Simple Sign-On Security

The first question most network administrators have is: isn't that a huge security problem?

Well the short answer is no, as a matter of fact it's not even a tiny security problem.

Of course the long version of no takes some explanation, which is what we will talk about in the rest of this article.

There are several specific areas of concern that are probably best expressed by the following questions:

• Where are the credentials stored?
• Can someone "sniff" passwords over the network?
• Who can access user credentials?
• How does the system extract a credential set?
• What about applications that are already AD integrated?

Answers to your security questions
All of the information used by Simple Sign On is stored in Active Directory; there are no separate databases, no special servers and no service accounts. This means that we can rely on standard Active Directory policies and permissions to enforce security on Simple Sign On application information and user identities. To further enhance security some of the Simple Sign On properties are encrypted with encryption keys unique to each Simple Sign On installation. This means that when the data travels over the network, it is still secure from prying eyes.

Since user credentials are stored in Active Directory we can set very granular permissions on them. Simple Sign On does this using Active Directory ACLs (access control lists). The default permissions are set so that only users can read their password list. Of course Simple Sign On administrators are responsible for assigning applications and basic identities to each user, but even these administrators cannot read someone else's password list. With Simple Sign On your identity is still secure and will never be forgotten.

Since we have already mentioned it, let's talk a little bit more about encryption. When Simple Sign On is first installed, a set of unique encryption keys are generated. All elements of Simple Sign On are irrevocably mated to these keys. This means that Simple Sign On tools from one installation will not work in another, not can they be used to "snoop" around the internet and steal user credentials. Additional security for individual passwords is accomplished by user specific encryption keys. The only potential problem is the loss of the keys, in which case all user identities and application definitions must be rebuilt. Since Simple Sign On is integrated with Active Directory, normal Active Directory backup and restore routines will preserve these encryption keys.

If you have deployed applications that already use Active Directory as their security principal, then Simple Sign On is not needed to manage users' access to these applications. However it is still possible to use Simple Sign On to launch these applications, providing a similar user experience in all cases.

Administrators should understand that Simple Sign On does not enhance the authentication technology used by an application. However since user logons are reduced to one (Microsoft's Active Directory), the more general environment of the network can be made more secure. You see, users don't actually have to know all the individual names and passwords for their applications! Simple Sign On supports an optional administrative security partition that will manage the creation and change process for each application's identity system!