SSO (Single Sign On/Off)

•Télécharger en tant que PPTX, PDF•

0 j'aime•1,183 vues

Russel Mahmud

What and Why is SSO? Different encryption algorithms, SSO Techniques, How does CAS and oAuth work?

Technologie Formation

SSO
Single Sign On/Off
Russel Mahmud
hossain@newscred.com

drive.google.com
gmail.google.com
drive.google.com
www.youtube.com
accounts.google.com
What is
SSO?

SSO Foundations
Authorization
Access Control
Identification
Authentication
SSO

Why SSO?
1. End User Experience Enhanced
2. Single Login Form
3. Centralized Auditing/Reporting
4. Developer Productivity Improved
5. Multi-factor Authentication Support
6. Reduce IT costs due to lower number of IT help desk calls
about passwords

Terminology
Cookies
Authentication
HTTPS
Encryption
Authorization

Encryption
1. Encryption algorithms transfer plain text into cipher text.
2. Two main types of encryption algorithms:
• Symmetric encryption
• Use same key for encryption and decryption
• Asymmetric encryption
• Use different keys for encryption and decryption
3. Symmetric algorithms are much faster than Asymmetric
encryption

SSO Techniques
1. CAS
2. SAML
3. OpenID
4. oAuth

How Does CAS work?
Web
Application
CAS
Kerberos
4.0Validate
2.1 Authentication
LD
AP
2.2Authentication

Goals
1. Centralize authentication process
2. Keep basic account data isolated
3. Allow users to stay logged in while browsing different apps

NewsCred Auth Design
smartgallery.newscred.com
1. Initial request

NewsCred Auth Design
smartgallery.newscred.com
1. Initial request
redirect to https://accounts.newscred.com/login/
2. No local session

NewsCred Auth Design
smartgallery.newscred.com
accounts.newscred.com

NewsCred Auth Design
smartgallery.newscred.com
accounts.newscred.com
3.0 Login form
Authentication
CDB
Database
3.1Login
verification

NewsCred Auth Design
smartgallery.newscred.com
accounts.newscred.com
3.0 Login form
Authentication
CDB
Database
3.1Login
verification
3.2 Sets Cookies (top domain)
Redirect callback_url?token=encrypted_token

Client Application Flowchart
Local
Session
?
Auth
Cookies
?
Yes
Private
Resource
Yes
NO
NO
Authentication Server
Create Local
Session
Verify
Token
NO
Token RSA
HMAC
DSA

Challenges
1. Cross domain auto logged in issue
2. Checking user permission of each domain
3. Updating and deleting account information
4. Cookies theft

Web Services
1. Public APIs : from anywhere, no authentication
2. S2S APIs : authenticated via API keys

Contenu connexe

Tendances

Secure Code Warrior - Unrestricted file uploadSecure Code Warrior

Secure Code Warrior - Cookies and sessionsSecure Code Warrior

Cross Site Scripting (XSS)Barrel Software

Cross site scripting (xss)Ritesh Gupta

Sitecore with Azure AD and Multifactor AuthenticationAnindita Bhattacharya

Shoot Me a Token: OpenAM as an OAuth2 ProviderForgeRock

Reflective and Stored XSS- Cross Site ScriptingInMobi Technology

Cross site scripting attacks and defensesMohammed A. Imran

Web application attackshruth

WHS-hackability-Index-083013Janis Weiss

OWASPTop 10InnoTech

Cross site scriptingkinish kumar

Web Security AttacksSajid Hasan

Xss (cross site scripting)vinayh.vaghamshi _

Security guidelines for web developmentkumar gaurav

Cross Site Scripting Defense Presentation Ikhade Maro Igbape

WSO2 API Manager: Support for OpenAPI 3.0, Access Control for APIs, and MoreWSO2

Secure Code Warrior - Cross site scriptingSecure Code Warrior

Cross site scripting XSSRonan Dunne, CEH, SSCP

API Security : Patterns and PracticesPrabath Siriwardena

Tendances (20)

Secure Code Warrior - Unrestricted file upload

Secure Code Warrior - Cookies and sessions

Cross Site Scripting (XSS)

Cross site scripting (xss)

Sitecore with Azure AD and Multifactor Authentication

Shoot Me a Token: OpenAM as an OAuth2 Provider

Reflective and Stored XSS- Cross Site Scripting

Cross site scripting attacks and defenses

Web application attacks

WHS-hackability-Index-083013

OWASPTop 10

Cross site scripting

Web Security Attacks

Xss (cross site scripting)

Security guidelines for web development

Cross Site Scripting Defense Presentation

WSO2 API Manager: Support for OpenAPI 3.0, Access Control for APIs, and More

Secure Code Warrior - Cross site scripting

Cross site scripting XSS

API Security : Patterns and Practices

En vedette

Evaluation 2lauraward97

Pharmaceutical licensing in oncology Pipelinepharma

Property troubles no moreRenee Mulen

A plain-distinction-part-2Nick Pellicciotta

Lexical approachenglishteacherr

Facebook PresentationToukir Khandakar

Macro finalShakyPickles

eefa7a8144719a068359ed302deb6abe.pptswebtests

Error logMr_L0ng

Copy of posture,breathing and clothing revised jason versionNick Pellicciotta

บันทึกการประชุมคณะกรรมการรักษาความมั่นคงและความสงบเรียบร้อยที่ทำการปกครองอำเภอเมืองตาก จังหวัดตาก

Theemergingchurchandtheoneprojectpart5 131031011512-phpapp01Nick Pellicciotta

3 Interesting Myths and Unknown drug factsPhillipRyan

Lesson 3 revelation seminars the villain of the drama of revelationNick Pellicciotta

Oestv 2016-12 - l'apprentissageOESTV

7 sealsNick Pellicciotta

Prometna Učilica - Pješačka zona i područje smirenog prometaprometna

Prometna Učilica - Djeca i roditelji na putu do školeprometna

Computer Graphics CalenderShakyPickles

Prometna Učilica: Drogeprometna

En vedette (20)

Evaluation 2

Pharmaceutical licensing in oncology

Property troubles no more

A plain-distinction-part-2

Lexical approach

Facebook Presentation

Macro final

eefa7a8144719a068359ed302deb6abe.ppt

Error log

Copy of posture,breathing and clothing revised jason version

บันทึกการประชุมคณะกรรมการรักษาความมั่นคงและความสงบเรียบร้อย

Theemergingchurchandtheoneprojectpart5 131031011512-phpapp01

3 Interesting Myths and Unknown drug facts

Lesson 3 revelation seminars the villain of the drama of revelation

Oestv 2016-12 - l'apprentissage

7 seals

Prometna Učilica - Pješačka zona i područje smirenog prometa

Prometna Učilica - Djeca i roditelji na putu do škole

Computer Graphics Calender

Prometna Učilica: Droge

Similaire à SSO (Single Sign On/Off)

SINGLE SIGN-ONShambhavi Sahay

Web Single sign on systemSwati Sinha

Single sign on assistant an authentication brokersFinalyear Projects

SecureOTP: Total One-Time-Password SolutionRafidah Ariffin

Help! I Have An Identity Crisis: A look at various mechanisms of Single Sign OnSaloni Shah

Security 101: Multi-Factor Authentication for IBM iPrecisely

Eliminating Secret Sprawl in the Cloud with HashiCorp Vault - 07.11.2018HashiCorp

JoomlaDay Austria 2016 - Presentation Why and how to use HTTPS on your website!Wilco Alsemgeest

QA Fest 2019. Диана Пинчук. Тестирование аутентификации и авторизации (AuthN ...QAFest

Single sign on - benefits, challenges and case study : iFour consultancyDevam Shah

K8s idm-devfestMarc Boorshtein

Best Practices in Cloud SecurityAlert Logic

Kebocoran Data_ Tindakan Hacker atau Kriminal_ Bagaimana kita mengantisipasi...Equnix Business Solutions

SEO benefits | ssl certificate | Learn SEOdevbhargav1

SSO introductionAidy Tificate

CIS13: Identity as a Matter of Public Safety: A Case Study in Secure API Acce...CloudIDSummit

ConFoo 2015 - Securing RESTful resources with OAuth2Rodrigo Cândido da Silva

Fundamentals of Microsoft 365 Security , Identity and ComplianceVignesh Ganesan I Microsoft MVP

Authenticator and provisioning connector in wso2 Identity ServerRajendram Kathees

Similaire à SSO (Single Sign On/Off) (20)

SINGLE SIGN-ON

Web Single sign on system

Single sign on assistant an authentication brokers

SecureOTP: Total One-Time-Password Solution

Help! I Have An Identity Crisis: A look at various mechanisms of Single Sign On

Security 101: Multi-Factor Authentication for IBM i

Eliminating Secret Sprawl in the Cloud with HashiCorp Vault - 07.11.2018

JoomlaDay Austria 2016 - Presentation Why and how to use HTTPS on your website!

QA Fest 2019. Диана Пинчук. Тестирование аутентификации и авторизации (AuthN ...

Single sign on - benefits, challenges and case study : iFour consultancy

K8s idm-devfest

Best Practices in Cloud Security

Kebocoran Data_ Tindakan Hacker atau Kriminal_ Bagaimana kita mengantisipasi...

SEO benefits | ssl certificate | Learn SEO

SSO introduction

CIS13: Identity as a Matter of Public Safety: A Case Study in Secure API Acce...

ConFoo 2015 - Securing RESTful resources with OAuth2

Fundamentals of Microsoft 365 Security , Identity and Compliance

Authenticator and provisioning connector in wso2 Identity Server

Dernier

HTML Injection Attacks: Impact and Mitigation StrategiesBoston Institute of Analytics

Apidays New York 2024 - The value of a flexible API Management solution for O...apidays

Artificial Intelligence: Facts and MythsJoaquim Jorge

Automating Google Workspace (GWS) & more with Apps Scriptwesley chun

TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc

2024: Domino Containers - The Next Step. News from the Domino Container commu...Martijn de Jong

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...apidays

TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc

Artificial Intelligence Chap.5 : UncertaintyKhushali Kathiriya

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobeapidays

GenAI Risks & Security Meetup 01052024.pdflior mazor

Partners Life - Insurer Innovation Award 2024The Digital Insurer

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Neo4j

Top 5 Benefits OF Using Muvi Live Paywall For Live StreamsRoshan Dwivedi

Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...Principled Technologies

Real Time Object Detection Using Open CVKhem

The 7 Things I Know About Cyber Security After 25 Years | April 2024Rafal Los

Scaling API-first – The story of a global engineering organizationRadu Cotescu

Axa Assurance Maroc - Insurer Innovation Award 2024The Digital Insurer

A Year of the Servo Reboot: Where Are We Now?Igalia

Dernier (20)

HTML Injection Attacks: Impact and Mitigation Strategies

Apidays New York 2024 - The value of a flexible API Management solution for O...

Artificial Intelligence: Facts and Myths

Automating Google Workspace (GWS) & more with Apps Script

TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments

2024: Domino Containers - The Next Step. News from the Domino Container commu...

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery

Artificial Intelligence Chap.5 : Uncertainty

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

GenAI Risks & Security Meetup 01052024.pdf

Partners Life - Insurer Innovation Award 2024

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...

Top 5 Benefits OF Using Muvi Live Paywall For Live Streams

Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...

Real Time Object Detection Using Open CV

The 7 Things I Know About Cyber Security After 25 Years | April 2024

Scaling API-first – The story of a global engineering organization

Axa Assurance Maroc - Insurer Innovation Award 2024

A Year of the Servo Reboot: Where Are We Now?

SSO (Single Sign On/Off)

1. SSO Single Sign On/Off Russel Mahmud hossain@newscred.com

2. drive.google.com gmail.google.com drive.google.com www.youtube.com accounts.google.com What is SSO?

3. SSO Foundations Authorization Access Control Identification Authentication SSO

4. Why SSO? 1. End User Experience Enhanced 2. Single Login Form 3. Centralized Auditing/Reporting 4. Developer Productivity Improved 5. Multi-factor Authentication Support 6. Reduce IT costs due to lower number of IT help desk calls about passwords

5. Terminology Cookies Authentication HTTPS Encryption Authorization

6. HTTPS

7. HTTPS

8. Encryption 1. Encryption algorithms transfer plain text into cipher text. 2. Two main types of encryption algorithms: • Symmetric encryption • Use same key for encryption and decryption • Asymmetric encryption • Use different keys for encryption and decryption 3. Symmetric algorithms are much faster than Asymmetric encryption

9. RSA

10. HMAC

11. DSA

12. SSO Techniques 1. CAS 2. SAML 3. OpenID 4. oAuth

13. How Does CAS work? Web Application CAS Kerberos 4.0Validate 2.1 Authentication LD AP 2.2Authentication

14. How Does oAuth work?

15. NewsCred Auth(MVP)

16. Goals 1. Centralize authentication process 2. Keep basic account data isolated 3. Allow users to stay logged in while browsing different apps

17. NewsCred Auth Design smartgallery.newscred.com 1. Initial request

18. NewsCred Auth Design smartgallery.newscred.com 1. Initial request redirect to https://accounts.newscred.com/login/ 2. No local session

19. NewsCred Auth Design smartgallery.newscred.com accounts.newscred.com

20. NewsCred Auth Design smartgallery.newscred.com accounts.newscred.com 3.0 Login form Authentication CDB Database 3.1Login verification

21. NewsCred Auth Design smartgallery.newscred.com accounts.newscred.com 3.0 Login form Authentication CDB Database 3.1Login verification 3.2 Sets Cookies (top domain) Redirect callback_url?token=encrypted_token

22. NewsCred Auth Design smartgallery.newscred.com accounts.newscred.com 3.0 Login form Authentication CDB Database 3.1Login verification 3.2 Sets Cookies (top domain) Redirect callback_url?token=encrypted_token

23. NewsCred Auth Design smartgallery.newscred.com accounts.newscred.com 3.0 Login form Authentication CDB Database 3.1Login verification 3.2 Sets Cookies (top domain) Redirect callback_url?token=encrypted_token 5.0 Access Web Application

24. Client Application Flowchart Local Session ? Auth Cookies ? Yes Private Resource Yes NO NO Authentication Server Create Local Session Verify Token NO Token RSA HMAC DSA

25. Challenges 1. Cross domain auto logged in issue 2. Checking user permission of each domain 3. Updating and deleting account information 4. Cookies theft

26. Web Services 1. Public APIs : from anywhere, no authentication 2. S2S APIs : authenticated via API keys

27. Questions ?

SSO (Single Sign On/Off)

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

En vedette

En vedette (20)

Similaire à SSO (Single Sign On/Off)

Similaire à SSO (Single Sign On/Off) (20)

Dernier

Dernier (20)

SSO (Single Sign On/Off)