Cyberstudy
PDF p.104 In progress Not in the PDF's table of contents

Single Sign-on Authentication

Open PDF at p.104 19 flashcards

Summary

PDF p.104

Single sign-on (SSO) systems allow users to authenticate once and gain access to multiple integrated application servers without re-entering credentials. Kerberos is a widely used SSO protocol, especially in Microsoft's Active Directory (AD) environments, involving a key distribution center (KDC) that includes an Authentication Service (AS) and a Ticket Granting Service (TGS).

In plain words

Supplementary — not from your PDF

Single sign-on means you log in once and then access many systems. Kerberos does this with a key distribution center (KDC). You first get a ticket-granting ticket (TGT), which proves you logged in but doesn't yet give access to anything specific.

Detailed explanation

PDF p.104
  • Single Sign-on (SSO)
    • Definition: Allows users to authenticate once and receive authorizations across multiple systems.
    • Benefit: Eliminates the need to enter credentials multiple times.
  • Kerberos Protocol
    • Components: Clients, application servers, and a key distribution center (KDC).
    • KDC Services: Authentication Service (AS) and Ticket Granting Service (TGS).
    • Principals: Human users and application services.
  • Kerberos Authentication Process
    • Step 1: Requesting a Ticket Granting Ticket (TGT)
      • Principal Action: Sends a request to the AS, encrypting the date and time with the user's password hash.
      • AS Action: Verifies the user account, decodes the request, and checks for expiration.
    • Step 2: AS Response
      • Ticket Granting Ticket (TGT): Contains client information, time stamp, and validity period, encrypted with the KDC's secret key.
      • TGS Session Key: Used for communication between the client and TGS, encrypted with the user's password hash.
  • Logical Token
    • TGT: Identifies and confirms authentication but does not grant access to resources.

Important terms

taken from the text above
Single Sign-on (SSO)
Allows users to authenticate once and receive authorizations across multiple systems.
KDC Services
Authentication Service (AS) and Ticket Granting Service (TGS).
Principals
Human users and application services.
Principal Action
Sends a request to the AS, encrypting the date and time with the user's password hash.
AS Action
Verifies the user account, decodes the request, and checks for expiration.
Ticket Granting Ticket (TGT)
Contains client information, time stamp, and validity period, encrypted with the KDC's secret key.
TGS Session Key
Used for communication between the client and TGS, encrypted with the user's password hash.
TGT
Identifies and confirms authentication but does not grant access to resources.
SSO Single sign-on AD Active Directory AS Authentication Service TGS Ticket Granting Service TGT Ticket Granting Ticket

Examples & real-world scenarios

Supplementary — not from your PDF
  • Logging into a Windows domain PC, then opening file shares without typing a password again.
  • The KDC's Authentication Service issuing the TGT.
  • The TGT being time-limited.

Scenario

Users complain they must re-enter passwords for every internal app. Joining the apps to the Kerberos realm gives them single sign-on after one domain login.

Common mistakes

Supplementary — not from your PDF
  • Thinking the TGT grants access to servers. It's used to get service tickets.
  • Forgetting that Kerberos depends on synchronised clocks.

Practical skills

Supplementary — not from your PDF
  • Describe the first stage of Kerberos in order.

What I should remember

Key Points PDF p.104
  • Single Sign-on (SSO)
    • Authentication: One-time authentication for multiple systems.
    • Efficiency: Reduces the need for repeated credential entry.
  • Kerberos Protocol
    • Components: Clients, application servers, KDC.
    • KDC Services: AS and TGS.
    • Principals: Users and services.
  • Kerberos Authentication Process
    • Requesting TGT: Encrypts date and time with password hash.
    • AS Verification: Checks user account and request validity.
    • AS Response: Issues TGT and TGS session key.
  • Logical Token
    • TGT: Confirms authentication, not resource access.