Single Sign-On -Mayuresh Pardeshi M.Tech CSE - I

Contents:  Introduction  Working Structure  Features  Applications

3 Why do we need SSO ? Current Situation: Network users interact with multiple service providers.

SSO:  A mechanism that allows users to authenticate themselves only once, and then log into multiple service providers, without necessarily having to re-authenticate.  Authentication Service Provider (ASP).  Service providers are aware of the ASP:  establish explicit trust relations, policies, contracts and supporting security infrastructure (e.g. PKI).  ASP is either a trusted third party or part of the user system (requires tamper-resistant hardware, e.g. smartcard, TPM).

5 General SSO Protocol Typical Information Flow } Repeated as necessary

Types of SSO:  Password Synchronization SecurePassSAM, Pass Synch  Legacy SSO Novell’s Secure Login & Microsoft Windows Server  Web Access Management (WAM) RSA  Cross Domain SSO OpenSSO, CAS  Federated SSO Facebook Connect, Google

Novell SecureLogin

Oblix (Oracle)

SAML:  1.The service provider received the client request, and it sent the request to Identity provider to do the client authentication.  2.Identity provider authenticate the client, create the assertion, and pass it back to the service provider. SAML assertions can be add a SOAP Header blocks, and pass by the HTTP protocol

Request from the Service provider  Here, a sample SAML-compliant request is sent from a service provider requesting password authentication by the identity provider.

Response from the Identity provider  In response, the issuing authority asserts that the subject (S) was authenticated by means (M) at time (T).

Advantages  Reduced operational cost  Reduced time to access data  Improved user experience, no password lists to carry  Advanced security to systems  Strong authentication  One Time Password devices  Smartcards  Ease burden on developers  Centralized management of users, roles  Fine grained auditing  Effective compliance (SOX, HIPPA)

References: 1) “OWASP, SanAntonio SingleSignOn” , Vijay Kumar, CISSP. 2) “Using EMV cards for Single Sign-On” 1 st European PKI Workshop Andreas Pashalidis and Chris J. Mitchell 3) 4) 5) 6) 7) 8) Microsoft.Net Passport Review Guide 9) Telling Humans and Computers Apart Automatically 10) XADM: How Secure Sockets Layer Works Microsoft.com