- We live in a world where we as individuals,
want to access lots and lots of computers.
I mean, just think about this.
In your normal browsing life,
you go to all kinds of different websites.
Those are actual computers and you have to access them.
Now, Web might be a little bit of a tricky one
because Web is a public kind of tool
but we could trivially add user names and passwords
to any website that we wanted to.
People don't do it very often, but you can.
Let's take a better example.
Let's talk about a local area network.
So here at Total Seminars,
we've got lots and lots of computers
and people are sharing stuff
and we got servers and printers and all kinds of things
that I, as an individual, want to be able to access.
In a typical Windows work group,
what we do is we have, well, here's an example.
We've got three or four computers
and we got a printer and whatever it might be.
Now each one of these hosts
have their own username and password list
and it works great.
The challenge is is that if I want to access one computer,
I have to have a username and password
on that computer that I can log in with.
If I want to access another computer,
it may have a different username and password.
So, the Windows work groups,
which have been around now for over 30 years,
work very, very well
and we can go ahead and log into these individual computers.
But once in a while,
you want to start logging into a lot of computers at once
and you want to go to this computer and that computer
and after a while, you start going
I can't remember all these passwords.
So, well, you can do one thing.
You could cheat.
So if we take a look at this example one more time,
what I could do is I can put the same username
and password on every single one of these computers
on my local area network.
And that way, I don't have to log in every time,
because once I log into my computer, it will in essence,
carry that authentication information
to each one of these other computers
and it'll always think that I have a user called Timmy
with a password of 1234.
That is not a good idea.
That is a very dangerous security issue
and it is a big problem.
So what can we do instead?
Well, what we can do is single sign on.
The idea behind single sign on
is that I log in once to something
and then everything else I need to get to,
I'm automatically logged into.
Now single sign on is a great idea
but it works differently
depending on how you're talking about it,
so let's start with the most classic
and that is single sign on on a local area network.
To do that, we're going to have to use
Windows Active Directory.
Now Windows Active Directory's been around forever
and it is the gold standard
when it comes to single sign on tools
for local area networks.
It actually works more than local area networks
but we'll keep it simple for the moment.
So, with Active Directory, what I have to first do
is go purchase a copy of Windows server
and I install that into my network
and here, it looks something like this.
So here's my Windows server with all these other computers.
Now, once I establish a domain,
as we call it in the Windows world,
we then have all of these other computers join this domain.
Now, we do this by having a administrator
actually go to each computer
and go through a process of having them join the domain.
So somebody in a high trust position
has to actually go through
and connect each one of these individual computers
to the domain, one at a time.
Now once that's done,
we in essence, have created a trust situation.
Because I, as an administrator
have went to each computer and said, join this domain,
we have what are known as federated systems.
When you hear the word federated, think trust.
So there is an implicit trust that has been developed there
simply because Microsoft
has a proprietary authentication mechanism
based on Kerberos.
But the bottom line is, is that we now have trust.
Now, if you're going to be doing single sign on
in a local area network,
odds are good you're going to be using Active Directory.
Even if you have Apple systems,
even if you have Linux systems,
those can use Windows file and sharing,
or if it's Linux, we can use Samba,
and all of these can be configured to join a local domain
which is actually cool.
I can't tell you how many big systems you have out there
where the research areas where they've got 1500 Linux boxes
and they still have a Windows Active Directory on there,
simply because it's easier from a maintenance standpoint
to be able to do single sign on.
So when you're talking about LANs,
you really are talking about Active Directory
as the single sign on tool.
Now, there is another type of single sign on
and this is completely different
and it's based on something called SAML.
Let me give you a scenario.
Let's say I'm running, well I live in Texas
so we're running an oil pipeline
and on this oil pipeline, we've got lots of pumps
and thermometers and cameras and all kinds of stuff,
hundreds of little devices
and we've developed web apps for these devices
so that I can turn pumps on, turn pumps off,
whatever it might be.
Now, just because these are web apps,
don't go thinking they're public.
They're well protected,
user names, passwords, all kinds of stuff.
It's not easy.
Hopefully it's basically impossible
for the public to get to,
but I, as the operator of all these pumps and everything,
I need to be able to get to these
but not only do I need to get to them,
I need to get to them securely
and I need to get to them anytime I want.
So if I've got a couple of hundred different
web app devices,
I would like to sign on one time and be done with it.
And that's where SAML really comes into play.
SAML is designed, really for web apps
more than anything else
and it allows us, as a single person at a single place,
to log into a whole bunch of different devices.
So let me show you a little bit how SAML works.
So, here's my oil pipeline
and we'll just put some devices here along the pipeline.
All of these devices are accessible through my VPN
to be able to get to them to do whatever I want to do.
Now, the trick here is,
is I don't want to keep logging into this pump
then that pump, then that camera
and that's how SAML works.
SAML starts off with having
what we call an identity provider.
So that's going to be a system somewhere
that's connected out here that everybody can talk to.
And what I will do is I will sign on
to the identity provider,
and then all of these individual web apps
are going to be called service providers.
So I can jump between any one of these
because the identity provider provides me with a token
that allows me to log into
any one of these different devices.
Now showing you SAML at work is a little bit tricky
because the only time you're going to see
SAML really working for a living is when you have people
who have web apps that they want to really, really control
and they're going to go ahead
and write a lot of code and you know what?
They don't tend to like people like me going in
and actually working on this.
But what I've got instead
is I got this wonderful little company called SSOCircle.
SSOCircle sells single sign on tool sets.
And so they have the nice little demo.
So let me show you how this guy works.
So, first of all, thank you SSOCircle
for letting me play on your site.
So what I'm going to do
is I've actually created an account already.
And what I'm going to do is just log in.
And here's my login.
Now there's a lot of extra information here.
Keep in mind, what they're doing
is they're trying to sell packages
for people who actually write SAML language.
But what I want to show you that's actually kind of cool here
is that I've gone ahead and logged in
to the identity provider that's provided by SSOCircle.
Now what they do that's really, really nice
is they provide, let me go.
They provide all of these service providers.
Now, these service providers, they're just samples.
They're examples of how logging in with SSOCircle
allows you to log into other disparate websites.
So I'm going to pick one here.
Here's salesforce.com.
Salesforce.com is a really, really popular,
it's like for use by salespeople and stuff,
customer relationship management tools.
So what we're going to do here is if I got this working right,
is now that I've logged into SSOCircle,
it's just going to pop me over to one little place
within Salesforce, like a little discussion page.
So let's see how this guy works.
Now, what you're seeing here is
because SSOCircle wants to sell us this product,
what it's doing is it's having you do
a little I'm not a robot.
Normally with SAML, we would skip this
but we'll go ahead and just click right on here.
And if I've done it right, tada, I am now auto-magically
on a little discussion page within Salesforce.
Notice that I didn't have to type in a username
or a password.
In fact, if I paid a little money,
I wouldn't even have to do that I'm not a robot thing.
And that's the power of SAML.
In fact, take a look over here,
up in the upper right hand corner,
you see where it says, log out?
With SAML, I can actually,
I'm already automatically logged in.
That's the beautiful part about single sign on
but I can also log out of just this web app
or I can log out of all web apps in one big shot.
Now, when we're talking about single sign on,
especially for the exam,
you need to think about what type of security needs
you're going to need.
For example, if we're talking about a local area network
where you just want to be able to share folders and files,
you're going to have to be using Windows Active Directory.
Yes, there are other options, but Windows AD is dominant.
But the moment you start talking about SCADA systems
or anything that's widespread or all over the place,
be sure to think SAML and you'll get it right on the exam.