- [Presenter] Suppose you have two separate applications.
Application one and application two,
both applications require user authentication,
as demonstrated in the following example.
In the figure, the user Derek first tries to connect
to an application one.
Second, application one prompts Derek for authentication.
Third, Derek authenticates to application one.
Fourth, Derek wants to connect to application two.
Fifth, Derek is then prompted
to authenticate to application two,
and six, Derek is authenticated to application two.
As you can see, this is not very user friendly.
In most environments, you are accessing dozens
of applications throughout an enterprise network
or even applications hosted in the cloud.
This is why single sign-on or SSO was created.
This figure shows an example
of a typical SSO implementation.
Even though the steps
in this figure are more elaborate
than those in the previous figure,
the user experience is better.
This is because the user Derek only needs
to authenticate once to application one,
and then he can browse or access any other application
that is a participant in the SSO implementation.
And that Derek is authorized to access.
The concept of a centralized identity
or linked identity is also referred to
as federated identity.
Federated identity systems handle authentication,
authorization, user attributes, exchange,
and manage user management.
The attributes exchange concept orchestrates data shared
across different user management systems.
The following attributes, like real name may be present
in multiple systems or applications.
Federated identity systems
counteract data duplication problems
by linking the related attributes
within all the elements that are participants
of the SSO environment.
SAML is used in SSO implementations.
However, there are other identity technologies used
in SSO implementations,
such as Open ID Connect, Microsoft Account,
formerly known as Passport, Facebook Connect and others.
SAML is an open standard for exchanging authentication
and authorization data between identity providers.
The following are several elements that are part
of an SSO and federated identity implementation.
Delegation, SSO implementations use delegation
to call external APIs to authenticate and authorize users.
Delegation is used to contain apps
and services from having to store passwords
and user information on site.
Domain, a domain in an SSO environment is the network
where all resources and users are linked
to a centralized database.
This is where all authentication
and authorization occurs.
Factor, you already learned
about multifactor authentication.
A factor in authentication is a vector
through which identity can be confirmed.
Federated identity management is a collection
of shared protocols that allows user identities
to be managed across organizations.
Federation provider is an identity provider
that offers single sign-on consistency
in authorization practices user management
and attributes exchange practices
between identity providers and relying parties.
A forest is a collection
of domains managed by a centralized system.
Identity provider or IDP is an application website
or service responsible for coordinating identities
between users and clients.
IDPs can provide a user with identifying information
and provide that information to services,
when the user requests access.
Kerberos is a ticket based protocol
for authentication, built on symmetric key encryption.
Multitenancy is a term in computing architecture,
referring to the serving of many users
or tenants from a single instance of an application.
Software as a service or SAS offerings
are examples of multitenancy.
They exist as a single instance, but have dedicated shares,
serve to many companies and teams.
OAuth is an open standard for authorization,
used by many APIs and modern applications.
OpenID or OpenID Connect is another open standard
for authentication.
OpenID Connect allows third party services
to authenticate users without clients needing
to collect, store and subsequently become liable
for a user's login information.
Passwordless is a type of authentication based on tokens.
Passwordless authentication challenges
are typically received and sent through SMS,
email or biometric sensors.
Social identity provider or Social IDP is a type
of identity providers originating in social services
like Google, Facebook, and Twitter.
With web identity, they are identifying data
typically obtained from an HTTP request.
Often these are retrieved
from an authenticated email address.
Windows Identity is how active directory
in Microsoft Windows environments organizes user information
and WS-Federation is a common infrastructure
federated standard for identity used by web service
and browsers on Windows Identity Foundation.
Windows Identity Foundation is a framework created
by Microsoft for building identity aware applications.