1 1 00:00:00,160 --> 00:00:01,890 Authentication methods. 2 2 00:00:01,890 --> 00:00:02,780 In this lesson, 3 3 00:00:02,780 --> 00:00:05,130 we're going to discuss different authentication methods 4 4 00:00:05,130 --> 00:00:06,330 that are used in our networks, 5 5 00:00:06,330 --> 00:00:08,090 including local authentication, 6 6 00:00:08,090 --> 00:00:10,840 LDAP, Kerberos and SSO. 7 7 00:00:10,840 --> 00:00:13,110 So what is authentication? 8 8 00:00:13,110 --> 00:00:15,060 Authentication is the process of determining 9 9 00:00:15,060 --> 00:00:17,510 whether someone or something is in fact, 10 10 00:00:17,510 --> 00:00:19,900 who or what it claims itself to be. 11 11 00:00:19,900 --> 00:00:21,710 So, if you're walking into my classroom 12 12 00:00:21,710 --> 00:00:23,230 on the first Monday of the semester, 13 13 00:00:23,230 --> 00:00:24,063 and you say, 14 14 00:00:24,063 --> 00:00:24,896 "Hi, Professor Dion, 15 15 00:00:24,896 --> 00:00:26,540 my name is John Smith." 16 16 00:00:26,540 --> 00:00:28,310 I might ask to see your student ID card 17 17 00:00:28,310 --> 00:00:29,460 or your driver's license 18 18 00:00:29,460 --> 00:00:31,850 so I could verify you are who you say you are. 19 19 00:00:31,850 --> 00:00:34,030 After all, you and I have never met before. 20 20 00:00:34,030 --> 00:00:36,130 So I need some way to validate your claim 21 21 00:00:36,130 --> 00:00:38,820 and authenticate that you are really John Smith. 22 22 00:00:38,820 --> 00:00:40,130 Now, the same thing will happen 23 23 00:00:40,130 --> 00:00:42,200 when you go and take your certification exam. 24 24 00:00:42,200 --> 00:00:43,390 Before you take your exam, 25 25 00:00:43,390 --> 00:00:44,223 they're going to look over 26 26 00:00:44,223 --> 00:00:45,950 your official government identification, 27 27 00:00:45,950 --> 00:00:48,160 such as your driver's license or a passport, 28 28 00:00:48,160 --> 00:00:50,150 and they're going to compare that to what you look like, 29 29 00:00:50,150 --> 00:00:51,880 and also compare it to the name that you used 30 30 00:00:51,880 --> 00:00:53,650 when you registered for the exam. 31 31 00:00:53,650 --> 00:00:55,940 So, if you registered as Jason Dion, 32 32 00:00:55,940 --> 00:00:57,990 but your driver's license says, Michael Jordan, 33 33 00:00:57,990 --> 00:00:59,550 they're not going to let you take your exam 34 34 00:00:59,550 --> 00:01:02,430 because you're going to fail the authentication process. 35 35 00:01:02,430 --> 00:01:05,240 The first authentication mechanism you have on a system, 36 36 00:01:05,240 --> 00:01:07,400 is known as local authentication. 37 37 00:01:07,400 --> 00:01:08,880 When you turn on your personal laptop 38 38 00:01:08,880 --> 00:01:10,910 and you entering your username and password, 39 39 00:01:10,910 --> 00:01:13,320 you're going to be using local authentication. 40 40 00:01:13,320 --> 00:01:15,570 Whenever you set up the laptop for the first time, 41 41 00:01:15,570 --> 00:01:18,770 you can create a username and a password on that device 42 42 00:01:18,770 --> 00:01:20,760 and the device will save it in an encrypted version 43 43 00:01:20,760 --> 00:01:22,040 on your hard drive. 44 44 00:01:22,040 --> 00:01:24,240 Now, every time you try to log on, 45 45 00:01:24,240 --> 00:01:26,200 it's going to take what you enter, encrypt it 46 46 00:01:26,200 --> 00:01:28,670 and compare it against what is stored as your username 47 47 00:01:28,670 --> 00:01:29,670 and password. 48 48 00:01:29,670 --> 00:01:30,680 If they match, 49 49 00:01:30,680 --> 00:01:31,690 you're going to be authenticated 50 50 00:01:31,690 --> 00:01:32,523 because you've met 51 51 00:01:32,523 --> 00:01:34,380 this single factor authentication requirement 52 52 00:01:34,380 --> 00:01:36,090 of a standard laptop by entering in, 53 53 00:01:36,090 --> 00:01:37,720 your username and password. 54 54 00:01:37,720 --> 00:01:39,590 Now, the next type of authentication we have, 55 55 00:01:39,590 --> 00:01:42,350 is known as LDAP, L-D-A-P. 56 56 00:01:42,350 --> 00:01:45,360 Now, LDAP is the Lightweight Directory Access Protocol. 57 57 00:01:45,360 --> 00:01:46,880 And it's essentially a database 58 58 00:01:46,880 --> 00:01:48,630 that's used to centralize information 59 59 00:01:48,630 --> 00:01:51,360 about your clients and your objects on your network. 60 60 00:01:51,360 --> 00:01:55,220 LDAP is essentially a simplified version of X.500, 61 61 00:01:55,220 --> 00:01:56,700 which is a directory service. 62 62 00:01:56,700 --> 00:01:59,500 And it contains a hierarchal organization of the users, 63 63 00:01:59,500 --> 00:02:03,090 groups, servers and systems inside your network. 64 64 00:02:03,090 --> 00:02:05,017 LDAP is going to communicate over port 389 65 65 00:02:05,017 --> 00:02:08,290 if you're going to be using the standard plain text version. 66 66 00:02:08,290 --> 00:02:10,600 If instead, you're using the more secure version 67 67 00:02:10,600 --> 00:02:13,100 known as LDAPS or LDAP Secure, 68 68 00:02:13,100 --> 00:02:15,720 it's going to communicate over port 636 69 69 00:02:15,720 --> 00:02:18,370 using either SSL or TLS encryption, 70 70 00:02:18,370 --> 00:02:19,510 to be able to protect your data 71 71 00:02:19,510 --> 00:02:20,770 as it crosses the network. 72 72 00:02:20,770 --> 00:02:22,990 LDAP is going to be used for validating 73 73 00:02:22,990 --> 00:02:24,860 a username and password combination 74 74 00:02:24,860 --> 00:02:28,250 against an LDAP server as your form of authentication. 75 75 00:02:28,250 --> 00:02:30,850 Now, it's going to be very similar to local authentication, 76 76 00:02:30,850 --> 00:02:32,300 except that it's now going to be occurring 77 77 00:02:32,300 --> 00:02:33,540 over the network. 78 78 00:02:33,540 --> 00:02:34,450 With LDAP, 79 79 00:02:34,450 --> 00:02:36,890 it is going to be considered a cross-platform system. 80 80 00:02:36,890 --> 00:02:40,030 And that means it works on Unix, Linux, OSX, 81 81 00:02:40,030 --> 00:02:41,160 and even Windows. 82 82 00:02:41,160 --> 00:02:44,420 But Microsoft also created their own implementation of this 83 83 00:02:44,420 --> 00:02:47,290 known as a AD or Active Directory. 84 84 00:02:47,290 --> 00:02:49,010 Now, in a Windows domain environment, 85 85 00:02:49,010 --> 00:02:50,290 Active Directory is going to be used 86 86 00:02:50,290 --> 00:02:52,570 to organize image, everything on the network, 87 87 00:02:52,570 --> 00:02:56,030 including those clients, servers, devices, users and groups 88 88 00:02:56,030 --> 00:02:57,450 that we mentioned before. 89 89 00:02:57,450 --> 00:02:58,840 Active Directory can be used 90 90 00:02:58,840 --> 00:03:00,810 as part of your overall security policies 91 91 00:03:00,810 --> 00:03:03,440 and access control through the use of group policies 92 92 00:03:03,440 --> 00:03:04,310 as well. 93 93 00:03:04,310 --> 00:03:06,260 Now, this brings us to Kerberos, 94 94 00:03:06,260 --> 00:03:08,510 which has focused on authentication and authorization 95 95 00:03:08,510 --> 00:03:10,210 within a Windows domain environment. 96 96 00:03:10,210 --> 00:03:12,740 And it integrates with Active Directory. 97 97 00:03:12,740 --> 00:03:15,110 Kerberos is designed to provide secure authentication 98 98 00:03:15,110 --> 00:03:17,590 to services over an insecure network. 99 99 00:03:17,590 --> 00:03:20,130 Kerberos is going to use tickets to authenticate a user 100 100 00:03:20,130 --> 00:03:23,110 and completely avoid sending passwords across the network 101 101 00:03:23,110 --> 00:03:25,950 because it relies instead on the Kerberos ticketing system 102 102 00:03:25,950 --> 00:03:27,820 inside of a Windows domain, 103 103 00:03:27,820 --> 00:03:29,610 Kerberos is authentication protocol 104 104 00:03:29,610 --> 00:03:32,260 that provides two way or mutual authentication. 105 105 00:03:32,260 --> 00:03:33,930 When a user logs on to the domain, 106 106 00:03:33,930 --> 00:03:35,810 they first contact the domain controller, 107 107 00:03:35,810 --> 00:03:39,140 which acts as the key distribution center or KDC. 108 108 00:03:39,140 --> 00:03:41,650 This KDC has two basic functions, 109 109 00:03:41,650 --> 00:03:43,730 authentication and ticket granting. 110 110 00:03:43,730 --> 00:03:46,300 So, if your client is authenticated properly, 111 111 00:03:46,300 --> 00:03:50,960 the KDC will issue them a TGT or a ticket granting ticket. 112 112 00:03:50,960 --> 00:03:52,890 This ticket granting ticket is then provided 113 113 00:03:52,890 --> 00:03:54,090 to the domain controller, 114 114 00:03:54,090 --> 00:03:57,410 anytime that user wants to access a resource on the network. 115 115 00:03:57,410 --> 00:03:58,243 Something like, 116 116 00:03:58,243 --> 00:04:00,420 a file share or a printer, for example. 117 117 00:04:00,420 --> 00:04:01,710 Now, the domain controller 118 118 00:04:01,710 --> 00:04:03,840 can also provide that user with a service ticket 119 119 00:04:03,840 --> 00:04:05,240 or a session key to use, 120 120 00:04:05,240 --> 00:04:06,720 whichever one is going to be appropriate 121 121 00:04:06,720 --> 00:04:07,970 for their current needs, 122 122 00:04:07,970 --> 00:04:09,878 based on what they're trying to access on the network. 123 123 00:04:09,878 --> 00:04:12,230 These tickets are presented to the resource 124 124 00:04:12,230 --> 00:04:14,330 and then access is going to be granted to the user 125 125 00:04:14,330 --> 00:04:15,163 because the resource 126 126 00:04:15,163 --> 00:04:17,910 always trust the domain controllers provided tickets. 127 127 00:04:17,910 --> 00:04:20,410 Now, if your domain controller is running Kerberos, 128 128 00:04:20,410 --> 00:04:22,350 this is going to happen on port 88. 129 129 00:04:22,350 --> 00:04:24,800 And so you have to keep that open on the domain controller, 130 130 00:04:24,800 --> 00:04:27,270 so it can receive these inbound service logging requests 131 131 00:04:27,270 --> 00:04:28,490 from your clients. 132 132 00:04:28,490 --> 00:04:30,500 Because Kerberos relies on the domain controller 133 133 00:04:30,500 --> 00:04:32,300 to serve as that key distribution center, 134 134 00:04:32,300 --> 00:04:34,290 this can become a single point of failure 135 135 00:04:34,290 --> 00:04:35,400 in your domain though. 136 136 00:04:35,400 --> 00:04:36,840 So be aware of that. 137 137 00:04:36,840 --> 00:04:38,690 If your domain controller goes down, 138 138 00:04:38,690 --> 00:04:40,899 ticket granting services are also going to be shut down. 139 139 00:04:40,899 --> 00:04:42,620 To prevent this though, 140 140 00:04:42,620 --> 00:04:44,350 most people will have a primary 141 141 00:04:44,350 --> 00:04:45,960 and secondary domain controller 142 142 00:04:45,960 --> 00:04:49,140 working in a clustered or active standby configuration. 143 143 00:04:49,140 --> 00:04:51,100 That gives you redundancy to ensure Kerberos 144 144 00:04:51,100 --> 00:04:52,350 is always up and available, 145 145 00:04:52,350 --> 00:04:54,820 and that LDAP continues to run effectively 146 146 00:04:54,820 --> 00:04:56,400 on a Windows environment. 147 147 00:04:56,400 --> 00:04:58,860 Now, our final authentication method we need to discuss, 148 148 00:04:58,860 --> 00:05:01,750 is known as SSO or Single Sign-On. 149 149 00:05:01,750 --> 00:05:04,050 Due to the large number of resources and websites 150 150 00:05:04,050 --> 00:05:05,490 that the average person has to access 151 151 00:05:05,490 --> 00:05:06,770 on a daily basis, 152 152 00:05:06,770 --> 00:05:08,900 many organizations are starting to adopt 153 153 00:05:08,900 --> 00:05:10,730 a Single Sign-On environment. 154 154 00:05:10,730 --> 00:05:12,890 When adopted, the organization establishes 155 155 00:05:12,890 --> 00:05:15,760 a default user profile for each of their users. 156 156 00:05:15,760 --> 00:05:17,650 And then, they link that profile 157 157 00:05:17,650 --> 00:05:19,160 to all of the different resources 158 158 00:05:19,160 --> 00:05:21,380 that the user is going to have access to. 159 159 00:05:21,380 --> 00:05:22,920 Under a Single Sign-On system, 160 160 00:05:22,920 --> 00:05:25,520 the user can have a single long, strong password 161 161 00:05:25,520 --> 00:05:26,460 that they can memorize, 162 162 00:05:26,460 --> 00:05:29,120 or they can use multi-factor authentication. 163 163 00:05:29,120 --> 00:05:30,230 Now, this will replace 164 164 00:05:30,230 --> 00:05:32,910 30 or 40 or 50 different logging credentials 165 165 00:05:32,910 --> 00:05:35,520 that the average person currently is using on a daily basis. 166 166 00:05:35,520 --> 00:05:37,350 And instead, allows them to memorize 167 167 00:05:37,350 --> 00:05:39,100 just one set of credentials. 168 168 00:05:39,100 --> 00:05:41,570 This makes accessing new resources much quicker 169 169 00:05:41,570 --> 00:05:43,780 and much easier because it simplifies user 170 170 00:05:43,780 --> 00:05:45,260 and password management. 171 171 00:05:45,260 --> 00:05:47,980 Now the one major drawback to using Single Sign-On, 172 172 00:05:47,980 --> 00:05:50,400 is that if the user credentials have been compromised, 173 173 00:05:50,400 --> 00:05:51,630 the attacker will now have access 174 174 00:05:51,630 --> 00:05:54,760 to every resource that that user had access to. 175 175 00:05:54,760 --> 00:05:56,900 I like to think about it like a master key. 176 176 00:05:56,900 --> 00:05:58,180 Let's assume you had a single key 177 177 00:05:58,180 --> 00:06:00,830 that opens your office, your car and your house, 178 178 00:06:00,830 --> 00:06:02,050 but you went to the mall, 179 179 00:06:02,050 --> 00:06:03,960 you dropped that key and you lost it. 180 180 00:06:03,960 --> 00:06:05,130 Unfortunately for you, 181 181 00:06:05,130 --> 00:06:07,080 now an evil person might find that key 182 182 00:06:07,080 --> 00:06:08,820 and have access to all those things, 183 183 00:06:08,820 --> 00:06:11,290 your home, your office and your car. 184 184 00:06:11,290 --> 00:06:13,810 This is the biggest drawback to using Single Sign-On. 185 185 00:06:13,810 --> 00:06:16,730 But again, if you're using multi-factor authentication, 186 186 00:06:16,730 --> 00:06:18,630 this is going to help keep it more secure 187 187 00:06:18,630 --> 00:06:20,450 than just using usernames and passwords. 188 188 00:06:20,450 --> 00:06:22,850 Because now, somebody has to have both factors 189 189 00:06:22,850 --> 00:06:24,470 in order to compromise your account. 190 190 00:06:24,470 --> 00:06:26,100 That might be a username, a password, 191 191 00:06:26,100 --> 00:06:27,700 and a key fob for instance. 192 192 00:06:27,700 --> 00:06:30,420 Single Sign-On works by creating these trust relationships 193 193 00:06:30,420 --> 00:06:32,650 between various applications and resources 194 194 00:06:32,650 --> 00:06:34,600 that a user might need to access. 195 195 00:06:34,600 --> 00:06:37,430 Then when the user tries to log onto their one account, 196 196 00:06:37,430 --> 00:06:39,900 it's going to leverage that existing trust relationship. 197 197 00:06:39,900 --> 00:06:41,690 So, the user's going to authenticate 198 198 00:06:41,690 --> 00:06:43,330 with just one service provider, 199 199 00:06:43,330 --> 00:06:45,780 but all the other resources they may need to access, 200 200 00:06:45,780 --> 00:06:47,550 are going to trust that service provider 201 201 00:06:47,550 --> 00:06:49,330 and allow that service provider to authenticate 202 202 00:06:49,330 --> 00:06:52,260 the user's identity on behalf of all the other websites 203 203 00:06:52,260 --> 00:06:53,493 and services out there.