-: Authentication Models.
In addition to the standard authentication process
and concept of multi-factor authentication,
there are other models of authentication
that can be utilized by an organization.
These include context-aware authentication,
Single Sign-On authentication,
and Federated Identity Management.
Context-aware authentication is a process that checks the
user or system attributes or their characteristics
prior to allowing them to connect.
The most common form of Context-aware authentication
occurs by limiting the time or the day that the user
is able to log on to a particular client or server.
Another common use of this is to limit
the geographic location that the user can log in from.
For example, if you're a small company in the United States,
you don't have any international employees,
then you might be able to prevent any users from outside
the United States from logging into your systems.
This can be checked either by the location source
of the IP address, or the GPS coordinates of the device
that they're trying to log in from.
Another authentication model is Single Sign-On or SSO.
Due to the large number of resources and websites
that the average person accesses on a daily basis,
many organizations are beginning
to adopt an SSO environment.
When adopted, the organization establishes
a default user profile for each user,
and then they link that profile to all of the different
resources that that user is going to have to access.
Now, under this type of system, the user is able to have a
single long, strong password that they can memorize.
This replaces the 30 or 40 different login credentials
that the average user has.
And since they let you memorize one, they can make it more
complex and easier to learn.
Additionally, if you're using multi-factor authentication,
like we talked about in the last lesson,
you now have a single strong dual factor
or multi-factor authentication to use.
This makes accessing new resources much quicker
and much easier and it simplifies user
and password management.
Now, the one major drawback to using a Single Sign-On
environment is that the user's credentials have been
compromised. That attacker now has access to every resource
that the user had access to.
I like to think about it like a master key.
Let's assume you had a single key that opens your office,
your car, and your house.
But as you went to the mall, you dropped it and lost it.
And if I found it, now I'm going to have access
to all three things.
Your car, your house, and your office.
This is the big drawback to a Single Sign-On environment,
but again, if you use multi-factor authentication,
that's going to help secure it even more.
The final model is called the Federated Identity Management
or FIDM.
Many organizations are now grouping together
to create these Federations.
Each organization that joins this Federation
has agreed to a common set of standards and policies
for the use of identification.
This allows a Federated Identity
to be created for that user.
This identity can then be used across all of those different
businesses that are part of the Federation,
as well as all their systems.
These Federations support the provisioning and management
of identification, authentication, and authorization.
This can be done through two basic models,
either Cross-Certification or Trusted Third-Party.
The Cross Certification model is going to utilize
a web of trust between these organizations.
Each organization is going to certify every other
organization inside the Federation.
This works well when there's just a small number
of organizations inside the Federation.
But once that number gets large, anything above 5 or 10
organizations, it becomes pretty difficult to manage.
Thinking back to your early network studies,
you can relate the Cross Certification model
to a full mesh network model.
Anything higher than about five organizations
and this model is going to break down really,
really quickly.
Now, that brings us to the second type,
which is called a Trusted Third-Party Model.
This is also known as a bridge model.
This allows organizations to place their trust
in a single third party.
This third party, then, manages the verification
and certification for all of the organizations
within the Federation.
This is more similar to the way a traditional
certificate authority on the Internet is going to work.
In this model, it's quite efficient even with a large number
of organizations within the Federation,
because everybody goes to that one trusted person
to get their verification done.
Security Assertion Markup Language, or SAML,
is an attestation model that's built on top of XML,
and it supports this federated identity management.
SAML is used for the authentication and authorization
between different systems,
especially over the Internet using a Single Sign-On method.
To perform this function,
SAML is going to use an attestation ticket
that's provided to the user being authenticated.
This ticket is then provided to the web server
that the user is going to want to access.
SAML is designed as a standardization of the
Single Sign-On process, and it's used across the web
in a large number of organizations.
Another possible solution that you might find is OpenID,
which is an open standard decentralized protocol
to authenticate users.
OpenID allows the user to log into an identity provider
and they can then utilize that same account across all
of the cooperating websites.
These cooperating websites are known as
RP's or Relying Parties.
One of the largest and most well-known OpenID
identity providers is actually Google.
Anytime you've gone to a website outside of Google,
and you click that Google login button,
you're using an OpenID system, to have Google authenticate
you to that third-party website.
OpenID is also much less difficult to implement than SAML.
But SAML does perform these functions a lot more
efficiently than OpenID.
Which one you're using is really going to be up to you.