Single Sign-On (SSO)

Single sign-on allows users to have one set of credentials that allows them to log into the system but have access to a lot of different resources. For one, it's a big convenience thing — that is, I only have to remember one set of credentials and then I gain access to all of these different systems that are out there. But not only that, it allows me to create a more complex password and not remember a ton of other passwords with this. And so it really actually propels our security efforts forward.

Fewer passwords, stronger passwords

We expect our users to jump through a bunch of hoops in order to create secure passwords. We probably want them to have a very long password, and I'm all for that. We also want them to have a password per account, and I definitely would want that as well. Perhaps we're doing some sort of level of complexity, or want them to change their passwords on a regular basis. The more we create of this, the harder it is that they're going to remember that password, especially if they're doing a password per account — and I strongly recommend that.

So one way that we can help facilitate this and make sure that they have strong passwords is to make it so that they have less passwords they have to memorize, and the way we can do this is through single sign-on. Single sign-on is the concept that with one set of credentials we'll gain access to all of the resources that we need access to. And so there is a single account that we're going to use for all of this access.

Interoperability

In order for us to facilitate single sign-on, there needs to be some sort of interoperability. Maybe we have some sort of central server, and that central server is going to make connections to other systems, and then when we do our authentication we're going to authenticate through this central control system here, which will then give us access to these different resources out there. And we call this interoperability. Interoperability is when we can have different systems — for instance, this central system right here — being able to communicate with other systems. There's an interoperability that happens here.

There are several different protocols that can help interoperability, or get systems to communicating with each other. Lightweight Directory Access Protocol is one of those. We also have Security Assertion Markup Language, or SAML, OpenID, or OAuth as some other examples of that. In fact, we could be using multiple protocols with a single system. That is, as we make a connection between two different servers here, maybe we're going to use SAML with this connection right here, and then we would use a different protocol for connection to other resources. So these might all have different protocols that communicate out, but in essence what we're doing is we're making this all interoperable so that way the user has a single sign-on experience.

LDAP and Active Directory

Let's use Lightweight Directory Access Protocol, or LDAP, as an example here. LDAP is a protocol, and it allows us to communicate with other devices and give us access to these different resources. And I'm going to specifically look at Active Directory's implementation of this. Active Directory is Microsoft's version of this.

Let's say we have a user laptop right here. This would be something called a domain controller, and the domain controller would be kind of like the controller of all of this access to all these different resources. And so then we would set up a directory. The directory would be all of the users, so this server would have a directory on it. That's why it's called Active Directory, because we have this dynamic directory that's on there of all the users.

And so now when you join this computer to that domain, one of those users that are part of this domain can now log into this computer and have access to the resources on that computer. Not only that, but they can also get access to any resources that are within this network that they were given permission to access. And it's all through this protocol here that allows all that communication and all of that setting up to happen, that interoperability to be set up.

Federation

There are times when we're working with two different services. Maybe this is Active Directory but this is some other type of system that's out there, and so what we want to do is create some sort of interoperability between these two different services. Well, we call this federation. It's a type of way that we do interoperability. So we would set up federation services on one of these devices to get it to communicate with another device, and then it would use some sort of protocol to be able to make that connection, that interoperability.