Overview
This lecture covers the concept of Single Sign-On (SSO), its advantages, security concerns, and examples like Kerberos and OpenID.
Single Sign-On (SSO) Concept
- SSO allows users to authenticate once to access multiple services and applications.
- Users do not need multiple sets of usernames and passwords for various services.
- SSO uses a central authentication server to issue a cookie or token for access.
Example: Kerberos Authentication
- Kerberos is an SSO authentication system where users authenticate once to receive a ticket granting ticket.
- The ticket granting ticket can be presented to access multiple services without re-entering credentials.
Benefits of SSO
- Users manage only one set of credentials, reducing insecure password storage.
- SSO reduces helpdesk support for password issues.
- Time spent on repeated authentication during the workday is minimized.
Security Considerations
- A compromised SSO account gives attackers access to all permitted services.
- Multi-factor authentication (MFA) should be used with SSO for added security.
- Attackers may try to steal SSO session cookies or tokens, bypassing MFA protections.
- Stolen session tokens can provide access until expired, even without actual credentials.
OpenID Decentralized Authentication System
- OpenID allows users to authenticate using a third-party identity provider at participating sites (relying parties).
- Relying parties do not need their own authentication infrastructure.
- Users can access sites with their existing identity provider accounts.
- The process involves establishing a shared secret, user authentication through the identity provider, and token-based credential relay.
Key Terms & Definitions
- Single Sign-On (SSO) — authentication method allowing one login for multiple services.
- Kerberos — SSO protocol using tickets for authentication across services.
- Multi-factor Authentication (MFA) — security process requiring additional verification besides a password.
- OpenID — open standard for decentralized authentication using third-party identity providers.
- Relying Party — a site that delegates authentication to an identity provider.
- Identity Provider — a service authenticating users on behalf of relying parties.
Action Items / Next Steps
- Review SSO implementations and consider the importance of MFA.
- Study how OpenID and Kerberos function in real-world scenarios.