Downloaded 286 times
Uploaded byRob Fitzgibbon
Single sign on
SSO refers to Single Sign-On, which allows a user to access multiple applications and systems with a single set of login credentials. It simplifies authentication for the user by storing their credentials in a centralized location and managing authentication across different systems. SSO helps reduce the complexity of a client's infrastructure by streamlining access to various enterprise applications, intranets, and extranets through a single authentication process at the firewall level. While SSO provides benefits like easier access and identity management, it also introduces complexity in coordinating authentication across multiple interconnected systems.
More Related Content
Single sign on
- 1. SSO PresentationPresentation PracticeSessionMay 14, 2010Prepared by: Rob Fitzgibbon1
- 2. What is SSO?TheShip’s Security Officer?Standards Setting Organization?SulfolobusSolfataricus?Society of Surgical Oncology?Syracuse Symphony Orchestra?2
- 3.
- 4. I know asmuch about SSO as I do about4
- 5. But here goesWantto sound likeMay end up sounding like5
- 6. SSO, Defined (geekspeak)Lotsof really important boxes and ovals with acronyms6
- 7. SSO, Defined (again)EnterpriseApplicationsEmail programBenefits/HR infoYouÏÐYour computerCorporate intranetYour one SSO passcodeThe firewall & SSO authentication systemClient Extranet7
- 8. SSO, Defined (andagain)the key metaphorOld SchoolSSO Equivalent8
- 9. SSO, Defined (yetagain)the backstage pass metaphor9
- 10. SSO, Defined (onelast time):the utensil metaphor~10
- 11. So Why learnabout SSO?11
- 12. Will it helpyou get the girl?No.12
- 13. Will it makeyou seem brilliant at the cocktail party?Nope.13
- 14. Will it turnthis client14
- 15.
- 16. But it mighthelp you appreciate the complexity of the client’s infrastructure16
- 17. Why am Italking about SSO?17
- 18.
- 19.
- 20.
- 21. With SSO, there’slots important terminology to remember!21
- 22.
- 23.
- 24.
- 25.
- 26.
- 27.
- 28.
- 29.
- 30. Feign Knowledge withImportant Sounding Acronyms30
- 31. AAA = Authentication,Authorization & AccountingAD = Active DirectoryCAS = Central Authentication ServiceEISA = Enterprise Information Security ArchitectureESSO = Enterprise Single Sign OnHTTPS = HyperText Transfer Protocol, SecureIDM = Identity ManagementLDAP = Lightweight Directory Access ProtocolOTP = One Time PasswordPII = Personal Identifying InformationRADIUS = Remote Authentication Dial In User ServiceSAML = Security Assertion Markup LanguageSSL = Secure Socket LayerSSOSrv = Microsoft Single-Sign On ServiceTCP/IP = Transmission Control Protocol/Internet ProtocolVPN = Virtual Private Network31
- 32. In case ofemergency, switch subject32
- 33. SSO really challengesinterface designers to develop perhaps the most complex customer facing interactions of their entire career:33
- 34.
- 35. LoginPasswordBehind that interfacelies an array of network systems…Go35
- 36. LoginPassword(Savage, merciless networksystems)Go36
- 37. What types ofclients use SSO?37
- 38. Who provides SSOSolutions?38
- 39.
- 40.
Editor's Notes
- #3 Single Sign On
- #4 Single Sign On
- #6 Danny Kaye – “The Court Jester” – about authentication & security systems – 1956 movie
- #8 Process that permits a user to enter one name and password ONCE in order to access multiple applications (single action = access to multiple systems)One password instead of multipleMultiple independent systems instead of oneLesser known sibling: Single Sign OffSystem that stores multiple sets of credentials for various internal applicationsOften done with web-portals that interface with multiple systems “on the back end”
- #9 The Skeleton key
- #11 Utensil
- #19 Utopian, Holy grail, HolisticCost - Savings (call centers aren’t dealing with forgotten password tickets)- Reduced IT dev timeUtopian Administration - Centralized, single systemwhich is good for reporting, compliance, maintenance, managing accts, etc.- The “perfect system”ProductivityEasier to remember one password - Reduces human error (password fatigue/identity chaos) Common authentication framework for developersCan be incorporated into Security Everything’s equally protected Reduces phishing success, since users don’t usually see login/password requests and when they do it out of the ordinary and seems suspiciousReduces chance of some types of identity theft (password on sticky note)
- #20 UtopianPoorly Conceived- Major issues arise if use cases, workflow, infrastructure hasn’t been totally figured outAdministration- Authentication systems become mission-critical; if fail, DOS, no access. Thus some mission critical capabilities may need to be outside of the SSO (e.g. floor access systems)Difficult to implement - Extremely difficult to retrofit- Mission critical nature of components (8 separate mission-critical systems and none can be brought down for any length of time to align with the others)Security issuesAuthentication server is now the single point of attackRisk of giving away “keys to the castle” – protection focus shifts to user credentialsThe “walk away and someone hops on your computer” issueEnterprise Reduced Sign On (purgatory, handles most systems if not the utopian all)- Edsel – the wrong car at the wrong time
- #21 The Must have featuresAvailable 24/7/365Backup (there are spare copies in the vault if needed)Comprehensive (covers all essential applications in the network, covers all possible use cases)Integral-able (able to be introduced and play well with existing systems)Redundant (if all or part of it fails, there are systems in place that will jump in as needed)Reliable (accurate and doesn’t make mistakes)Scalable (0 to thousands of users)
- #23 Authentication (from Greek: αυθεντικός ; real or genuine, from authentes; author) is the act of establishing or confirming something (or someone) as authentic, that is, that claims made by or about the subject are true ("authentification" is a French language variant of this word). This might involve confirming the identity of a person, tracing the origins of an artifact, ensuring that a product is what its packaging and labeling claims to be, or assuring that a computer program is a trusted one. Authentication can also be used for identity delegation. Identity Delegation in IT network is an evolving field[1].A process of proving the identity of a computer or computer user. For users, it generally involves a user name and password. Computers usually pass a code that identifies that they are part of a network. - it’s a horizontal systemOften done by an authentication ServerPhysiognomy = idea that facial characteristics are indications of personality/character/psychologyBiometrics =
- #24 directory service is simply the software system that stores, organizes and provides access to information - corresponding table of names and values (eg login/password. Name, address, etc.)
- #25 Encryption (greek for “make hidden”)is a form of security that turns information, images, programs or other data into unreadable cipher by applying a set of complex algorithms to the original material. These algorithms transfer the data into streams or blocks of seemingly random alphanumeric characters. The one weakness of symmetric encryption programs is that the single key must necessarily be shared, presenting an opportunity for it to be leaked or stolen. Symmetric types of encryption schemes use a single password to serve as both encryptor and decryptor. Part of key management involves changing the encryption key often to improve security.
- #26 The process of managing individuals in a system; managing who someone is an what they have access to (technical, legal, security, social)
- #27 protocol is a set of rules which is used by computers to communicate with each other across a network - a protocol or communications protocol is a formal description of message formats and the rules for exchanging those messages. Protocols may include signaling, authentication and error detection and correction capabilities. In its simplest form, a protocol can be defined as the rules governing the syntax, semantics, and synchronization of communication - protocol (SPNEGO,[ (Simple and Protected GSSAPI Negotiation Mechanism)] Kerberos,(made by MIT) and NTLMSSP (Microsoft’s NT LAN Manager Security Support Provider) authentication protocols with respect to SSPI (A Microsoft Windows security application programming interface
- #28 communication session, is a semi-permanent interactive information exchange between communicating devices that is established at a certain time and torn down at a later time. Hypertext Transfer Protocol (HTTP) is stateless: a client computer running a web browser must establish a new Transmission Control Protocol (TCP) network connection to the web server with each new HTTP GET or POST request - The Session Layer provides the mechanism for opening, closing and managing a session between end-user application processes, i.e. a semi-permanent dialogue. More than 1 party Information is being exchanged- Across a shared meduim
- #29 The art and skill of developing a plan to achieve a goal
- #30 Who’s doing what, where – someone, somewhere, doing something for some reason, sometimesWorkflows often instructional (how to make a cup of coffee)David McCaulay – describing the workflow for how to construct something & later came up with a book called “the way things work”
- #32 Enterprise Single Sign On – that’s where the industry has been heading; SAML = used by GoogleEISA = SSO is just a component of this
- #33 Everybody loves puppiesEverybody loves the Red SoxWhen in doubt, switch the topic to puppies or the Red Sox & you’ll regain your equilibrium
- #40 Not just the technical, it’s the human component as well that’s critical