1. Single Sign-On -Mayuresh Pardeshi M.Tech CSE - I

2. Contents:  Introduction  Working Structure  Features  Applications

3. 3 Why do we need SSO ? Current Situation: Network users interact with multiple service providers.

4. SSO:  A mechanism that allows users to authenticate themselves only once, and then log into multiple service providers, without necessarily having to re-authenticate.  Authentication Service Provider (ASP).  Service providers are aware of the ASP:  establish explicit trust relations, policies, contracts and supporting security infrastructure (e.g. PKI).  ASP is either a trusted third party or part of the user system (requires tamper-resistant hardware, e.g. smartcard, TPM).

5. 5 General SSO Protocol Typical Information Flow } Repeated as necessary

6. Types of SSO:  Password Synchronization SecurePassSAM, Pass Synch  Legacy SSO Novell’s Secure Login & Microsoft Windows Server  Web Access Management (WAM) RSA  Cross Domain SSO OpenSSO, CAS  Federated SSO Facebook Connect, Google

7. Novell SecureLogin

8. Oblix (Oracle)

9. SAML:  1.The service provider received the client request, and it sent the request to Identity provider to do the client authentication.  2.Identity provider authenticate the client, create the assertion, and pass it back to the service provider. SAML assertions can be add a SOAP Header blocks, and pass by the HTTP protocol

10. Request from the Service provider  Here, a sample SAML-compliant request is sent from a service provider requesting password authentication by the identity provider.

11. Response from the Identity provider  In response, the issuing authority asserts that the subject (S) was authenticated by means (M) at time (T).

12. Advantages  Reduced operational cost  Reduced time to access data  Improved user experience, no password lists to carry  Advanced security to systems  Strong authentication  One Time Password devices  Smartcards  Ease burden on developers  Centralized management of users, roles  Fine grained auditing  Effective compliance (SOX, HIPPA)

13. References: 1) “OWASP, SanAntonio SingleSignOn” 2006-08, Vijay Kumar, CISSP. 2) “Using EMV cards for Single Sign-On” 1 st European PKI Workshop Andreas Pashalidis and Chris J. Mitchell 3) www.cafesoft.com/support/security/glossary.html www.cafesoft.com/support/security/glossary.html 4) www.ibm.com/software/webservers/portal/library/v12/InfoCenter/wps/glossary.htm www.ibm.com/software/webservers/portal/library/v12/InfoCenter/wps/glossary.htm 5) www.suliscommunication.com/language/ecommerce/ebus3.htm www.suliscommunication.com/language/ecommerce/ebus3.htm 6) http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci340859,00.html 7) http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci340859,00.html 8) Microsoft.Net Passport Review Guide 9) Telling Humans and Computers Apart Automatically 10) XADM: How Secure Sockets Layer Works Microsoft.com