Solved

Implementing Single Sign On (SSO) for application

Posted on 2010-11-13
4
468 Views
Last Modified: 2012-05-10
Hi

We are running AD 2003 in our environment. We have multiple domains in one forest.

There is a finance application (FinanceApp) that we use on most users' desktops. At the moment, their usernames/passwords for AD and for FinanceApp are two seperate entities. That is, they log on to their PC's with their AD credentials, and when they launch FinanceApp they need to enter a seperate set of credentials.

We'd like to look into some sort of SSO functionality, whereby once users log onto their PC via AD, these same credentials can log them onto the FinanceApp.

Does anyone know how we can make this work? FinanceApp runs on Windows 2003 Servers and our clients are Windows XP.
0
Comment
Question by:smith1974
4 Comments
 
LVL 57

Assisted Solution

by:Mike Kline
Mike Kline earned 100 total points
Comment Utility
Do you know if FinanceApp can be integrated with AD?   Out of the box natively without an identity management solution for SSO you would have to have an app that can use AD credentials (integrate) to get a single sign on solution for that app.



Thanks



mike
0
 
LVL 9

Expert Comment

by:Lance_P
Comment Utility
What MK says :)

Microsoft products support SSO OOTB. For other applications, the developer will have to integrate it with AD for SSO to work.
0
 

Author Comment

by:smith1974
Comment Utility
Thanks both.

So if we do integrate the app with AD, would that still be SSO we're using, or an AD integrated app?

I'm having trouble visualising how SSO can work if there isn't any AD integration?
0
 
LVL 4

Accepted Solution

by:
kareejb earned 400 total points
Comment Utility
SSO usually refers to a trusted external application/website performing user authentication which in turn usually generates a cookie or token that can be provided to other apps to prove you have already successfully authenticated (this is how the Kerberos protocol that AD utilizes, works at the 10,000 ft level). The application will simply log you in without prompting for a password.  

An AD integrated app uses AD services transparently and can use your current login credentials to authenticate or can prompt for your AD username and password to login (no user database specific to the application). No need to setup an external app or web site to handle authentication as AD has already done all that for you.

A common setup that i have had to implement in the past for 3rd party applications that weren't AD aware (e.g. Java applications, Linux web apps) was installing a basic web service on an intranet running Windows Server 2k3/2K8 and IIS setup to do integrated authentication. AD Group policy was already defined that configured IE on all the clients to automatically send credentials for sites in the intranet zone making authenticating to these websites transparent to the end user. IIS would have an ASP or ASP.NET app installed that would to generate this cookie or token and redirect you to the 3rd party website, which would then log you in without prompting. Since IIS natively handles the AD authentication portion it makes for a fairly reliable setup.

If this isn't done properly it can present a pretty large security hole however so tread carefully. You have to investigate how the cookie/token is generated, passed, and expired, if at all. A recently piloted 3rd party app at my company had an out of the box SSO implementation that the sales team touted as a key feature. I found, once I dissected it, that it just basically converted your username to base64 with some extra garbage (always the same garbage) to pad out the parameter and passed in that to the web app. So basically if you knew someones username, you could easily login as them. They came back and said we should simply implement SSL to hide the token exchange. I told them that was insufficient and to go back to the drawing board.
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now