We live in a world where we as individuals want to
access lots and lots of computers. I mean, just
think about this. In your normal browsing life, you
go to all kinds of different websites, those are
actual computers, and you have to access them.
Now, web might be a little bit of a tricky one,
because web is a public kind of tool. But we can
trivially add usernames and passwords to any
website that we want it to people don't do it very
often, but you can. Let's take a better example,
let's talk about a local area network. So here in
Total Seminars, we've got lots and lots of
computers, and people are sharing stuff. And we
got servers and printers and all kinds of things
that I as an individual want to be able to access.
In a typical Windows workgroup, what we do is we
have well, here's an example, we've got three or
four computers, we got a printer and whatever it
might be. Now each one of these hosts have their
own username and password list, and it works
great. The challenges is that if I want to access
one computer, I have to have a username and
password on that computer that I can log in with.
If I want to access another computer, it may have
a different username and password. So the Windows
workgroups which have been around now for over 30
years, work very, very well. And we can go ahead
and log into these individual computers. But once
in a while, you want to start logging into a lot
of computers at once. You want to go to this
computer and that computer, and after a while you
start going I can't remember all these passwords.
So well, you can do one thing you can cheat. So if
we take a look at this example, one more time,
what I could do is I can put the same username and
password on every single one of these computers on
my local area network. And that way, I don't have
to log in every time because once I log into my
computer, it will in essence, carry that
authentication information to each one of these
other computers. And it'll always think that I
have a user called Timmy with a password of 1234.
That is not a good idea. That is a very dangerous
security issue, and it is a big problem. So what
can we do instead? Well, what we can do is single
sign on. The idea behind single sign on is that I
log in once to something and then everything else
I need to get to I'm automatically logged into.
Now Single Sign On is a great idea, but it works
differently depending on how you're talking about
it. So let's start with the most classic, and that
is single sign on on a local area network. To do
that, we're going to have to use Windows Active
Directory. Now Windows Active Directory has been
around forever, and it is the gold standard when
it comes to single sign on tools. For local area
networks, it actually works more than local area
networks, but we'll keep it simple for the moment.
So with Active Directory, what I have to first do
is go purchase a copy of Windows Server, and I
install that into my network. And here it looks
something like this. So here's my Windows Server
with all these other computers. Now, once I
establish a domain, as we call it in the Windows
world, we then have all of these other computers
join this domain. Now, we do this by having a
administrator actually go to each computer and go
through a process of having them join the domain.
So somebody in a high trust position has to
actually go through and connect each one of these
individual computers to the domain, one at a time.
Now once that's done, we in essence have created a
trust situation. Because I as an administrator
have went to each computer and said join this
domain, we have what are known as federated
systems. When you hear the word federated think
trust. So there is an implicit trust that has been
developed there simply because Microsoft has a
proprietary authentication mechanism based on
Kerberos. But the bottom line is, is that we now
have trust. Now, if you're going to be doing
single sign on in a local area network, odds are
good, you're going to be using Active Directory.
Even if you have Apple systems, even if you have
Linux systems, those can use Windows file sharing,
or if it's Linux, we can use Samba. And all of
these can be configured to join a local domain,
which is actually cool. I can't tell you how many
big systems you have out there where the research
area has really got 1500 Linux boxes, and they still
have a Windows Active Directory on there simply
because it's easier from a maintenance standpoint
to be able to do single sign on. So when you're
talking about LANs, you really are talking about
Active Directory as the single sign on tool. Now
there is a another type of single sign on and this
is completely different. And it's based on
something called SAML.
[No audio]
Let me give you a scenario. Let's say I'm running
well I live in Texas, so we're running an oil
pipeline. And on this oil pipeline, we've got lots
of pumps and thermometers and cameras and all
kinds of stuff hundreds of little devices. And
we've developed webapps for these devices, so that
I can turn pumps on, turn pumps off, whatever it
might be. Now, just because these are web apps,
don't go thinking they're public. They're well
protected, usernames, passwords, all kinds of
stuff. It's not easy. Hopefully, it's basically
impossible for the public to get to. But I as the
operator of all these pumps, and everything, I
need to be able to get to these. But not only do I
need to get to them, I need to get to them
securely, and I need to get to them anytime I
want. So if I've got a couple of 100 different web
app devices, I would like to sign on one time and
be done with it. And that's where SAML really comes
into play. SAML is designed really for web apps
more than anything else, and it allows us as a
single person at a single place to log into a
whole bunch of different devices. So let me show
you a little bit how SAML works. So here's my oil
pipeline, and we'll just put some devices here
along the pipeline, all of these devices are
accessible through my VPN, to be able to get to
them to do whatever I want to do. Now, the trick
here is, is I don't want to keep logging into this
pump, then that pump, then camera, and that's how
SAML works. SAML starts off with having what we
call an identity provider. So that's going to be a
system somewhere that's connected out here that
everybody can talk to. And what I will do is I
will sign on to the identity provider, and then
all of these individual web apps are going to be
called service providers. So I can jump between
any one of these, because the identity provider
provides me with a token that allows me to log
into any one of these different devices. Now
showing you SAML at work is a little bit tricky,
because the only time you're going to see SAML
really working for a living is when you have
people who have web apps that they want to really,
really control. And they're going to go ahead and
write a lot of code. And you know what they don't
tend to like people like me going in and actually
working on this. But what I've got instead is got
this wonderful little company called SSOCircle.
SSOCircle sells Single Sign On tool sets, and so
they have the nice little demo. So let me show you
how this guy works. So first of all, thank you SSOCircle
for letting me play on your site. So what
I'm going to do is I've actually created an
account already. And what I'm going to do is just
login, and here's my login. Now there's a lot of
extra information here. Keep in mind, what they're
doing is they're trying to sell packages for
people actually write SAML language. But what
I want to show you that's actually kind of cool
here is that I've gone ahead and logged in to the
identity provider that's provided by SSOCircle.
Now what they do that's really, really nice is
they provide, let me go, they provide all of the
service providers. Now these service providers
through just samples, they're examples of how
logging in with SSOCircle allows you to log into other
disparate websites. So I'm going to pick one here,
here's SalesForce.com. SalesForce.com is a really,
really popular site for use by salespeople and
stuff, customer relationship management tools. So
what we're going to do here is, if I got this
working right, is now that I've logged into SSOCircle,
it's just gonna pop me over to one little
place within SalesForce, like a little discussion
page. So let's see how this guy works. Now, what
you're seeing here, is because SSOCircle wants to
sell us these product, what it's doing is it's
having you do a little I'm not a robot. Normally
with SAML, we would skip this, but we'll go ahead
and just click right on here. And if I've done it
right, ta-da, I am now automatically on a little
discussion page within SalesForce. Notice that I
didn't have to type in a username or a password.
In fact, if I paid a little money, I wouldn't even
have to do that I'm not a robot thing. And that's
the power of SAML. In fact, take a look over
here, up in the upper right hand corner, you see
where it says logout. With SAML, I can actually,
I'm already automatically logged in. That's the
beautiful part about single sign on. But I could
also log out of just this web app, or I could log
out of all web apps in one big shot. Now, when
we're talking about single sign on, especially for
the exam, you need to think about what type of
security needs you're going to need. For example,
if we're talking about a local area network, where
you just want to be able to share folders and
files, you're going to have to be using Windows
Active Directory. Yes, there are other options,
but Windows AD is dominant. But the moment you
start talking about SCADA systems or anything
that's widespread or all over the place, be sure
to think SAML, and you'll get it right on the exam.
[No audio]