The landscape of today’s work culture goes far and wide from what was once considered traditional. Every employee requires a multitude of applications to stay productive. So how can this be achieved with multiple roles, multiple applications while ensuring security?
Identity and Access Management (IAM) is one such domain that provides solutions to streamline the accesses and roles of users. Single sign-on is a crucial tool for employees that enables them to access an array of applications without the hassles of logging in multiple times.
In this read, we will discuss the following:
1. What is single sign-on? How does it work?
2. What are the different types of single sign-on?
3. How to implement single sign-on?
4. What are the benefits of single sign-on?
5. Single sign-on and MFA, what do you choose?
What is single sign-on? How does it work?
Single sign-on (SSO) is part of the Identity and Access Management solutions. It is essentially used as a productivity and security tool to authenticate users to their applications. Single sign-on can be used by large and small businesses alike.
How does it work?
When a user tries to access an application, which is the Service Provider, the application checks if the user is authenticated already. If not, it redirects the user to the single sign-on application that asks the user to enter a user name and a password. If the user is verified to be whom he/she claims to be, then, they are given access to all the applications they are entitled to. These accesses are provided without having to repeat the process multiple times for different applications. SAML based SSO is the most widely used SSO protocol. Today even OAuth and OpenID are used for single sign-on where the user’s identity is verified from their social identities like Google, Facebook among others.
What are the different types of single sign-on?
There are various types of single sign-on through which the user’s identity is authenticated. Some of the common ones used by the single sign-on providers are as below:
- Kerberos-based single sign-on
Here the users are provided with a Kerberos Ticket-Granting-Ticker after the authentication of their credentials. This is done when two non secure networks require communication securely. - Smart card-based authentication
When smart card based SSO is prompted, users connect their smart card to the computer and unlock it with a PIN. These are highly protected microcontrollers with cryptographic keys. - Integrated Windows Authentication
This is an authentication that is achieved automatically between the Microsoft Internet Information Services and Internet Explorer. It is done via a cryptographic exchange that involves hashing. - SAML based authentication
It carries out authentication and authorization between the Service Provider and the Identity Provider based on the XML Markup Language.
How to implement single sign-on?
Single sign-on implementation can be carried out in a thoroughly seamless manner with an SSO service provider who can understand your organizational requirements.
You must narrow down key points such as whether you want an on-prem SSO, an IDaaS or a hybrid environment for your organization. The list of applications and employees who need SSO functionality. And lastly, a vendor who makes the implementation easy for you.
The vendor must be able to accommodate all your applications. A vendor like Cross Identity can even build connectors for you at no extra cost and build additional connectors within a week. Cross Identity SSO does not even need a comprehensive guide on how to implement it. The product is enabled with a contextual guide that can help you at every step of the way. Seamless SSO for you and your employees can be achieved with a simple step of adding the applications to the SSO dashboard. Now, the SSO enabled applications will be accessible to the users whether the applications are federated, non-federated or even thick client.
What are the benefits of single sign-on?
Single sign-on is the need of the hour for businesses. It addresses several key aspects of organizational issues like productivity and security. Here are some benefits you experience with a seamless SSO:
- Increases user productivity: Every user, be it your employee or a customer, will need multiple applications daily. They have to remember all the credentials and login to each application every time they want to access it. This becomes a cumbersome process. With single sign-on, the users only have to login once. When their identity is authenticated they will be able to use all the applications they are authorized to use without repetitive login processes, saving a lot of time.
- Promotes better security practices: With users having to remember only one set of credentials, they will not indulge in bad security practices. Noting down passwords on a paper, making a list on excel, or using the same password across all applications are all very poor password habits. A bad actor could easily take advantage of this and sneak their way into your network. With the single sign-on service, the users only have to remember one credential and securely use every application.
- Reduces IT time: With multiple applications, having multiple passwords, users are bound to forget some from time to time. When this happens, users have to reach out to their IT help desk for a reset. This prevents the user from using the application as well as takes up IT time from more important tasks.
- Paves the way for Intelligent security: The Single sign-on integration with applications itself paves the way for smarter security decisions. But, by combining SSO with risk engines powered with cognitive technologies, takes it a notch higher. They give your organizational security the edge to know at all times of any unwarranted access or unusual behavior from users. These indicators could be used to step up the authentication or suspend their access from the application altogether.
Single sign-on and MFA, what do you choose?
To single sign-on, you need one set of credentials and it does make the user’s life easier. As mentioned in the previous section, the user saves time and makes your network secure. But, SSO also has a disadvantage because of the very aspect that makes it seamless— a single credential. If a bad actor gets hold of this credential, then he/she could intrude your corporate network. Thus, in Identity Management there is another solution called Multi-factor authentication which verifies the user based on several parameters: Something you know (passwords), something you have (OTP), something you are (biometric attributes like a fingerprint), somewhere you are (location), something you do (your daily habits like when you log in). These are indeed thorough methods to verify users for the access of each application. But, this brought along inconveniences as well such as taking up time and additional efforts to use one application. This is why IAM has now evolved and combines SSO and MFA to save you the burden of choosing.
Single sign-on security enabled with MFA with a vendor like Cross Identity is the way to go. The user logins in once using two or more factors of authentication and stays authenticated to all the entitled resources. Now, the authentication can be stepped up when the user accesses sensitive files. The user may also be prompted with additional security measures when their behavior is detected to be unusual by the risk engine.
With the evolving cyberspace, a complete Identity and Access Management is the way to obtain holistic security. Cross Identity’ CI provides SSO, MFA, Identity Governance, Risk Engine, and so much more. Contact us for further queries.
FAQs
Is single sign-on secure?
Yes, because single sign-on enables users to log in just once to multiple applications with one set of credentials, preventing password hassles and enhancing productivity.
What is the difference between SAML and OAuth?
SAML allows authentication and authorization between two servers—Identity Provider and Service Provider. OAuth allows authorization of access between applications and websites without disclosing credentials.
How does SAML work while providing SSO?
SAML authenticates the user’s identity to the service provider from the identity provider using redirects and checks if the user is authorized to use the application.
What is the difference between identity provider and service provider?
Service providers are those who provide application service to the end-user. Identity providers are those who store user identities using a directory from where a user can SSO to access applications from the service providers.
