CIS 2015 So you want to SSO … Scott Tomilson & John Dasilva
1 like822 views
The document discusses Single Sign-On (SSO) and its integration with various applications, emphasizing the need for a unified username and password approach. It outlines the challenges and steps related to 'first mile' and 'last mile' integration, including the necessity of conforming to web SSO standards such as SAML and OpenID Connect. Additionally, it addresses the options available for mobile application SSO and the importance of user experience in managing multiple logins.
CIS 2015 So you want to SSO … Scott Tomilson & John Dasilva
- 1. So you want to SSO … Scott Tomilson John DaSilva
- 2. You’ve waited long enough … Copyright © 2015 Cloud Identity Summit. All rights reserved. 2 Mobile AppsWeb Apps SaaS Apps username password username password username password username password username password username password username password username password username password
- 3. Copyright © 2015 Cloud Identity Summit .All rights reserved. 3
- 4. Copyright © 2015 Cloud Identity Summit .All rights reserved. 4 Integration Kits
- 5. It’s time for SSO … … what do you mean by SSO? App Enablement?Session Management? Access Control? Auditing?Authentication Policy? “One Username & Password (or some other form of authentication) just One Time”
- 6. It’s time for SSO … … and how will we get SSO? Open Standards?On-Premise ? IdaaS? Agents vs Gateway?App Changes? “Eliminate Unnecessary Passwords” (yes, some work will be needed – but you want to do this the right way)
- 7. Copyright © 2015 Cloud Identity Summit .All rights reserved. 7 Access Management ENTERPRISE Federated Identity Management
- 8. SSOfor Web Applications Copyright © 2015 Cloud Identity Summit. All rights reserved. 8
- 9. “First Mile” / “Last Mile” Integration Federation Server Identity Store Federation Server Target App Identity Provider (IdP) Service Provider (SP) “First Mile” “Last Mile”
- 10. “First Mile” Integration • If you’re using a Federation Server – hopefully this is just a configuration exercise: • ADconnect (Active Directory) • PingFederate (Complex AD, LDAP, WAM, etc.) • PingOne Cloud Directory (IdaaS user/group dir.) • Worst case – there are Libraries & APIs to help you integrate a custom portal or user store Copyright © 2015 Cloud Identity Summit. All rights reserved. 10
- 11. “Last Mile” Integration Here’s where things get interesting … Copyright © 2015 Cloud Identity Summit. All rights reserved. 11
- 12. “Last Mile” Integration Question #1: Does your application support Web (federated) SSO standards? (i.e.: SAML, WS-Federation, OpenID Connect) Copyright © 2015 Cloud Identity Summit. All rights reserved. 12
- 13. “Last Mile” Integration – with Standards Copyright © 2015 Cloud Identity Summit. All rights reserved. 13 Federation Server Identity Store Target App Identity Provider (IdP) Service Provider (SP) SAML
- 14. Copyright © 2015 Cloud Identity Summit. All rights reserved. 14 “Last Mile” Integration – with Standards Your Apps Your Identity Stores / Partners Acme Beta Com SAML SAML SAML Federation Hub
- 15. “Last Mile” Integration – with Standards Copyright © 2015 Cloud Identity Summit. All rights reserved. 15 Does your app Web SSO standards? (SAML/WS-Fed/OIDC) Do you prefer IdaaS? No Yes Yes No
- 16. “Last Mile” Integration Question #2: Does your application support HTTP header-based SSO? Copyright © 2015 Cloud Identity Summit. All rights reserved. 16
- 17. “Last Mile” Integration – with HTTP Headers Federation Server Identity Store Federation Server Target App Identity Provider (IdP) Service Provider (SP) SAML Agent / Gateway HTTP Headers User: joe Email: [email protected] Group: Sales
- 18. “Last Mile” Integration – with HTTP Headers • Federated SSO • PingFederate Integration Kits: • Apache & IIS • WAM Features (Session Management, URL Authorization & Auditing) • Gateway (Reverse Proxy) • Agents: Apache & IIS Copyright © 2015 Cloud Identity Summit. All rights reserved. 18
- 19. “Last Mile” Integration – with Standards Copyright © 2015 Cloud Identity Summit. All rights reserved. 19 Does your app support HTTP header based SSO? Do you want WAM features? No Yes Yes No
- 20. “Last Mile” Integration Question #3: Can you modify the application? Copyright © 2015 Cloud Identity Summit. All rights reserved. 20
- 21. “Last Mile” Integration – with App Changes Copyright © 2015 Cloud Identity Summit. All rights reserved. 21 Features Approach Effort Level Product(s) Federated SSO Implement SAML L n/a Implement OpenID Connect S n/a HTTP Headers XS PingFederate REST API S PingFederate PingOne SSO Integration Kit SDK Library (Java, .NET) S PingFederate WAM Features (Session Management, URL Authorization & Auditing) HTTP Headers XS PingAccess
- 22. “Last Mile” Integration Question #4: Did you reach here with 3 NO’s? Copyright © 2015 Cloud Identity Summit. All rights reserved. 22
- 23. “Last Mile” Integration – “I’m out of options…” • PingFederate Integration Kits • Basic SSO (Password Vaulting) Copyright © 2015 Cloud Identity Summit. All rights reserved. 23 … still lost? Talk to us!
- 24. SSOfor Mobile Applications Copyright © 2015 Cloud Identity Summit. All rights reserved. 24
- 25. Copyright © 2015 Cloud Identity Summit .All rights reserved. 25 Get Your Time Machines Ready …
- 26. SSO for Mobile Applications • Are multiple logins (with the same creds) OK? • User experience could be mitigated with long lived refresh tokens • Shared refresh tokens? (Multiple apps – same dev. signer) • Shared browser session? • Centralized broker of OAuth Access Tokens • Napps – http://openid.net/wg/napps/ • PingOne Mobile – Early Napps draft support compatible with both PingFederate and PingOneCopyright © 2015 Cloud Identity Summit. All rights reserved. 26
- 27. In Closing … Copyright © 2015 Cloud Identity Summit. All rights reserved. 27
- 28. Copyright © 2015 Cloud Identity Summit .All rights reserved. 28