- We live in a world where we as individuals
want to access lots and lots of computers.
I mean, just think about this,
in your normal browsing life,
you go to all kinds of different websites.
Those are actual computers and you have to access them.
Now web might be a little bit of a tricky one
because web is a public kind of tool
but we can trivially add usernames and passwords
to any website that wanted to.
People don't do it very often but you can.
Let's take a better example.
Let's talk about a local area network.
So here at Total Seminars, we've got lots and lots
of computers and people are sharing stuff
and we got servers and printers and all kinds of things
that I as an individual want to be able to access.
In a typical Windows workgroup,
what we do is we have well, here's an example.
We've got three or four computers,
we got a printer, and whatever it might be.
Now each one of these hosts have their own
username and password list and it works great.
The challenge is that if I wanna access one computer,
I have to have a username and password
on that computer that I can log in with.
If I wanna access another computer,
it may have a different username and password.
So the Windows workgroups which have been around now
for over 30 years work very, very well.
And we can go ahead and log into these individual computers
but once in a while, you wanna start logging into
a lot of computers at once.
And you wanna go to this computer and that computer
and after a while you start going
I can't remember all these passwords.
So well you can do one thing.
You could cheat.
So if we take a look at this example one more time,
what I could do is I could put
the same username and password
on every single one of these computers
on my local area network.
And that way, I don't have to log in every time
because once I log into my computer
it will in essence carry that authentication information
to each one of these other computers
and it'll always think that I have a user called Timmy
with a password of 1234.
That is not a good idea.
And is a very dangerous security issue
and it is a big problem.
So what can we do instead?
Well, what we can do is single sign-on.
The idea behind single sign-on is that I log in once
to something and then everything else I need to get to
I'm automatically logged into.
Now single sign-on is a great idea
but it works differently depending
on how you're talking about it
so let's start with the most classic
and that is single sign-on on a local area of network.
To do that, we're gonna have
to use Windows Active Directory.
Now Windows Active Directory has been around
forever and it is the gold standard
when it comes to single sign-on tools
for local area networks.
It actually works more than local area networks
but we'll keep it simple for the moment.
So with Active Directory, what I have to first do
is go purchase a copy of Windows Server
and I install that into my network
and it will look something like this.
So here's my Windows Server with all these other computers.
Now once I establish a domain
as we call it in the Windows world,
we then have all of these other computers join this domain.
Now we do this by having a administrator
actually go to each computer and go through a process
of having them join the domain.
So somebody in a high trust position
has to actually go through and connect
each one of these individual computers
to the domain one at a time.
Now once that's done, we in essence have created
a trust situation because I as an administrator
have went to each computer and said, join this domain.
We have what are known as federated systems.
When you hear the word federated, think trust.
So there is an implicit trust that has been developed there
simply because Microsoft has a proprietary
authentication mechanism based on Kerberos
but the bottom line is is that we now have trust.
Now if you're gonna be doing single sign-on
in a local area network, odds are good
you're gonna be using Active Directory.
Even if you have Apple systems,
even if you have Linux systems.
Those can use Windows file and sharing,
or if it's Linux, we can use Samba
and all of these can be configured
to join a local domain which is actually cool.
I can't tell you how many big systems
you have out there where research areas
really have got 1,500 Linux boxes
and they still have a Windows Active Directory on there
simply because it's easier for the maintenance standpoint
to be able to do single sign-on.
So when you're talking about LANs,
you really are talking about Active Directory
as the single sign-on tool.
Now, there is another type of single sign-on
and this is completely different and is based on
something called SAML.
Let me give you a scenario.
Let's say I'm running, well I live in Texas
so we're running an oil pipeline.
And on this oil pipeline, we've got lots of pumps
and thermometers and cameras and all kinds of stuff,
hundreds of little devices and we've developed web apps
for these devices so that I can turn pumps on,
turn pumps off, whatever it might be.
Now just because these are web apps,
don't go thinking they're public,
they're well-protected usernames,
passwords, all kinds of stuff.
It's not easy, hopefully it's basically impossible
for the public to get to but I as the operator
of all these pumps and everything,
I need to be able to get to these.
But not only do I need to get to them,
I need to get to them securely
and I need to get to them any time I want.
So if I've got a couple of hundred
different web app devices,
I would like to sign on one time and be done with it.
And that's where SAML really comes into play.
SAML is designed really for web apps
more than anything else.
And it allows us as a single person
at a single place to log into
a whole bunch of different devices.
So let me show you a little bit how SAML works.
So here's my oil pipeline and we'll just put
some devices here along the pipeline.
All of these devices are accessible
through my VPN to be able to get to them
to do whatever I wanna do.
Now the trick here is is I don't wanna keep logging into
this pump and that pump then that camera.
And that's how SAML works.
SAML starts off with having what we call
an identity provider so that's gonna be a system somewhere
that's connected out here that everybody can talk to.
And what I will do is I will sign on
to the identity provider
and then all of these individual web apps
are gonna be called service providers.
So I can jump between any one of these
because the identity provider provides me
with a token that allows me to log
into any one of these different devices.
Now showing you SAML at work is a little bit tricky
because the only time you're gonna see
SAML really working for a living
is when you have people who have web apps
that they want to really, really control
and they're gonna go ahead
and write a lot of code and you know what?
They don't tend to like people like me
going in and actually working on this.
But what I've got instead is I've got this wonderful
little company called SSOCircle.
SSOCircle sells single sign-on tool sets
and so they have this nice little demo.
So let me show you how this guy works.
So first of all thank you SSOCircle
for letting me play on your site.
So what I'm gonna do is I've actually
created an account already.
And what I'm gonna do is just log in and here's my log in.
Now there's a lot of extra information here.
Keep in mind what they're doing
is they're trying to sell packages
for people who actually write SAML language.
But what I wanna show you that's actually kinda cool here
is that I've gone ahead and logged in
to the identity provider that's provided by SSOCircle.
Now what they do that's really, really nice
is they provide, let me go,
they provide all of these service providers.
Now these service providers, they're just samples,
they're examples of how logging in with SSOCircle
allows you to log into other disparate websites.
So I'm gonna pick one here, here's salesforce.com.
Salesforce.com is a really, really popular site
for use by sales people and stuff,
customer relationship management tools.
So what we're gonna do here is if I got this working right,
is now that I've logged into SSOCircle,
it's just gonna pop me over to one little place
within Salesforce like a little discussion page.
So let's see how this guy works.
Now what you're seeing here is
because SSOCircle wants to sell us this product,
what is doing is it's having you
do a little I'm not a robot.
Normally with SAML we would skip this
but we'll go ahead and just click right on here
and if I've done it right, ta-dah!
I am now auto magically on a little discussion page
within Salesforce.
Notice that I didn't have to type in
a username or a password.
In fact, if I paid a little money,
I wouldn't even have to do that I'm not a robot thing.
And that's the power of SAML.
In fact, take a look over here.
Up in the upper right-hand corner
you see where it says Log Out,
with SAML, I can actually, I'm already automatically
logged in, that's the beautiful part about single sign-on
but I could also log out of just this web app
or I could log out of all web apps in one big shot.
Now when we're talking about single sign-on,
especially for the exam, you need to think about
what type of security needs you're going to need.
For example, if we're talking about a local area of network
where you just want to be able to share folders and files,
you're gonna have to be using Windows Active Directory.
Yes there are other options but Windows AD is dominant.
But the moment you start talking about SCADA systems
or anything that's widespread or all over the place,
be sure to think SAML and you'll get it right on the exam.