1
00:00:00,410 --> 00:00:03,630
In this lesson, we'll cover single sign-on.

2
00:00:03,630 --> 00:00:06,060
Single sign-on, also known as SSO,

3
00:00:06,060 --> 00:00:07,560
is an authentication process

4
00:00:07,560 --> 00:00:10,410
that allows a user to access multiple applications

5
00:00:10,410 --> 00:00:13,110
or websites by logging in only once

6
00:00:13,110 --> 00:00:14,400
with a single set of credentials,

7
00:00:14,400 --> 00:00:16,680
such as by using a username and password.

8
00:00:16,680 --> 00:00:19,350
And this approach simplifies the user experience

9
00:00:19,350 --> 00:00:22,410
and increases productivity by reducing the need for users

10
00:00:22,410 --> 00:00:24,150
to remember multiple passwords

11
00:00:24,150 --> 00:00:26,640
across various websites and applications.

12
00:00:26,640 --> 00:00:29,520
So, how does this SSO work?

13
00:00:29,520 --> 00:00:33,270
Well, single sign-on works based on a trusted relationship

14
00:00:33,270 --> 00:00:35,700
that is established between an application

15
00:00:35,700 --> 00:00:39,180
and identity provider, also known as an IdP.

16
00:00:39,180 --> 00:00:40,920
The identity provider is a system

17
00:00:40,920 --> 00:00:44,490
that creates, maintains, and manages identity information

18
00:00:44,490 --> 00:00:47,490
for principals while providing authentication services

19
00:00:47,490 --> 00:00:49,020
to relying applications

20
00:00:49,020 --> 00:00:51,930
within a federation or distributed network.

21
00:00:51,930 --> 00:00:53,070
Now, let's take a quick look

22
00:00:53,070 --> 00:00:57,150
at the simplified step-by-step process used by SSO.

23
00:00:57,150 --> 00:01:00,720
Most commonly, SSO is used inside of an enterprise network

24
00:01:00,720 --> 00:01:02,730
and relies on the trusted relationship

25
00:01:02,730 --> 00:01:04,800
between your active directory controller

26
00:01:04,800 --> 00:01:07,170
and your various applications and websites

27
00:01:07,170 --> 00:01:09,420
that are part of the organization's network.

28
00:01:09,420 --> 00:01:12,900
First, the user logs into the primary identity provider,

29
00:01:12,900 --> 00:01:14,670
such as your Windows domain controller,

30
00:01:14,670 --> 00:01:17,130
who most commonly accepts their username and password

31
00:01:17,130 --> 00:01:18,750
as their method for authentication

32
00:01:18,750 --> 00:01:22,290
or the use of a username and password with a one-time code,

33
00:01:22,290 --> 00:01:23,760
making them more similar

34
00:01:23,760 --> 00:01:26,220
to multi-factor authentication systems.

35
00:01:26,220 --> 00:01:29,730
Then the user attempts to access a secondary application

36
00:01:29,730 --> 00:01:32,490
or website that is configured to use SSO

37
00:01:32,490 --> 00:01:34,020
and has a trusted relationship

38
00:01:34,020 --> 00:01:36,360
with the primary identity provider.

39
00:01:36,360 --> 00:01:38,520
For example, if you are trying to access

40
00:01:38,520 --> 00:01:40,980
your organization's internal SharePoint server,

41
00:01:40,980 --> 00:01:42,810
it might not ask you to submit

42
00:01:42,810 --> 00:01:44,700
for your username and password a second time

43
00:01:44,700 --> 00:01:46,560
because you have already been authenticated

44
00:01:46,560 --> 00:01:48,270
by the primary identity provider,

45
00:01:48,270 --> 00:01:49,830
your Windows domain controller,

46
00:01:49,830 --> 00:01:52,380
and therefore the secondary application or website,

47
00:01:52,380 --> 00:01:54,540
in this case, the internal SharePoint server,

48
00:01:54,540 --> 00:01:56,970
will send a request to the primary identity provider

49
00:01:56,970 --> 00:01:58,830
to verify the user's identity,

50
00:01:58,830 --> 00:02:01,950
and the primary identity provider will then respond back

51
00:02:01,950 --> 00:02:04,860
with their assertion that the user is authenticated.

52
00:02:04,860 --> 00:02:07,920
At this point, the secondary application or website

53
00:02:07,920 --> 00:02:09,479
grants access to the user.

54
00:02:09,479 --> 00:02:11,070
And in this case, you are now logged

55
00:02:11,070 --> 00:02:12,569
into the SharePoint server

56
00:02:12,569 --> 00:02:14,250
and can continue to perform your required work role

57
00:02:14,250 --> 00:02:15,390
for the day.

58
00:02:15,390 --> 00:02:17,940
There are several benefits to using single sign-on

59
00:02:17,940 --> 00:02:19,950
including an improved user experience,

60
00:02:19,950 --> 00:02:21,240
increase productivity,

61
00:02:21,240 --> 00:02:23,370
reduce information technology support costs,

62
00:02:23,370 --> 00:02:25,020
and enhance security.

63
00:02:25,020 --> 00:02:28,230
First, we can create an improved user experience.

64
00:02:28,230 --> 00:02:30,000
Since users will only need to remember

65
00:02:30,000 --> 00:02:31,320
one set of credentials,

66
00:02:31,320 --> 00:02:32,910
this can reduce their frustrations

67
00:02:32,910 --> 00:02:34,770
of forgetting their username or passwords

68
00:02:34,770 --> 00:02:38,160
for websites and applications that they don't commonly use.

69
00:02:38,160 --> 00:02:40,740
Second, we have increased productivity.

70
00:02:40,740 --> 00:02:42,180
Since users can save time

71
00:02:42,180 --> 00:02:45,420
by not having to sign in each application separately,

72
00:02:45,420 --> 00:02:47,370
they can get more work done and less time,

73
00:02:47,370 --> 00:02:50,220
which increases their productivity on their job.

74
00:02:50,220 --> 00:02:51,480
Third, we have the reduced

75
00:02:51,480 --> 00:02:53,400
information technology support cost.

76
00:02:53,400 --> 00:02:56,400
One of the largest and more time consuming requests

77
00:02:56,400 --> 00:02:57,990
that most server desks receive

78
00:02:57,990 --> 00:03:00,930
is to reset a user's password when they forgot.

79
00:03:00,930 --> 00:03:04,110
Since SSO has less passwords that you need to memorize,

80
00:03:04,110 --> 00:03:06,870
this creates fewer password reset requests,

81
00:03:06,870 --> 00:03:10,410
so that the help desk workload can be significantly reduced.

82
00:03:10,410 --> 00:03:12,960
Fourth, we have enhanced security.

83
00:03:12,960 --> 00:03:15,240
It may seem counterintuitive at first,

84
00:03:15,240 --> 00:03:18,060
but single sign-on can actually improve security

85
00:03:18,060 --> 00:03:20,760
by encouraging the use of stronger passwords

86
00:03:20,760 --> 00:03:23,850
since your users only have to remember a single password,

87
00:03:23,850 --> 00:03:27,030
and this also helps to reduce the risk of password reuse.

88
00:03:27,030 --> 00:03:31,050
Now, many of us already use single sign-on on a daily basis

89
00:03:31,050 --> 00:03:32,400
without realizing it.

90
00:03:32,400 --> 00:03:35,640
For example, if you tried to log into diontraining.com

91
00:03:35,640 --> 00:03:37,800
and you use your Google account to do that,

92
00:03:37,800 --> 00:03:40,800
you're actually using single sign-on in our federated system

93
00:03:40,800 --> 00:03:42,510
where Google is authenticating you

94
00:03:42,510 --> 00:03:44,880
and then you log into our website as well

95
00:03:44,880 --> 00:03:46,740
since we have a trusted relationship

96
00:03:46,740 --> 00:03:48,720
set up within their system.

97
00:03:48,720 --> 00:03:50,700
Another example that is used in the corporate world

98
00:03:50,700 --> 00:03:52,680
where a company might set up a SSO

99
00:03:52,680 --> 00:03:54,720
for their internal applications.

100
00:03:54,720 --> 00:03:57,660
An employee logs in once into their company credentials

101
00:03:57,660 --> 00:03:59,940
and then has access to their email,

102
00:03:59,940 --> 00:04:02,280
project measurement tool, and HR system

103
00:04:02,280 --> 00:04:05,430
without needing to log into each one separately.

104
00:04:05,430 --> 00:04:07,650
To enable and support single sign-on,

105
00:04:07,650 --> 00:04:09,990
there are three commonly used protocols,

106
00:04:09,990 --> 00:04:11,643
LDAP, OAuth, and SAML.

107
00:04:13,230 --> 00:04:15,210
First, we have LDAP.

108
00:04:15,210 --> 00:04:18,480
The Lightweight Directory Access Protocol, or LDAP,

109
00:04:18,480 --> 00:04:20,310
is a protocol used to access

110
00:04:20,310 --> 00:04:23,790
and maintain distributed directory information services

111
00:04:23,790 --> 00:04:26,250
over a internet protocol network.

112
00:04:26,250 --> 00:04:29,430
LDAP can be used to look up encryption certificates,

113
00:04:29,430 --> 00:04:31,860
connected printers and other services on the network,

114
00:04:31,860 --> 00:04:34,500
and provide a single sign-on capability

115
00:04:34,500 --> 00:04:36,390
where one password for a user is shared

116
00:04:36,390 --> 00:04:38,910
between many different services on the network.

117
00:04:38,910 --> 00:04:42,570
Lightweight Directory Access Protocol, as the name implies,

118
00:04:42,570 --> 00:04:44,940
is often used as a directory service

119
00:04:44,940 --> 00:04:47,220
to essentially share the information infrastructure

120
00:04:47,220 --> 00:04:49,680
for locating, managing, administering,

121
00:04:49,680 --> 00:04:53,190
and organizing common items and network resources.

122
00:04:53,190 --> 00:04:56,460
These resources can include volumes, folders,

123
00:04:56,460 --> 00:05:00,210
files, printers, users, groups, devices,

124
00:05:00,210 --> 00:05:03,240
and other objects in your enterprise network.

125
00:05:03,240 --> 00:05:05,940
For example, an organization may use LDAP

126
00:05:05,940 --> 00:05:07,920
to form a directory of its employees

127
00:05:07,920 --> 00:05:09,840
that allows information about those users

128
00:05:09,840 --> 00:05:11,490
to be stored in one place

129
00:05:11,490 --> 00:05:13,560
and accessed by different applications,

130
00:05:13,560 --> 00:05:15,960
including your contact list, address books,

131
00:05:15,960 --> 00:05:17,910
and email clients.

132
00:05:17,910 --> 00:05:20,100
The Lightweight Directory Access Protocol

133
00:05:20,100 --> 00:05:22,140
is also used in authentication

134
00:05:22,140 --> 00:05:25,440
and serves as a central repository for user information.

135
00:05:25,440 --> 00:05:27,840
When a user attempts to log into a system,

136
00:05:27,840 --> 00:05:30,300
the system can curate the LDAP directory

137
00:05:30,300 --> 00:05:33,000
to check the entered username and password.

138
00:05:33,000 --> 00:05:35,880
If the LDAP directory confirms the credentials,

139
00:05:35,880 --> 00:05:38,730
the user is authenticated and granted access.

140
00:05:38,730 --> 00:05:41,400
LDAP can also store other user information

141
00:05:41,400 --> 00:05:43,080
that can be used for authorization,

142
00:05:43,080 --> 00:05:45,330
such as what groups the user is a member of

143
00:05:45,330 --> 00:05:47,700
or what roles that they have.

144
00:05:47,700 --> 00:05:49,830
This allows systems to make decisions

145
00:05:49,830 --> 00:05:51,840
about what resources or services

146
00:05:51,840 --> 00:05:54,090
a user should have access to.

147
00:05:54,090 --> 00:05:56,580
While LDAP can transmit data in plain text,

148
00:05:56,580 --> 00:05:59,400
it also supports a secure version known as LDAPS,

149
00:05:59,400 --> 00:06:03,510
which can support LDAP over SSL or StartTLS,

150
00:06:03,510 --> 00:06:05,160
both of which encrypt the data

151
00:06:05,160 --> 00:06:06,960
to provide secure transmission.

152
00:06:06,960 --> 00:06:08,460
This is particularly important

153
00:06:08,460 --> 00:06:11,220
when transmitting sensitive data, such as user credentials,

154
00:06:11,220 --> 00:06:14,070
over a semi-trusted or untrusted network.

155
00:06:14,070 --> 00:06:16,230
Now, second, we have OAuth.

156
00:06:16,230 --> 00:06:19,500
Open Authorization, or Oauth, is an open standard

157
00:06:19,500 --> 00:06:22,230
for token-based authentication and authorization

158
00:06:22,230 --> 00:06:24,930
that allows an individual's account information

159
00:06:24,930 --> 00:06:26,760
to be used by third party services

160
00:06:26,760 --> 00:06:29,070
without exposing the user's password.

161
00:06:29,070 --> 00:06:31,260
For example, when you log into a website,

162
00:06:31,260 --> 00:06:32,820
like diontraning.com,

163
00:06:32,820 --> 00:06:35,490
and it offers one or more options to log in

164
00:06:35,490 --> 00:06:38,130
using another website or services credentials,

165
00:06:38,130 --> 00:06:40,800
that is actually OAuth at work behind the scenes

166
00:06:40,800 --> 00:06:43,290
to allow that login process to occur.

167
00:06:43,290 --> 00:06:45,270
The OAuth protocol is commonly used

168
00:06:45,270 --> 00:06:48,720
for authentication and authorization in RESTful APIs

169
00:06:48,720 --> 00:06:51,030
since it is designed to allow secure sharing

170
00:06:51,030 --> 00:06:53,790
of user profile information between sites.

171
00:06:53,790 --> 00:06:56,430
Users create an account with identity provider

172
00:06:56,430 --> 00:06:58,140
and then they can use this account

173
00:06:58,140 --> 00:07:00,300
to log into another OAuth website

174
00:07:00,300 --> 00:07:03,780
without sharing their password to that specific website.

175
00:07:03,780 --> 00:07:06,600
When using the setup, a user can grant a client,

176
00:07:06,600 --> 00:07:09,540
like an application or website authorization,

177
00:07:09,540 --> 00:07:11,340
to access parts of their accounts,

178
00:07:11,340 --> 00:07:13,950
like their name, email address, profile picture,

179
00:07:13,950 --> 00:07:15,300
and other details.

180
00:07:15,300 --> 00:07:19,320
The user account is hosted by one or more resource servers,

181
00:07:19,320 --> 00:07:21,450
also known as API servers.

182
00:07:21,450 --> 00:07:23,550
Authorization requests are processed

183
00:07:23,550 --> 00:07:25,110
by an authorization server,

184
00:07:25,110 --> 00:07:28,350
which can manage multiple resource servers.

185
00:07:28,350 --> 00:07:31,470
The client application or service must be registered

186
00:07:31,470 --> 00:07:35,250
with an authorization server and provide a redirect URL,

187
00:07:35,250 --> 00:07:37,830
and receives an ID and a secret.

188
00:07:37,830 --> 00:07:40,050
When the client requests authorization,

189
00:07:40,050 --> 00:07:41,850
the user approves the request,

190
00:07:41,850 --> 00:07:43,440
and depending on the flow type,

191
00:07:43,440 --> 00:07:46,050
and then the client receives an access validation token

192
00:07:46,050 --> 00:07:47,880
by the authorization server.

193
00:07:47,880 --> 00:07:50,520
This token is presented to the resource server

194
00:07:50,520 --> 00:07:53,490
to access the requested resource.

195
00:07:53,490 --> 00:07:56,130
To transfer this claimed data over the network,

196
00:07:56,130 --> 00:07:59,280
the OAuth protocol uses the JavaScript Object Notation,

197
00:07:59,280 --> 00:08:03,750
or JSON-formatted Web Tokens, known as JWT,

198
00:08:03,750 --> 00:08:07,440
which can be easily passed in a Base64 encoded string

199
00:08:07,440 --> 00:08:10,980
in URLs and HTTP headers, and can be digitally signed

200
00:08:10,980 --> 00:08:13,260
for authentication and integrity.

201
00:08:13,260 --> 00:08:15,450
Third, we have SAML.

202
00:08:15,450 --> 00:08:17,880
The Security Assertion Markup Language, or SAML,

203
00:08:17,880 --> 00:08:20,550
is a standard for logging users into applications

204
00:08:20,550 --> 00:08:23,430
based on their sessions in other contexts.

205
00:08:23,430 --> 00:08:25,260
Now, this single sign-in log on standard

206
00:08:25,260 --> 00:08:27,330
has significant advantages over logging in

207
00:08:27,330 --> 00:08:29,430
using a username and password though.

208
00:08:29,430 --> 00:08:31,560
When a user logs in using SAML,

209
00:08:31,560 --> 00:08:33,299
rather than asking for a password,

210
00:08:33,299 --> 00:08:36,390
the application redirects the user to identity provider

211
00:08:36,390 --> 00:08:37,919
with a SAML request.

212
00:08:37,919 --> 00:08:40,890
The identity provider then verifies the user's identity

213
00:08:40,890 --> 00:08:43,230
and sends a response back to the application,

214
00:08:43,230 --> 00:08:45,060
which in turns logs the user

215
00:08:45,060 --> 00:08:47,100
into the application or website.

216
00:08:47,100 --> 00:08:48,750
Now, SAML can be a little complex,

217
00:08:48,750 --> 00:08:50,640
but what you really need to remember

218
00:08:50,640 --> 00:08:52,230
is that it enables services

219
00:08:52,230 --> 00:08:55,110
to be decoupled from the identity providers

220
00:08:55,110 --> 00:08:56,970
and eliminates the need for services

221
00:08:56,970 --> 00:08:59,220
to authenticate users directly.

222
00:08:59,220 --> 00:09:00,690
Instead of the service provider

223
00:09:00,690 --> 00:09:02,310
conducting the authentication,

224
00:09:02,310 --> 00:09:04,560
the service provider just receives confirmation

225
00:09:04,560 --> 00:09:05,790
from the identity provider

226
00:09:05,790 --> 00:09:08,973
that the user has been authenticated into the given service.

227
00:09:09,810 --> 00:09:13,410
So remember, single sign-on, also known as SSO,

228
00:09:13,410 --> 00:09:16,530
allows a user to access multiple applications or websites

229
00:09:16,530 --> 00:09:19,530
by logging in only once with a single set of credentials.

230
00:09:19,530 --> 00:09:21,420
LDAP is a protocol used to access

231
00:09:21,420 --> 00:09:24,000
and maintain distributed directory information services

232
00:09:24,000 --> 00:09:25,740
over an IP network.

233
00:09:25,740 --> 00:09:27,360
OAuth is an open standard

234
00:09:27,360 --> 00:09:30,120
for token-based authentication and authorization.

235
00:09:30,120 --> 00:09:33,390
SAML is a standard for logging users into application

236
00:09:33,390 --> 00:09:35,880
based on their sessions in another context.

237
00:09:35,880 --> 00:09:37,530
Single sign-on is a great technology

238
00:09:37,530 --> 00:09:38,910
that increases usability

239
00:09:38,910 --> 00:09:41,730
and increases the security of your authentication systems

240
00:09:41,730 --> 00:09:44,430
by relying on a network of trusted identity partners

241
00:09:44,430 --> 00:09:46,140
to help ensure that each use

242
00:09:46,140 --> 00:09:48,153
is properly validated and authenticated.