1
00:00:00,000 --> 00:00:00,870
In this lesson,

2
00:00:00,870 --> 00:00:01,920
we're going to cover the concept

3
00:00:01,920 --> 00:00:03,840
of Federation.

4
00:00:03,840 --> 00:00:06,090
In the world of identity and access management,

5
00:00:06,090 --> 00:00:08,370
Federation refers to a process that allows

6
00:00:08,370 --> 00:00:10,620
for the linking of electronic identities

7
00:00:10,620 --> 00:00:12,420
and attributes to store that information

8
00:00:12,420 --> 00:00:16,200
across multiple distinct identity management systems.

9
00:00:16,200 --> 00:00:18,735
Federation allows users to use the same username,

10
00:00:18,735 --> 00:00:21,330
password or other credentials

11
00:00:21,330 --> 00:00:23,520
to log into multiple systems managed

12
00:00:23,520 --> 00:00:25,350
by different organizations.

13
00:00:25,350 --> 00:00:27,390
But this is more like a single sign-on

14
00:00:27,390 --> 00:00:29,723
than a password reuse type of situation.

15
00:00:29,723 --> 00:00:32,970
Federations work by using the trusted relationships

16
00:00:32,970 --> 00:00:35,040
that exist between different systems.

17
00:00:35,040 --> 00:00:36,930
When a user logs into a system,

18
00:00:36,930 --> 00:00:38,850
that system can then use the Federation

19
00:00:38,850 --> 00:00:41,104
to verify the user's identity with another system.

20
00:00:41,104 --> 00:00:43,590
Federation is a concept that extends

21
00:00:43,590 --> 00:00:45,030
beyond the traditional boundaries

22
00:00:45,030 --> 00:00:47,910
of an organization's network and instead recognizes

23
00:00:47,910 --> 00:00:50,640
that there is a need for your network to be accessible

24
00:00:50,640 --> 00:00:52,440
to a broader group of users,

25
00:00:52,440 --> 00:00:54,300
including not just your employees

26
00:00:54,300 --> 00:00:58,050
but your partners, suppliers, and customers as well.

27
00:00:58,050 --> 00:01:00,870
While managing employee accounts can be straightforward,

28
00:01:00,870 --> 00:01:03,630
managing accounts for each partner, supplier,

29
00:01:03,630 --> 00:01:06,284
or customer internally can be much more challenging.

30
00:01:06,284 --> 00:01:08,460
This is where a Federation comes

31
00:01:08,460 --> 00:01:11,220
into play by allowing the organization's network

32
00:01:11,220 --> 00:01:12,690
to trust accounts created

33
00:01:12,690 --> 00:01:14,355
and managed by a different network.

34
00:01:14,355 --> 00:01:17,760
This means that a supplier or customer can authenticate

35
00:01:17,760 --> 00:01:19,710
using their own network credentials

36
00:01:19,710 --> 00:01:21,720
and then your company's network can trust

37
00:01:21,720 --> 00:01:22,720
this authentication

38
00:01:23,696 --> 00:01:25,380
because of a pre-established trust relationship

39
00:01:25,380 --> 00:01:26,935
between the two systems.

40
00:01:26,935 --> 00:01:28,410
Now, let's take a quick look

41
00:01:28,410 --> 00:01:31,440
at a simplified step-by-step approach that is occurring.

42
00:01:31,440 --> 00:01:32,490
When someone tries to log

43
00:01:32,490 --> 00:01:34,560
into a system using a Federation.

44
00:01:34,560 --> 00:01:36,360
To log in using a Federation,

45
00:01:36,360 --> 00:01:37,577
you'll follow a six step process

46
00:01:37,577 --> 00:01:40,410
including login initiation,

47
00:01:40,410 --> 00:01:42,177
redirection to an identity provider,

48
00:01:42,177 --> 00:01:44,400
authenticating the user,

49
00:01:44,400 --> 00:01:45,806
generation of an assertion,

50
00:01:45,806 --> 00:01:47,667
returning to a service provider,

51
00:01:47,667 --> 00:01:49,680
verification and access.

52
00:01:49,680 --> 00:01:51,856
And finally, the login is complete.

53
00:01:51,856 --> 00:01:55,470
First, the user will initiate a login.

54
00:01:55,470 --> 00:01:58,170
This occurs when the user accesses a service

55
00:01:58,170 --> 00:02:00,660
or application and chooses to log in.

56
00:02:00,660 --> 00:02:01,776
The system will recognize

57
00:02:01,776 --> 00:02:04,410
that it's a federated login based on the domain

58
00:02:04,410 --> 00:02:08,190
and the user's credentials or other predefined criteria.

59
00:02:08,190 --> 00:02:10,530
Second, the user will be redirected

60
00:02:10,530 --> 00:02:12,300
to the identity provider.

61
00:02:12,300 --> 00:02:14,040
The service or application,

62
00:02:14,040 --> 00:02:15,930
often termed the service provider,

63
00:02:15,930 --> 00:02:17,340
will redirect the user

64
00:02:17,340 --> 00:02:18,600
to the home network

65
00:02:18,600 --> 00:02:22,266
or identity provider known as the IdP for authentication.

66
00:02:22,266 --> 00:02:25,170
And this is where the user's credentials are being stored

67
00:02:25,170 --> 00:02:28,890
and they will be used to validate the specific user.

68
00:02:28,890 --> 00:02:31,320
Third, we have to authenticate the user.

69
00:02:31,320 --> 00:02:33,210
Once the user enters their credentials

70
00:02:33,210 --> 00:02:34,830
such as their username or password

71
00:02:34,830 --> 00:02:35,887
with the identity provider,

72
00:02:35,887 --> 00:02:38,970
the identity provider will validate the user's identity

73
00:02:38,970 --> 00:02:40,684
which serves as the authentication mechanism

74
00:02:40,684 --> 00:02:42,862
during their login activity.

75
00:02:42,862 --> 00:02:45,595
Fourth, we have the generation of an assertion.

76
00:02:45,595 --> 00:02:46,806
Once authenticated,

77
00:02:46,806 --> 00:02:49,252
the identity provider will create an assertion,

78
00:02:49,252 --> 00:02:51,840
usually a token that includes information

79
00:02:51,840 --> 00:02:53,130
about the user's identity,

80
00:02:53,130 --> 00:02:54,420
their authentication status,

81
00:02:54,420 --> 00:02:56,580
and possibly other attributes.

82
00:02:56,580 --> 00:02:59,730
This assertion is created in a standardized format

83
00:02:59,730 --> 00:03:01,620
depending on which protocol is being used

84
00:03:01,620 --> 00:03:04,650
such as SAML or OpenID Connect.

85
00:03:04,650 --> 00:03:07,470
Fifth, the user is returned to the service provider.

86
00:03:07,470 --> 00:03:10,200
This redirection will cost the user to be returned

87
00:03:10,200 --> 00:03:11,310
to the initial service

88
00:03:11,310 --> 00:03:13,533
or application that they wanted to access,

89
00:03:13,533 --> 00:03:15,960
which we refer to as the service provider,

90
00:03:15,960 --> 00:03:17,100
with the assertion

91
00:03:17,100 --> 00:03:20,130
that they just received from the identity provider.

92
00:03:20,130 --> 00:03:23,070
Sixth, verification and access occurs.

93
00:03:23,070 --> 00:03:23,970
During this step,

94
00:03:23,970 --> 00:03:26,014
the service provider will verify the assertion to ensure

95
00:03:26,014 --> 00:03:28,290
that it's from a trusted identity provider

96
00:03:28,290 --> 00:03:30,390
and then the service provider will grant the user

97
00:03:30,390 --> 00:03:33,035
access based off the information and the assertion.

98
00:03:33,035 --> 00:03:36,540
And now the Federation process is complete.

99
00:03:36,540 --> 00:03:37,563
The user now has access

100
00:03:37,563 --> 00:03:39,315
to the service or application,

101
00:03:39,315 --> 00:03:40,800
and potentially others

102
00:03:40,800 --> 00:03:44,010
within Federation without needing to log in again.

103
00:03:44,010 --> 00:03:45,603
From an endpoint user perspective,

104
00:03:45,603 --> 00:03:47,923
Federation is a great thing because they only

105
00:03:47,923 --> 00:03:50,010
need to have a single account to be able

106
00:03:50,010 --> 00:03:52,685
to access a wide variety of services and applications.

107
00:03:52,685 --> 00:03:54,540
To configure Federation

108
00:03:54,540 --> 00:03:56,520
across multiple organizational networks,

109
00:03:56,520 --> 00:03:57,353
we usually rely

110
00:03:57,353 --> 00:04:01,350
on a technology like SAML, OAuth, and OpenID Connect

111
00:04:01,350 --> 00:04:04,350
as our authentication and authorization protocols.

112
00:04:04,350 --> 00:04:06,463
Federations offer us benefits including

113
00:04:06,463 --> 00:04:08,580
simplified user experience,

114
00:04:08,580 --> 00:04:10,140
reduce administrative overhead,

115
00:04:10,140 --> 00:04:11,146
and increased security.

116
00:04:11,146 --> 00:04:12,840
Since Federations require

117
00:04:12,840 --> 00:04:15,660
that a user only has to remember one set of credentials,

118
00:04:15,660 --> 00:04:17,880
this makes the entire login process much simpler

119
00:04:17,880 --> 00:04:19,320
and much more efficient.

120
00:04:19,320 --> 00:04:22,290
Also, since organizations don't need to manage accounts

121
00:04:22,290 --> 00:04:23,850
for every individual user

122
00:04:23,850 --> 00:04:26,580
and instead they can just trust the authentication provided

123
00:04:26,580 --> 00:04:27,924
by the user's home network.

124
00:04:27,924 --> 00:04:30,872
This helps to reduce the administrative overhead required

125
00:04:30,872 --> 00:04:33,000
from our organizations.

126
00:04:33,000 --> 00:04:35,495
And since users are less likely to reuse passwords

127
00:04:35,495 --> 00:04:38,670
or resort to insecure password storage methods,

128
00:04:38,670 --> 00:04:40,740
the security of the network is improved

129
00:04:40,740 --> 00:04:42,090
and the risk of password related

130
00:04:42,090 --> 00:04:44,310
security breaches is reduced.

131
00:04:44,310 --> 00:04:47,910
So remember, using a Federation allows users

132
00:04:47,910 --> 00:04:49,765
to utilize the same username, password,

133
00:04:49,765 --> 00:04:51,266
or other credentials to log

134
00:04:51,266 --> 00:04:54,646
into multiple systems managed by different organizations.

135
00:04:54,646 --> 00:04:57,463
Federations work by using a trusted relationship

136
00:04:57,463 --> 00:04:59,100
between different systems

137
00:04:59,100 --> 00:05:00,240
offering several benefits,

138
00:05:00,240 --> 00:05:02,370
which include improved user experience,

139
00:05:02,370 --> 00:05:04,860
increased productivity, reduced IT costs,

140
00:05:04,860 --> 00:05:06,273
and enhance security.