General Overview of Various SSO Systems: Active Directory, Google & Facebook Antti Pyykkö Mikko Malinen Oskari Miettinen
Single Sign-On (SSO) “The ability to allow multiple actions to take place on behalf of a user, without requiring multiple authentications by that user.” (Anchan and Pegah, 2003) ”A method of access control that enables a user to authenticate once and gain access to the resources of multiple software systems.” (Wikipedia, 2008)
Using services without SSO
Using services with SSO
Active Directory (AD) Active Directory (AD) is an implementation of LDAP (Lightweight Directory Access Protocol) directory services by Microsoft Contains resources, services and users of the network Client authenticates to AD and receives a ticket (presenting rights to use services) Applications can impersonate client
Google SSO Uses SAML (Security Assertion Markup Language) technique Basically Google is the only service provider The user logs in Gmail is able to use e.g. Google Calendar or Google Docs
Facebook “Facebook is a social utility that connects people with friends and others who work, study and live around them” (Facebook About Facebook) “Provides a framework for software developers to create applications that interact with core Facebook features” (Wikipedia 2008 – Facebook)
Facebook SSO Uses sessions between Facebook and external applications Facebook offers linking for applications but it doesn’t take responsibility of them Session is established only once between application and Facebook
Facebook SSO If session does not exist User gets an auth_token which is then exchanged, with api_key, to session_key Session is now established and application can make calls to Facebook API
Why SSO? Saves time Reduces authentication problems (lost passwords etc.) Enhances security Application makers don’t have to think about security and authentication in their applications BUT may create bottlenecks
Comparison of SSOs AD vs. Facebook & Google: AD is designed for more local environments and is intended for more administrative tasks Facebook vs. Google: Google uses a third party identity provider, Facebook doesn’t Facebook vs. Google: trust issues related to applications that are not created by their host
Thank you! Any questions?!