Karl Jones: /* External links */

2016-04-25T10:43:19Z

‎External links

Karl Jones: /* External links */

2016-01-26T11:47:17Z

‎External links

Karl Jones: /* External links */

2016-01-26T11:46:50Z

‎External links

Karl Jones at 17:44, 2 January 2016

2016-01-02T17:44:19Z

Karl Jones: /* See also */

2015-10-14T16:10:14Z

‎See also

Karl Jones: Created page with "'''Single sign-on''' ('''SSO''') is a property of access control of multiple related, but independent software systems. (TO D..."

2015-09-28T14:02:55Z

Created page with "'''Single sign-on''' ('''SSO''') is a property of access control of multiple related, but independent software systems. (TO D..."

New page

'''Single sign-on''' ('''SSO''') is a property of [[authorization (computer access control)|access control]] of multiple related, but independent [[software]] systems.

(TO DO: expand, organize, cross-reference, illustrate.)

== Description ==

With this property a user [[login|logs in]] with a single ID to gain access to a connected system or systems without being prompted for different usernames or passwords, or in some configurations seamlessly sign on at each system.

This is typically accomplished using the [[Lightweight Directory Access Protocol]] (LDAP) and stored LDAP databases on servers.

A simple version of single sign-on can be achieved over [[Internet protocol suite|IP networks]] using [[HTTP cookie|cookies]] but only if the sites share a common DNS parent domain.

Conversely, '''single sign-off''' is the property whereby a single action of signing out terminates access to multiple software systems.

As different applications and resources support different [[authentication]] mechanisms, single sign-on must internally translate and store credentials for the different mechanisms, from the credential used for initial authentication.

Other shared authentication schemes not to be confused with SSO include [[OAuth]], [[OpenID]], [[OpenID Connect]] and [[Facebook Platform#Facebook Connect|Facebook Connect]], which require the user to enter their login credentials each time they access a different site or application.

== Benefits ==

Benefits of using single sign-on include:

* Reducing [[password fatigue]] from different user name and password combinations
* Reducing time spent re-entering passwords for the same identity
* Reducing IT costs due to lower number of IT [[help desk]] calls about passwords

SSO shares centralized [[authentication server]]s that all other applications and systems use for authentication purposes and combines this with techniques to ensure that users do not have to actively enter their credentials more than once.

== Criticisms ==

The term ''reduced sign-on'' (RSO) has been used by some to reflect the fact that ''single sign-on'' is impractical in addressing the need for different levels of secure access in the enterprise, and as such more than one authentication server may be necessary.

As single sign-on provides access to many resources once the user is initially authenticated ("keys to the castle") it increases the negative impact in case the credentials are available to other persons and misused. Therefore, single sign-on requires an increased focus on the protection of the user credentials, and should ideally be combined with strong authentication methods like [[smart card]]s and [[one-time password]] tokens.

Single sign-on also makes the authentication systems highly critical; a loss of their availability can result in denial of access to all systems unified under the SSO. SSO can be configured with session failover capabilities in order to maintain the system operation.

Nonetheless, the risk of system failure may make single sign-on undesirable for systems to which access must be guaranteed at all times, such as security or plant-floor systems.

== Security ==

In March, 2012, a research paper reported an extensive study on the security of [[social login]] mechanisms. The authors found 8 serious logic flaws in high-profile ID providers and relying party websites, such as [[OpenID]] (including Google ID and PayPal Access), [[Facebook]], [[Janrain]], [[Freelancer]], [[FarmVille]], and [[Sears.com]].

Because the researchers informed ID providers and relying party websites prior to public announcement of the discovery of the flaws, the vulnerabilities were corrected, and there have been no security breaches reported.

In May 2014, a vulnerability named [[Covert Redirect]] was disclosed.

It is first reported "Covert Redirect Vulnerability Related to OAuth 2.0 and OpenID" by its discoverer Wang Jing, a Mathematical PhD student from [[Nanyang Technological University]], Singapore.

In fact, almost all Single sign-on protocols are affected. Covert Redirect takes advantage of third-party clients susceptible to an XSS or Open Redirect.

== Common configurations ==

=== Kerberos based ===

* Initial sign-on prompts the user for credentials, and gets a [[Kerberos (protocol)|Kerberos]] [[ticket-granting ticket]] (TGT).
* Additional software applications requiring authentication, such as [[email client]]s, [[wiki]]s, [[revision control]] systems, etc., use the ticket-granting ticket to acquire service tickets, proving the user's identity to the mailserver / wiki server / etc. without prompting the user to re-enter credentials.

[[Microsoft Windows|Windows]] environment - Windows login fetches TGT. [[Active Directory]]-aware applications fetch service tickets, so user is not prompted to re-authenticate.

[[Unix]]/[[Linux]] environment - Login via Kerberos [[Pluggable Authentication Modules|PAM]] modules fetches TGT. Kerberized client applications such as [[Evolution (software)|Evolution]], [[Firefox]], and [[Apache Subversion|SVN]] use service tickets, so user is not prompted to re-authenticate.

=== Smart card based ===

Initial sign-on prompts the user for the [[smart card]]. Additional software applications also use the smart card, without prompting the user to re-enter credentials. Smart card-based single sign-on can either use certificates or passwords stored on the smart card.

=== Integrated Windows Authentication ===

''[[Integrated Windows Authentication]]'' is a term associated with [[Microsoft]] products and refers to the [[SPNEGO]], [[Kerberos protocol|Kerberos]], and [[NTLMSSP]] authentication protocols with respect to [[Security Support Provider Interface|SSPI]] functionality introduced with Microsoft [[Windows 2000]] and included with later [[Windows NT]]-based operating systems.

The term is most commonly used to refer to the automatically authenticated connections between Microsoft [[Internet Information Services]] and [[Internet Explorer]]. Cross-platform [[Active Directory]] integration vendors have extended the Integrated Windows Authentication paradigm to Unix, Linux and Mac systems.

=== Security Assertion Markup Language ===

[[Security Assertion Markup Language]] (SAML) is an [[XML]]-based solution for exchanging user security information between an [[business|enterprise]] and a [[service provider]]. It supports [[World Wide Web Consortium|W3C]] XML encryption and service provider initiated web browser single sign-on exchanges.

A user wielding a user agent (usually a web browser) is called the subject in the SAML-based single sign-on. The user requests a web resource protected by a SAML service provider. The service provider, wishing to know the identity of the requesting user, issues an authentication request to a SAML identity provider through the user agent. The identity provider is the one that provides the user credentials. The service provider trusts the identity provider of the user information, to provide access to its services or resources.

== Emerging configurations ==

=== Mobile devices as access controllers ===

A newer variation of single sign-on authentication has been developed using mobile devices as access controllers. Users' mobile devices can be used to automatically log them onto multiple systems, such as building access control systems and computer systems, through the use of authentication methods which include [[OpenID Connect]] and SAML, in conjunction with an [[X.509]] [[ITU-T]] [[cryptography]] certificate used to identify the mobile device to an access server.

== See also ==

* [[Central Authentication Service]]
* [[Identity management]]
* [[Identity management systems]]
* [[List of single sign-on implementations]]
* [[Security Assertion Markup Language]]

== External links ==

* [https://en.wikipedia.org/wiki/Single_sign-onSingle sign-on] @ Wikipedia
* [http://www.opengroup.org/security/sso/sso_intro.htm Single Sign-on Intro with Diagrams]

← Older revision		Revision as of 10:43, 25 April 2016
Line 93:		Line 93:
	* [https://en.wikipedia.org/wiki/Single_sign-on Single sign-on] @ Wikipedia		* [https://en.wikipedia.org/wiki/Single_sign-on Single sign-on] @ Wikipedia
	* [http://www.opengroup.org/security/sso/sso_intro.htm Single Sign-on Intro with Diagrams]		* [http://www.opengroup.org/security/sso/sso_intro.htm Single Sign-on Intro with Diagrams]
		+
		+	[[Category:Computer networks]]
		+	[[Category:Computing]]
		+	[[Category:Identity]]
		+	[[Category:Information]]
		+	[[Category:Information security]]
		+	[[Category:Internet]]
		+	[[Category:Web design and development]]

@@ Line 91: / Line 91: @@
 == External links ==
-* [https://en.wikipedia.org/wiki/Single_sign-onSingle Single sign-on] @ Wikipedia
+* [https://en.wikipedia.org/wiki/Single_sign-on Single sign-on] @ Wikipedia
 * [http://www.opengroup.org/security/sso/sso_intro.htm Single Sign-on Intro with Diagrams]

← Older revision		Revision as of 17:44, 2 January 2016
Line 1:		Line 1:
	'''Single sign-on''' ('''SSO''') is a property of [[authorization (computer access control)\|access control]] of multiple related, but independent [[software]] systems.		'''Single sign-on''' ('''SSO''') is a property of [[authorization (computer access control)\|access control]] of multiple related, but independent [[software]] systems.
−
−	~~(TO DO: expand, organize, cross-reference, illustrate.)~~

	== Description ==		== Description ==

@@ Line 85: / Line 85: @@
 * [[Central Authentication Service]]
 * [[Identity management]]
 * [[Identity management systems]]

Single sign-on - Revision history

Karl Jones: /* External links */

Karl Jones: /* External links */

Karl Jones: /* External links */

Karl Jones at 17:44, 2 January 2016

Karl Jones: /* See also */

Karl Jones: Created page with "'''Single sign-on''' ('''SSO''') is a property of access control of multiple related, but independent software systems. (TO D..."