Single Sign-On Architectures. Jan De Clercq Security Consultant HPCI Technology Leadership Group Hewlett-Packard

Transcription

1 Single Sign-On Architectures Jan De Clercq Security Consultant HPCI Technology Leadership Group Hewlett-Packard page 1

2 Agenda Trusted Security Infrastructures SSO: What and Why? SSO Architectures Extending SSO page 2

3 Trusted Security Infrastructures (TSIs) Applications App 1 App 2 App 3 App... Trusted Security Infrastructures Security Admin Identity Mgmt Sec Pol Mgmt Authent Infra Auditing Access Control Infra Core I.T Infrastructure Services Meta-Directory Dir ADir BDir C DBs Msg Mgmt Web Services page 3

4 SSO Foundations: Trust Trust Identification SSO Authorization Access Control page 4

5 Agenda Trusted Security Infrastructures SSO: What and Why? SSO Architectures Extending SSO page 5

6 Ease of Administration SSO What and Why? Ease of Use Enables Enforcement of Coherent Security Policy Key to the Kingdom? page 6

7 Infrastructure Server - Physical providers of authentication/sso Authority SSO Terminology - Logical providers of authentication/sso/trust = Domain (Windows speak) = Cell (DCE speak) = Realm (Kerberos speak) s Digital Identity Factors Token page 7

8 SSO Terminology Tok Sign-On Server Account and Management User Trust Token Validation Exchange Resource Domain Domain Server page 8

9 Agenda Trusted Security Infrastructures SSO: What and Why? SSO Architectures Extending SSO page 9

10 Simple SSO Single Authority and Server Single Authority and Multiple Servers SSO Solution and Architectures Complex SSO With Single Set of s Token-based SSO PKI-based SSO With Multiple Sets of s Synchronization Client-side Caching Server-side Caching page 10

11 Tok Simple SSO Solutions Sign-On Server Account and Management User Trust Token Validation Exchange Resource Domain Domain Server SSO with a single Authority and a single Server Examples: OS, EAMS, Centralized RAS page 11

12 Simple SSO Solutions Server Replicated Tok Replication Sign-On Server Master Account and Management User Trust Token Validation Exchange Resource Domain Domain Server SSO with a single Authority and multiple Servers Examples: OS, EAMS, Centralized RAS page 12

13 Tok Traditional Sign-On (No SSO) Tok Sign-On Authority Account and Management User Sign-On(s) Authority Account and Management page 13

14 Complex SSO Solutions: Single Set: Token-based SSO Tok Sign-On Temporary Token Authority Account and Management User Trust Transparant Sign-On(s) using Temporary Token Authority Account and Management Examples: Kerberos, EAMS, Passport page 14

15 Complex SSO Solutions: Single Set: PKI-based SSO User Private Key User Cert User User Registration Certificate Issuance Authority Trust CA Cert Account and Management CA Cert Transparant Sign-On(s) using Public Key s (Certificate and Private Key) Authority CA Cert Examples: Entrust, Baltimore, Windows 2000, Windows.NET page 15

16 Tok Complex SSO Solutions: Multiple Set: Password Sync Tok Sign-On Authority Account and Management User Sync Software Trust Synchronization Sign-On(s) Sync Software Authority Account and Management Examples: PassGo, PSynch, MetaDirectories, Provisioning software page 16

17 Tok Complex SSO Solutions: Multiple Set: Client-side Caching Tok User Sign-On Authority Account and Management Secure Client-Side Cache Transparant Sign-On(s) Using Cached s Trust Authority Account and Management Examples: Windows XP and Windows.NET, Identix Biologon, Entrust Entelligence page 17

18 Tok Complex SSO Solutions: Multiple Set: Server-side Cache Sign-On Tok User Request for s s for Autentication Authority Authority Account and Management Trust Transparant Sign-On(s) Using s Returned from Authority s Authority Account and Management Examples: Tivoli SecureWay SSO, CA ETrust SSO page 18

19 SSO Solutions: Pros and Cons (1) page 19

20 SSO Solutions: Pros and Cons (2) page 20

21 SSO Solutions: Pros and Cons (3) page 21

22 Agenda Trusted Security Infrastructures SSO: What and Why? SSO Architectures Extending SSO page 22

23 Extending SSO To cover Different Organizations Scope: Extranet and Internet Federation To cover Different Applications Scope: Intranet APIs page 23

24 Defining Federation The Use of agreements, standards, and technologies to make identity and entitlements portable across autonomous identity domains. page 24

25 Extending SSO: Federation page 25

26 Extending SSO: APIs page 26

27 Conclusion Creating an SSO Infrastructure for a heterogeneous environment is not an easy job The creation of SSO Infrastructures is a great opportunity to leverage directory and meta-directory investments page 27

28 TSI: Conclusion Trusted Security Infrastructures Security Admin Sec Adm Provisioning Authent Infra NOS Access Control Infra Apps Resource Managers Access Method Office Enterprise (SMB) EAMS Web (HTTP) PKI AAA Radius / Tacacs+ Remote Access (PPP) Wireless page 28

29 Questions? page 29

30