.
6:01
SPEAKER_00: Think about the CFO at your company.
6:04
SPEAKER_00: I'm talking to you, the listener.
6:06
SPEAKER_00: Think about your chief financial officer.
6:08
SPEAKER_00: We aren't saying uh Active Directory is gone now for the CFO.
6:12
SPEAKER_00: We are saying for this specific user, Okta is now the boss of their job title and department, but AD might still be the boss of their on-premise email address and their password.
6:22
SPEAKER_01: Aaron Ross Powell That is a perfect visualization.
6:24
SPEAKER_01: Yeah, it is an object-level switch down to the exact attribute.
6:27
SPEAKER_01: You basically convert a user who is originally synced from Active Directory into a cloud editable object.
6:33
SPEAKER_01: The system maps the schema of AD to the schema of the cloud directory.
6:37
SPEAKER_01: From the actual millisecond, you flip the source of authority for, say, the department attribute.
6:41
SPEAKER_01: That specific field acts as if it were originally created natively in the cloud.
6:45
SPEAKER_01: The dependency string is cut, but the access remains totally intact.
6:49
SPEAKER_00: Okay, but wait.
6:50
SPEAKER_00: The CFO is a busy person.
6:52
SPEAKER_00: Let's say it's 2 p.m.
6:53
SPEAKER_00: on a Tuesday.
6:54
SPEAKER_00: The CFO is sitting at their desk, logged into some critical financial dashboard, crunching numbers for an earnings call.
7:01
SPEAKER_00: Behind the scenes, the IT administrator hits the button and flips the source of authority for the CFO's entire profile from AD to Okta or to ping.
7:12
SPEAKER_00: What actually happens in that exact moment?
7:14
SPEAKER_00: Does the CFO screen go blank?
7:17
SPEAKER_01: Oh no.
7:17
SPEAKER_00: Do they get a giant red error message telling them to log back in?
7:21
SPEAKER_00: Because I mean, if you interrupt the CFO's earnings call, someone is definitely getting fired.
7:25
SPEAKER_01: Yeah, that would be a resume generating event.
7:27
SPEAKER_01: But this is where modern continuous evaluation engines save the day.
7:30
SPEAKER_01: The answer is no, they do not get booted out.
7:33
SPEAKER_01: And the reason lies in how session state is managed in modern architectures compared to legacy systems.
7:38
SPEAKER_00: How so?
7:39
SPEAKER_01: In a legacy AD environment, you authenticate once, you get a ticket, and you basically trust it for hours, regardless of what changes on the back end.
7:46
SPEAKER_01: It's just a static check.
7:47
SPEAKER_00: Like a point-in-time snapshot of your identity.
7:49
SPEAKER_01: Exactly, yes.
7:50
SPEAKER_01: But in Okta, session state is governed by global session policies.
7:55
SPEAKER_01: And in ping, it's driven by their adaptive authentication policies.
7:58
SPEAKER_01: These policies do not just check a static password once, they are continuously evaluating contextual signals in the background.
8:06
SPEAKER_00: Constantly watching.
8:07
SPEAKER_01: Constantly.
8:08
SPEAKER_01: They are looking at the device posture like does the laptop still have its firewall on?
8:12
SPEAKER_01: They're looking at IP reputation.
8:14
SPEAKER_01: Did the connection suddenly route through a known bad Tor node?
8:18
SPEAKER_01: They are analyzing behavioral velocity.
8:20
SPEAKER_00: Aaron Powell So because the system is constantly watching those contextual clues, it realizes, hey, the database backend just changed ownership, but the laptop is still the CFO's laptop, the IP is still the corporate office, the risk is zero.
8:31
SPEAKER_01: You nailed it.
8:32
SPEAKER_01: As long as that risk profile remains low, the session persists natively.
8:36
SPEAKER_01: The cloud directory simply takes over the continuous evaluation without the CFO ever even noticing that the source of authority just changed right beneath them.
8:44
SPEAKER_01: The transfer of the structural weight happens entirely transparently.
8:48
SPEAKER_00: Wow.
8:48
SPEAKER_00: Okay, let me challenge that though.
8:50
SPEAKER_00: Transparency is great when everything works perfectly.
8:53
SPEAKER_00: But we are talking about human beings managing infinitely complex distributed systems here.
8:58
SPEAKER_00: What happens when someone messes up the configuration?
9:01
SPEAKER_01: Ah.
9:01
SPEAKER_01: Well, it is the single biggest risk in an SOA migration, hands down.
9:06
SPEAKER_00: Right.
9:06
SPEAKER_00: So let's walk through it.
9:07
SPEAKER_00: Say we have a massive enterprise, we have Workday as the HR system, we have the old Active Directory, and we have Okta in the cloud, and IT makes a routing mistake.
9:16
SPEAKER_00: Suddenly, both systems, Legacy AD and Okta, think they are the authoritative source for a user's department code.
9:23
SPEAKER_00: Workday tells Okta the user is in marketing.
9:26
SPEAKER_00: But some old script tells AD the user is in sales.
9:30
SPEAKER_00: And both systems think they are the ultimate boss.
9:32
SPEAKER_00: Does the whole profile just corrupt?
9:34
SPEAKER_00: Do we get a split brain scenario?
9:36
SPEAKER_01: So this brings us to a really fundamental concept in distributed computing, which is state management and collision resolution.
9:42
SPEAKER_01: Depending on the synchronization model in play, you might hit a race condition where you know wherever system writes the data last just wins.
9:49
SPEAKER_01: But modern enterprise architectures are built to anticipate this kind of mess.
9:53
SPEAKER_01: They operate on eventual consistency models versus immediate global enforcement.
9:59
SPEAKER_00: Meaning the system tolerates a little bit of delay to keep things rain fast.
10:03
SPEAKER_01: Oh yes.
10:04
SPEAKER_01: To maximize right availability across global data centers, a user's profile update in a European data center might take a few seconds to replicate to Asia.
10:14
SPEAKER_01: But to address your specific scenario of a true collision over who owns the attribute what we call behavioral drift, the system relies incredibly heavily on observability and health monitoring pipelines.
10:26
SPEAKER_00: Explain how those pipelines actually catch the collision, though.
10:28
SPEAKER_00: Is some poor analyst just staring at a log file?
10:31
SPEAKER_01: Far from it, thankfully.
10:32
SPEAKER_01: These pipelines are highly automated.
10:34
SPEAKER_01: They don't just look at network latency, they use behavioral baselines.
10:38
SPEAKER_01: But more importantly, they execute continuous synthetic transactions.
10:42
SPEAKER_00: Synthetic transaction, you're like fake user logins.
10:45
SPEAKER_01: Precisely.
10:46
SPEAKER_01: The system basically acts as a dummy user, constantly probing its own endpoints from an outsider's perspective to recreate user experiences and detect anomalies.
10:56
SPEAKER_01: If the directory synchronization engine attempts to write an attribute, but it detects that another authoritative source has a conflicting lock on that exact same attribute, the collision is flagged immediately.
11:07
SPEAKER_00: So the system just throws its hands up and says, I'm confused.
11:10
SPEAKER_00: Humans need to fix this right now.
11:12
SPEAKER_01: It generates a high severity alert, yes.
11:15
SPEAKER_01: And this is crucial.
11:16
SPEAKER_01: To correct this, administrators cannot just click a sync button again and hope the cloud forcefully overwrites AD.
11:22
SPEAKER_01: They must leverage identity governance access reviews.
11:25
SPEAKER_00: Meaning they have to go in manually.
11:27
SPEAKER_01: Yeah, they have to manually audit the drift, look at the audit logs to see exactly where the conflicting rights originated, override the conflict manually, and re-establish the correct source of authority mapping to enforce immediate global consistency.
11:39
SPEAKER_00: It's basically like having two middle managers giving you conflicting instructions, and you just freeze until the vice president steps in, looks at the org chart, and says, no, this person is the actual boss.
11:49
SPEAKER_00: Listen to them.
11:50
SPEAKER_01: That's a very human way to describe a complex database lock, but functionally, it's accurate.
11:55
SPEAKER_00: Okay.
11:56
SPEAKER_00: So we've established the brain here.
11:58
SPEAKER_00: We know how ownership of the identity is transferred attribute by attribute, but now we have to talk about the nervous system.
12:04
SPEAKER_00: We have to talk about how the brain in the cloud actually talks to the legacy body sitting in the basement data center.
12:12
SPEAKER_00: I want to transition into directory sync agent architecture because honestly, this presents a massive, massive paradox.
12:19
SPEAKER_00: No.
12:20
SPEAKER_00: Well, we have built this beautiful secure cloud identity in Okta or Ping, right?
12:26
SPEAKER_00: But the legacy Active Directory Domain Controller is sitting in a heavily fortified, dark server room.
12:32
SPEAKER_00: To make these systems talk, historically, you had to poke a giant hole in the corporate firewall just to let the cloud reach inside and read the directory.
12:40
SPEAKER_01: Which is the absolute antithesis of modern security.
12:43
SPEAKER_01: Every single inbound firewall rule is a potential attack vector.
12:48
SPEAKER_01: If the cloud is compromised, or if an attacker manages to spoof the cloud's IP address, they can walk right through that inbound port and directly access the domain controller.
12:57
SPEAKER_00: It gives chief information security officers absolute nightmares.
13:01
SPEAKER_00: So how do Okta and Ping actually solve this without compromising the perimeter?
13:05
SPEAKER_01: They solve it by completely inverting the communication flow.
13:08
SPEAKER_01: The modern pattern used by both vendors is an outbound-only architecture.
13:13
SPEAKER_01: I have to say, this is a massive architectural triumph.
13:16
SPEAKER_00: Walk me through the mechanics of that.
13:18
SPEAKER_00: How can you sync data if the cloud can't reach in?
13:21
SPEAKER_01: It relies on stateful packet inspection at the firewall level.
13:24
SPEAKER_01: So here's how it works.
13:26
SPEAKER_01: Okta provides the Okta AD agent, and ping has its equivalent directory sync agents.
13:31
SPEAKER_01: These are incredibly lightweight pieces of software.
13:33
SPEAKER_01: You install them on a domain join Windows server that sits inside your internal network right next to your Active Directory.
13:39
SPEAKER_00: Okay, so the agent is already inside the house.
13:42
SPEAKER_01: Yes.
13:43
SPEAKER_01: The agent reads the Active Directory data locally using standard LDIP queries.
13:48
SPEAKER_01: Then the agent initiates a connection outbound to the cloud over standard port 443 using HTTPS.
13:55
SPEAKER_00: Oh, I see.
13:56
SPEAKER_00: So because the call is coming from inside the house, the corporate firewall sees a trusted internal server trying to reach the internet and it says, sure, you can go out.
14:04
SPEAKER_01: Exactly.
14:05
SPEAKER_01: The firewall is stateful.
14:08
SPEAKER_01: It remembers that the internal agent started the conversation.
14:11
SPEAKER_01: When the cloud responds with instructions saying, hey, change this user's phone number, the firewall allows that response back in because it is part of an already established outbound initiated TCP handshake.
14:22
SPEAKER_00: That's brilliant.
14:23
SPEAKER_01: There are zero inbound firewall ports required.
14:26
SPEAKER_01: Nothing from the outside internet can initiate a connection to that agent.
14:29
SPEAKER_00: That completely eliminates the external attack surface for the synchronization engine.
14:33
SPEAKER_01: It really does.
14:34
SPEAKER_01: And from a management perspective, it's brilliant.
14:36
SPEAKER_01: All the rules, the attribute mappings, and the configuration settings, they're all managed centrally in the cloud portal.
14:42
SPEAKER_01: You are not remote desk tubing into a local Windows server to tweak a configuration text file anymore.
14:48
SPEAKER_00: Which is what we used to do all the time.
14:49
SPEAKER_01: Right.
14:50
SPEAKER_01: You manage the behavior of the agent from the Okta Universal Directory dashboard or the pinyon interface.
14:55
SPEAKER_01: The agent simply pulls the cloud, asks, what do you want me to do, and executes the instructions locally.
15:01
SPEAKER_00: I love the elegance of that.
15:02
SPEAKER_00: But let's talk about the reality of enterprise scale.
15:05
SPEAKER_00: We are pushing all this data out through this outbound pipe.
15:09
SPEAKER_00: How much weight can this specific bridge hold before it just buckles?
15:14
SPEAKER_00: A global bank doesn't just have a few hundred employees, but they have hundreds of thousands of objects.
15:19
SPEAKER_01: This is where we really have to look closely at the architectural limits documented in the vendor specifications, because they strictly dictate your deployment strategy.
15:28
SPEAKER_01: There are explicit operational thresholds we must acknowledge here.
15:31
SPEAKER_01: In parallel, cloud sync engines, tenants with more than 150,000 total objects per domain, and that counts users, computers, and groups, hit explicit scale constraints.
15:42
SPEAKER_00: 150,000 objects.
15:43
SPEAKER_00: I mean, that sounds like a big number to a small business, but if you factor in service accounts, meeting room accounts, and security groups, an enterprise hits that ceiling incredibly fast.
15:52
SPEAKER_01: Very fast.
15:53
SPEAKER_01: Furthermore, the lightweight cloud agents often struggle with massive grouping structures.
15:58
SPEAKER_01: Groups with more than 50,000 members are frequently unsupported by these lightweight outbound agents.
16:04
SPEAKER_00: Wow, 50,000.
16:05
SPEAKER_01: And there's a critical nuance regarding how directory mathematics work here.
16:09
SPEAKER_01: Nested groups, where one group is a member of another group, they count as one single member each.
16:14
SPEAKER_01: This means manual reconciliation of deeply nested complex hierarchies is just not supported at scale by the lightweight agent.
16:21
SPEAKER_01: It just cannot process the mathematical graph fast enough over an outbound poll.
16:26
SPEAKER_00: Now contrast that with ping, because I know ping has a massive footprint in the enterprise space specifically because of its scale.
16:32
SPEAKER_01: Yes.
16:32
SPEAKER_01: Ping directory is engineered fundamentally of an enterprise LDIP server.
16:37
SPEAKER_01: It is capable of scaling to hundreds of millions of entries and is currently managing over 8 billion identities globally across its customer pace.
16:46
SPEAKER_00: 8 billion?
16:47
SPEAKER_00: That's wild.
16:48
SPEAKER_01: It's massive.
16:49
SPEAKER_01: However, regardless of the directory's total theoretical capacity, the physical sync agent interval timings and limits dict how fast those on-prem changes can reflect in the cloud.
17:00
SPEAKER_01: The pipe itself has constraints, even if the ocean it feeds into is practically limitless.
17:07
SPEAKER_00: So I have two massive operational questions for you then.
17:10
SPEAKER_00: First, what happens if you are that global bank and you have 150,001 users?
17:15
SPEAKER_00: You breach the limit.
17:16
SPEAKER_00: And second, what happens if the physical server running this lightweight agent has a hardware failure, catches fire, and just dies?
17:23
SPEAKER_00: Does all synchronization just stop?
17:25
SPEAKER_01: Well let's address the hardware failure first because it really highlights the resilience of the architecture.
17:29
SPEAKER_01: This is handled by active high availability or HA behavior.
17:33
SPEAKER_00: Break that down.
17:33
SPEAKER_00: How does it differ from the old way?
17:35
SPEAKER_01: So legacy synchronization engines, like older Microsoft Identity Manager deployments, they often rely on a passive staging server.
17:42
SPEAKER_01: You had your main sync server and a backup just sitting there doing absolutely nothing.
17:47
SPEAKER_01: If the primary died, a human administrator had to wake up at 3 a.m., log in, and manually fail over to the passive server.
17:55
SPEAKER_01: It was slow and highly prone to error.
17:58
SPEAKER_00: A terrible design for modern uptime requirements, obviously.
18:01
SPEAKER_01: Modern cloud sync architectures completely abandon that.
18:04
SPEAKER_01: Instead, you deploy multiple provisioning agents across different network segments or data centers.
18:08
SPEAKER_01: Three, four, five agents.
18:10
SPEAKER_01: It doesn't matter.
18:11
SPEAKER_01: And they are all active simultaneously.
18:14
SPEAKER_00: So they are all constantly polling the cloud, asking for work?
18:17
SPEAKER_01: Exactly.
18:17
SPEAKER_01: They share the load.
18:18
SPEAKER_01: If one agent server goes down, say the hardware fails, or someone just unplugs the wrong network cable, the cloud system detects the missed polls.
18:26
SPEAKER_01: Traffic automatically shifts within 120 seconds to the remaining active agents.
18:30
SPEAKER_00: 120 seconds.
18:31
SPEAKER_01: Yes.
18:31
SPEAKER_01: There is zero impact on directory read operations, and write operations barely experience a noticeable hiccup before the other agents pick up the Slack.
18:38
SPEAKER_00: Okay, that handles the hardware failure beautifully.
18:41
SPEAKER_00: But what about the scale limit?
18:43
SPEAKER_00: What if I genuinely have more than 150,000 objects, or I have some ancient legacy application that relies on a single security group with 80,000 members?
18:53
SPEAKER_01: If those operational limits are permanently exceeded by the organization's architecture, you cannot rely solely on the lightweight agent.
18:59
SPEAKER_01: You must pivot to a hybrid coexistence strategy.
19:03
SPEAKER_00: Meaning you use two completely different types of sync engines.
19:06
SPEAKER_01: Exactly.
19:07
SPEAKER_01: You segment the workload, you let the lightweight cloud sync agent handle the 80% standard identity flow.
19:12
SPEAKER_01: That's the bulk of your standard users, the day-to-day password resets, the basic profile updates.
19:17
SPEAKER_01: It handles the volume efficiently.
19:19
SPEAKER_01: But then you deploy a heavier, traditional server-bound KinectSync engine to handle the remaining 20%.
19:24
SPEAKER_00: The heavy lifting.
19:25
SPEAKER_01: Yes.
19:26
SPEAKER_01: That 20% covers the complex legacy cases.
19:29
SPEAKER_01: It handles the massive groups over 50,000 members.
19:31
SPEAKER_01: It handles intricate device write backs and complex schema mapping that the lightweight agent simply does not have the processing power to compile on the fly.
19:38
SPEAKER_01: It is really about using the right architectural tool for the specific constraint you are facing.
19:43
SPEAKER_00: I see where you're going, and I love the pragmatism of that hybrid approach.
19:47
SPEAKER_00: But I want to pivot.
19:48
SPEAKER_00: Because we've mapped the identities, we've synced the users to the cloud using our outbound only agent, and we've survived a server failure using that 120-second failover.
19:58
SPEAKER_00: The user is in the cloud, the foundation is poured.
20:01
SPEAKER_00: But here is the massive, unavoidable reality check for every enterprise in the world.
20:06
SPEAKER_01: The legacy applications.
20:08
SPEAKER_00: Exactly.
20:09
SPEAKER_00: Let's talk about the user sitting at their desk.
20:11
SPEAKER_00: Their identity is in the cloud.
20:12
SPEAKER_00: But to do their actual job, they need to access an ancient, on-premises, Windows integrated billing application that was built like 20 years ago.
20:21
SPEAKER_00: This application has no idea what Okta is, it has never heard of ping.
20:24
SPEAKER_00: It doesn't speak modern web protocols.
20:26
SPEAKER_00: It doesn't know what SAML is.
20:27
SPEAKER_00: It definitely doesn't know what an OUF token is.
20:30
SPEAKER_01: It only speaks Kerberos.
20:32
SPEAKER_00: It only speaks Kerberos.
20:33
SPEAKER_00: And this right here, this is the classic legacy anchor.
20:36
SPEAKER_00: This is the exact moment where most cloud migration strategies just hit a solid brick wall.
20:42
SPEAKER_00: The CIO says move everything to the cloud.
20:44
SPEAKER_00: And the IT architects look at the billing system and say, we can't.
20:48
SPEAKER_00: It's tethered to the floor.
20:50
SPEAKER_00: So this brings us to section three: Kerberos bridging for legacy access.
20:55
SPEAKER_00: How do we achieve desktop single sign-on for a user who just authenticated in the cloud, but is trying to access a legacy Kerberos resource sitting on a local server?
21:04
SPEAKER_01: We have to build a highly sophisticated bridge.
21:07
SPEAKER_01: And bridging that gap requires some of the most complex cryptographic translation mechanics in the entire industry.
21:12
SPEAKER_01: To understand the bridge, you really have to understand the gap.
21:15
SPEAKER_01: Kerberos was developed in the 1980s at MIT during Project Athena.
21:19
SPEAKER_00: Wow, the 80s!
21:20
SPEAKER_01: Yeah.
21:20
SPEAKER_01: It relies on symmetric cryptography, meaning the key to encrypt the data is the exact same key used to decrypt it.
21:26
SPEAKER_01: It relies on a trusted third party called the Key Distribution Center, or KDC, and it is heavily reliant on a local secure network.
21:33
SPEAKER_00: It was built for closed corporate campuses, not the open internet.
21:36
SPEAKER_01: Exactly.
21:37
SPEAKER_01: Modern cloud authentication relies on asymmetric cryptography and web tokens that get passed over the internet.
21:42
SPEAKER_01: So how do we translate?
21:44
SPEAKER_01: Let's break down the two vendor approaches to this exact problem, because while they achieve the identical outcome of seamless access, their architectural components differ slightly.
22:00
SPEAKER_01: On combining two specific tools.
22:02
SPEAKER_01: First, the Okta AD agent, which we discussed earlier, handles the desktop single sign-on piece.
22:07
SPEAKER_01: It securely logs the user into their physical machine.
22:10
SPEAKER_01: But the real magic happens with the Okta Access Gateway, or OAG.
22:15
SPEAKER_01: OAG operates as the bridge.
22:17
SPEAKER_01: It sits in front of the legacy application and uses a protocol called Kerberos Constrained Delegation or KCD to translate the modern cloud session into a legacy ticket.
22:26
SPEAKER_01: And what about Ping?
22:27
SPEAKER_01: On the Ping identity side, the architecture uses Ping Access as the reverse proxy gateway, combined with Ping Federate's Kerberos adapter.
22:35
SPEAKER_01: Ping Federate acts as the massive Federation hub translating the modern OpenID Connect or SAML tokens from the cloud into legacy WS Trust or Kerberos tickets that the on-prem application can actually consume.
22:48
SPEAKER_00: Okay, I don't just want the high-level outcome here though.
22:51
SPEAKER_00: I want to trace the exact sequence of this exchange.
22:54
SPEAKER_00: I want to know what the browser and the servers are whispering to each other in the dark.
22:58
SPEAKER_00: Let's walk through a user, let's call him Alex, logging in.
23:00
SPEAKER_01: I will walk you through the cryptographic handshake step by step.
23:04
SPEAKER_01: Step one, Alex logs into his physical corporate desktop machine.
23:08
SPEAKER_01: Because his machine is tied to the modern identity fabric via desktop SSO, he is authenticated in the cloud.
23:14
SPEAKER_01: The operating system holds a valid cloud identity token right in its memory.
23:18
SPEAKER_00: Okay.
23:18
SPEAKER_00: Alex is at his desktop.
23:20
SPEAKER_00: Step two.
23:20
SPEAKER_01: Step two.
23:21
SPEAKER_01: Alex opens his web browser and types in the URL of the legacy on-premises web app, the ancient billing system.
23:27
SPEAKER_01: Step three.
23:28
SPEAKER_01: The gateway, whether that's Okta Access Gateway or Ping Access, is strategically positioned in front of that billing system.
23:36
SPEAKER_01: It intercepts Alex's browser request.
23:38
SPEAKER_01: The gateway looks at the request and realizes Alex doesn't have an active session for this specific legacy app yet, so it redirects his browser up to the cloud identity provider, the IDP.
23:50
SPEAKER_00: It kicks into the cloud.
23:51
SPEAKER_00: What happens next?
23:52
SPEAKER_01: This is where the translation really begins.
23:53
SPEAKER_01: The cloud IDP returns an HTTP 401 unauthorized status code to Alex's browser.
23:59
SPEAKER_00: Hold on, I have to interrupt you there.
24:00
SPEAKER_00: If 401 is an error code, why is the gateway intentionally rejecting him and throwing an error?
24:05
SPEAKER_01: Ah, it isn't a true rejection.
24:06
SPEAKER_01: It's a challenge mechanism.
24:08
SPEAKER_01: Along with that 401 unauthorized code, the IDP includes a very specific HTTP header.
24:13
SPEAKER_01: WWW authenticate.
24:15
SPEAKER_01: Negotiate.
24:16
SPEAKER_00: Negotiate, yes.
24:17
SPEAKER_01: It is the server telling the browser, I don't know who you are, but let's negotiate a secure context.
24:21
SPEAKER_01: Show me what security protocols you support.
24:24
SPEAKER_00: Okay, so the browser gets challenged.
24:25
SPEAKER_01: Step five.
24:27
SPEAKER_01: Because Alex already logged into his desktop securely back in step one, the browser natively understands this challenge.
24:33
SPEAKER_01: It automatically intercepts that 401 error before Alex ever even sees it on the screen.
24:37
SPEAKER_00: Oh wow.
24:38
SPEAKER_01: The browser dips down into the Windows operating system, grabs the desktop sign-on information, and fires back a new request to the server with a new header.
24:47
SPEAKER_01: Authorization.
24:50
SPEAKER_00: You are gonna have to explain ESPNEGO to me because that sounds like a waffle brand.
24:54
SPEAKER_01: Espinego stands for Simple and Protected GSS API negotiation mechanism.
24:59
SPEAKER_00: Catchy.
24:59
SPEAKER_01: Very.
25:00
SPEAKER_01: In layman's terms, it is a digital handshake protocol.
25:03
SPEAKER_01: It allows the browser to say to the server, I don't know exactly what security language you speak, so here is a list of my credentials wrapped in a standard envelope.
25:11
SPEAKER_01: Open it and pick the one you understand.
25:12
SPEAKER_00: That makes perfect sense.
25:13
SPEAKER_00: It's an agreement protocol.
25:14
SPEAKER_00: So what is the final step?
25:16
SPEAKER_01: Step six.
25:17
SPEAKER_01: The cloud IDP receives and validates that SPNego token.
25:21
SPEAKER_01: It says, okay, this mathematical proof confirms Alex is who he says he is.
25:25
SPEAKER_01: It passes this confirmation down to the gateway.
25:28
SPEAKER_01: Now the gateway uses Kerberos constrained delegation.
25:31
SPEAKER_01: The gateway turns around, faces the internal network, and requests a local Kerberos ticket on behalf of Alex from the on-premise domain controller.
25:39
SPEAKER_00: Wait, it accesses proxy.
25:41
SPEAKER_01: Exactly.
25:42
SPEAKER_01: The gateway takes that newly minted Kerberos ticket, hands it to the legacy billing app, and Alex is granted access.
25:48
SPEAKER_01: He is looking at the billing dashboard, and he never once saw a login screen.
25:52
SPEAKER_00: That is incredible.
25:53
SPEAKER_00: I want to use an analogy to make sure we are mapping the cryptography correctly here.
25:57
SPEAKER_00: It's like Alex has a highly secure, modern digital ID on a smartphone.
26:01
SPEAKER_00: He walks up to an exclusive old school club, a highly secure translator, the gateway is standing at the door.
26:07
SPEAKER_00: The translator scans Alex's digital ID, verifies it mathematically with headquarters, and then the translator personally takes a VIP pass, locks it inside a titanium lockbox that only the bouncer inside can open, and hands that lockbox to the bouncer.
26:20
SPEAKER_00: Alex never had to talk to the bouncer himself.
26:22
SPEAKER_01: The titanium lockbox is a crucial addition to that analogy because it accurately represents how Kerberos service principal names, or SPNs, function.
26:31
SPEAKER_01: The ticket isn't just a piece of paper anyone can read.
26:34
SPEAKER_00: Let's dig into that because I want to throw a massive wrench into this architecture.
26:38
SPEAKER_00: What if someone intercepts that lockbox?
26:41
SPEAKER_00: We are passing Kerberos tickets across a network.
26:44
SPEAKER_00: What if the Kerberos constrained delegation trust is misconfigured by an admin?
26:49
SPEAKER_00: Or a highly sophisticated threat actor manages to intercept the Kerberos ticket in transit.
26:54
SPEAKER_01: This is a vital edge case to explore because any form of credential delegation inherently carries massive security implications.
27:01
SPEAKER_01: Let's look at the misconfiguration first.
27:03
SPEAKER_01: If the KCD trust itself breaks, say, a domain admin is cleaning up Active Directory and accidentally revoke the service account permissions that the gateway uses, the seamless SSO instantly fails.
27:14
SPEAKER_01: The gateway can no longer request tickets on behalf of users.
27:17
SPEAKER_00: But the whole system just crashes.
27:19
SPEAKER_01: No, it elegantly degrades.
27:21
SPEAKER_01: Systems federated through Ping or Okta are designed for resilience.
27:25
SPEAKER_01: The architecture realizes the SP Nego flow failed, and it will immediately revert to displaying a standard secure HTML login screen.
27:33
SPEAKER_01: It forces the user to manually enter credentials as a fallback.
27:36
SPEAKER_00: Oh, that's smart.
27:37
SPEAKER_01: And simultaneously, this degradation triggers high priority alerts to the observability pipelines, notifying the Security Operations Center that the SP Nego Cerbero's flow is broken.
27:47
SPEAKER_00: It fails open but securely and screams for help.
27:50
SPEAKER_00: But what about the interception scenario?
27:53
SPEAKER_00: What if the threat actor sniffs the network traffic and grabs the ticket?
27:56
SPEAKER_01: If the ticket is actively intercepted in transit, the architecture's defense in depth takes over.
28:02
SPEAKER_01: First, the entire HTT exchange between the browser, the gateway, and the IDP relies on TLS encryption.
28:08
SPEAKER_01: But even if they break that, the Kerberos ticket itself is mathematically protected.
28:13
SPEAKER_01: This goes back to your lockbox analogy.
28:15
SPEAKER_01: Kerberos tickets are strictly bound to specific service principal names, or SPNs.
28:19
SPEAKER_00: Define SPN for the listener really quickly.
28:21
SPEAKER_01: An SPN is a unique identifier for a specific service running on a server.
28:26
SPEAKER_01: When the gateway requests the ticket, it encrypts it using the specific symmetric cryptographic key associated with the billing application's SPN.
28:35
SPEAKER_01: It mathematically ties the ticket to that specific service on that specific server.
28:40
SPEAKER_00: So the ticket is useless anywhere else.
28:43
SPEAKER_01: Exactly.
28:44
SPEAKER_01: Even if a threat actor sniffs the ticket on the wire, attempting to reuse it outside of that strictly bound context, like trying to pass it to the email server, or the database server is extraordinarily difficult, bordering on impossible without the symmetric key.
28:58
SPEAKER_01: The ticket simply will not be decrypted or accepted by any other service on the network.
29:02
SPEAKER_00: Okay, that makes me feel much better about bridging legacy Kerberos.
29:06
SPEAKER_00: We've mapped the identities, we've synced the data, and we've successfully navigated the Kerberos bridge for daily access.
29:12
SPEAKER_00: But up to this point, we have assumed that our user, Alex, already exists in the system.
29:16
SPEAKER_00: We've been looking at his day-to-day routine.
29:18
SPEAKER_00: Let's rewind time.
29:19
SPEAKER_00: Let's go all the way back to the genesis of the identity.
29:22
SPEAKER_00: Where does a cloud-first identity actually originate?
29:25
SPEAKER_01: That is the pivotal question of modern lifecycle management.
29:28
SPEAKER_00: Because it shouldn't be a tired IT guy manually typing a name into an Active Directory terminal at 4 p.m.
29:34
SPEAKER_00: on a Friday.
29:35
SPEAKER_00: We need to talk about HR-driven provisioning.
29:37
SPEAKER_01: If an enterprise is truly breaking its dependency on legacy active directory, it has to completely change where identity is born.
29:44
SPEAKER_01: Historically, AD was the authoritative source of truth for the entire employee life cycle.
29:49
SPEAKER_01: HR would hire someone, email IT, and IT would manually create the AD account.
29:54
SPEAKER_01: AD was the genesis.
29:55
SPEAKER_00: Which is incredibly inefficient and prone to human error.
29:58
SPEAKER_00: Typos, wrong permissions, delays.
30:00
SPEAKER_01: Completely.
30:01
SPEAKER_01: In the modern architectural paradigm, the human resources information system platforms like workday or SAP success factors becomes the absolute starting point.
30:10
SPEAKER_01: It is the single authoritative trigger for identity creation.
30:13
SPEAKER_00: The HR-driven IT model.
30:15
SPEAKER_01: Yes.
30:16
SPEAKER_01: Let's look at the mechanics using Okta workflows and lifecycle management, which features native API connectors for workday and success factors.
30:23
SPEAKER_01: And we will look at Ping's equivalent, Pignon DaVinci, which is a highly visual, no code identity orchestration engine.
30:31
SPEAKER_01: The moment HR finalizes a new higher record in workday, an API call or a webhook instantly triggers a predefined orchestration flow in Okta or Ping.
30:40
SPEAKER_00: So no one in IT is opening a help desk ticket.
30:43
SPEAKER_01: Absolutely no tickets.
30:44
SPEAKER_01: The entire day one provisioning task is automated, and these workflows are deeply intelligent.
30:49
SPEAKER_01: They're scheduled dynamically based on the exact start date populated in the HR system combined with global time zone mapping logic.
30:56
SPEAKER_00: The time zone mapping is crucial.
30:58
SPEAKER_00: Explain how that impacts the rollout.
31:00
SPEAKER_01: Think about a global enterprise.
31:01
SPEAKER_01: If Alex is hired to work in the Sydney, Australia office, his Monday morning begins 14 hours before a new hire sitting in New York.
31:08
SPEAKER_01: If the orchestration engine runs a generic nightly batch script based on US Eastern Time, Alex spends his entire first day in Sydney locked out of his computer.
31:17
SPEAKER_00: A terrible onboarding experience.
31:19
SPEAKER_01: Exactly.
31:20
SPEAKER_01: But OctaWorkflows and Pink DaVinci calculate the exact local time zone offset based on the HR location data.
31:27
SPEAKER_01: On the specific morning of Alex's first day, local time, the workflow executes the final provisioning steps.
31:34
SPEAKER_01: It automatically generates a temporary access pass, or TP, which is a time-limited, highly secure initial credential, and emails it securely to Alex's manager.
31:44
SPEAKER_00: So what does this mean for you, the listener, if you manage IT?
31:47
SPEAKER_00: It means the classic, we forgot to tell IT about the new hire problem completely vanishes.
31:53
SPEAKER_00: The manager has the secure credentials waiting in their inbox before Alex even walks through the office doors.
31:58
SPEAKER_00: But let me throw another massive wrench in the gears here.
32:01
SPEAKER_00: Go ahead.
32:01
SPEAKER_00: Let's talk about the messy reality of human resources.
32:04
SPEAKER_00: What if Alex gets a counteroffer from his old company?
32:07
SPEAKER_00: What if the hire is terminated or the offer is rescinded before day one, but after the automated provisioning engine has already run the preliminary setup and created all his cloud accounts?
32:16
SPEAKER_01: This edge case perfectly illustrates why moving away from legacy AD batch scripts is so critical.
32:23
SPEAKER_01: This is where the machine speed capability of modern identity platforms proves its absolute worth.
32:29
SPEAKER_01: Because security critical changes like terminating access require immediate global enforcement, the orchestration engine acts as an automated kill switch.
32:38
SPEAKER_00: How fast is immediate though?
32:39
SPEAKER_01: The absolute moment an HR representative updates Alex's status to terminated or offer rescinded in workday, Workday fires a webhook directly to Okta Workflows or Ping DaVinci.
32:50
SPEAKER_00: A webhook, meaning an instant HTTP push notification rather than waiting for the system to pull for changes.
32:56
SPEAKER_01: Exactly.
32:56
SPEAKER_01: The engine doesn't wait for a 2 a.m.
32:58
SPEAKER_01: nightly batch sync to realize the user is gone.
33:00
SPEAKER_01: It acts at machine speed.
33:02
SPEAKER_01: The workflow receives the webhook and instantly invalidates that temporary access pass before the manager can even hand it over to anyone.
33:08
SPEAKER_01: Furthermore, the workflow immediately fires off parallel API calls to revoke access across the entire software stack.
33:15
SPEAKER_00: Everything at once.
33:16
SPEAKER_01: Everything.
33:16
SPEAKER_01: The source documentation specifically notes deployment scenarios where 50 plus enterprise downstream SAWS applications are instantly deprovisioned and revoked in seconds.
33:27
SPEAKER_00: Wow, 50 plus apps in seconds.
33:29
SPEAKER_01: The Slack account, the Salesforce license, the Microsoft 365 mailbox, all locked.
33:35
SPEAKER_01: It completely neutralizes the risk of an orphaned account existing in the wild before the account was ever truly active.
33:42
SPEAKER_00: That is ruthless, beautiful efficiency.
33:44
SPEAKER_00: I love it.
33:45
SPEAKER_00: Okay, so we've covered the lifecycle genesis in HR, we covered the sync agent, and we covered the legacy Kerberos translation.
33:52
SPEAKER_00: Now I want to look much closer at the architecture of the gateway itself, Okta Access Gateway and Ping Access, because we touched on how they handle the Kerberos translation, but I want to understand how they secure applications that traditionally hide behind a corporate firewall.
34:05
SPEAKER_00: This brings us to section five, which I call the gateway to the pass.
34:08
SPEAKER_01: To understand this, we must first make a really crucial architectural distinction for the listener.
34:13
SPEAKER_01: The gateway architecture we are discussing now is entirely separate from the directory sync agent we covered back in section two.
34:19
SPEAKER_00: Right, let's be explicitly clear.
34:21
SPEAKER_00: The sync agent from earlier is moving identity data names, job titles, department codes.
34:26
SPEAKER_00: It works quietly in the background.
34:28
SPEAKER_01: Precisely.
34:28
SPEAKER_01: The directory sync agent handles database replication.
34:32
SPEAKER_01: The gateway ping access or Okta Access Gateway handles live application access traffic.
34:37
SPEAKER_01: It sits directly in the data path of the user.
34:40
SPEAKER_01: When a user clicks a link to open an app, their network traffic physically routes through the gateway.
34:45
SPEAKER_00: So how does this gateway actually protect the legacy application?
34:49
SPEAKER_00: Because previously, that application relied on a firewall to keep bad actors out.
34:53
SPEAKER_01: The gateway acts as a zero trust enforcement point that completely inverts the traditional access model.
34:59
SPEAKER_01: Think about Alex trying to access the on-prem billing application from a coffee shop.
35:03
SPEAKER_01: Before the gateway architecture, Alex would have to connect to a VPN to get inside the firewall.
35:08
SPEAKER_01: With the gateway, Ping Access or OEG sits on the edge of the network.
35:12
SPEAKER_01: It intercepts Alex's web traffic and forces him to authenticate in the cloud first.
35:16
SPEAKER_00: Before he even gets near the on-prem server.
35:19
SPEAKER_01: Exactly.
35:19
SPEAKER_01: The gateway halks the traffic.
35:22
SPEAKER_01: It applies modern adaptive MFA.
35:24
SPEAKER_01: It checks the device posture to ensure the laptop is managed.
35:28
SPEAKER_01: It runs risk-based policies, utilizing tools like OctaFastPass to evaluate if the login context is anomalous based on behavioral history.
35:36
SPEAKER_01: Only after Alex successfully passes this rigorous cloud scale security checkpoint does the gateway bridge the verified session into the on-prem environment.
35:45
SPEAKER_00: So the legacy application is completely shielded.
35:48
SPEAKER_01: It is entirely dark to the outside world.
35:50
SPEAKER_01: The legacy application only ever receives traffic directly from the gateway proxy.
35:54
SPEAKER_01: It never talks to the internet and it never talks directly to Alex's laptop.
35:58
SPEAKER_00: Okay, I see the security benefit.
35:59
SPEAKER_00: But if I am an IT architect, I am looking at this design and I am terrified.
36:03
SPEAKER_00: If this gateway is sitting in front of my most critical revenue-generating legacy applications, it sounds like a massive single point of failure.
36:10
SPEAKER_00: If that gateway server crashes, does the entire company lose access to billing, inventory, and HR?
36:16
SPEAKER_01: That is the exact right question to ask, and the deployment mechanics account for this inherently.
36:21
SPEAKER_01: You never deploy these gateways as a single instance.
36:24
SPEAKER_01: The vendor system and network requirements dictate that you must deploy a minimum of two virtual appliances or VAs per cluster to ensure high availability.
36:35
SPEAKER_00: A highly available cluster of gateways.
36:37
SPEAKER_01: Yes.
36:37
SPEAKER_01: In a production environment, you might have four or five virtual appliances running in parallel.
36:42
SPEAKER_01: Incoming traffic is continuously load balanced across the entire cluster.
36:47
SPEAKER_01: If a single virtual appliance handling gateway traffic suffers a catastrophic failure, whether it's a kernel panic, a network interface failure, or it's just taken offline for a seamless software update, the load balancer detects the failure in milliseconds.
37:00
SPEAKER_00: And what happens to the user?
37:01
SPEAKER_00: What happens to Alex mid-click?
37:02
SPEAKER_01: The other healthy nodes in the cluster transparently take over the HTTP proxy request.
37:08
SPEAKER_01: Because the session state data is distributed and managed correctly across the cluster, the failover happens without disrupting the user's active session.
37:17
SPEAKER_01: Alex clicks submit on a billing invoice, the server he was talking to dies mid-request, another server picks up the packet, and Alex doesn't even realize the infrastructure just saved itself.
37:27
SPEAKER_00: That is enterprise grade resilience.
37:29
SPEAKER_00: But this brings us to the ultimate architectural question.
37:31
SPEAKER_00: This is the paradigm shift that ties everything together.
37:34
SPEAKER_00: Think about this scenario.
37:36
SPEAKER_00: We have remote users sitting at home accessing internal on-premises applications through this gateway.
37:42
SPEAKER_00: How is this any different from the traditional VPN we have been using for 20 years?
37:46
SPEAKER_00: Why go through all this trouble to deploy clusters of Okta access gateways when I can just have my users click connect on a VPN client?
37:54
SPEAKER_01: To understand why gateways fundamentally beat traditional VPNs, we really have to interrogate the network stack itself.
38:01
SPEAKER_01: We need a masterclass on the OSI model.
38:03
SPEAKER_00: I am ready.
38:04
SPEAKER_00: Lay it on me layer by layer because this distinction really matters.
38:07
SPEAKER_01: The Open System's interconnection model, or OSI model, defines how network communications operate.
38:13
SPEAKER_01: Layer one is the physical cable.
38:15
SPEAKER_01: Layer two is the data link, like MSC addresses.
38:18
SPEAKER_01: Layer three is the network layer.
38:20
SPEAKER_01: This is where IP addresses live.
38:22
SPEAKER_01: A traditional virtual private network, VPN, operates at this network layer, layer three, or sometimes at layer four, the transport layer.
38:30
SPEAKER_00: What does that mean in practical terms for the user?
38:33
SPEAKER_01: It means when you authenticate to a traditional VPN from your house, your remote laptop is essentially assigned a local IP address on the internal corporate network.
38:43
SPEAKER_01: The VPN punches a secure tunnel through the internet and virtually places your device inside the corporate building.
38:49
SPEAKER_00: You are inside the perimeter.
38:51
SPEAKER_01: Exactly.
38:51
SPEAKER_01: And because you are operating at layer three on the network, you have broad lateral access to that network segment by default.
38:58
SPEAKER_01: You can ping other servers, you can run port scans to see what services are running.
39:02
SPEAKER_00: Which is convenient for IT administrators, but terrifying for security.
39:05
SPEAKER_01: It is the ultimate vulnerability.
39:08
SPEAKER_01: If a user's remote device is compromised with malware, say their kid downloaded a malicious file onto the corporate laptop, that malware now has a direct encrypted tunnel into the entire internal corporate network.
39:19
SPEAKER_01: The malware can move laterally, discover customer databases, infect file shares, and launch catastrophic ransomware attacks from the inside because the VPN trusted the device at the network level.
39:29
SPEAKER_00: An absolutely unacceptable blast radius for a modern enterprise.
39:32
SPEAKER_01: Precisely.
39:33
SPEAKER_01: Now contract that layer three model with modern gateways like Ping Access or Okta Access Gateway.
39:38
SPEAKER_01: These gateways do not operate at layer three.
39:40
SPEAKER_01: They operate at the application layer, layer seven.
39:42
SPEAKER_01: They are designed to provide zero trust-based access to specific IP addresses or fully qualified domain names without requiring a legacy VPN tunnel.
39:51
SPEAKER_00: So what is the functional difference for the malware?
39:53
SPEAKER_00: How does layer seven stop the ransomware?
39:56
SPEAKER_01: The distinction is monumental.
39:57
SPEAKER_01: With a layer seven gateway, the user's remote device never touches the internal corporate network.
40:02
SPEAKER_01: The client device is not assigned an internal IP address.
40:05
SPEAKER_01: Instead, the gateway acts as an absolute proxy.
40:08
SPEAKER_01: The user connects to the gateway over the internet.
40:10
SPEAKER_01: The gateway connects to the application on the internal network.
40:14
SPEAKER_01: The gateway stitches the communication together, but the two networks never actually touch.
40:18
SPEAKER_00: So you are connecting to the application, not the network.
40:22
SPEAKER_01: Exactly.
40:22
SPEAKER_01: You are only granted per app access to specific TCP or UDP applications.
40:28
SPEAKER_01: The access policies use fine-grained conditions based on user attributes.
40:32
SPEAKER_01: You map the exact blast radius.
40:34
SPEAKER_01: The user can view the billing webpage because the gateway proxies HTTP traffic to port 443.
40:40
SPEAKER_01: But they cannot ping the database server hosting the billing data.
40:43
SPEAKER_01: They cannot scan the subnet.
40:44
SPEAKER_01: Lateral movement is structurally impossible because, from the user's perspective, there is no network access to move laterally across.
40:51
SPEAKER_00: Okay, I have an analogy for this, and I think it perfectly illustrates the layer three versus layer seven divide.
40:56
SPEAKER_00: Think of a traditional VPN like checking someone's ID at the front gate of a massive sprawling corporate campus and then just letting them wander the halls freely.
41:06
SPEAKER_00: They could go into the cafeteria, they could sneak into the server room, they could rattle the doorknob of the CEO's office to see if it's unlocked.
41:14
SPEAKER_00: That is layer three network access.
41:16
SPEAKER_01: And the gateway.
41:17
SPEAKER_00: The gateway architecture is like a magical elevator.
41:19
SPEAKER_00: You check the user's ID in the lobby.
41:22
SPEAKER_00: It is heavily guarded.
41:23
SPEAKER_00: Once they are verified, they get in the elevator, but the elevator has no buttons, the doors close, and it opens directly into the specific room they are allowed to be in, the billing department.
41:31
SPEAKER_00: There are no hallways, there is no wandering.
41:33
SPEAKER_00: They do their job, they get back in the elevator, and they are back on the street.
41:37
SPEAKER_00: Just the lobby and the exact room they need.
41:39
SPEAKER_01: Aaron Powell That is a brilliant visualization of layer seven zero trust access versus layer three network access.
41:46
SPEAKER_01: You have entirely eliminated the hallways.
41:48
SPEAKER_00: And when you eliminate the hallways, you eliminate the threat actor's ability to navigate your infrastructure.
41:53
SPEAKER_00: You eliminate lateral movement.
41:55
SPEAKER_01: Precisely.
41:55
SPEAKER_01: You contain the blast radius to a single application.
41:58
SPEAKER_00: Well, we have covered an incredible amount of ground today in this deep dive.
42:02
SPEAKER_00: Let's recap the blueprint.
42:03
SPEAKER_00: We started by looking at how to master profiles in the cloud, switching that source of authority granularly, attribute by attribute, to prevent a hard cutover.
42:12
SPEAKER_00: We look at how identity data is synced securely using lightweight, outbound-only agents over port 443, eliminating inbound firewall rules.
42:22
SPEAKER_01: We build a sophisticated cryptographic bridge for legacy Kerberos applications using SP Nego and constrained delegation, allowing cloud identities to access ancient systems without breaking a sweat.
42:32
SPEAKER_00: We learned how HR platforms like Workday become the absolute trigger for machine speed provisioning and critically immediate automated revocation.
42:40
SPEAKER_00: And finally, we saw how surgical layer seven application gateways completely replace the massive risky blast radius of traditional network-wide VPNs.
42:49
SPEAKER_01: By understanding these fundamental mechanics, from eventual consistency to layer seven proxies, you now have the architectural blueprint to break free from the constraints of legacy active directory, while simultaneously improving both your security posture and the end user experience.
43:05
SPEAKER_00: It is a massive structural upgrade.
43:11
SPEAKER_01: So uh having just wrapped up the mechanics of directory sync agents in this deep dive, and you know, really understanding exactly how these platforms pull user data from on-prem environments up into the cloud, we need to immediately pivot.
43:26
SPEAKER_00: Aaron Powell Right, because that's just the start.
43:28
SPEAKER_01: Exactly.
43:29
SPEAKER_01: Getting those groups and roles synced is really just step one for you.
43:32
SPEAKER_01: The critical question for an administrator or say an enterprise architect listening to this is how you actually govern what you've just synced.
43:40
SPEAKER_00: Yeah, it's the governance equivalents.
43:42
SPEAKER_01: Right.
43:42
SPEAKER_01: Specifically focusing on access certification and uh privileged elevation.
43:46
SPEAKER_00: Aaron Powell Because synchronizing an identity, I mean, it simply establishes that the user exists, right?
43:51
SPEAKER_00: It just means they have a certain set of baseline permissions imported from an active directory or an HR system.
43:56
SPEAKER_01: Trevor Burrus Just moving the data over.
43:57
SPEAKER_00: Aaron Powell Yeah, just moving it.
43:58
SPEAKER_00: But governance is about Continuous validation.
44:01
SPEAKER_00: It shifts the entire conversation.
44:03
SPEAKER_00: It goes from, you know, how did this user get this access initially to can the business prove exactly why this user still needs this access today?
44:11
SPEAKER_01: Like right now.
44:12
SPEAKER_00: Right now, based on their exact current context.
44:16
SPEAKER_00: Because without robust governance, a perfectly synced directory just becomes this stagnant pool of accumulating privileges.
44:24
SPEAKER_01: Aaron Powell Which is terrifying.
44:25
SPEAKER_00: It really is.
44:26
SPEAKER_00: That accumulation is the primary attack surface for modern threat actors.
44:30
SPEAKER_01: Aaron Powell It's basically the difference between handing someone an ID badge on their first day and actually checking to see if they still work in that department like three years later.
44:38
SPEAKER_00: Aaron Powell That's exactly it.
44:40
SPEAKER_01: So let's look at how Octa Identity Governance handles this because their approach to access certification campaigns and entitlement reviews is quite specific.
44:49
SPEAKER_01: Especially when dealing with high-risk groups.
44:51
SPEAKER_00: Yeah.
44:51
SPEAKER_00: Okta Identity Governance treats access certification as a dynamic, continuous requirement.
44:56
SPEAKER_01: Aaron Powell Not just a yearly checklist.
44:58
SPEAKER_00: Exactly, rather than a static annual IT headache.
45:02
SPEAKER_00: So let's walk through a highly specific named scenario so you can really visualize this.
45:06
SPEAKER_01: Okay, lay it out.
45:07
SPEAKER_00: Imagine a sensitive group in your sync directory.
45:10
SPEAKER_00: Let's call them the production database administrators.
45:13
SPEAKER_01: Oh, that's a big one.
45:14
SPEAKER_01: You don't want anyone in there who doesn't need to be.
45:16
SPEAKER_00: Right.
45:16
SPEAKER_00: This isn't a group you want people lingering in if they, you know, change roles or move to a different project.
45:21
SPEAKER_00: So Okta allows you to configure a periodic quarterly access review specifically targeted at this one group.
45:29
SPEAKER_01: Just for that group.
45:30
SPEAKER_00: Yeah.
45:30
SPEAKER_00: And when the quarter ends, the system automatically initiates a workflow.
45:35
SPEAKER_00: It doesn't wait for an IT admin to remember to send an email.
45:38
SPEAKER_01: Which they will forget.
45:40
SPEAKER_00: Oh, absolutely.
45:40
SPEAKER_00: So the system actively prompts the resource owner or you know, the direct manager of the users in that group.
45:46
SPEAKER_00: Okay.
45:47
SPEAKER_00: And it asks them to explicitly verify the continued need for this specific group membership for every single user holding it.
45:55
SPEAKER_00: Trevor Burrus, Jr.
45:55
SPEAKER_01: But I mean the psychological reality of those reviews is often the weakest link in the chain.
46:00
SPEAKER_01: We call it rubber stamp fatigue.
46:02
SPEAKER_01: A manager gets a massive spreadsheet of entitlements, gets completely overwhelmed, and just blindly clicks approve all so they can get back to their actual job.
46:11
SPEAKER_01: Aaron Powell So how does the Okta platform mechanically combat that fatigue?
46:15
SPEAKER_00: Yeah.
46:16
SPEAKER_01: Because if the interface just throws 50 names at a manager, the governance is purely theatrical.
46:21
SPEAKER_00: Aaron Powell Well, the mitigation for rubber stamp fatigue relies heavily on context injection.
46:26
SPEAKER_01: Context injection.
46:27
SPEAKER_00: Yeah, right within the approval dashboard itself.
46:30
SPEAKER_00: The manager isn't just looking at a raw list of names and like obscure Active Directory security groups.
46:37
SPEAKER_01: Aaron Powell Right, which are usually named something impossible to understand anyway.
46:41
SPEAKER_00: Exactly.
46:41
SPEAKER_00: So the Okta identity governance interface pulls in recent usage telemetry.
46:46
SPEAKER_00: Oh wow.
46:47
SPEAKER_00: Yeah.
46:48
SPEAKER_00: It might highlight that a specific engineer hasn't actually authenticated into any application tied to that production database administrator's group in, say, the last 85 days.
46:59
SPEAKER_01: So it puts that right in front of the manager's face.
47:01
SPEAKER_00: Right there on the screen.
47:02
SPEAKER_00: That visual friction forces the manager to pause.
47:06
SPEAKER_00: The system is essentially saying you are about to approve access for a highly sensitive database that this user hasn't touched in three months.
47:13
SPEAKER_00: Are you sure?
47:14
SPEAKER_01: That's brilliant.
47:15
SPEAKER_01: So let's follow that thread to the consequence.
47:18
SPEAKER_01: Say the manager actually pays attention and realizes the engineer moved to a front-end development team, so they hit deny.
47:25
SPEAKER_01: Or perhaps more commonly, the manager is on sabbatical and the review is simply ignored.
47:30
SPEAKER_00: Which is the classic problem.
47:32
SPEAKER_01: Right.
47:32
SPEAKER_01: Historically, if an access review email was ignored, the user just kept their access.
47:37
SPEAKER_00: Yeah, and the internal auditor just flagged it as an exception like six months later.
47:41
SPEAKER_01: Exactly.
47:42
SPEAKER_01: So how does this change?
47:43
SPEAKER_00: Well, that historical failure mode is what modern identity governance engines are explicitly designed to eliminate.
47:49
SPEAKER_00: Under the Okta identity governance mechanics, there is a configured grace period for this quarterly review.
47:55
SPEAKER_01: Like a countdown timer?
47:56
SPEAKER_00: Basically, yeah.
47:57
SPEAKER_00: Let's say the organization sets a strict 14-day window.
48:00
SPEAKER_00: The manager is prompted via email or Slack or Microsoft Teams integrations.
48:06
SPEAKER_01: Right, wherever they actually work.
48:07
SPEAKER_00: Exactly.
48:08
SPEAKER_00: And if the manager actively hits deny on a user, or this is the key part, if that 14-day grace period expires with absolutely no response, the consequence is absolute and immediate.
48:20
SPEAKER_01: The system cuts them off.
48:21
SPEAKER_01: But I want to really understand the underlying mechanism of that cutoff for our listeners.
48:26
SPEAKER_01: Does it just like send a ticket to a help desk queue for someone to manually remove the user from the group?
48:33
SPEAKER_00: No, absolutely not.
48:34
SPEAKER_00: The reliance on manual ticketing for revocation completely defeats the purpose of automated governance.
48:40
SPEAKER_01: Right, because then you're waiting on a humic again.
48:41
SPEAKER_00: Exactly.
48:42
SPEAKER_00: The system automatically revokes the group membership at the control plane level.
48:46
SPEAKER_01: How does it talk to the app, though?
48:48
SPEAKER_00: Okta Identity Governance utilizes automated provisioning protocols, often S9.
48:54
SPEAKER_01: System for cross-domain identity management.
48:56
SPEAKER_00: Right, SCIM.
48:58
SPEAKER_00: So it uses that to send an immediate API call down to the target applications and directories.
49:03
SPEAKER_01: Just fires off a command.
49:04
SPEAKER_00: Yeah.
49:05
SPEAKER_00: The identity control plane strips the entitlement.
49:08
SPEAKER_00: The user's session token for that specific application is invalidated right then and there.
49:13
SPEAKER_01: Oh, it kills the active session too.
49:15
SPEAKER_00: Yep.
49:15
SPEAKER_00: And their membership array is updated to remove the production database group.
49:19
SPEAKER_00: The automation itself is the enforcement mechanism.
49:23
SPEAKER_01: That removes the human bottleneck entirely.
49:25
SPEAKER_01: So we've established how to govern standing access.
49:29
SPEAKER_01: But what about the engineers who legitimately need that high-level access, but you know, only for a two-hour maintenance window.
49:36
SPEAKER_00: Ah, yeah, that's a different beast.
49:38
SPEAKER_01: This brings us to Octa Privileged Access and Justin Time Elevation, or JIT.
49:44
SPEAKER_00: JIT is so critical here.
49:46
SPEAKER_01: I always like to frame standing privileges with a physical analogy for you all listening.
49:50
SPEAKER_01: Imagine you hire a plumbing contractor to fix a very specific leak in a third floor bathroom of your corporate headquarters.
49:58
SPEAKER_00: Okay, tracking.
49:59
SPEAKER_01: To let them fix that leak, you hand them a permanent physical master key to the entire building.
50:04
SPEAKER_01: You just let them keep it forever, just in case they ever need to fix another pipe five years from now.
50:08
SPEAKER_00: Which is insane in the physical world.
50:10
SPEAKER_01: Right.
50:11
SPEAKER_01: But that is exactly what having standing privileges is like in an IT environment.
50:14
SPEAKER_00: It really is.
50:15
SPEAKER_01: So just in time access is handing that plumber a digital key card that only unlocks the front door, the elevator to a third floor, and that specific bathroom door.
50:24
SPEAKER_00: And nowhere else.
50:25
SPEAKER_01: Nowhere else.
50:26
SPEAKER_01: And crucially, the key card automatically deactivates after exactly two hours.
50:31
SPEAKER_00: I love that.
50:32
SPEAKER_00: The digital key card analogy encapsulates the zero standing privileges concept perfectly.
50:38
SPEAKER_00: Right.
50:38
SPEAKER_00: And the precise technical parameters required to execute that scenario in Okta privileged access are fascinating.
50:45
SPEAKER_00: It relies on rigorous context.
50:47
SPEAKER_01: Well, let's break down the workflow for that.
50:48
SPEAKER_00: Okay.
50:49
SPEAKER_00: An engineer needs to jump into that production database to run a critical schema altering update.
50:55
SPEAKER_00: They do not have standing admin rights.
50:57
SPEAKER_01: Because we got rid of those.
50:59
SPEAKER_00: Exactly.
50:59
SPEAKER_00: So step one, the user requests temporary elevation to a privileged role through the Okta interface, or maybe a command line utility.
51:07
SPEAKER_01: So they basically knock on the door.
51:09
SPEAKER_00: They knock on the door.
51:10
SPEAKER_00: But the system demands context before even considering the request.
51:13
SPEAKER_00: The engineer must input a valid ticket number.
51:16
SPEAKER_01: Trevor Burrus Like a ServiceNow or JRA ticket.
51:19
SPEAKER_00: Exactly.
51:20
SPEAKER_00: An ITSM ticket that perfectly matches an approved scheduled maintenance window.
51:24
SPEAKER_01: Aaron Powell So it's checking against the ITOL process.
51:26
SPEAKER_00: Yes.
51:26
SPEAKER_00: The identity platform executes an API call directly to ServiceNow to cross-reference the state of that exact ticket.
51:33
SPEAKER_01: It's verifying that there is an actual documented business justification for this specific identity to access this specific resource at this exact second.
51:43
SPEAKER_00: Precisely.
51:43
SPEAKER_01: But I mean, a valid ticket number doesn't guarantee the session hasn't been hijacked.
51:47
SPEAKER_00: Right.
51:47
SPEAKER_01: If an attacker stole the engineer's session cookie an hour ago, they could theoretically just paste in a known ticket number.
51:54
SPEAKER_00: Which brings us to step two authentication and timing.
51:57
SPEAKER_01: Oh, okay.
51:58
SPEAKER_00: To counter session hijacking, the system issues a step-up multi-factor authentication challenge.
52:03
SPEAKER_01: A step-up MFA.
52:05
SPEAKER_00: Right.
52:06
SPEAKER_00: And in high-stakes infrastructure scenarios, relying on a simple push notification to a smartphone is totally insufficient.
52:12
SPEAKER_01: Aaron Powell Because of MFA fatigue attacks?
52:14
SPEAKER_00: Exactly.
52:15
SPEAKER_00: Where attackers spam the user with approval requests until they, you know, just accidentally hit yes to make their phone stop buzzing.
52:21
SPEAKER_01: Right.
52:22
SPEAKER_01: We see that constantly now.
52:23
SPEAKER_00: So Octaprivileged access often mandates cryptographic or biometric verification for this step up.
52:28
SPEAKER_01: So it forces a harder challenge.
52:30
SPEAKER_00: Yeah, this means leveraging WebAuthan protocols.
52:32
SPEAKER_00: It requires the user to tap a YubiKey or use Windows.
52:37
SPEAKER_01: Hello.
52:38
SPEAKER_01: Something tied to the hardware.
52:39
SPEAKER_00: Right.
52:40
SPEAKER_00: To verify that the actual physical person sitting at the keyboard possesses the hardware-bound cryptographic key that originated the session.
52:48
SPEAKER_01: Okay, so the biometric scan or the hardware token proves physical presence.
52:53
SPEAKER_00: Yes.
52:54
SPEAKER_01: And once they pass that step-up challenge, the access is provisioned.
52:58
SPEAKER_01: Now, the source material we're doing this deep dive on highlights some distinct timing parameters here, depending on the architecture.
53:04
SPEAKER_01: The timing is crucial.
53:06
SPEAKER_01: Standard group provisioning via SCM might take, what, two to ten minutes to sync down to the application?
53:10
SPEAKER_00: Yeah, two to ten minutes is standard, mostly depending on the application's polling intervals.
53:16
SPEAKER_01: Right.
53:16
SPEAKER_01: But for advanced infrastructure access like SSHing into a Linux server or RDPing into a Windows server, Okta privileged access can actually inject ephemeral tokens directly into the client.
53:28
SPEAKER_00: Which is incredible.
53:29
SPEAKER_01: Right, granting the elevated access in under four seconds.
53:32
SPEAKER_00: We really need to unpack how that ephemeral token injection actually works because it is a massive departure from legacy vaulting solutions.
53:40
SPEAKER_01: Let's do it.
53:40
SPEAKER_01: Contrast it with the old way.
53:42
SPEAKER_00: Well, in a traditional privileged access management setup, a system would retrieve a highly privileged static password from an encrypted vault.
53:51
SPEAKER_01: Right, the password manager approach.
53:53
SPEAKER_00: And the user would use that password to log in.
53:55
SPEAKER_00: The problem is that the password still exists.
53:57
SPEAKER_01: It's just hidden.
53:58
SPEAKER_00: It's just hidden.
53:59
SPEAKER_00: Someone could intercept it.
54:00
SPEAKER_00: But OctaPrivileged Access uses a client-side agent to inject a short-lived cryptographic certificate.
54:07
SPEAKER_01: The ephemeral token.
54:08
SPEAKER_00: Right.
54:08
SPEAKER_00: It injects it directly into the SSH or RDP stream.
54:12
SPEAKER_00: This token is minted on the fly by the identity platform's certificate authority.
54:17
SPEAKER_01: Aaron Powell So it didn't even exist.
54:19
SPEAKER_00: It physically did not exist five seconds ago.
54:21
SPEAKER_01: And the most important part of that digital key card analogy we used earlier is the evaporation.
54:26
SPEAKER_00: Exactly.
54:26
SPEAKER_00: Evaporation.
54:28
SPEAKER_00: Because the certificate is minted with a strict time to live or TTL, it is strictly time bound.
54:34
SPEAKER_01: So you can't just keep in your pocket.
54:35
SPEAKER_00: No.
54:36
SPEAKER_00: The policy might dictate that this specific database maintenance role is only granted for two to four hours.
54:41
SPEAKER_00: Okay.
54:42
SPEAKER_00: And the moment that timer hits zero, the certificate mathematically expires.
54:46
SPEAKER_00: The access evaporates automatically.
54:49
SPEAKER_01: Just poof, gone.
54:50
SPEAKER_00: Gone.
54:51
SPEAKER_00: The active SSH session is forcibly terminated by the agent.
54:55
SPEAKER_00: Or the temporary group membership is instantly stripped by the control plane.
55:00
SPEAKER_01: The user drops back to zero privilege.
55:02
SPEAKER_00: Exactly.
55:02
SPEAKER_00: There are no vaulted passwords to rotate, and no standing access remains for an attacker to compromise later.
55:09
SPEAKER_01: It's so clean.
55:10
SPEAKER_01: But we also need to look at ping identity's approach to this governance challenge as well.
55:14
SPEAKER_00: Yes, ping is huge in this space.
55:17
SPEAKER_01: Because ping has a really deep pedigree here, specifically regarding ping identity governance and the capabilities they inherited from their acquisition of ForgeRock.
55:25
SPEAKER_00: Right.
55:26
SPEAKER_01: ForgeRock built a massive reputation in the industry for handling incredibly complex consumer scale and enterprise environments.
55:33
SPEAKER_00: Oh, absolutely.
55:34
SPEAKER_00: The ForgeRock Heritage is really the architectural foundation of what is now called the Pingknown Advanced Identity Cloud.
55:40
SPEAKER_01: Okay.
55:40
SPEAKER_01: How does that architecture differ?
55:42
SPEAKER_00: Aaron Ross Powell, well ForgeRock was originally built on a highly extensible tree-based authorization model.
55:47
SPEAKER_01: Aaron Powell Tree-based.
55:48
SPEAKER_00: Yeah.
55:49
SPEAKER_00: It was designed to handle extreme customization and massive scale.
55:53
SPEAKER_00: We're talking about environments often dealing with legacy IoT devices and complex telecommunications infrastructure.
56:00
SPEAKER_00: Trevor Burrus, Jr.
56:00
SPEAKER_01: So massive data volumes.
56:01
SPEAKER_00: Unbelievable volumes.
56:03
SPEAKER_00: And that DNA translates into highly sophisticated policy-based certification within Ping's governance suite today.
56:11
SPEAKER_01: So they use that scale for governance.
56:12
SPEAKER_00: Right.
56:13
SPEAKER_00: Ping utilizes highly customizable templates to run distinct types of certification campaigns.
56:19
SPEAKER_00: They separate them to target risk precisely without overwhelming the reviewers.
56:23
SPEAKER_01: Let's break down those specific campaign types because they don't just have one generic review access button.
56:29
SPEAKER_00: No, not at all.
56:30
SPEAKER_00: The first type is identity certification.
56:32
SPEAKER_01: Identity certification, okay.
56:34
SPEAKER_00: This is a macro level review.
56:35
SPEAKER_00: It asks a fundamental question: should this user, this identity, even exist in our directory system anymore?
56:41
SPEAKER_01: Aaron Powell So not even looking at what they can do, just if they should be there.
56:45
SPEAKER_00: Exactly.
56:46
SPEAKER_00: This isn't about what they have access to.
56:47
SPEAKER_00: It's a validation of the user's overarching relationship with the organization.
56:51
SPEAKER_01: Aaron Powell Like an overarching sanity check.
56:53
SPEAKER_00: Right.
56:54
SPEAKER_00: It's designed to catch orphaned accounts, such as, you know, a contractor whose contract expired three months ago, but whose profile was never formally deactivated by HR.
57:04
SPEAKER_01: Which happens all the time.
57:04
SPEAKER_00: All the time.
57:05
SPEAKER_00: So that's the macro level.
57:06
SPEAKER_00: Then you have entitlement assignment certification.
57:09
SPEAKER_01: Okay, and that's the opposite.
57:11
SPEAKER_00: Yes, this is the micro level view.
57:12
SPEAKER_00: It zooms in on the very granular permissions.
57:16
SPEAKER_01: Like what?
57:17
SPEAKER_00: Like asking if a user still needs a specific low-level write.
57:22
SPEAKER_00: For instance, do they still need read-only access to a specific AWSS3 bucket?
57:27
SPEAKER_00: Or write access to a specific folder path on an old file server.
57:32
SPEAKER_01: So we are talking tiny details.
57:33
SPEAKER_00: Very tiny.
57:34
SPEAKER_00: But there's a practical problem here.
57:36
SPEAKER_01: I can imagine.
57:36
SPEAKER_00: If a large enterprise runs granular entitlement campaigns for every single user, the volume of data would paralyze the management layer.
57:45
SPEAKER_01: The rubber stamp fatigue would be completely unmanageable.
57:48
SPEAKER_00: It would be impossible.
57:48
SPEAKER_00: So that operational bottleneck is why ping includes the third type, which is role membership certification.
57:54
SPEAKER_01: Ah, role membership.
57:55
SPEAKER_00: Right.
57:56
SPEAKER_00: This sits directly between the macro and micro levels.
57:59
SPEAKER_00: Roles are essentially logical collections of individual entitlements.
58:03
SPEAKER_01: So it bundles them.
58:04
SPEAKER_00: It bundles them.
58:05
SPEAKER_00: Instead of asking a manager to review 50 separate folder permissions and database rights, the campaign just asks: Does this user still qualify for the senior financial analyst role?
58:16
SPEAKER_01: Oh, that is so much easier for a manager to answer.
58:18
SPEAKER_00: Exactly.
58:19
SPEAKER_00: And if the reviewer determines the answer is no, removing that single role automatically cascades down.
58:26
SPEAKER_01: And strips all the underlying stuff.
58:27
SPEAKER_00: It strips all the underlying granular entitlements associated with it.
58:31
SPEAKER_01: Wow.
58:31
SPEAKER_00: So by layering these three campaign types, an organization can run identity certifications annually, role certifications quarterly, and then reserve granular entitlement certifications only for the absolute most high-risk privileged access paths.
58:46
SPEAKER_01: Okay, I want to introduce a nightmare scenario into this architecture for you.
58:50
SPEAKER_00: Oh, let's hear it.
58:51
SPEAKER_01: We've laid out these beautiful automated workflows for access and just-in-time elevation.
58:57
SPEAKER_01: But let's look at a specific edge case involving an active threat.
59:01
SPEAKER_01: Imagine a lower privileged administrator.
59:04
SPEAKER_01: They have some basic directory rights.
59:06
SPEAKER_01: Maybe they can reset passwords or modify basic user attributes, but they're strictly prohibited from having standing access to that production database administrator's group.
59:15
SPEAKER_00: Okay, so they have a foot in the door, but they shouldn't be near the vault.
59:18
SPEAKER_01: Exactly.
59:19
SPEAKER_01: This could be an insider threat or an external attacker who has successfully compromised a low-level help desk account.
59:25
SPEAKER_00: Right.
59:25
SPEAKER_00: A classic lateral movement scenario.
59:27
SPEAKER_01: Exactly.
59:28
SPEAKER_01: So this rogue administrator attempts to completely bypass the ServiceNow ticketing workflow.
59:34
SPEAKER_01: They bypassed the step up WebAuthen biometric MFA entirely.
59:39
SPEAKER_00: They're trying to sneak around it.
59:41
SPEAKER_01: Right.
59:41
SPEAKER_01: They use their low-level directory write access to try and grant themselves, or maybe a shadow account they control, elevated access to that sensitive group directly.
59:49
SPEAKER_01: Oh, I seriously.
59:50
SPEAKER_01: Maybe they try to manipulate the directory attribute manually via like an obscure PowerShell script, or they attempt to replay a compromise token completely outside the approved just-in-time workflow.
1:00:02
SPEAKER_00: This is a very real threat model.
1:00:04
SPEAKER_01: Aaron Powell So my question is, does the identity platform fail silently here?
1:00:08
SPEAKER_01: Do they slip through just because they technically had a valid admin session for lower-tier tasks?
1:00:14
SPEAKER_00: No.
1:00:15
SPEAKER_00: The action absolutely does not fail silently.
1:00:18
SPEAKER_00: This scenario really highlights how modern governance engines integrate with continuous threat detection and contextual risk scoring.
1:00:25
SPEAKER_01: Okay, break that down.
1:00:26
SPEAKER_00: In the Okta and Ping architectures, the platform is constantly evaluating session telemetry every single millisecond.
1:00:33
SPEAKER_01: What's it looking for?
1:00:34
SPEAKER_00: When the rogue administrator attempts to manipulate the directory attribute directly, the control plane detects the anomaly immediately because it looks for the missing links in the required chain of trust.
1:00:45
SPEAKER_01: Aaron Powell But wait, what specific missing links trigger the alert?
1:00:48
SPEAKER_01: If they have right access to attributes, the system technically sees a valid command, right?
1:00:54
SPEAKER_00: It sees a valid command, but in invalid context.
1:00:57
SPEAKER_00: The identity control plane detects a role change attempted on a highly sensitive target group.
1:01:02
SPEAKER_00: It immediately cross-references its own internal state.
1:01:05
SPEAKER_01: Aaron Powell And what does it find?
1:01:06
SPEAKER_00: It recognizes that there is no active, approved, just-in-time ticketing workflow associated with that specific administrator's session.
1:01:14
SPEAKER_01: It says, hey, there's no service now ticket for this.
1:01:17
SPEAKER_00: Exactly.
1:01:18
SPEAKER_00: Or if they attempt to replay a token, the platform's telemetry notes that the token is being presented from an IP address or a device fingerprint or a geographical location that breaks from the behavioral baseline of that specific administrator.
1:01:32
SPEAKER_01: Aaron Powell So the telemetry captures the discontinuity.
1:01:35
SPEAKER_01: The systems spots the cheat.
1:01:38
SPEAKER_00: It spots it instantly.
1:01:39
SPEAKER_01: So what is the actual mechanical penalty?
1:01:41
SPEAKER_01: Does it just block the one single request or does it take broader action?
1:01:45
SPEAKER_00: Oh, the resolution is instant and aggressive.
1:01:47
SPEAKER_00: It's driven by the user's continuous trust score.
1:01:50
SPEAKER_01: Continuous trust score.
1:01:51
SPEAKER_00: Yes.
1:01:52
SPEAKER_00: Modern platforms evaluate risk on a continuous scale, let's say from one to one hundred.
1:01:56
SPEAKER_01: Okay.
1:01:56
SPEAKER_00: A standard authenticated session with a corporate device might sit comfortably at a high trust score, maybe a ninety.
1:02:02
SPEAKER_01: Sure, looks normal.
1:02:04
SPEAKER_00: But the moment that unapproved manual manipulation of a sensitive group is attempted, the risk engine flags a critical anomaly.
1:02:10
SPEAKER_00: The trust score plummets.
1:02:12
SPEAKER_01: How far?
1:02:13
SPEAKER_00: Let's say it hits a critical floor, like a score of 10.
1:02:17
SPEAKER_00: When the score hits that floor, entitlement decay is absolute.
1:02:21
SPEAKER_01: Entitlement decay is absolute.
1:02:24
SPEAKER_01: That implies a total revocation of trust, not just a denial of the current action.
1:02:29
SPEAKER_00: You nailed it.
1:02:29
SPEAKER_00: The platform actively revokes the trust of the entire session.
1:02:34
SPEAKER_00: The rogue request to elevate privileges is explicitly blocked in real time.
1:02:39
SPEAKER_01: So it throws an error.
1:02:40
SPEAKER_00: It throws a hard error right back to the user or the script attempting it, but it goes much further.
1:02:45
SPEAKER_01: Because their score is a 10 now.
1:02:47
SPEAKER_00: Right.
1:02:47
SPEAKER_00: Because the continuous risk score dropped below the acceptable policy threshold, the identity platform invalidates the user's current session tokens across all connected applications.
1:02:57
SPEAKER_01: It kicks them out of everything.
1:02:58
SPEAKER_00: Everything.
1:03:13
SPEAKER_00: So the rogue admin is locked out of their existing low-level access, the elevation attempt is blocked, and the security team is actively hunting the origin of the request within milliseconds.
1:03:24
SPEAKER_01: That is incredibly powerful.
1:03:26
SPEAKER_01: But you know, and enforcing these group and role policies relies heavily on how the identity platform interacts with the core directory itself.
1:03:35
SPEAKER_00: Because it's all connected.
1:03:36
SPEAKER_01: Right.
1:03:36
SPEAKER_01: A governance engine can only enforce rules on a directory architecture that it can actually interpret and control.
1:03:42
SPEAKER_00: Exactly.
1:03:43
SPEAKER_01: Which connects our governance conversation directly to the underlying architecture.
1:03:47
SPEAKER_01: And that brings us to our second topic in this deep dive: the critical distinction in directory architecture.
1:03:53
SPEAKER_00: This architectural distinction is honestly perhaps the most fundamentally misunderstood aspect of modern identity and access management today.
1:04:00
SPEAKER_01: Oh, without a doubt.
1:04:02
SPEAKER_00: When enterprise architects look at Okta, Ping, and Microsoft, they often assume they are comparing competing versions of the exact same technology stack.
1:04:10
SPEAKER_01: Trevor Burrus, they think it's apples to apples.
1:04:12
SPEAKER_00: Right.
1:04:13
SPEAKER_00: But there is a profound architectural divergence here that dictates the operational reality of an organization's entire IT infrastructure for the next decade.
1:04:23
SPEAKER_01: So we need to lay this out plainly.
1:04:24
SPEAKER_01: What is the actual architectural reality of Okta and Ping?
1:04:29
SPEAKER_00: The reality is that Okta and Ping are fundamentally authentication gateways.
1:04:34
SPEAKER_01: Gateways.
1:04:35
SPEAKER_00: Yes.
1:04:35
SPEAKER_00: They are advanced identity brokers and policy enforcement engines.
1:04:39
SPEAKER_00: They are not traditional directory services in the way that an on-premises systems administrator understands the term.
1:04:46
SPEAKER_00: Right.
1:04:46
SPEAKER_00: They manage identity, they enforce MFA, they broker trust between cloud applications, but they are not the bedrock directory.
1:04:53
SPEAKER_01: Let's define the jargon here to be absolutely clear for everyone listening.
1:04:57
SPEAKER_01: What does it mean technically that they are gateways and not directories?
1:05:00
SPEAKER_00: It means Okta and Ping possess no native Active Directory schema.
1:05:04
SPEAKER_01: No native AD schema.
1:05:06
SPEAKER_01: None.
1:05:06
SPEAKER_00: Active Directory or AD has a very specific, deeply ingrained structural schema.
1:05:11
SPEAKER_00: It's a database structure defining user objects, computer objects, group policy objects, and organizational units.
1:05:19
SPEAKER_00: Exactly.
1:05:19
SPEAKER_00: That legacy Windows environments require to function.
1:05:22
SPEAKER_00: Okta and Ping do not have this structure natively.
1:05:26
SPEAKER_01: So what's the consequence of that?
1:05:27
SPEAKER_00: Because they lack this schema, they cannot natively domain join a Windows server.
1:05:34
SPEAKER_01: Oh wow.
1:05:34
SPEAKER_00: You cannot point a legacy Windows file server or a SQL database at Okta and ask it to join the Okta domain because there is no such thing as an Okta AD domain.
1:05:44
SPEAKER_01: Aaron Powell This requires us to look at the protocols involved.
1:05:47
SPEAKER_01: Because Okta and Ping speak the language of the modern web.
1:05:50
SPEAKER_00: Yes, entirely.
1:05:50
SPEAKER_01: They use protocols like SAML and OIDC.
1:05:53
SPEAKER_01: SAML Security Assertion Markup Language and OIDC OpenID Connect are stateless token based protocols.
1:06:00
SPEAKER_00: Right.
1:06:00
SPEAKER_01: They rely on XML or JSON web tokens to pass authentication claims securely over the internet.
1:06:06
SPEAKER_01: They don't require the application to maintain a persistent open connection to the directory.
1:06:10
SPEAKER_00: Which is great for the cloud.
1:06:11
SPEAKER_01: But legacy directory aware workloads don't speak CMLL or OIDC.
1:06:16
SPEAKER_00: No, they don't at all.
1:06:17
SPEAKER_00: Legacy applications like an older ERP system or a massive fleet of Windows servers that require group policy for configuration management, or even just an on-premises intranet site, they speak legacy protocols.
1:06:32
SPEAKER_00: Right.
1:06:32
SPEAKER_00: They require LDA, the lightweight directory access protocol, to query the directory tree directly, or they require Kerberos and NTLM for authentication.
1:06:40
SPEAKER_01: And Kerberos is a very different beast.
1:06:42
SPEAKER_00: Oh, completely.
1:06:43
SPEAKER_00: Kerberos is a stateful ticket granting protocol developed back in the 1980s.
1:06:48
SPEAKER_00: It requires a literal network path.
1:06:51
SPEAKER_01: A line of sight.
1:06:52
SPEAKER_00: A physical line of sight from the application server directly to a domain controller to request and verify cryptographic tickets.
1:06:59
SPEAKER_00: Ukta and Ping as cloud gateways cannot act as a Kerberos key distribution center in a native Windows enterprise context.
1:07:06
SPEAKER_01: Aaron Powell Okay, so if an organization has a legacy directory aware workload that absolutely requires LDA queries or Kerberos authentication, how do Okta and Ping handle them?
1:07:17
SPEAKER_00: They depend entirely on the customer's existing infrastructure.
1:07:20
SPEAKER_01: Wait, really?
1:07:20
SPEAKER_00: Yes.
1:07:21
SPEAKER_00: To support those legacy directory aware workloads, Okta and Ping are completely dependent on an organization's existing Active Directory environment.
1:07:31
SPEAKER_01: So you still need AD.
1:07:32
SPEAKER_00: You still need it.
1:07:33
SPEAKER_00: They sit on top of your AD.
1:07:35
SPEAKER_00: They act as a brilliant translation layer, taking your AD identities and translating them into SAML and OIDC tokens for your modern SAS applications like Salesforce or Workday.
1:07:46
SPEAKER_01: Okay, see.
1:07:47
SPEAKER_00: But the legacy Active Directory, the physical or virtual domain controllers running the LDAP and Kerbero services, must still physically exist somewhere in your environment for those legacy internal apps to function.
1:08:00
SPEAKER_01: That is the gateway model.
1:08:01
SPEAKER_01: The modern layer sits right on top of the legacy foundation.
1:08:04
SPEAKER_01: Exactly.
1:08:05
SPEAKER_01: So we have to contrast that with the Microsoft intro domain services approach.
1:08:08
SPEAKER_01: Yeah.
1:08:08
SPEAKER_01: Because Microsoft engineered a completely different path that changes the operational requirement entirely.
1:08:13
SPEAKER_00: Aaron Powell Oh, it's night and day.
1:08:15
SPEAKER_00: Microsoft enter domain services is not just a gateway or a translation layer.
1:08:19
SPEAKER_01: What is it then?
1:08:20
SPEAKER_00: It is designed as a complete replacement for self-managed on-premises Active Directory infrastructure.
1:08:26
SPEAKER_00: It replaces the need for an organization to build, manage, and patch their own domain controllers.
1:08:31
SPEAKER_01: Okay, so how does it actually work under the hood?
1:08:34
SPEAKER_01: If an enterprise architect isn't spinning up a Windows Server virtual machine, installing the Active Directory domain services role and promoting it to a domain controller, what is Microsoft actually doing?
1:08:47
SPEAKER_00: Under the hood, UNTRA domain services provides managed domain services directly in the cloud.
1:08:52
SPEAKER_01: Managed services.
1:08:53
SPEAKER_00: Yes.
1:08:54
SPEAKER_00: Microsoft natively hosts the actual domain join capabilities, the group policy enforcement, the LDAP endpoints, and the legacy Caberos and NTLM authentication services.
1:09:05
SPEAKER_01: They just run it for you.
1:09:06
SPEAKER_00: They run it.
1:09:07
SPEAKER_00: When an architect provisions this service, the system performs a continuous one-way synchronization from the organization's main UNTRA tenant, which is their modern cloud identity control plane directly into this managed domain environment.
1:09:19
SPEAKER_01: And where does this environment live?
1:09:20
SPEAKER_00: Crucially, Microsoft handles the deployment.
1:09:23
SPEAKER_00: They deploy this managed domain in highly available replica sets spread across multiple Microsoft Azure regions to ensure fault tolerance and low latency.
1:09:33
SPEAKER_01: Let me synthesize this with an analogy for everyone because understanding this distinction is really the crux of the enterprise architecture decision.
1:09:40
SPEAKER_00: Aaron Powell It's the biggest decision they'll make.
1:09:42
SPEAKER_00: Right.
1:09:43
SPEAKER_01: If an organization uses Okta or Ping, they are basically hiring a brilliant multilingual concierge at the front desk of their corporate building.
1:09:52
SPEAKER_00: I like this.
1:09:53
SPEAKER_01: The concierge handles all the modern interactions, speaks all the new internet protocols flawlessly, checks everyone's identity at the door with biometrical precision, and directs traffic to the cloud applications.
1:10:04
SPEAKER_00: Doing a great job.
1:10:05
SPEAKER_01: But the building owner still has to pay for, power, cool, and maintain the old dusty server room in the basement to run the building's internal legacy plumbing.
1:10:14
SPEAKER_00: Yes.
1:10:15
SPEAKER_01: Microsoft intra-domain services, on the other hand, takes a bulldozer to the basement and moves the entire server room to the cloud.
1:10:23
SPEAKER_01: You don't have a basement anymore.
1:10:24
SPEAKER_01: Microsoft provides the plumbing as a utility.
1:10:27
SPEAKER_00: That analogy perfectly sets up the operational edge case that every enterprise architect must face when planning a cloud transformation.
1:10:36
SPEAKER_01: Right, because there are trade-offs.
1:10:38
SPEAKER_00: Let's break down concretely what this means for an architect tasked with migrating a massive fleet of legacy directory-aware applications to the cloud.
1:10:47
SPEAKER_00: They have to decide between these two approaches, and the downstream operational consequences of that decision are massive.
1:10:55
SPEAKER_01: Okay, let's walk through the octaping operational reality first.
1:10:58
SPEAKER_01: The architect chooses the concierge model.
1:11:01
SPEAKER_01: They want the advanced best-of-breed policy engine Okta or Ping provides at the front door.
1:11:06
SPEAKER_00: Well, if the architect chooses Okta or Ping, they face a specific operational reality.
1:11:12
SPEAKER_00: They are permanently tethered to legacy infrastructure maintenance.
1:11:15
SPEAKER_01: The dusty basement.
1:11:17
SPEAKER_00: They must still provision, manage, patch, and backup legacy Windows Server domain controllers to keep those older applications running.
1:11:24
SPEAKER_01: Even if they move them out of their own building.
1:11:27
SPEAKER_00: Yes.
1:11:27
SPEAKER_00: It doesn't matter if those domain controllers are left on premises in a physical data center, or if the architect tries to modernize slightly by spinning them up as infrastructure as a service, or IAS, virtual machines in AWS, Google Cloud, or Azure.
1:11:43
SPEAKER_01: It's still a server you have to run.
1:11:45
SPEAKER_00: Exactly.
1:11:46
SPEAKER_00: The IT operations team is still responsible for the operating system.
1:11:50
SPEAKER_00: They are spending hours every single month applying Windows security updates during weekend maintenance windows, monitoring event logs for replication errors, and managing snapshot backups for those domain controller VMs.
1:12:02
SPEAKER_01: And all of that is just to keep the legacy apps functioning behind the modern Okta or Ping Gateway.
1:12:07
SPEAKER_00: That's it.
1:12:07
SPEAKER_01: So they are managing the plumbing themselves, which eats into their operational budget and their engineers' precious time.
1:12:14
SPEAKER_00: Massively.
1:12:15
SPEAKER_01: Now, contrast that with the Microsoft operational reality for that exact same architect migrating that exact same fleet of legacy applications.
1:12:22
SPEAKER_00: Okay, so if the architect chooses Microsoft entra domain services, they achieve full infrastructure independence from domain controllers.
1:12:29
SPEAKER_01: True independence.
1:12:30
SPEAKER_00: Yes.
1:12:31
SPEAKER_00: They can execute a true lift and shift migration of those legacy applications directly into Azure infrastructure.
1:12:39
SPEAKER_01: Just pick them up and move them.
1:12:40
SPEAKER_00: Pick them up and move them.
1:12:42
SPEAKER_00: Because the domain services, the LDAP, Kerberos, and group policy are fully managed by Microsoft as a platform as a service offering, the operational burden shifts entirely.
1:12:54
SPEAKER_01: What does that mean day-to-day for the team?
1:12:57
SPEAKER_00: It means the architect will never have to run Windows update on a domain controller virtual machine ever again.
1:13:03
SPEAKER_01: That's a dream for a lot of admins.
1:13:05
SPEAKER_00: It really is.
1:13:06
SPEAKER_00: The burden of maintaining the active directory replica sets, ensuring geographic high availability, monitoring directory replication health, and applying the underlying OS security patches is handled entirely by Microsoft behind the scenes.
1:13:19
SPEAKER_01: Okay, but I want to push back on the lift and shift magic bullet narrative, though.
1:13:22
SPEAKER_00: Fair enough.
1:13:23
SPEAKER_01: Because it sounds perfect on a whiteboard to just bulldozer the basement and move the plumbing to Azure.
1:13:28
SPEAKER_00: Yeah.
1:13:28
SPEAKER_01: But in the real world, physics still apply.
1:13:30
SPEAKER_00: They absolutely do.
1:13:31
SPEAKER_01: What is the hidden friction of choosing the enter domain services route?
1:13:36
SPEAKER_01: If those legacy applications require a literal network line of sight to a domain controller for Kerberos authentication, doesn't moving the domain controller to an Azure region introduce serious latency issues?
1:13:50
SPEAKER_01: Especially if the legacy applications themselves haven't been migrated yet, or if the replica sets aren't perfectly aligned geographically.
1:13:57
SPEAKER_00: That is the critical constraint of the intra-domain services model.
1:14:00
SPEAKER_00: The platform handles the operational maintenance, but the architectural physics of legacy protocols remain exactly the same.
1:14:07
SPEAKER_01: So you can't cheat the speed of light.
1:14:09
SPEAKER_00: You cannot cheat the speed of light.
1:14:10
SPEAKER_00: If an organization spins up intra-domain services in the Azure US East region, but attempts to authenticate a legacy application sitting in an on-premises data center in London, the Kerberos ticketing process, which involves multiple back-and-forth network handshakes, must traverse the transatlantic link.
1:14:28
SPEAKER_01: Every single time.
1:14:29
SPEAKER_00: Every single time.
1:14:30
SPEAKER_00: That introduces latency that can cause legacy applications to time out or fail entirely.
1:14:35
SPEAKER_01: Which would bring the business to a halt.
1:14:37
SPEAKER_00: Right.
1:14:38
SPEAKER_00: Therefore, intra-domain services is most effective when the legacy workloads themselves are simultaneously lifted and shifted into the same Azure virtual networks as the managed replica sets.
1:14:49
SPEAKER_01: So they have to move together.
1:14:50
SPEAKER_00: Exactly.
1:14:51
SPEAKER_00: If the architect chooses the Microsoft route, they must carefully design the network topology to ensure the application servers sit adjacent to the managed domain services.
1:15:00
SPEAKER_00: Otherwise, the operational independence they gained from abandoning virtual machines is totally negated by the performance degradation of the applications themselves.
1:15:09
SPEAKER_01: That's a wrap on Okta and Ping promise freedom from Active Directory.
1:15:13
SPEAKER_01: Do they deliver?
1:15:15
SPEAKER_01: We closed on the real trade-off.
1:15:17
SPEAKER_01: Okta and Ping keep you permanently maintaining legacy domain controllers somewhere, while Microsoft's alternative removes that server but ties your legacy apps to wherever its replica set lives.
1:15:30
SPEAKER_01: You can't cheat network latency either way.
1:15:33
SPEAKER_01: Next episode, we shift from steady state architecture to crisis mode.
1:15:38
SPEAKER_01: Day one of the MA and how integration actually starts on Microsoft Intra.
1:15:44
SPEAKER_01: Find the show notes and connect with Ernie on LinkedIn, link in the description.
1:15:48
SPEAKER_01: Subscribe if this is useful.
1:15:50
SPEAKER_01: Until next time.