We live in a world where we as individuals want to access lots and lots of computers. I mean just think
about this. In your normal browsing life you go to all kinds of different Web sites those are actual
computers and you have to access them now.
Web might be a little bit of a tricky one because web is a public kind of tool but we can trivially
add usernames and passwords to any Web site that we wanted to.
People don't do it very often but you can.
Let's take a better example.
Let's talk about a local area network.
So here at total seminars we've got lots and lots of computers and people are sharing stuff and we got
servers and printers and all kinds of things that I as an individual want to be able to access. In a
typical Windows workgroup
what we do is we have well here's an example we've got three or four computers.
We've got a printer and whatever it might be.
Now each one of these hosts have their own username and password list and it works great.
The challenge is that if I want to access one computer I have to have a username and password on that
computer that I can log in with if I want to access another computer.
It may have a different username and password.
So the Windows work groups which been around now for over 30 years worked very very well.
We can go ahead and log in to these individual computers but once in a while you want to start logging
into a lot of computers at once.
You want to go to this computer and that computer and after awhile you start going I can't remember
all these passwords.
So well you can do one thing.
You can cheat.
So if we take a look at this example one more time what I can do is I can put the same username and
password on every single one of these computers on my local area network.
And that way I don't have to log in every time because once I log into my computer it will in essence
carry that authentication information to each one of these other computers.
And then I always think that I have a user called Timmy with password of 1 2 3 4.
That is not a good idea. That is a very dangerous security issue and it is a big problem.
So what can we do instead.
Well what we can do is single sign on. The idea behind single sign on is that I log in once to something
and then everything else I need to get to I'm automatically logged into. Now single sign on is a great
idea but it works differently depending on how you're talking about it,
so let's start with the most classic and that is single sign on on a local area network. To do that
we're going to have to use Windows Active Directory. Now Windows Active Directory has been around for
ever and it is the gold standard when it comes to single sign on tools for local area networks it actually
works for more than local area networks but we'll keep it simple for the moment.
So with Active Directory what I have to first do is go purchase a copy of Windows Server and install
that onto my network.
Here looks something like this.
So here's my Windows server with all these other computers.
Now once I establish a domain as we call it in the Windows world we then have all of these other computers
join this domain.
Now we do this by having a administrator actually go to each computer and go through a process of having
them join the domain so somebody in a high trust position has to actually go through and connect each
one of these individual computers to the domain one at a time.
Now once that's done we in essence have created a trust situation because I as an administrator have
went to each computer and said join this domain we have what are known as Federated systems.
When you hear the word Federated think trust.
So there is an implicit trust that has been developed there simply because Microsoft has a proprietary
authentication mechanism based on Kerberos.
But the bottom line is is that we now have trust.
Now if you're going to be doing single sign on in a local area network odds are good you're going to
be using active directory even if you have Apple systems even if you have Linux systems those can use
Windows file sharing.
Or if it's Linux we can use Samba and all of these can be configured to join a local domain which is
actually cool.
I can't tell you how many big systems you have out there where the research areas really got 1500 Linux
boxes and they still have a Windows active directory on there simply because it's easier from a maintenance
standpoint to be able to do single sign on.
So when you're talking about LAN's you really are talking about active directory as the single sign on
tool.
Now there is another type of single sign on and this is completely different and it's based on something
called SAML.
Let me give you a scenario.
Let's say I'm running while I live in Texas so we're running an oil pipeline and on this oil pipeline
we've got lots of pumps and thermometers and cameras and all kinds of stuff. Hundreds of little devices.
And we've developed web apps for these devices so that I can turn pumps on turn pumps off whatever it
might be.
Now just because these are web apps don't go thinking they're public they're well-protected usernames
passwords all kinds of stuff.
It's not easy.
Hopefully it's basically impossible for the public to get to.
But I as the operator of all these pumps and everything I need to be able to get to these.
But not only do I need to get to them I need to get to them securely and I need to get to them any time
I want.
So if I've got a couple of hundred different web app devices I would like to sign on one time and be
done with it.
And that's where SAML really comes into play.
SAML is designed really for web apps more than anything else and it allows us as a single person at
a single place to log into a whole bunch of different devices.
So let me show you a little bit how SAML works.
So here's some of my oil pipeline and we'll just put some devices here along the pipeline.
All of these devices are accessible through my VPN to be able to get to them to do whatever I want to
do.
Now the trick here is is I don't want to keep logging into this pump and that pump and that camera and
that's how SAML works.
SAML starts off with having what we call an identity provider so that's going to be a system somewhere
that's connected out here that everybody can talk to.
And what I will do is I will sign on to the identity provider.
And then all of these individual web apps are going to be called service providers.
So I can jump between any one of these because the identity provider provides me with a token that allows
me to log in to any one of these different devices.
Now showing you SAML at work is a little bit tricky because the only time you're going to see SAML really
working for a living is when you have people who have web apps that they want to really really control
and they're going to go ahead write a lot of code and you know what they don't tend to like people like
me going in and actually working on this.
But what I've got instead has got this wonderful little company called SSOCircle. SSOCircle
sells
Single Sign on tool sets.
And so they have a nice little demo.
So let me show you how this guy works.
So first of all thank you SSOCircle for letting me play on your site.
So what I'm going to do is I've actually created an account already and what I'm going to do is just
log in and here's my log in.
Now there's a lot of extra information here.
Keep in mind what they're doing is they're trying to sell packages for people who actually write
SAML language.
But what I want to show you that's actually kind of cool here is that I've gone ahead and logged in
to the identity provider that's provided by SSO circle.
Now what they do that's really really nice is
they provide all of the service providers.
Now these service providers are just samples they're examples of how logging in with SSO circle allows
you to log into other disparate websites.
So I'm going to pick one here. Here sales force dot com. Sales force dot com is a really really popular
site for use by sales people and stuff.
Customer Relationship Management tools.
So what we're going to do here is if I got this working right now that I've logged into SSO circle
it's just going to pop me over to one little place within sales force like a little discussion page.
So let's see how this guy works.
Now what you're seeing here is because SSO circle wants to sell us this product what it's doing is
it's having you do a little.
I'm not a robot.
Normally with SAML we would skip this but we'll go ahead.
Just click right on here and if I did it right.
Ta-da! I am now auto magically on a little discussion page within sales force.
Notice that I didn't have to type in a user name or a password.
In fact if I paid a little money I wouldn't even have to do that
I'm not a robot thing.
And that's the power of SAML.
In fact take a look over here.
Up in the upper right hand corner you see where it says log out? With SAML
I can actually I'm already automatically logged in that's the beautiful part about single sign on.
But I could also log out of just this web app or I could log out of all web apps in one big shot.
Now when we're talking about single sign on especially for the exam you need to think about what type
of security needs you're going to need.
For example if we're talking about a local area network where you just want to be able to share folders
and files you're going to have to be using Windows active directory.
Yes there are other options but Windows AD is dominant.
But the moment you start talking about SCADA systems or anything that's widespread or all over the
place be sure to think SAML and you'll get it right on the exam.