-: Authentication methods. 2 2
In this lesson, 3 3
we're going to discuss different authentication methods 4 4
that are used in our networks, 5 5
including local authentication, 6 6
LDAP, Kerberos and SSO. 7 7
So what is authentication? 8 8
Authentication is the process of determining 9 9
whether someone or something is in fact, 10 10
who or what it claims itself to be. 11 11
So, if you're walking into my classroom 12 12
on the first Monday of the semester, 13 13
and you say, 14 14
"Hi, Professor Dion, 15 15
my name is John Smith." 16 16
I might ask to see your student ID card 17 17
or your driver's license 18 18
so I could verify you are who you say you are. 19 19
After all, you and I have never met before. 20 20
So I need some way to validate your claim 21 21
and authenticate that you are really John Smith. 22 22
Now, the same thing will happen 23 23
when you go and take your certification exam. 24 24
Before you take your exam, 25 25
they're going to look over 26 26
your official government identification, 27 27
such as your driver's license or a passport, 28 28
and they're going to compare that to what you look like, 29 29
and also compare it to the name that you used 30 30
when you registered for the exam. 31 31
So, if you registered as Jason Dion, 32 32
but your driver's license says, Michael Jordan, 33 33
they're not going to let you take your exam 34 34
because you're going to fail the authentication process. 35 35
The first authentication mechanism you have on a system, 36 36
is known as local authentication. 37 37
When you turn on your personal laptop 38 38
and you entering your username and password, 39 39
you're going to be using local authentication. 40 40
Whenever you set up the laptop for the first time, 41 41
you can create a username and a password on that device 42 42
and the device will save it in an encrypted version 43 43
on your hard drive. 44 44
Now, every time you try to log on, 45 45
it's going to take what you enter, encrypt it 46 46
and compare it against what is stored as your username 47 47
and password. 48 48
If they match, 49 49
you're going to be authenticated 50 50
because you've met 51 51
this single factor authentication requirement 52 52
of a standard laptop by entering in, 53 53
your username and password. 54 54
Now, the next type of authentication we have, 55 55
is known as LDAP, L-D-A-P. 56 56
Now, LDAP is the Lightweight Directory Access Protocol. 57 57
And it's essentially a database 58 58
that's used to centralize information 59 59
about your clients and your objects on your network. 60 60
LDAP is essentially a simplified version of X.500, 61 61
which is a directory service. 62 62
And it contains a hierarchal organization of the users, 63 63
groups, servers and systems inside your network. 64 64
LDAP is going to communicate over port 389 65 65
if you're going to be using the standard plain text version. 66 66
If instead, you're using the more secure version 67 67
known as LDAPS or LDAP Secure, 68 68
it's going to communicate over port 636 69 69
using either SSL or TLS encryption, 70 70
to be able to protect your data 71 71
as it crosses the network. 72 72
LDAP is going to be used for validating 73 73
a username and password combination 74 74
against an LDAP server as your form of authentication. 75 75
Now, it's going to be very similar to local authentication, 76 76
except that it's now going to be occurring 77 77
over the network. 78 78
With LDAP, 79 79
it is going to be considered a cross-platform system. 80 80
And that means it works on Unix, Linux, OSX, 81 81
and even Windows. 82 82
But Microsoft also created their own implementation of this 83 83
known as a AD or Active Directory. 84 84
Now, in a Windows domain environment, 85 85
Active Directory is going to be used 86 86
to organize image, everything on the network, 87 87
including those clients, servers, devices, users and groups 88 88
that we mentioned before. 89 89
Active Directory can be used 90 90
as part of your overall security policies 91 91
and access control through the use of group policies 92 92
as well. 93 93
Now, this brings us to Kerberos, 94 94
which has focused on authentication and authorization 95 95
within a Windows domain environment. 96 96
And it integrates with Active Directory. 97 97
Kerberos is designed to provide secure authentication 98 98
to services over an insecure network. 99 99
Kerberos is going to use tickets to authenticate a user 100 100
and completely avoid sending passwords across the network 101 101
because it relies instead on the Kerberos ticketing system 102 102
inside of a Windows domain, 103 103
Kerberos is authentication protocol 104 104
that provides two way or mutual authentication. 105 105
When a user logs on to the domain, 106 106
they first contact the domain controller, 107 107
which acts as the key distribution center or KDC. 108 108
This KDC has two basic functions, 109 109
authentication and ticket granting. 110 110
So, if your client is authenticated properly, 111 111
the KDC will issue them a TGT or a ticket granting ticket. 112 112
This ticket granting ticket is then provided 113 113
to the domain controller, 114 114
anytime that user wants to access a resource on the network. 115 115
Something like, 116 116
a file share or a printer, for example. 117 117
Now, the domain controller 118 118
can also provide that user with a service ticket 119 119
or a session key to use, 120 120
whichever one is going to be appropriate 121 121
for their current needs, 122 122
based on what they're trying to access on the network. 123 123
These tickets are presented to the resource 124 124
and then access is going to be granted to the user 125 125
because the resource 126 126
always trust the domain controllers provided tickets. 127 127
Now, if your domain controller is running Kerberos, 128 128
this is going to happen on port 88. 129 129
And so you have to keep that open on the domain controller, 130 130
so it can receive these inbound service logging requests 131 131
from your clients. 132 132
Because Kerberos relies on the domain controller 133 133
to serve as that key distribution center, 134 134
this can become a single point of failure 135 135
in your domain though. 136 136
So be aware of that. 137 137
If your domain controller goes down, 138 138
ticket granting services are also going to be shut down. 139 139
To prevent this though, 140 140
most people will have a primary 141 141
and secondary domain controller 142 142
working in a clustered or active standby configuration. 143 143
That gives you redundancy to ensure Kerberos 144 144
is always up and available, 145 145
and that LDAP continues to run effectively 146 146
on a Windows environment. 147 147
Now, our final authentication method we need to discuss, 148 148
is known as SSO or Single Sign-On. 149 149
Due to the large number of resources and websites 150 150
that the average person has to access 151 151
on a daily basis, 152 152
many organizations are starting to adopt 153 153
a Single Sign-On environment. 154 154
When adopted, the organization establishes 155 155
a default user profile for each of their users. 156 156
And then, they link that profile 157 157
to all of the different resources 158 158
that the user is going to have access to. 159 159
Under a Single Sign-On system, 160 160
the user can have a single long, strong password 161 161
that they can memorize, 162 162
or they can use multi-factor authentication. 163 163
Now, this will replace 164 164
30 or 40 or 50 different logging credentials 165 165
that the average person currently is using on a daily basis. 166 166
And instead, allows them to memorize 167 167
just one set of credentials. 168 168
This makes accessing new resources much quicker 169 169
and much easier because it simplifies user 170 170
and password management. 171 171
Now the one major drawback to using Single Sign-On, 172 172
is that if the user credentials have been compromised, 173 173
the attacker will now have access 174 174
to every resource that that user had access to. 175 175
I like to think about it like a master key. 176 176
Let's assume you had a single key 177 177
that opens your office, your car and your house, 178 178
but you went to the mall, 179 179
you dropped that key and you lost it. 180 180
Unfortunately for you, 181 181
now an evil person might find that key 182 182
and have access to all those things, 183 183
your home, your office and your car. 184 184
This is the biggest drawback to using Single Sign-On. 185 185
But again, if you're using multi-factor authentication, 186 186
this is going to help keep it more secure 187 187
than just using usernames and passwords. 188 188
Because now, somebody has to have both factors 189 189
in order to compromise your account. 190 190
That might be a username, a password, 191 191
and a key fob for instance. 192 192
Single Sign-On works by creating these trust relationships 193 193
between various applications and resources 194 194
that a user might need to access. 195 195
Then when the user tries to log onto their one account, 196 196
it's going to leverage that existing trust relationship. 197 197
So, the user's going to authenticate 198 198
with just one service provider, 199 199
but all the other resources they may need to access, 200 200
are going to trust that service provider 201 201
and allow that service provider to authenticate 202 202
the user's identity on behalf of all the other websites 203 203
and services out there.