Single Sign-On (SSO)
Single Sign-On (SSO) defines a unified logon experience, from the viewpoint of the end user, when accessing one or more systems.
5 slides · 2 min read · Domain 5
SSO is often referred to as reduced sign-on or federated identity management. The idea is that a user only has to log in to a single authorization provider and they are then granted access to all the resources they have privileges for - including information assets, folders and systems.
Classic single sign-on systems provide a single repository of user credentials, such as user ID and passwords, associated with a suite of applications. Users launch various applications through the SSO client software, which opens the appropriate application program and sends the appropriate keystrokes to that program, thus simulating the user typing their own ID and password.
The figure below shows the basic concepts of an SSO system in operation.
The user's initial login request is authenticated by the SSO server (shown as steps 1 and 2 in the figure). Each attempt by the user to access another server, such as one hosting a web service or an applications platform, requires a back-end authentication exchange between the SSO and the applications server (steps 3-6). This authentication usually involves the SSO server packaging information about the authenticated user's identity, along with a current applications password from its onboard database, being passed to the applications server.
Access tokens can also be used instead of applications passwords; based largely on what the applications) and their servers need for authentication and authorization purposes. As we'll see in Module 6, a variety of technologies, such as SAML, c an be used to implement SSO.
Text on this slide
Applications Platform Server
7,10: User access attempt File
Servers 4,5: SS0 Request Authenticated
Web Servers Identity and access management
3, 6: User access attempt
1, 2: User Login/SSO Grant
However, there are some limitations, risks and challenges when designing an SSO architecture
SINGLE POINT OF FAILURE
Some security experts tend to regard SSO as "putting all your eggs in one basket," and there is a point to that.
If a malicious attacker gains access to a single set of credentials in an organization that implemented SSO, then the attacker now has access to all the resources allocated to that user. However, the risk can be mitigated by using additional access control mechanisms such as 2FA and time/geolocation access limitation. Furthermore, the single point of failure can refer to the SSO database being a desirable asset for any attacker.
PASSWORD SYNCHRONIZATION
Password synchronization: For the SSO mechanism to work properly, the entire system has to be synchronized so that any password change will run across all the integrated systems.
LEGACY SYSTEMS
Some legacy systems do not support the use of SSO mechanisms, moreover, in some cases it is difficult to find experts who know how to work on such systems.