We live in a world
Where we as individuals want to access lots and lots of computers
We just think about this in your normal browsing like you go to all kinds of different websites those are actual computers
Can you have two access now
Web might be a little bit of a tricky one because web is a public kind of tool but we can Trivoli ad
Usernames and passwords to any website that we wanted to people don't do it very often but you can
What's make a better example let's talk about
So here total seminars we got lots and lots of computers and people are sharing stuff and we got
Servers and printers and all kinds of things
Set eyes an individual want to be able to access
In a
Typical windows
Work group
What we do is we have well here's an example we got
Three or four computers we got a printer and whatever it might be each one of these
Hose
Have their own username and password list of works great
The challenges is that if I want to ask this one computer I have to have a username and password
On that computer that I can log in with
If I want to access another computer it may have a different
Username and pass
So
The windows workgroup switch been around now for
Over 30 years
Work very very well we can go ahead and log into these individual
But once in awhile you want to start logging into a lot of computers
Do you want to go to the computer that computer and after a while you start going I can't remember all these passwords
So well you can do one thing you can cheat
So if we take a look at this example one more time what I can do is I can put the same username and password on every single
These computers
On my local area network
And that way I don't have to login every time because once I log into my computer it will in essence carry that
Authentication information
To each one of these other computers and then always think that I have a
User called Timmy with password of 1 2 3 4
That is not a good idea
That is a very dangerous security issue and it is a big problem
So what can we do instead well
What we can do is
Single sign
The idea behind single sign-on
Is that
Hide login once to something
And then everything else I need to get to I'm automatically logged in
Now single sign-on is a great idea but it works differently depending on how you're talking about so let's start with the most classic
And that is
Single sign-on on a local area network
The dude that we're going to have to use Windows Active Directory Windows Active Directory been around forever
And it is the gold standard when it comes to single sign-on tools
Free local area networks that actually works more than local area network but will keep it simple for the moment
So
With active directory what I have to first do is go purchased a copy of Windows server and I install that into my
My networking here look something like this so
Here's my Windows server with all these other computers
Now once I established a domain as we called in the windows world
We didn't have all of these other computers join this
Domain
We do this by having a administrator actually go to each computer
And go to a process of having them join the domain so somebody in a high trust position
Cast actually go through and
Connect each one of these individual computers to The Domain one of the time now once that's done
When Athens had created a trust
Situation
Because I've been ministrator
Have went to each computer and said join this domain
We have what are known as
Federated systems
When you hear the word Federated thing
So there is an
The trust that has been developed there
Simply because Microsoft has a proprietary authentication mechanism based on Kerberos
But the bottom line is is that we now
Have trust
Now
If you're going to be doing single sign-on in a local area network
Odds are good you're going to be using active
Even if you have apple systems even if you have Linux
Those can use Windows File and Sherry or if it's Lenox we can use Samba and all of these can be configured
Figured to join a local domain which is actually cool I can't tell you
How many big systems you have out there where
Researcher is really got 1500 Linux boxes
And they still have a Windows
Active directory on there
Simply because it's easier from a maintenance standpoint be able to do
Single sign-on so when you're talking about lands
You really are talking about active directory as the single sign-on tool
There is another type of single sign-on this is
Pletely different
And it's based on something called saml
Let me give you a scenario let's say I'm running while I live in Texas so we're running an oil pipe
Turn on this oil pipeline we've got lots of pumps and thermometers and cameras and
All kinds of stuff hundreds of little devices
And we've developed web app
For these devices
So that I can turn pumps on turn pumps off whatever it might be
Just because he's our web apps don't go thinking there Pub
Well protected
Usernames passwords all kinds of stuff
It's not easy hopefully it's basically impossible for the public to get to
But I is the operator
Of all these pumps and everything
I need to be able to get to these
But now I need to get to them I need to get to them securely and I need to get to them
Anytime I want so if I've got a couple of hundred different
Web app devices
I would like to sign on one time and be done with it
And that's where
SML really comes into play
Saml is designed
Really for web apps more than anything else
And it allows us
As a single person at a single place
To log into a whole bunch of different device
So let me show you a little bit how saml works
Sarah some light oil Pipeline and we'll just put some devices here along the pipeline
All of these devices
Are accessible through my VPN to be able to get to them to do whatever I want to do
The trick here is is I don't want to keep logging into this pump than that pump in that camera
And that's how saml works
SML starts off with having
What we call an identity provider so it's going to be a system somewhere
That's connected out here that everybody can talk to
What I will do is I will sign on to the identity provider
And then all of these individual web apps are going to be called
Service provider
So I can jump between any one of these
Because the identity provider
Provides
Me
With a
Token that allows me to log into
Any one of these different devices
Now showing us ml at work is a little bit tricky because
Are you going to see saml really working for a living is when you have people who have
Web apps that they want to
Really really
Control and they're going to go ahead and write a lot of code and you know what
White people like me
Going in and actually work it on the
What I got instead of got with this wonderful company called SSO Circle
SSO Circle cell
Single sign-on tool set
And so they have the nice little demo so let me show you how this guy works so first of all thank you
For letting me play on your site
So what I'm going to do if I'd actually created an account already
And what I'm going to do is just log in
Here's my login now there's a lot of extra information ear keep in mind what they're doing is they're trying to
Packages for people actually write saml Lang
But what I want to show you the text
The cool here
Is that I'm going to head and logged in
To the identity provider that's provided by
SSO Circle
What they do that's really really nice
Is they provide
They provide all of these service
Abby service providers through
Just samples three examples of how
Login with SSO Circle
Allows you to log into other
Despair website
I'm going to take one here here
Salesforce.com
Salesforce.com is a
Really really popular
What's like for use by sales people in stuff customer relation
What we're going to do here is if I got this working right
Is now that I've logged in SSO Circle
It just going to pop me over
Two one
Little place
Within Salesforce
Let's see how this
Now what you're seeing here
Is
Because I Said So Circle once
What is doing is it
How do you do a little I'm not a robot
Normally with us AML we would
And if I've done it right
Shut up I am now automatch
Musically on a little discussion page within sales
Notice that I didn't have to type in the username or password
In fact if I paid a little money I wouldn't even have to do that I'm not a robot
And that's the power of Sam Elm fact take a look over here
Open the upper right
Say word says log out
What's SNL
I can't actually I'm already automatically logged in that's the beautiful part about single sign-on
But I could also log out
This
Web app where I can log out of all web apps
In one big
Snow
When were talking about single sign-on
Sleep for the exam
You need to think about
What type of
Security needs you're going to need
For example
If we're talking about a local area network
Search where you just want to be able to share folders and files
You're going to have to be using
Windows Active Directory
Yes there are other options but Windows ad is dominant
Put the moment
Can you start talking
Scada systems or anything that's why
Spread are all over the place
Be sure to think
SML and you'll get it right on the