Single Sign On (SSO) with SAML

The pace at which our number of usernames and passwords increase every year is enormous. With each new account we have a new dimension of security associated with it. On the organizations perspective, multiple accounts cause security problems and huge storage and management issues too. With cloud infrastructures increasingly becoming popular, these problems are escalated. Single Sign on (SSO) is therefore a popular infrastructure for organizations today. If you see Google, with one login, you can access Gmail, Google Drive, Youtube, Google Calendar, Blogger and other services that it offers. The latest one is the browser Google Chrome’s cool support which enables you to sync your bookmarks, extensions and even live pages all using just the same account.

Benefits of using SSO:     
1. SSO reduces password fatigue which is caused due to entering different username and password     combinations. 
2.It provides a centralized infrastructure for managing and storing of account details. This in turn reduces IT    related costs.
3.It also reduces the cost for setting up IT help desks for password losses.  It provides easier access to resources.
4.It makes security management much easier by having a single layer of security which is more generalized for each service or application.
5.Tracking users and tracking their access to resources becomes easier.

There are different single sign on configurations that exists.

   - One time Password (OTP): OTP is one of the most secure ways to do a Single Sign On. There is a two factor authentication using special OTP tokens which is one of the best practices in the industry today.

     
   - Kerberos based SSO: Kerberos has ticket granting servers. The initial sign on grants you access to the Kerberos system. Other different services are all accessed by requesting for tickets for that particular service.

     
   - Security Assertion Markup Language (SAML): SAML is a XML-based solution for exchanging user security information between your organization and a service provider. It supports W3C XML encryption and service provider initiated web single sign-on exchanges. The user is called the subject in the SAML based Single Sign On. The identity provider is the one which provides the user credentials. The service provider trusts the identity provider on the user information to provide access to its services or resources.

More on SAML:

A transaction from an identity provider to service provider is called SAML assertion. SAML assertion structure is defined using an XML schema which is specified under the OASIS SAML standard. It contains header information, the subject and attributes for the subjects which are the statements for the subject and conditions. The identity provider sends a certificate to the service provider on Login. This certificate is a proof that the data entered by the user is valid and based on this certificate the service provider grants the user access to the service. The certificate usually contains the signature of the identity provider and other attributes which were setup during setting up of the Single Sign On feature which were decided by the Service provider. Force.com uses SAML for Single Sign On.  It is a very modular way to implement SSO.