Single Sign-On Architectures Jan De Clercq Security Consultant HPCI Technology Leadership Group Hewlett-Packard page 1
Agenda Trusted Security Infrastructures SSO: What and Why? SSO Architectures Extending SSO page 2
Trusted Security Infrastructures (TSIs) Applications App 1 App 2 App 3 App... Trusted Security Infrastructures Security Admin Identity Mgmt Sec Pol Mgmt Authent Infra Auditing Access Control Infra Core I.T Infrastructure Services Meta-Directory Dir ADir BDir C DBs Msg Mgmt Web Services page 3
SSO Foundations: Trust Trust Identification SSO Authorization Access Control page 4
Agenda Trusted Security Infrastructures SSO: What and Why? SSO Architectures Extending SSO page 5
Ease of Administration SSO What and Why? Ease of Use Enables Enforcement of Coherent Security Policy Key to the Kingdom? page 6
Infrastructure Server - Physical providers of authentication/sso Authority SSO Terminology - Logical providers of authentication/sso/trust = Domain (Windows speak) = Cell (DCE speak) = Realm (Kerberos speak) s Digital Identity Factors Token page 7
SSO Terminology Tok Sign-On Server Account and Management User Trust Token Validation Exchange Resource Domain Domain Server page 8
Agenda Trusted Security Infrastructures SSO: What and Why? SSO Architectures Extending SSO page 9
Simple SSO Single Authority and Server Single Authority and Multiple Servers SSO Solution and Architectures Complex SSO With Single Set of s Token-based SSO PKI-based SSO With Multiple Sets of s Synchronization Client-side Caching Server-side Caching page 10
Tok Simple SSO Solutions Sign-On Server Account and Management User Trust Token Validation Exchange Resource Domain Domain Server SSO with a single Authority and a single Server Examples: OS, EAMS, Centralized RAS page 11
Simple SSO Solutions Server Replicated Tok Replication Sign-On Server Master Account and Management User Trust Token Validation Exchange Resource Domain Domain Server SSO with a single Authority and multiple Servers Examples: OS, EAMS, Centralized RAS page 12
Tok Traditional Sign-On (No SSO) Tok Sign-On Authority Account and Management User Sign-On(s) Authority Account and Management page 13
Complex SSO Solutions: Single Set: Token-based SSO Tok Sign-On Temporary Token Authority Account and Management User Trust Transparant Sign-On(s) using Temporary Token Authority Account and Management Examples: Kerberos, EAMS, Passport page 14
Complex SSO Solutions: Single Set: PKI-based SSO User Private Key User Cert User User Registration Certificate Issuance Authority Trust CA Cert Account and Management CA Cert Transparant Sign-On(s) using Public Key s (Certificate and Private Key) Authority CA Cert Examples: Entrust, Baltimore, Windows 2000, Windows.NET page 15
Tok Complex SSO Solutions: Multiple Set: Password Sync Tok Sign-On Authority Account and Management User Sync Software Trust Synchronization Sign-On(s) Sync Software Authority Account and Management Examples: PassGo, PSynch, MetaDirectories, Provisioning software page 16
Tok Complex SSO Solutions: Multiple Set: Client-side Caching Tok User Sign-On Authority Account and Management Secure Client-Side Cache Transparant Sign-On(s) Using Cached s Trust Authority Account and Management Examples: Windows XP and Windows.NET, Identix Biologon, Entrust Entelligence page 17
Tok Complex SSO Solutions: Multiple Set: Server-side Cache Sign-On Tok User Request for s s for Autentication Authority Authority Account and Management Trust Transparant Sign-On(s) Using s Returned from Authority s Authority Account and Management Examples: Tivoli SecureWay SSO, CA ETrust SSO page 18
SSO Solutions: Pros and Cons (1) page 19
SSO Solutions: Pros and Cons (2) page 20
SSO Solutions: Pros and Cons (3) page 21
Agenda Trusted Security Infrastructures SSO: What and Why? SSO Architectures Extending SSO page 22
Extending SSO To cover Different Organizations Scope: Extranet and Internet Federation To cover Different Applications Scope: Intranet APIs page 23
Defining Federation The Use of agreements, standards, and technologies to make identity and entitlements portable across autonomous identity domains. page 24
Extending SSO: Federation page 25
Extending SSO: APIs page 26
Conclusion Creating an SSO Infrastructure for a heterogeneous environment is not an easy job The creation of SSO Infrastructures is a great opportunity to leverage directory and meta-directory investments page 27
TSI: Conclusion Trusted Security Infrastructures Security Admin Sec Adm Provisioning Authent Infra NOS Access Control Infra Apps Resource Managers Access Method Office Enterprise (SMB) EAMS Web (HTTP) PKI AAA Radius / Tacacs+ Remote Access (PPP) Wireless page 28
Questions? Jan.DeClercq@hp.com page 29