Re: SSO

On Thu, Jul 17, 2008 at 11:01 AM, Sharad Desai <ssdesai1@xxxxxxxxx> wrote:
Hello,

Thanks for your responses.

You may want to search for SPNEGO and mod_auth_kerb. Windows IE and IIS
have SPNEGO built in, and can use the Kerberos in Active Directory.
Apache can use mod_auth_kerb that supports SPNEGO. With FireFox 2 on any
platform
see the about:config and the network.negotiate-auth.trusted-uris option.

I would have definitely considered this, but the group that I am working
with does not want to include AD in any solution.

Also, (I'm not sure how familiar people are with Cosign) since Cosign
transforms Kerberos authentication to a cookie-based authentication which
the browsers can use, I was wondering if you have had any experience with
this.

When trying to determine the right SSO solution for your web
applications, it is important to realize that the mode of operation
behind solutions that call themselves "SSO" varies tremendously so you
really need to carefully state your requirements.

For example, you mentioned WebAuth and CoSign. Both of these solutions
are really targeted for highly heterogeneous environments like
University networks where the only client requirement is that the
browser support cookies. So it works on the IntrAnet, the IntErnet, on
a hostile dormitory network, a kiosk at the airport, ...etc. But if
you don't have those requirements these solutions do have quite a bit
of overhead with all the redirecting and, more important, they do not
give you true single-sign-on behavior. They're more like "double sign
on" because you have to login to a central server and they get
redirected back to the target site.

Then you have "SSO" solutions like OpenID which are really more like
"triple sign on" since you have to login to your workstation, then to
the OpenID service and then put in the OpenID service you're using at
the target site. This scenario is really only for the IntErnet where
there is no chance of the client and service being members of the same
domain.

For a strictly IntrAnet environment the WWW-Authenticate: Negotiate or
NTLMSSP protocols used by IIS, mod_auth_kerb, Plexcel, JCIFS and
others are the only true *Single* Sign On solutions where the clients
existing credentials are used to transparently authenticate without
requiring the user to enter a password. These use either the original
WWW-Authenticate: NTLM protocol (obsolete), raw NTLMSSP (rare), raw
Kerberos 5 (rarer) or SPNEGO (very common - used to "negotiate" either
NTLMSSP or Kerberos 5).

Mike

--
Michael B Allen
PHP Active Directory SPNEGO SSO
http://www.ioplex.com/
.

Relevant Pages

  • Re: Cannot find domain controller
    ... "Kerberos uses the FQDN to identify itself as well as to confirm with ... Can't be SPNEGO 'cause that stands for Simple and Protected GSSAPI ... how it works, however I know what will fix it, that is requiring a PTR. ... few comments I have found in the past all point to Kerberos and SPNEGO ...
    (microsoft.public.windows.server.active_directory)
  • Re: SSO
    ... and can use the Kerberos in Active Directory. ... Apache can use mod_auth_kerb that supports SPNEGO. ... transforms Kerberos authentication to a cookie-based authentication which ...
    (comp.protocols.kerberos)
  • How to know user name from kerbero
    ... How to make an app, ... I had a question for you related to Windows authentication and SSO using ... It uses SPNEGO (Kerberos), ... When IE try to connect, I response a http 401 Autorization: ...
    (microsoft.public.platformsdk.security)
  • Re: Data Refresh Failed - Office 2007- Excel services
    ... You need Kerberos or SSO. ... having exactly the same problem and am trying to use Windows authentication. ... Is it really the case that you have to use SSO to get this to work? ... few months back with an ASP.net app i was writing to communicate with a SQL ...
    (microsoft.public.sharepoint.portalserver)
  • Re: Cannot find domain controller
    ... " The SPN record for the domain controlller is used by the SPNEgo ... Any pointer to where SPENEGO is dependent on PTR records? ... SPNEGO is AFAIK, ... It's all about Kerberos. ...
    (microsoft.public.windows.server.active_directory)