Single sign-on technologies and implementation methods

¶ … SSO is so reliable

Single sign-on (SSO) is a session/client verification handle that allows a client to use a single password and name combination, and be able to access other applications. The procedure validates the client for all the applications they are allowed to and wipes out further prompts when they switch applications within the session. Most managers and security workforce are introduced generally to two SSO's - non-Web-based and Web-based (or legacy) SSO - and various tasks that could be clubbed under single sign-on. Actually there are many kinds of SSO, single sign-on in software and hardware structures, and customer-requirements oriented as against server-side arrangements. The five commonly used ways of Single Sign-On in utilization as of now are: Web Single Sign-On; Enterprise Single Sign-On; Kerberos (or Ticket/Token Authentication); Open ID and Federation or Federated Identity. The critical SSO arrangements are: The SSO with JAAS; SSO Appliance and IBM ThinkPad Notebook Fingerprint Reader. In order to avoid duplicity of operations in security catalogs for clients, the SSO coordinates with the clients and the server, for example, LDAP and Microsoft Active Directory. Amongst the most advanced uses of SSO can most probably be seen in use in IBM ThinkPad Notebook R51/R52 that incorporate an inherent facility allowing user to access disparate applications like Windows, other software applications as well as browsing on the Web through a single sign-in. The sign-in process is simple. All one has to do is swipe his fingers over a palm shaped ridge that contains a sensor and allows entry on recognition of the pattern. Towards addressing the issues of accessing software on entirely different platforms and verticals, which seems to be a daunting task, given varying structural structures, LDAP is consolidated with JAAS (Java Authentication and Authorization Service), thus providing together, a solid security structure.

Introduction

Users face the onerous issues of juggling with passwords and username combinations quite often when working on disparate platforms, applications, and are prompted for each such instance. Emerging SSO technology has eased their workflow largely. Single sign-on has evolved, considerably, and continues to do so, to address the issues faced by workers in the IT field and applications therein. This work presents some of the SSO techniques in use today. 'Real' SSO, by itself is not a single entity. It is a general term used for all those techniques and devices or combinations that aim to lessen the burden of multiple log-in instances within a session. It is more of an arrangement that helps end-users and managers of systems alike in accessing their work seamlessly with the added benefit of security and consistency of the enterprise, thereby making it easier to work around tasks easily without the danger and risks of hacking, stealth, or impersonation. The browsing on net, different platforms and legacy applications that IT users and managers have to navigate through are not an easy ensemble to secure using a single point of entry, though. Each has its own set of queries, requirements, and security parameters that may vary greatly from the other. Effectually, SSO, at its minimal best can be a 'lessened' use of user-password combination that one may have to use on encountering promptings. However, SSO's have an obvious drawback- undesired, unauthorized access to a 'real' and 'solitary' SSO user-password combination could be disastrous for the entire organization and the ramifications could be far-reaching. This inherent security predicament is, however overshadowed by advantages that it offers to users, and it can be so designed to make it difficult, almost impossible, to access by unauthorized individuals (PistolStar, Inc., 2006). Each organization needs to look at its requirements and complexities closely and evaluate the need for the right SSO application out of the many different possibilities available in the way they are deployed, designed, and put to use.

Background

The basic notion is to exchange the complexity of the multi-tiered, complex security architecture with SSO (single sign-on) thus relieving the system to deal with contentious security issues. SSO's use cookies and Security Assertion Markup Language (SAML) deployments, for providing security. A validation token is received and transmitted over an exclusive and secure channel. Conventionally, many service providers profess use of SSL certified server endorsements and a corresponding cryptographic deciphering program is available with clients via browsers. Security domains create artifacts that act as tokens are sent through the channels to the other security domains to warrantee verification. Once the authentication is achieved, such tokens are removed and identification signatures are transmitted to the URL to release the information and data access at client end commences. (Yu & Asia Pacific Web Conference, 2004).

SAML (Security Assertion Markup Language)

Security Assertion Markup Language, an accepted standard used to validate and authenticate data across domains, has been completed by the non-profit organization, OASIS. Through the use of this language, security can be realized between clients (via authentication and verification), domains and devices that are then called subjects. SAML uses a feature of XML to seek an 'assertion' out of three defined types for the data transmitted, which is an acceptable protocol sought by the sender, which may or may not be responded to by the receiver properly. An 'assertion' is a feature of the receiver or subject known to the channel or the transmitting subject. The three types of 'assertions' are: Authentication, Authorization and Attribution. Authentication is the validity of the subject through an earlier encounter and may have been realized through hardware token, a password or through public domain key, X509. Authorization is the instance of 'assertion' where access to data or channel may or may not be assigned. The 'assertion' Attribution denotes that the subject in question is relevant to the attributes of the system.

SAML is not rigid in its definitions and leaves enough room for flexibility for independent systems to decide if security measures in place are effective enough to counter challenges and employ salvage actions in instances of unauthorized breaches arising out of conflicts in 'assertions' measures. Thus, it is more humane in its nature and allows each domain to assert its own security strategy without proving difficult to another security measure employed by another entity with which it seeks cooperation and exchange of data across the web. Additionally, SAML can also be tied together with SOAP (Simple Object Access Protocol) over the most widely used HTTP (Yu & Asia Pacific Web Conference, 2004).

Problem definition

The aim of this paper is to understand the technicalities and aims and objectives to be achieved through deployment of SSO. The reader of this paper will be empowered to understand the limitations and strengths of employing SSO as a measure against unauthorized access and pilferage of data, it is believed. In the following discussions solutions to problems faced when implementing SSO are also attended to, based on its characteristics.

Purpose

The object of this paper is to analyze commercially available Single Sign-On applications. This is, hence, not an exhaustive list of SSO solutions. The areas of using smart cards and cryptography that are popularly used as security measures are also delved into in this treatise, though the exact hands-on working is not touched upon.

Goals

This paper:

1.

Analyzes SSO implementations and solutions,

2.

Presents practical implementations, and

3.

Discusses the aims and effectiveness of solutions offered by SSO's

Background

Major background area

Authentication, Authorization and Attribution are the three most vital assertions sought for, by service providers on the web, about which SSO technology revolves to empower clients and domains to access safely multiple instances using single key obtained on the platform or technology called PKI- Public Key Infrastructure. One of more of these assertions enables normal uses of web where authorization given to a user can be used to gain access to multiple instances on offer. Currently all services involving Internet Service Provider (ISP) and Internet Protocol (IP)'s validate recognition and verification through username-password combination. In centrally controlled administrations, use of Remote Authentication Dial-In Service (RADIUS) and Terminal Access Controller Access Control System (TACACS+) is made to authorize access as well as to provide authorization information to the verified client or user. In such systems, the entire access system is controlled centrally. The user/client generally needs an exclusive password entry for different entries. This leads to users using a singular password that is easiest for them to recollect. This makes the system weak from security point-of-view. To overcome this incidence, as also to secure client data owing to increased offers of value-based services over the internet, Public Key Infrastructure (PKI) solutions need to offer authentication solutions to make internet use simpler as well as safer. The ideal solution would be a single access key for all web based instances and services. That sweeping authentication is yet to take shape, what we see instead, now, is an independent and often stand-alone Public Key Infrastructure solution for each application and access. And, in spite of the fact that TSL/SSL (Transport Layer Security / Secure Socket Layer) authentication layer is capable of providing such features very few services are seen to implement the PKI-based user authentication functionality. The PKI-based authentication system can possibly be made more general in its deployment by allowing the ISP's and IP's to perform the functions of validating as well as authorizing (Rossebo & Olnes, 2003).

Technical Background

This segment gives overview of SSO (Single Sign-On) functionality and of one instance of its implementation through the Shibboleth System. SSO is a verification system whereby a solitary user-password combination validates and authorizes a client to access all services under the same roof without having to answer a prompt for access authentication at each new instance encountered in the program, application, or system. As such SSO serves the dual purpose of providing access after due verification, authorization through single password authentication, thereby making the system safe and at the same time saving the user a lot of trouble of remembering multiple user-password combinations. Shibboleth and Open ID and similar protocols can be utilized to make SSO effective. Shibboleth is flexible, robust, has wide acceptance, and is favored for managing SSO. The working of Shibboleth is as follows: When a client tries to access resources protected by the SP, prior authentication is a necessary requirement or if it is a first time visit, authentication will have to be done by the user. For first time authentication, the SP may redirect the client to the WAYF (Where Are You From) procedure. Here the client is offered the list of those client credentials that are needed to access the said resources. If the client is able to choose a credentialed organization out of those appearing in the list offered by the SP, then he/she is directed to a corresponding IdP (Identity Provider). Using this IdP, the client can then follow the procedure laid down for SSO specified by corresponding organization for accessing the resource. On being authenticated successfully the client is attested to certain attributes logged in with the organization such as username, his/her association with organization etc. following such authentication, the browser is reconnected with the resource web attempted in the first instance with the newly authenticated IdP and attributes of the client. The SP filters these attributes and IdP information for access control laid down by the organization, which if matched, authorizes the program access to the client to the resource after another instance of Shibboleth session with the client. (De, 2012).

SSO

SSO (Single Sign-on) is a significant driver leading to authentication frameworks. To put it plainly, SSO is the process by which the user needs to authenticate only once to be able to gain entry to multiple instances without any further need to verify his credentials. SSO is the system whereby a solitary activity of client verification and approval allows a client to gain entry to all PCs and frameworks to which the user is authorized, and does not need to enter passwords at further prompts. SSO is of immense significance for both managers as well as clients. It is an understood fact that the working procedures become much simpler as recurring entry barriers are removed by deployment of SSO technique as only one logon per day is required by the client and there is only one set of username-password each client has to deal with. This is bound to reflect in improved efficiency. The infrastructure for authorization,, security administrators, and support staff will have much lesser database of user credentials to deal with making it easier to track movement and access to the resources. All the authentication data is thus placed under central control and the tools, techniques and routines of controlling and manipulating are identical, thus making the task of the security administrators easier. Such ease can also be vulnerability as through knowledge of access to one instance of data entry, the intruder would be able to access the entire database using the same repeatability that made task of the users and administrators simpler. (Clercq & Grillenmeier, 2007).

SSO is not advantageous simply because of its simplicity of organization and utilization; SSO is also advantageous from security point-of-view. Centralization facilitates uniformity in framing the policy applicable across the organization. A decentralized structure is more difficult to monitor and maintain than a centralized one. The presence of deployment of SSO techniques improves the security factor of an organization. If clients need to remember multiple username-password combinations, they are liable to divulge them, as users would paste the same within easy reach. Thus, vital information about a system or database may be compromised inadvertently in the absence of SSO technique. The chances of compromise are proportional to the number of combinations every user has to contend with. A quality SSO arrangement is one that is independent of the application or platform where it is put to use: it is capable of shielding its procedures and techniques from the clients and can give feedback required by the centralized security administration and (Clercq & Grillenmeier, 2007).

A possible contention against SSO is that SSO qualifications are the pathway or "key to the kingdom." If one obtains all the 550 accreditations, one can access all data under security. This danger may be lessened by mixing up the class of credentials offered. The three prevalent ways of credentials are knowledge based (as in passwords); attributes based (fingerprints- as used in biometrics) and third one is the possession based (such as the smart card or tokens). Such a veritable mix of accreditation devices should further strengthen the virtue of deploying SSO. when picking SSO accreditations that are not information based (a fantastic sample of learning-based certifications is the watchword) but instead biometrics-based (e.g. fingerprints) or ownership based (e.g. cryptographic tokens or smartcards). The utilization of multifactor confirmation answers for SSO will further lessen this danger (Clercq & Grillenmeier, 2007).

Web VS Enterprise SSO

A number of contemporary SSO instances treat Web and venture SSO arrangements differently. Web SSO deployments give a Web-based single sign-on meaning,: a straightforward logon used by clients who access applications and database through the Web and the HTTP. When you need to coordinate an application with a Web SSO framework, the application under consideration has to be Web-compliant. As a rule, this means having a multi-layered architecture of the front-end on the Web application. This is impractical, specifically for the centralized legacy applications that are in use for long, with front end at discretion of the user. WAMS (Web Access Management Systems) and the consolidated efforts worldwide are now concentrating on SSO techniques and solutions for security. Enterprise SSO solutions and deployments are capable of providing a wider SSO exposure. Enterprise SSO extend the use from SSO to Web-compliant applications, to terminal service-based applications that individual entities access, to applications that terminate at user ends and to a wide range of other Web independent instances (e.g. Legacy applications, mainframes et al.) (Clercq & Grillenmeier, 2007).

Related work

This part of the study deals with browser-supported login solutions, password managers' functions, and Open ID applications. Exploration in the field of web SSO security encompasses topics like, conflicts of usage about Open ID (Sun et. al, 2011), phishing assaults' possibilities (Messina, 2009), and concerns about confidentiality and privacy (Pfitzmann & Waidner, 2003; Uruena & Busquiel, 2010).

Password and form managers

Password managers are applications that help users help lessen the load on memory, by helping web clients sort out their online client name-password combinations. A study recently conducted by Gawand Felten (2006), most such managers are built-in features of the browser itself (e.g., auto complete), as opposed to those actualized as an addendum to programs (e.g., Password Multiplier (Halderman, Waters & Felten, 2005)). Such password managers alleviate the trouble of juggling with multiple passwords. Yet, clients do face issues while shifting passwords from standalone to system structures (Chiasson, van Oorschot, & Biddle, 2006). Such frameworks normally have problem transporting of passwords from one PC to another (Chiasson, van Oorschot & Biddle, 2006), and clients may feel insecure about them (Gaw & Felten, 2006). Likewise, for secret word administrators that enhance security through automated password creation (e.g., Passpet, Yee & Sitaker, 2006)), clients may not be comfortable about the fact that the process of creation passwords seem rather out of control (Chiasson, van Oorschot, & Biddle, 2006).

Web SSO systems

To employ Web SSO successfully, major service providers and content hosting services have devised ways via which other sites can acknowledge client access and authorize access from their own domains (e.g., Microsoft LiveID (Oppliger, 2004), Yahoo BBAuth (Yahoo Inc., 2008), AOL OpenAuth (AOL LLC., 2008), along with Facebook Connect (Facebook, Inc., 2010)). Then again, these frameworks are however, centralized, and of sole ownership formats; identification data is monitored and manipulated centrally. The likes of Liberty Alliance Project and Shibboleth are federal identity applications that allow for single sign-on across domains. In order to provide further assurance, firm agreements between the federal organizations have to be proffered, which is however difficult to assess and measure conclusively.

Browser-supported login solutions

The use of OpenID is made easier as it fills up the client's Open ID URL automatically on visiting reliable sites via Firefox's plug-in VeriSign's Seatbelt. Seatbelt's advantage is in its ease of use; but it may not locate the required fields accurately, as it makes use of a simple matching process for filling up forms (e.g., OIDURL, openID, open id, open-id) for identification. Also, it requires corresponding between Seatbelt structure and login state instances resident in the incident OpenID IdPs. Weave Identity of Mozilla Labs, which is a Firefox plug-in for single-click and programmed login, uses Firefox-resident password manager and coordinates Weave server programmed Open ID sign-on. Like VeriSign's Seatbelt, Weave Identity may not be able to identify and submit logins accurately; and programmed Open ID login feature is restricted to Weave records only (Sun et. al, 2011).

Summary

SSO frameworks aim to make transactions of data and information across web networks as seamless and smooth as debit/credit cards do against cash for goods bought in day-today transaction over the internet. In such instances third-party authorization of credentials offered through smart cards is done by the vendors' website management implementations. SSO (Single Sign On) (otherwise also called Enterprise Single Sign On or "ESSO") is an arrangement made possible by implementing signing in verifications into multiple branches within a single enterprise domain, legacy software and databases through single user-password combination sign-in. SSO is also used between federated enterprises. The advantages of SSO are:

Virtue of uniformity in authentication and authorization procedures across an enterprise

Direct connect between two clients for auditing purposes, thereby strengthening the security functions

Absolving the program developers from attending to additional burden of security in their program development cycle

Normally outcomes in major password help-desk cost cuts

The web space is stateless, meaning there is no sequential flow of actions. Hence, each access request to a resource or database must be checked for policies pertaining to authentication. Therefore, most SSO strategies make use of the Lightweight Directory Access Protocol (LDAP) contents while asserting the values given by the client seeking access. The LDAP indexes are made for faster referencing to tend to the high load it has to address. Further, the LDAP registries are used by SSO for authentication essentially.

Methodology

On instance of SSO, an automated resident test is invoked which passes through the browser through the protocol called HTTP and in turn invokes API's on the RP and IdP ends of the browser. These are the Browser relayed messages (BRMs). The result of this test is the token issued by the server or the destination of the receiver where the token is being sent ( a URL) for verification and is resident in the respective HTTP or other fields in it that affect the transfer. Such fields could be a target for attack and hence the test. Having obtained the information, the next step is to be assured whether another instance has obtained or deployed a token. Such information posits the success or failure of third-party hijacking or intervention of the process. After this, the experts take over to analyze the situation and provide answers towards safe passage of the genuine transactions. In so doing, we establish the possibilities of stealth or impersonation and may even reach the origin of dubious access.

Test environment and Example implementation

Browser relayed message (BRM). A SSO procedure is explained as an arrangement of program transferred messages traded between the RP and the IdP. Normally, a HTTP correspondence can be considered a sequential; to and fro exchange response pairs. A pair is made up by the corresponding instance(s) of a HTTP demand Xa, where X stands for the number of times a request is placed (i.e., 1a, 2a, and so on.), and HTTP answer to it/them Xb (1b, 2b, and so forth.) to be sent back from the server (either the RP or the IdP). A BRM is the Xb emulated by a solicitation (X+1)a in the following pair. Every BRM depicts an answer of the SSO in which the server handler like a web API of step X passes information to the handler of step X+1, with the program state that rides on it. The whole SSO procedure is based strictly according to demand 1a passed on to the RP. It invokes BRM1, which could be for the site characteristics proclaimed by the RP to the IdP. More BRMs may be produced if such a need arises later. The last BRM (e.g., BRM5 in Figure 1 (lower)) ultimately culminates in authenticating the clients identity identified by the browser (Wang, Chen & Wang, 2012).

Figure 1: Above a browser-related message (BRM) consists of a response and the next request; lower: a sample SSO process

Single sign-on using LTPA

IBM WebSphere and Lotus Domino LTPA use a SSO variation known as LPTA. A server designed for authentication based on LTPA sends a time-stamped LTPA cookie to the browser after client authentication which, though valid for the entire session, may expire if it encounters inactivity for considerable, pre-decided duration. Once a client is in receipt of such a token, he can visit associate sites on the browser without further sign-ins as the browser passes on the token information to all such sites under its umbrella. The cookie contains the authentication information of the recognized client. This data is scrambled and marked utilizing a public/private pair of codes. In the accompanying figure, the client accesses the server of the Portal and a prompt asks him to enter credentials. The Portal server approves the login accreditations furnished by the client with the LDAP server and furnishes the client with a LTPA token. If requested, the same token is utilized by other servers as a part of the same browser family to allow access to the client without further prompts for credentials. Thus SSO deployment allows access within an environment with a single point of entry (Bauman, 2012).

Source: IBM Connections wiki: IBM Redbooks: Creating Integrated Web Experience with IBM Lotus collaboration software

Prerequisites for single sign-on

Common directory

For keeping the configuration simple, all servers under the same domain ( using the same authentication parameters) should be found in a single directory. That makes SSO implementation simple rather than on separate directories which would make SSO configuration complex. In the present example such a shared directory is the Domino LDAP (Bauman, 2012).

Common DNS domain

All different servers found on the same directory and by consequence under same authentication must carry same domain name (i.e.: use the same host name suffix). In the example environment, this is .demos.ibm.com (Bauman, 2012).

Common realm name

The realm name of all servers sharing the same authentication must be the same. In the sample environment, this is domino.demos.ibm.com:389. If all WebSphere-based servers make use of shared attributes then leaving them all with the default name for domain "defaultWIMFileBasedRealm" is possible. However, in the case environment the Portal server is arranged to utilize the Domino index as a stand-alone LDAP and as a feature of this setup, the domain name is changed to LDAP host name: 389. All other WebSphere Application Servers utilizing a combined index file must have their domain name altered accordingly. Here it is pertinent to point out that during configuration of SSO for Domino servers, the LPTA key provides for the realm name inherently (Bauman, 2012).

Time synchronization

All the servers conforming to the same authentication attributes should conform uniformly to a time. This requirement is necessary in spite of the fact that the deployment and incidence of usage may not take place in the same time zone. In the example shown, the time stamp is obtained from a virtual host. If you encounter a situation where successful log in to one sever (say, Server A) allows you to log in to another server (say Server B), but a prior log in to Server B. doe snot automatically allow access to Server B, then, it is mostly a typical case of time difference between the two (Bauman, 2012).

Simple example with SSO (Java or .NET with 3 rdp party library)

Overview of a Single Sign-on SolutionDefault.aspx in the AppLauncher Application

This Web page class retrieves the data of one who used Windows and authenticated to IIS and display the applications accessed. The accessed applications are displayed in a Data Grid and any of these applications can be accessed again on clicking on the specific instance which then creates a new token, stores the paired combination of userID in the EsApp token table and then invoke the application by providing the token to the AppLogin.aspx in the corresponding web application

Figure 2. The application launcher shows a record of applications. The user is permitted to runAppLogin.aspx within each and every Web Site

Only the application launcher can access this Web page class. In case some other application tries accessing this page, the instance is redirected to the Default.aspx page of the Web site. And since Web application authentication is forms-based, the user will go to the Login.aspx page of the site (Sheriff, 2004).Login.aspx in Each Web Site

To reach this page the entered credentials are measured against the database entries. A valid entry invokes a ticket and the user is directed to the page requested. This is called the landing page in every website. And this is only a normal procedure (Sheriff, 2004).Default.aspx in Each Web Site

The default landing page is the main landing page which can be reached only if user identification has been ascertained. Such verification is awarded through Login Web or AppLogin pages (Sheriff, 2004).

Tables

The database has to populated by few tables to enable functioning of the SSO. Through the example offered affair an idea of the tables to be created is sought to be explained. Many more fields than created here may be needed in an actual enterprise application. For the tables created here, the functionality and objective of classes has been explained in brief in fig. 4 (Sheriff, 2004).

Figure 3. A small amount of straightforward tables are required to execute a single sign-on system inclusive with individual roles and functions

AppLauncher Web Application

Let us review at the Web page, which shows the application's a client can execute.

Figure 4. The AppLauncherxx solution includes the AppLauncherxx program as well as a reference to the AppLauncherDataxx programDefault.aspx in AppLauncherxx

Application Launcher Web site needs only one page: default.aspx. This Web page reads the login Id and produces a list of functions and applications that can be accessed by that user from the entries marked against it in the database. The code for the Page_Load event procedure that is invoked on loading the default.aspx is seen below.

'VB.NET

Private Sub-Page_Load (ByVal sender As System.Object,

ByVal e As System.EventArgs) Handles MyBase.Load

' Display the User Name

' Without the Domain prefix

lblLogin.Text = "Applications Available for: " &

Apps.LoginIDNoDomain (User.Identity.Name)

AppLoad ()

End Sub

The LoginIDNoDomain static method in the Apps class when called removes the domain prefix. For example: If a login id of "Ken" is verified on a domain called "PDSA," then the User.Identity.Name property produces "PDSAKen." On passing through this stage the prefix PDSA will be stripped of and produce the string "Ken" as an output.

Loading the Applications This User Can Run

The AppLoad method uses an instance arrived on the Apps class to extract a corresponding DataSet of applications that this user can access. The method GetAppsByLoginID method in the Apps class is depicted later in this article.

' VB.NET

Private Sub-AppLoad ()

Dim app As New Apps

Try

' Load applications for this user grdApps.DataSource = app.GetAppsByLoginID (User.Identity.Name)

grdApps.DataBind ()

Catch ex-As Exception

lblMessage.Text = ex.Message

End Try

End Sub

The LinkButton Control

This LinkButton has been defined as subsequent in the Web page.

AppID=''

UserID=''

CommandArgument=''

Text=''>

ItemCommand Event

Finally, once the Token is extracted through this process, the URL within the CommandArgument property of the LinkButton is tied to this token; a Response. Redirect has been produced to allow the passing of the token by the application of the Web where the client has logged in.

' VB.NET

Private Sub-grdApps_ItemCommand (ByVal source As Object,

ByVal e As System.Web.UI.WebControls.DataGridCommandEventArgs)

Handles grdApps.ItemCommand

Dim app As New Apps

Dim boolRedirect As Boolean

Dim token As String

Dim lb As LinkButton

Try

lb = DirectCast (e.Item.Cells (0).Controls (1), LinkButton)

' Create a Token for this user/app token = app.CreateLoginToken (lb.Text,

User.Identity.Name,

Convert.ToInt32(lb.Attributes ("UserID")),

Convert.ToInt32(lb.Attributes ("AppID")))

boolRedirect = True

Catch ex-As Exception

boolRedirect = False

lblMessage.Text = ex.Message

End Try

If boolRedirect Then

' Redirect to Web application ' passing in the generated token

Response.Redirect (e.CommandArgument.ToString () &

"?Token=" & token, False)

End If

End Sub

The LinkButton contains the AppID and UserID during its set up process and once invoked, the Attributes property can then be used to extract the ID's. Attributes are those additional parameters that need to be added for server control that are not a part of originally defined controls for the server to exercise.

Modify the Web.Config

Prior to authenticating clients and users within the Web application one has got to place the element within the Web.Config file to "Windows." Furthermore, one has got to refuse unidentified users in the element within the Web.config.

One last entry you have got to do is to save the connection string for getting at the tables within the database. Here, a simple of the Web.config has been used to store the connection string.

value="server=(local);Database=eSecurity;uid=myUserID;pwd=myPassword" /

Here a database within the SQL Server ™ called eSecurity has been created. This paper's sample code comprises of a SQL script which helps to create the tables inside a SQL Server database.

Apps Class

We will now visit the Apps class. It is a major component and does most of the work required for the security of the enterprise. All the three classes in the AppLauncherData technique: load user applications, prepare loading roles, and work around security tokens. It is safer to keep the correspondence with the database as also to stay away from user interface tier for manipulating tokens. This allows creation of the tokens independently and keeping the user interface intact while corresponding with the database.

The Apps class loads the applications for users and works with tokens. Here is this class definition:

' VB.NET

Public Class Apps

Private mConnectString As String

Public Sub-New ()

mConnectString = ConfigurationSettings.

AppSettings ("eSecurityConnectString")

End Sub

End Class

As is obvious, the class first of all loads a member variable with a connection string retrieved from the Web.config file.

GetAppsByLoginID Method

By passing the user's username to GetAppsByLoginID procedure you can provide him the access to an application. This procedure performs the Join to obtain all requirements needed for use. The SQL Join used requires the information resident in the esApps and esAppsUsers table. You would at the same time need to attest to the esUsers table as you want to provide access to a particular user and the table contains LoginID for all users. Hence, the primary key in the lookup for the user must be accessed in the esUsers tables.

' VB.NET

Public Function GetAppsByLoginID (ByVal LoginID As String)

As DataSet

Dim ds As New DataSet

Dim cmd As SqlCommand

Dim da As SqlDataAdapter

Dim sql As String

sql = "SELECT esApps.iAppID, esAppsUsers.iUserID, "

sql & = " esApps.sAppName, esApps.sDesc, esApps.sURL "

sql & = " FROM esApps"

sql & = " INNER JOIN esAppsUsers "

sql & = " ON esApps.iAppID = esAppsUsers.iAppID "

sql & = " INNER JOIN esUsers "

sql & = " ON esAppsUsers.iUserID = esUsers.iUserID "

sql & = " WHERE sLoginID = @sLoginID "

sql = String.Format (sql, Apps.LoginIDNoDomain (LoginID))

Try

cmd = New SqlCommand (sql)

cmd.Parameters.Add (New

SqlParameter ("@sLoginID," SqlDbType.Char))

cmd.Parameters ("@sLoginID").Value =

Apps.LoginIDNoDomain (LoginID)

cmd.Connection = New SqlConnection (mConnectString)

da = New SqlDataAdapter (cmd)

da.Fill (ds)

Return ds

Catch ex-As Exception

Throw ex

End Try

End Function

The CreateLoginToken Method

Each click on an application in the DataGrid creates a fresh token. The CreateLoginToken method achieves this function.

' VB.NET

Public Function CreateLoginToken (ByVal AppName As String,

ByVal LoginID As String, ByVal UserID As Integer,

ByVal AppID As Integer) As String

Dim cmd As New SqlCommand

Dim param As SqlParameter

Dim token As String

Dim sql As String

' Generate a new Token

token = GenerateToken ()

sql = "INSERT INTO esAppToken (sToken, sAppName, "

sql & = " sLoginID, iUserID, iAppID, dtCreated) "

sql & = " VALUES (@sToken, @sAppName, @sLoginID, "

sql & = " @iUserID, @iAppID, @dtCreated)"

sql = String.Format (sql, token, AppName,

Apps.LoginIDNoDomain (LoginID), UserID, AppID,

DateTime.Now.ToString ())

param = New SqlParameter ("@sToken," SqlDbType.Char)

param.Value = token cmd.Parameters.Add (param)

param = New SqlParameter ("@sAppName," SqlDbType.Char)

param.Value = AppName cmd.Parameters.Add (param)

param = New SqlParameter ("@sLoginID," SqlDbType.Char)

param.Value = Apps.LoginIDNoDomain (LoginID)

cmd.Parameters.Add (param)

param = New SqlParameter ("@iUserID," SqlDbType.Int)

param.Value = UserID

cmd.Parameters.Add (param)

param = New SqlParameter ("@iAppID," SqlDbType.Int)

param.Value = AppID

cmd.Parameters.Add (param)

param = New SqlParameter ("@dtCreated," SqlDbType.DateTime)

param.Value = DateTime.Now cmd.Parameters.Add (param)

Try cmd.CommandType = CommandType.Text cmd.CommandText = sql cmd.Connection = New SqlConnection (mConnectString)

cmd.Connection.Open ()

cmd.ExecuteNonQuery ()

Catch ex-As Exception

Throw ex

Finally

If cmd.Connection.State ConnectionState.Closed Then cmd.Connection.Close ()

cmd.Connection.Dispose ()

End If

End Try

Return token

End Function

GenerateToken creates the token. CreateLoginToken is a different method because in future it allows change of type of token generated. Some ideas towards the same are provided at the end. This method employs the GUID class to create a new GUID as the token (Sheriff, 2004).

' VB.NET

Public Function GenerateToken () As String

Return System.Guid.NewGuid ().ToString ()

End Function

Retrieving Tokens in the Web Applications

For application launching testing purposes, an application to call action from the browser must be created. This test Web application is going to utilize the AppLauncherDataxx project already described will test such an application (Sheriff, 2004).

Figure 5. Each Web application will use the AppLauncherDataxx project in combination with an AppLogin, Login, and Default page

Modify the Web.Config

value="server=(local);Database=

eSecurity;uid=mUserID;pwd=myPassword">

You should also provide for authentication based on forms for Web-application. Towards the same, alter the element as exemplified:

Lastly, element has to modified to avoid unauthorized entry.

The AppLogin.aspx Page

Bear in mind that that each instance of access needs to invoke AppLogin page and pass on the generated token. The AppLogin page will validate the token, obtain all parameters from esAppToken table, and then erase all traces in the esAppToken to avoid any subsequent use.

' VB.NET

Private Sub-Page_Load (ByVal sender As System.Object, ByVal e As

System.EventArgs) Handles MyBase.Load

VerifyToken ()

End Sub

Private Sub-VerifyToken ()

Dim app As New Apps

Dim al As AppToken

Try

al = app.VerifyLoginToken (

Request.QueryString ("Token").ToString ())

If al.LoginID.Trim () = " Then

' Not a valid login ' Redirect them to default page ' This will put them at the login page

Response.Redirect ("default.aspx")

Else

' Create a Forms Authentication Cookie

' Set Forms authentication variables

FormsAuthentication.Initialize ()

FormsAuthentication.SetAuthCookie (

al.LoginID.ToString (), False)

' Set the Application Token Object

Application ("AppToken") = al ' Redirect to Default page

Response.Redirect ("default.aspx")

End If

Catch

' Redirect them to the login page via the Default page

Response.Redirect ("default.aspx")

End Try

End Sub

A authentication cookie of the form has been invoked by reaching the FormsAuthentication, Initialize and FormsAuthentication.SetAuthCookie procedures. By this, a memory cookie is relayed to the browser. This cookie is validated in each instance of access by ASP.NET runtime (Sheriff, 2004).

The VerifyLoginToken Method

The generated token in the query line is checked for validity by comparing it with the entries in the lookup table (esAppToken). All the individual properties of the values from the table are placed into of the AppToken object if matching is achieved. This loaded AppToken object is then returned.

' VB.NET

Public Function VerifyLoginToken (ByVal Token As String) As AppToken

Dim al As New AppToken

Dim ds As New DataSet

Dim cmd As SqlCommand

Dim dr As DataRow

Dim da As SqlDataAdapter

Dim sql As String

sql = "SELECT iAppTokenID, sAppName, sLoginID, "

sql & = " iAppID, iUserID "

sql & = " FROM esAppToken"

sql & = " WHERE sToken = @sToken "

Try

cmd = New SqlCommand (sql)

cmd.Parameters.Add (New

SqlParameter ("@sToken," SqlDbType.Char))

cmd.Parameters ("@sToken").Value = Token cmd.Connection = New SqlConnection (mConnectString)

da = New SqlDataAdapter (cmd)

da.Fill (ds)

If ds.Tables (0).Rows.Count > 0 Then

dr = ds.Tables (0).Rows (0)

al.LoginID = dr ("sLoginID").ToString ()

al.AppName = dr ("sAppName").ToString ()

al.AppKey = Convert.ToInt32(dr ("iAppID"))

al.LoginKey = Convert.ToInt32(dr ("iUserID"))

DeleteToken (Convert.ToInt32(dr ("iAppTokenID")))

End If

Catch ex-As Exception

Throw ex

End Try

Return al

End Function

(Sheriff, 2004)

Installing the Samples

There are two examples used as applications in this paper. Both pertain to the applications for the Web. A class library is also included for solutions used in each of the applications. The sample programs are presented in both Microsoft Visual Basic® and .NET. In order to help preparation of a database, .SQL documents are included in the record. The .SQL documents are designed with SQL Server in mind, however could be easily altered to address other database Servers. The following steps need to be followed for installation (Sheriff, 2004)

1.

Creation of a database within the DBMS referred to as eSecurity.

2.

Run the .SQL files so as to create tables within the eSecurity file.

3.

Unzip these files within the supplied .ZIP file in the folder.

4.

Build virtual catalogs to identify folders being used.

5.

Edit.SLN files to identify the virtual directory folders.

Conclusions and future work

This paper has endeavored to furnish better ways of implementing SSOs, overcoming the shortcomings of the ones in use and safer communication protocols. Users as well as the service provider implement Encryption and decryption during validation. Client logs in with encrypted token and for verification. Provider decodes the token for authentication. This procedure avoids the possibility of falsified authentication instances. Hackers can be kept at bay using this dual encryption -decryption method and authentication from fraud instances due to drawback of openness in this technique can be overridden by a strong password. For distributed systems further study is proposed along the lines used in this paper for centralized structures of organization of framework. Further security endowments might well incorporate application of Biometrics.