<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Texte brut Car";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
span.TextebrutCar
{mso-style-name:"Texte brut Car";
mso-style-priority:99;
mso-style-link:"Texte brut";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1038" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="FR-CA" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoPlainText">Service accounts do not meet an authorization problem. For example employee who can not perform transfer beyond a certain rise.<o:p></o:p></p>
<p class="MsoPlainText">So this issue seems to me fairly common like the schema below.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><!--[if gte vml 1]><v:shapetype id="_x0000_t75" coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f">
<v:stroke joinstyle="miter" />
<v:formulas>
<v:f eqn="if lineDrawn pixelLineWidth 0" />
<v:f eqn="sum @0 1 0" />
<v:f eqn="sum 0 0 @1" />
<v:f eqn="prod @2 1 2" />
<v:f eqn="prod @3 21600 pixelWidth" />
<v:f eqn="prod @3 21600 pixelHeight" />
<v:f eqn="sum @0 0 1" />
<v:f eqn="prod @6 1 2" />
<v:f eqn="prod @7 21600 pixelWidth" />
<v:f eqn="sum @8 21600 0" />
<v:f eqn="prod @7 21600 pixelHeight" />
<v:f eqn="sum @10 21600 0" />
</v:formulas>
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect" />
<o:lock v:ext="edit" aspectratio="t" />
</v:shapetype><v:shape id="_x0000_s1037" type="#_x0000_t75" alt="User / Browser" style='position:absolute;margin-left:1.5pt;margin-top:0;width:61.5pt;height:56.25pt;z-index:251659264;visibility:visible;mso-height-percent:0;mso-wrap-distance-left:9pt;mso-wrap-distance-top:0;mso-wrap-distance-right:9pt;mso-wrap-distance-bottom:0;mso-position-horizontal:absolute;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:text;mso-height-percent:0;mso-height-relative:margin'>
<v:imagedata src="cid:image001.emz@01D0500B.D120E280" o:title="" />
</v:shape><v:shape id="_x0000_s1033" type="#_x0000_t75" alt="SP" style='position:absolute;margin-left:102pt;margin-top:15.7pt;width:61.5pt;height:27pt;z-index:251661312;visibility:visible;mso-height-percent:0;mso-wrap-distance-left:9pt;mso-wrap-distance-top:0;mso-wrap-distance-right:9pt;mso-wrap-distance-bottom:0;mso-position-horizontal:absolute;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:text;mso-height-percent:0;mso-height-relative:margin'>
<v:imagedata src="cid:image002.emz@01D0500B.D120E280" o:title="" />
</v:shape><v:shape id="_x0000_s1035" type="#_x0000_t75" alt="Apps" style='position:absolute;margin-left:207pt;margin-top:12pt;width:61.5pt;height:30.75pt;z-index:251663360;visibility:visible;mso-height-percent:0;mso-wrap-distance-left:9pt;mso-wrap-distance-top:0;mso-wrap-distance-right:9pt;mso-wrap-distance-bottom:0;mso-position-horizontal:absolute;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:text;mso-height-percent:0;mso-height-relative:margin'>
<v:imagedata src="cid:image003.emz@01D0500B.D120E280" o:title="" />
</v:shape><v:shape id="_x0000_s1036" type="#_x0000_t75" alt="SP" style='position:absolute;margin-left:309.75pt;margin-top:12pt;width:61.5pt;height:32.25pt;z-index:251665408;visibility:visible;mso-height-percent:0;mso-wrap-distance-left:9pt;mso-wrap-distance-top:0;mso-wrap-distance-right:9pt;mso-wrap-distance-bottom:0;mso-position-horizontal:absolute;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:text;mso-height-percent:0;mso-height-relative:margin'>
<v:imagedata src="cid:image004.emz@01D0500B.D120E280" o:title="" />
</v:shape><v:shape id="_x0000_s1034" type="#_x0000_t75" alt="Services" style='position:absolute;margin-left:411.75pt;margin-top:13.5pt;width:61.5pt;height:32.25pt;z-index:251667456;visibility:visible;mso-height-percent:0;mso-wrap-distance-left:9pt;mso-wrap-distance-top:0;mso-wrap-distance-right:9pt;mso-wrap-distance-bottom:0;mso-position-horizontal:absolute;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:text;mso-height-percent:0;mso-height-relative:margin'>
<v:imagedata src="cid:image005.emz@01D0500B.D120E280" o:title="" />
</v:shape><v:shape id="_x0000_s1026" type="#_x0000_t75" alt="IDP" style='position:absolute;margin-left:195pt;margin-top:68.25pt;width:61.5pt;height:32.25pt;z-index:251669504;visibility:visible;mso-height-percent:0;mso-wrap-distance-left:9pt;mso-wrap-distance-top:0;mso-wrap-distance-right:9pt;mso-wrap-distance-bottom:0;mso-position-horizontal:absolute;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:text;mso-height-percent:0;mso-height-relative:margin'>
<v:imagedata src="cid:image006.emz@01D0500B.D120E280" o:title="" />
</v:shape><v:shape id="Connecteur_x0020_droit_x0020_avec_x0020_flèche_x0020_7" o:spid="_x0000_s1032" type="#_x0000_t75" style='position:absolute;margin-left:63pt;margin-top:22.5pt;width:39pt;height:11.25pt;z-index:251670528;visibility:visible;mso-width-percent:0;mso-height-percent:0;mso-wrap-distance-left:9pt;mso-wrap-distance-top:0;mso-wrap-distance-right:9pt;mso-wrap-distance-bottom:0;mso-position-horizontal:absolute;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:text;mso-width-percent:0;mso-height-percent:0;mso-width-relative:margin;mso-height-relative:margin'>
<v:imagedata src="cid:image007.png@01D0500B.D120E280" o:title="" cropleft="-218453f" />
<o:lock v:ext="edit" aspectratio="f" />
</v:shape><v:shape id="Connecteur_x0020_droit_x0020_avec_x0020_flèche_x0020_13" o:spid="_x0000_s1029" type="#_x0000_t75" style='position:absolute;margin-left:163.5pt;margin-top:23.25pt;width:44.25pt;height:11.25pt;z-index:251672576;visibility:visible;mso-wrap-distance-left:9pt;mso-wrap-distance-top:0;mso-wrap-distance-right:9pt;mso-wrap-distance-bottom:0;mso-position-horizontal:absolute;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:text'>
<v:imagedata src="cid:image008.png@01D0500B.D120E280" o:title="" cropleft="-231897f" />
<o:lock v:ext="edit" aspectratio="f" />
</v:shape><v:shape id="Connecteur_x0020_droit_x0020_avec_x0020_flèche_x0020_14" o:spid="_x0000_s1030" type="#_x0000_t75" style='position:absolute;margin-left:267pt;margin-top:22.5pt;width:44.25pt;height:11.25pt;z-index:251674624;visibility:visible;mso-wrap-distance-left:9pt;mso-wrap-distance-top:0;mso-wrap-distance-right:9pt;mso-wrap-distance-bottom:0;mso-position-horizontal:absolute;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:text'>
<v:imagedata src="cid:image008.png@01D0500B.D120E280" o:title="" cropleft="-231897f" />
<o:lock v:ext="edit" aspectratio="f" />
</v:shape><v:shape id="Connecteur_x0020_droit_x0020_avec_x0020_flèche_x0020_15" o:spid="_x0000_s1031" type="#_x0000_t75" style='position:absolute;margin-left:368.25pt;margin-top:24pt;width:44.25pt;height:11.25pt;z-index:251676672;visibility:visible;mso-wrap-distance-left:9pt;mso-wrap-distance-top:0;mso-wrap-distance-right:9pt;mso-wrap-distance-bottom:0;mso-position-horizontal:absolute;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:text'>
<v:imagedata src="cid:image008.png@01D0500B.D120E280" o:title="" cropleft="-231897f" />
<o:lock v:ext="edit" aspectratio="f" />
</v:shape><v:shape id="Connecteur_x0020_droit_x0020_avec_x0020_flèche_x0020_16" o:spid="_x0000_s1027" type="#_x0000_t75" style='position:absolute;margin-left:159.75pt;margin-top:40.5pt;width:58.5pt;height:31.5pt;z-index:251678720;visibility:visible;mso-width-percent:0;mso-height-percent:0;mso-wrap-distance-left:9pt;mso-wrap-distance-top:0;mso-wrap-distance-right:9pt;mso-wrap-distance-bottom:0;mso-position-horizontal:absolute;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:text;mso-width-percent:0;mso-height-percent:0;mso-width-relative:margin;mso-height-relative:margin'>
<v:imagedata src="cid:image009.png@01D0500B.D120E280" o:title="" />
<o:lock v:ext="edit" aspectratio="f" />
</v:shape><v:shape id="Connecteur_x0020_droit_x0020_avec_x0020_flèche_x0020_17" o:spid="_x0000_s1028" type="#_x0000_t75" style='position:absolute;margin-left:239.25pt;margin-top:43.5pt;width:81.75pt;height:27pt;z-index:251680768;visibility:visible;mso-width-percent:0;mso-height-percent:0;mso-wrap-distance-left:9pt;mso-wrap-distance-top:0;mso-wrap-distance-right:9pt;mso-wrap-distance-bottom:0;mso-position-horizontal:absolute;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:text;mso-width-percent:0;mso-height-percent:0;mso-width-relative:margin;mso-height-relative:margin'>
<v:imagedata src="cid:image010.png@01D0500B.D120E280" o:title="" />
<o:lock v:ext="edit" aspectratio="f" />
</v:shape><![endif]--><![if !vml]><span style="mso-ignore:vglayout">
<table cellpadding="0" cellspacing="0" align="left">
<tbody>
<tr>
<td width="2" height="0"></td>
</tr>
<tr>
<td></td>
<td><img width="629" height="134" src="cid:image011.png@01D0500B.D120E280" alt="User / Browser,SP,Apps,SP,Services,IDP" v:shapes="_x0000_s1037 _x0000_s1033 _x0000_s1035 _x0000_s1036 _x0000_s1034 _x0000_s1026 Connecteur_x0020_droit_x0020_avec_x0020_flèche_x0020_7 Connecteur_x0020_droit_x0020_avec_x0020_flèche_x0020_13 Connecteur_x0020_droit_x0020_avec_x0020_flèche_x0020_14 Connecteur_x0020_droit_x0020_avec_x0020_flèche_x0020_15 Connecteur_x0020_droit_x0020_avec_x0020_flèche_x0020_16 Connecteur_x0020_droit_x0020_avec_x0020_flèche_x0020_17"></td>
</tr>
</tbody>
</table>
</span><![endif]><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<br style="mso-ignore:vglayout" clear="ALL">
<p class="MsoPlainText">Thanks<o:p></o:p></p>
<p class="MsoPlainText"><span lang="FR" style="mso-fareast-language:FR-CA"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="FR" style="mso-fareast-language:FR-CA"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="FR" style="mso-fareast-language:FR-CA">-----Message d'origine-----<br>
De : users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net] De la part de Cantor, Scott<br>
Envoyé : 23 février 2015 15:53<br>
À : Shib Users<br>
Objet : Re: SOA Security</span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">On 2/23/15, 7:52 PM, "Arnal, Pascal" <<a href="mailto:Pascal.Arnal@lacapitale.com"><span style="color:windowtext;text-decoration:none">Pascal.Arnal@lacapitale.com</span></a>> wrote:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">>Ok and if I downgrade to IDP V2.4.3, could I secure my apps and
<o:p></o:p></p>
<p class="MsoPlainText">>services easily ?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I don't think the word "easy" really comes into this conversation.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Enterprises have almost no deployment of end to end security for services behind the firewall, of course. Privileged service accounts are the dominant solution because *that* is the easy option.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-- Scott<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">--<o:p></o:p></p>
<p class="MsoPlainText">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
<span style="color:windowtext;text-decoration:none">users-unsubscribe@shibboleth.net</span></a><o:p></o:p></p>
</div>
<br>
<hr>
<font face="Arial" color="Gray" size="1">AVIS: Ce courriel privilégié et confidentiel est destiné à la seule personne ou entité à laquelle il est adressé. Pour toute autre personne, toute action prise en rapport à ce courriel ainsi que toute lecture, reproduction,
transmission et/ou divulgation d'une partie ou de l'ensemble de celui-ci est interdite. Si vous n'êtes pas la personne autorisée à recevoir ce courriel, S.V.P. le retourner à l'expéditeur et le détruire. Bien que ce courriel ait été traité contre les virus,
il est de la responsabilité du destinataire de s'assurer que l'envoi en est exempt. Nos communications avec vous peuvent contenir des renseignements confidentiels ou protégés par le secret professionnel. Si vous désirez que nous communiquions avec vous par
un autre moyen de transmission que le courrier électronique ordinaire non sécurisé, veuillez nous en aviser.<br>
<br>
NOTICE: This privileged and confidential email is intended only for the individual or entity to whom it is addressed. With regard to all others, any action related with this email as well as any reading, reproduction, transmission and/or dissemination in whole
or in part of the information included in this email is prohibited. If you are not the addressee, immediately return the email to sender prior to destroying all copies. Even if this email is believed to be free from any virus, it is the responsibility of the
recipient to make sure that it is virus exempt. Our communications to you may contain confidential information or information protected under solicitor-client privilege. Please advise if you wish us to use a mode of communication other than regular, unsecured
e-mail in our communications with you.<br>
</font>
</body>
</html>