Juniper Identity Management Service Overview
Juniper Identity Management Service (JIMS) provides a robust and scalable user identification and IP address mapping implementation which includes endpoint context and machine ID. JIMS collects advanced user identities from different authentication sources for SRX Series devices.
Security Director is used to push the JIMS configuration to SRX Series devices. You can use JIMS to obtain IP address or user mapping and device information. SRX Series devices generate the authentication entries for user firewall.
SRX Series devices communicate with JIMS through HTTP or HTTPS connection. Use HTTP connection for debugging and HTTPS for deployments. SRX Series devices consist of primary and secondary JIMS configurations. These devices must always query the primary JIMS. The secondary JIMS is available as a fall back option with limited resources. The secondary JIMS must be used when the HTTP GET query or number of queries to the primary JIMS fails. SRX Series devices constantly scrutinize the failed primary JIMS and revert to the primary JIMS, once it is up and running.
When you request a JIMS report, the SRX Series device specifies the timestamp. JIMS forms a HTTPS response from the earliest known report since the requested timestamp. SRX Series devices request for the maximum number of reports to include in the response from JIMS. Along with the requested reports, JIMS always returns a cookie. In the subsequent requests to JIMs, SRX Series devices include cookies instead of timestamp to indicate the same context, same beginning timestamp, and to resume the same response from where it has stopped the previous time.
IP and user mapping information might be inaccurate, if the user identities in JIMS are cleared, delayed, or missing.
SRX firewall authentication can also push the authentication entries to JIMS.
The SRX Series device communicates with JIMS through HTTP or HTTPS messages to obtain the access token and query for user identities. The following different query modes are available and all queries can happen simultaneously.
Access Token Query
JIMS requires OAuth 2.0 protocol to authenticate or authorize. The SRX Series device user query function requires an access token to query the JIMS server. The SRX Series device uses the client credentials such as client ID and client secret to obtain an access token. These parameters must be consistent with the API client configured on JIMS.
Batch or Periodic Query
At the beginning, SRX Series device sends the batch queries to JIMS sequentially to obtain all the expected user identities. When there are no more entries in JIMS, SRX Series device periodically queries for the newly generated reports with the configured interval.
The timestamp is mentioned in the query to restart the response. The timestamp is expected in the query under the following circumstances:
SRX Series device queries the JIMS server for the first time
SRX Series device switches over to the secondary JIMS
SRX Series device does the error recovery because of an internal error or upon receiving error response from JIMS
For all the other cases, SRX Series device provides the received cookie information in the query instead of a timestamp.
IP Address Query
SRX Series device can provide another query to JIMS specifying the IP addess, if it has missed the data for the existing IP address flow. If there are many IP address queries in the queue, SRX Series device can keep multiple concurrent HTTP or HTTPS connections with JIMS to increase the throughput. However, the number of concurrent connections are restricted to less than or equal to 20 connections to reduce the load on JIMS.
User Mapping Query
SRX Series device can engage Captive Portal to obtain the user ID to authenticate the user. Once the user is authenticated, SRX Series device can issue another query to JIMS specifying the user ID and IP address to obtain user information. The firewall authentication uses the https://<JIMS>/<query-api>/user/ip=<ip>&id=<id>&domain=<domain> API to push an authentication success entry to JIMS with the user IP, user ID, and the domain. JIMS responds with the user information.
The difference between the IP address query and user query is that the IP address query does not have the user ID. Both these queries insert the user information to the internal cache of JIMS , and all SRX devices are updated with user information.