Now we're done with user account management and the password management, now let us move on to a different
authentication way, which is single sign on, as you can see on the screen, this image through one
or login exchange or one authentication, you can access many different Third-Party websites and software.
So what exactly is a single sign on, single sign on and authentication method that enables users to
securely authenticate with multiple applications and websites by using just one set of wrenches?
Well, you click that does it click a name in your mind or you're -- right.
Google?
Yes.
Google is an example.
Signing with Google is an example of single sign on.
How does this all work?
So basically, as this all works on based upon a trust relationship set up between an application known
as the service provider and an identity provider like one login.
Now, this trust relationship is often based upon a certificate that is exchanged between the identity
provider and the service provider.
This certificate that is being sent from the identity provider to the service provider so that the service
provider knows it is coming from a trusted source and SSL that a single sign on this identity data takes
the form of tokens which contain identifying bits of information about the user, like a user's e-mail
address or a username.
So what?
Here it is.
You can see, just choose my pen.
So here is a user and he's browsing to domain one as well as the domain to now.
He is required to sign in in domain one as well as in signing domain two.
So when he is required to sign in to domain or to here, the domain two redirects it to authentication.
So and we can see a button sometimes on the Web site saying log in with Google.
So let me click that log in with Google.
It sends us to the authentication server, which is the Google's Gmail or any signing server.
And when we sign in, it provides a token to the browser and it gets stored in the cookie.
And then finally, we can get redirected to do mean to account.
This is using a central authentication to just forgive me for the shapes and drawings.
I'm not that good at drawing shapes, but yes, I hope you understand my what I'm trying to exactly
tell you about single sign on.
So what is and single sign on token that let us move on to the next image and as a token is a collection
of data, all the information that is passed from one system to another during the SSL process, that
data can simply be a user's e-mail address and information about which system is sending the token tokens
must be digitally signed for the token receiver to verify that token is coming from a trusted source.
The certificate that is used for this digital signature is exchanged during the initial configuration
process.
So let us have a look at this example first, watchit, user browses to this website, Domain one.
Well done, I've done good oval.
So now this domain one, one user tries to access or log into his account in domain one, what is what
does this domain one does?
It redirects this to the authentication server that we just saw in the last image.
Now, what does this authentication server does?
Is it either user logs in or the cookie is available, as I said, in the browser itself.
Now, once this authentication server verifies that, OK, this user is legitimate.
It stores the cookie in the browser cookie storage, OK, it's still the cookie in the browser cookie
storage and then did this domain sends a token to this browser cookie storage and checks, whether this
is a legitimate user or not.
And after that, it uses the token to authenticate the user.
And finally, user gets logged in and it stores the domain one cookie in the browser, cookie storage.
Now, let's say user browsers to domain to the domain do after it redirects the domain to two token
authentication server.
And then it happened the same process.
It happens every along with.
So the first step here is it user browsers to the domain.
Now this domain tries to access user logging in which redirects the user to authentication server authentication
server checks that OK, this case trying to login.
No problem.
Let's give the cookies to the browser storage.
And I've got this authentication.
Very server verifies that, OK, this is a vesicular and I have discussed credentials and this authentication
server then tells this domain that, OK, just trust me, I know this is a vesicular too.
So please allow him to log into a website and domain says, OK, no problem, there's no issue.
And the Domain then uses the token to authenticate and finally the user gets logged into the Web site.
This is how single Sinon works.
Now, the major benefit of single Sinon is you don't have to make multiple passwords.
That is why Google being the authoritative server in this case.
And so that is relied upon by most of the websites and apps.
You will find a option to log in using Google, if you know what I mean.
Go to any website, go to any well-known Shutterstock or Freeburg or any other website, you will have
an option to typically sign in with Google.
That is an example of single sign on.
Also, when you are signing to Gmail in one account and if you want to access Google on different account,
again, the singles and on feature is used when you want to access it because you are trying to access
it through two different accounts.
This is the basic idea that goes behind a single signing procedure.
Now, if you ask me is this is or is single sign on really secure?
Now the answer to this question is it depends.
There are many reasons why I say so can improve security.
A single sign on solution can simplify username and password management for both the users and the administrators.
Users no longer have to keep track of different sets of wrenches and can simply remember a single more
complex password as so can also cut down the amount of time the helpdesk has to spend on assisting users
with lost passwords.
Administrators can centrally controlled requirements like password complexity and amphitheatres the
multifactor authentication.
But since every coin has two sides, single Sinon does have some drawbacks.
For example, you might have applications that you want to have locked down a bit more.
For this reason, it would be important to choose and as a solution that gives you the ability to require
an additional authentication factor before the user logs into a particular application, or that prevents
users from accessing certain applications unless they are connected to a secure network.
Uh, so with this we are done with a SASO and this is very important and you should understand is also
an assessment.
But for this lecture, for the exam point of view or from your interview preparation, just make sure
that you remember what it is.
So no one is going to ask you this procedure that we just saw on the screen.
You just have to tell what SSL is and what are the drawbacks and what are the advantages and how as
this law is implemented in your terms.
Again, guys, I'm warning you, if you are doing this just for the sake of certification, please don't
do it.
Knowledge is very important when it comes to having a career in cybersecurity.
Even back in my P'--, even when I was doing cybersecurity, my trainer always told me to first understand
the concepts rather than just learning them.
So make sure you understand Single-Site.
Unless and until you understand a single zanón, you don't have to memorize it all the best.
And I will see you in the next lecture.