Section 17.161 Single Sign-On (SSO)

Question 1

Single Sign-On (SSO)

Answer 1

Authentication process allowing users to access multiple applications with one set of credentials

■ Simplifies the user experience and enhances productivity by reducing the need to remember multiple p[asswords for various applications

■ Trusted relationship between applications and Identity Providers (IdP)

Question 2

How SSO Works

Answer 2

SSO works based on a trusted relationship that is established between an appliation and an Identity Provider (IdP)

■ User logs into the primary identity provider (IdP): such as windows domain controller

■ Accesses a secondary application or website configured for SSO

■ The secondary application verifies the user’s identity with the IdP’s assertion

■ Once authenticated, access to the secondary application is granted

Question 3

Identity Provider (IdP)

Answer 3

The identity provider is a system
that creates, maintains, and manages identity information
for principals while providing authentication services to relying applications within a federation or distributed network.

Question 4

Benefits of SSO

Answer 4

■ Improved user experience (only remember one set of credentials)

■ Increased productivity (save time not signing in)

■ Reduced IT support costs (service desk password reset is most common call)

■ Enhanced security, encouraging stronger passwords

Question 5

To enable and support SSO there are Protocols in place:

LDAP (Lightweight Directory Access Protocol)

Answer 5

Used to access and maintain distributed directory information services over an Internet protocol network

● Supports central repository for authentication and authorisation

● Can be secured using LDAPS (LDAP over SSL or StartTLS)

● LDAP stores user data for authorisation, like group memberships and roles

Question 6

To enable and support SSO there are Protocols in place:

OAuth (Open Authorization)

Answer 6

Open standard for token-based authentication and authorisation that allows third-party services to access user account information without exposing passwords

● Often used in RESTful APIs for secure sharing of user profile data: The client app or service registers with the authorisation server, provides a redirect URL and gets an ID and secret

● Uses JSON Web Tokens (JWT) for data transfer

Question 7

To enable and support SSO there are Protocols in place:

SAML (Security Assertion Markup Language)

Answer 7

Standard for logging users into applications based on sessions in another context.

Redirects users to an identity provider for authentication

● Eliminates the need for services to authenticate users directly

● Decouples services from identity providers, enhancing security and flexibility