1. General Overview of Various SSO Systems: Active Directory, Google & Facebook Antti Pyykkö Mikko Malinen Oskari Miettinen

2. Single Sign-On (SSO) “The ability to allow multiple actions to take place on behalf of a user, without requiring multiple authentications by that user.” (Anchan and Pegah, 2003) ”A method of access control that enables a user to authenticate once and gain access to the resources of multiple software systems.” (Wikipedia, 2008)

3. Using services without SSO

4. Using services with SSO

5. Active Directory (AD) Active Directory (AD) is an implementation of LDAP (Lightweight Directory Access Protocol) directory services by Microsoft Contains resources, services and users of the network Client authenticates to AD and receives a ticket (presenting rights to use services)  Applications can impersonate client

7. Google SSO Uses SAML (Security Assertion Markup Language) technique Basically Google is the only service provider The user logs in Gmail  is able to use e.g. Google Calendar or Google Docs

9. Facebook “Facebook is a social utility that connects people with friends and others who work, study and live around them” (Facebook 2008 - About Facebook) “Provides a framework for software developers to create applications that interact with core Facebook features” (Wikipedia 2008 – Facebook)

10. Facebook

11. Facebook SSO Uses sessions between Facebook and external applications Facebook offers linking for applications but it doesn’t take responsibility of them Session is established only once between application and Facebook

12. Facebook SSO If session does not exist  User gets an auth_token which is then exchanged, with api_key, to session_key Session is now established and application can make calls to Facebook API

13. Why SSO? Saves time Reduces authentication problems (lost passwords etc.) Enhances security Application makers don’t have to think about security and authentication in their applications BUT may create bottlenecks

14. Comparison of SSOs AD vs. Facebook & Google: AD is designed for more local environments and is intended for more administrative tasks Facebook vs. Google: Google uses a third party identity provider, Facebook doesn’t Facebook vs. Google: trust issues related to applications that are not created by their host

15. Thank you! Any questions?!