Cyberstudy
PDF p.107 In progress

Federation

Open PDF at p.107 17 flashcards

Summary

PDF p.107

Federation allows a network to be accessible to external entities like partners, suppliers, and customers by trusting accounts managed by different networks. This approach simplifies account management and enables seamless authentication and authorization across different platforms using claims-based identity protocols.

In plain words

Supplementary — not from your PDF

Federation lets you use one organization's login at another organization's service. The service provider trusts an identity provider (IdP) to vouch for you with a signed claim, so it doesn't need its own password for you.

Detailed explanation

PDF p.107
  • Federation Concept
    • Definition: Extends network access beyond a well-defined group of employees to external entities.
    • Business Example: A company opens parts of its network to partners, suppliers, and customers, trusting accounts managed by other networks.
    • Consumer Example: Users can log into services like Twitter using credentials from another service like Google Workspace.
  • On-Premises vs. Federated Networks
    • On-Premises Networks: Use technologies like LDAP and Kerberos, often implemented in Windows Active Directory, for centralized account and device management.
    • Federated Networks: Require additional protocols and frameworks to ensure interoperability between different platforms, as web applications and third-party networks may not support direct federation with Active Directory/LDAP.
  • Claims-Based Identity
    • Process
      • Access Request: The principal (user) attempts to access a service provider (SP).
      • Redirection: The SP redirects the principal to an identity provider (IdP) for authentication.
      • Authentication: The principal authenticates with the IdP and obtains a claim (token or document signed by the IdP).
      • Claim Presentation: The principal presents the claim to the SP.
      • Validation: The SP validates the claim using its trust relationship with the IdP.
      • Authorization: The SP connects the authenticated principal to its accounts database to determine permissions and attributes, possibly querying additional attributes from the IdP if authorized.

Important terms

taken from the text above
Federation Concept
Extends network access beyond a well-defined group of employees to external entities.
Business Example
A company opens parts of its network to partners, suppliers, and customers, trusting accounts managed by other networks.
Consumer Example
Users can log into services like Twitter using credentials from another service like Google Workspace.
On-Premises Networks
Use technologies like LDAP and Kerberos, often implemented in Windows Active Directory, for centralized account and device management.
Federated Networks
Require additional protocols and frameworks to ensure interoperability between different platforms, as web applications and third-party networks may not support direct federation with Active Directory/LDAP.
Access Request
The principal (user) attempts to access a service provider (SP).
Redirection
The SP redirects the principal to an identity provider (IdP) for authentication.
Authentication
The principal authenticates with the IdP and obtains a claim (token or document signed by the IdP).
Claim Presentation
The principal presents the claim to the SP.
Authorization
The SP connects the authenticated principal to its accounts database to determine permissions and attributes, possibly querying additional attributes from the IdP if authorized.

Examples & real-world scenarios

Supplementary — not from your PDF
  • 'Sign in with Google' on a third-party site.
  • Partner staff using their own company logins on your portal.
  • The service provider redirecting you to your IdP to log in.

Scenario

A company gives suppliers access to an ordering portal. Instead of creating hundreds of accounts, it federates with the suppliers' identity providers, so leavers lose access when their own company disables them.

Common mistakes

Supplementary — not from your PDF
  • Thinking the service provider sees your password. The IdP handles authentication.
  • Forgetting that federation depends on trust between the parties.

Practical skills

Supplementary — not from your PDF
  • Draw the redirect flow between user, SP and IdP.

What I should remember

Key Points PDF p.107
  • Federation Concept
    • Network Access: Extends to external entities.
    • Business and Consumer Examples: Trusts accounts from other networks.
  • On-Premises vs. Federated Networks
    • On-Premises: Centralized management with LDAP/Kerberos.
    • Federated: Requires interoperability protocols.
  • Claims-Based Identity
    • Access Request: Principal attempts to access SP.
    • Redirection: SP redirects to IdP.
    • Authentication: Principal authenticates with IdP.
    • Claim Presentation: Principal presents claim to SP.
    • Validation: SP validates claim.
    • Authorization: SP determines permissions and attributes.