微軟推出聯合身分憑證系統以增強身分驗證安全性

聯合身分憑證系統旨在最大限度地減少使用者在透過 Microsoft Entra 使用多種服務時必須交出安全憑證資訊的次數。

Microsoft has announced a new Azure feature designed to minimize security risk during authentication.

Microsoft 宣布了一項新的 Azure 功能，旨在最大限度地降低身份驗證過程中的安全風險。

The Federated Identity Credentials system is intended to reduce the frequency with which users must provide their secure credential information when accessing multiple services through Microsoft Entra.

聯合身分憑證系統旨在減少使用者在透過 Microsoft Entra 存取多個服務時必須提供安全憑證資訊的頻率。

The feature enables users to log into a single service to initiate their session. Following the initial login, they can then access other services without providing their secure login credentials and certificates.

該功能使用戶能夠登入單一服務來啟動會話。初始登入後，他們可以存取其他服務，而無需提供安全登入憑證和憑證。

“This process, known as the Workload Identity Federation flow, supports tokens from GitHub, Kubernetes, and other third-party OIDC issuers,” Microsoft said.

微軟表示：“這個過程被稱為工作負載身份聯合流程，支援來自 GitHub、Kubernetes 和其他第三方 OIDC 發行者的代幣。”

“With this new capability, apps can also accept managed identity tokens issued by Microsoft Entra.”

“借助這項新功能，應用程式還可以接受 Microsoft Entra 頒發的託管身份令牌。”

In more technical terms, upon initially logging in with a Microsoft Entra service, the user will be issued a token. This token will be valid for any service that supports the Microsoft Entra API.

用更技術性的術語來說，在首​​次使用 Microsoft Entra 服務登入時，使用者將獲得一個令牌。此令牌對於支援 Microsoft Entra API 的任何服務都有效。

Using Entra minimizes the number of times a user needs to provide their secret information, such as login credentials or secure key information, thereby reducing the risk surface by minimizing the possibility of a threat actor gaining access to the secret information.

使用 Entra 可以最大限度地減少使用者需要提供其秘密資訊（例如登入憑證或安全金鑰資訊）的次數，從而透過最大限度地減少威脅行為者存取秘密資訊的可能性來減少風險面。

Such tactics are becoming increasingly popular in the identity management space. Okta recently made a unified identity management system the centerpiece of its future business plan.

這種策略在身分管理領域變得越來越流行。 Okta 最近將統一身分管理系統作為其未來業務計劃的核心。

Vendors largely view identity management solutions as a key component of their information security plan because using a single token across multiple services minimizes the chances of interception and protects against data breaches by third-party vendors who would otherwise need to collect sensitive information.

供應商在很大程度上將身分管理解決方案視為其資訊安全計畫的關鍵組成部分，因為在多個服務中使用單一代幣可以最大限度地減少攔截的機會，並防止第三方供應商（否則需要收集敏感資訊）的資料外洩。

In Microsoft’s case, the Entra platform encompasses not only the Azure services, but also a range of apps that utilize Kubernetes and GitHub.

就微軟而言，Entra 平台不僅包含 Azure 服務，還包含一系列利用 Kubernetes 和 GitHub 的應用程式。

“Customers using Microsoft Entra ID applications to authenticate users, access resources on behalf of users, or perform cross-tenant access can improve their security by adopting managed identities as federated identity credentials,” Microsoft said.

微軟表示：“使用微軟 Entra ID 應用程式來驗證用戶身份、代表用戶訪問資源或執行跨租戶訪問的客戶可以通過採用託管身份作為聯合身份憑證來提高其安全性。”

“This approach is more secure and robust compared to managing secrets, rotating certificates, and handling multiple permission sets for apps and managed identities.”

“與管理機密、輪換證書以及處理應用程式和託管身份的多個權限集相比，這種方法更安全、更穩健。”