• Replies 2 replies
  • Subscribers 0 subscribers
  • Views 22 views
  • Users 0 members are here
Options
3sides - Social sharing widget
Related

Question about HighQ Hub and Security Architecture

Robyn Tippins
27266

I was reading through some security documentation and read that HighQ hub serves as an SSO module for all of a users sites, and ostensibly all instances, of HighQ. It is through this that any IDP provider uses to set up federation for example. There also seems to be a lot of emphasis on the "instance isolation/segregation" architecture and the creation of unique, segregated IAM infrastructure for each instance, and this is represented as foundational to the entire security architecture of HighQ. My question is, if there is a, centralized, non segregated authentication/access service, HighQ Hub which i guess you could describe as a sort of quasi IAM-lite directory service, does this not undermine to a certain extent the security benefits of the segregated instance? If everyone is entering different silos but through the same front door, what's the point of having the silos?

Parents
  • Thomson Reuters Thomson Reuters staff member

    Hi Michael Sevarino, Thank you for your post here.

    To take your analogy ''If everyone is entering different silos but through the same front door, what's the point of having the silos?'', I would state that what is taken care of by Hub is less a shared front door and more of a 'street'. Hub itself is effectively only performing IDP discovery. No Authentication of user accounts is occuring in that application and we are not persisting the user data there. It is merely shuttling requests from instances of HighQ products to the correct SSO services. Anything critical (for want of a better phrase) is happening elsewhere.

    So, to return to the notion of a 'street' ... Everyone has their own front door, but the street provides a way of people finding the correct front door for them to use.
    Another analogy which could be appropriate here are load-balancers or reverse proxying. Whenever there is 'separation', (be it physical or virtual), at some stage in the chain there is going to have to be a single 'SOMETHING' which takes care of routing requests to their correct destination... For our SSO integrations, that happens to be Hub.

    I hope that helps. Please feel free to raise a ticket with support if you require anything more specific answering, regarding the Hub application or SSO integrations.

    Edit: CC Keyur Patel for visibility on the above comment, as they are the facet lead for Hub.

Reply
  • Thomson Reuters Thomson Reuters staff member

    Hi Michael Sevarino, Thank you for your post here.

    To take your analogy ''If everyone is entering different silos but through the same front door, what's the point of having the silos?'', I would state that what is taken care of by Hub is less a shared front door and more of a 'street'. Hub itself is effectively only performing IDP discovery. No Authentication of user accounts is occuring in that application and we are not persisting the user data there. It is merely shuttling requests from instances of HighQ products to the correct SSO services. Anything critical (for want of a better phrase) is happening elsewhere.

    So, to return to the notion of a 'street' ... Everyone has their own front door, but the street provides a way of people finding the correct front door for them to use.
    Another analogy which could be appropriate here are load-balancers or reverse proxying. Whenever there is 'separation', (be it physical or virtual), at some stage in the chain there is going to have to be a single 'SOMETHING' which takes care of routing requests to their correct destination... For our SSO integrations, that happens to be Hub.

    I hope that helps. Please feel free to raise a ticket with support if you require anything more specific answering, regarding the Hub application or SSO integrations.

    Edit: CC Keyur Patel for visibility on the above comment, as they are the facet lead for Hub.

Children
No Data