See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/309225903

A Review on Single Sign on Enabling Technologies and Protocols

Article in International Journal of Computer Applications · October 2016

DOI: 10.5120/ijca2016911938

CITATIONS READS

16 9,523

2 authors, including:

Aqeel Khalique
Jamia Hamdard
32 PUBLICATIONS 295 CITATIONS

SEE PROFILE

All content following this page was uploaded by Aqeel Khalique on 18 July 2017.

The user has requested enhancement of the downloaded file.

 International Journal of Computer Applications (0975 – 8887)
Volume 151 – No.11, October 2016

A Review on Single Sign on Enabling Technologies and

Protocols
Tayibia Bazaz Aqeel Khalique
Department of Computer Department of Computer
Science & Engineering Science & Engineering
Jamia Hamdard Jamia Hamdard
New Delhi, India New Delhi, India

ABSTRACT is laid on the thought that whether SSO is a blessing or a risk

In today’s digital era, users are increasingly accessing factor and Section 7 concludes the paper.
countless number of applications every day. For accessing
these services, the users first have to authenticate themselves
2. SINGLE SIGN ON (SSO)
and need to maintain a separate set of username and password 2.1 Overview
for each application. This led to the development of Single SSO is an access control method which asks a user to login
Sign On (SSO). This paper presents review on SSO enabling once and allows them to access multiple resources and
technologies and discusses SSO architectures, protocols and services after successful login without being prompted to
analysis related to growing use of SSO. login again. Thus, SSO approach enables users to authenticate
only once and then enjoy easy access to other applications
General Terms securely.
User Authentication, Service Authentication, Single Sign On

Keywords
Single Sign On (SSO), Authentication, Multi-factor
Authentication (MFA), SAML, OpenID

1. INTRODUCTION
In the present era of Internet, Application Service Provider
(ASP) provides a standard interface to a countless number of
users and also a standard connection point to various
application providers. As almost each application has its own
authentication mechanism, users need to go through multiple
login steps. The user information and security are not
correlated making the user management complicated and
unsafe. In order to address the issues related to the user Fig 1: SSO Overview
convenience and security, the commonly used technique is
Single Sign On (SSO). SSO is an access control method Figure 1 shows the SSO approach where a user authenticates
which asks a user to login once and without any further login once and then can access different applications or services
criteria, he/she is allowed to access the resources of multiple easily. These applications can be within a single organization
software systems securely. SSO helps in the integration of the or different organizations i.e., some are within one domain
security policy and user information [1]. and some within multiple domains. Federation allows to
access applications of different organizations and hence, takes
Prior to SSO, a user was supposed to login with a new SSO to the next level where users are able to federate their
account each time a new application was opened. Hence, was SSO solution outside their organization and allow trusted third
supposed to memorize numerous passwords which is really a parties to login once and use their applications [2]. SSO
difficult task to perform. To deal with this, users usually solution copies the necessary user credentials required across
preferred to go for simple and almost same passwords. This these domains securely.
approach is easy but has a potential threat. Choosing simple
passwords made a cracker’s job easy. An attacker can guess 2.2 SSO Architecture
the password and gain access to all of the confidential There are different types of SSO architectures, with different
information. With the introduction of SSO, users are being properties and infrastructures namely Secure Client-Side
freed from this menace. They just need to authenticate Credential Caching, Secure Server-Side Credential Caching,
themselves once and then can easily access the multiple SSO with Single Set of Credentials, Public Key Infrastructure
applications running on various domains securely. based SSO, Token based SSO. Secure Client-Side Credential
The structure of this paper is outlined as follows; in Section Caching and Secure Server-Side Credential Caching come
under SSO with multiple set of credentials while Public Key
2, this paper discusses about the architecture, trust models and
Infrastructure based SSO and Token based SSO come under
variants of SSO. In Section 3, discussion about SSO enabling
technologies and protocols is done. Section 4 discusses the SSO with single set of credentials. Depending on their
benefits and drawbacks of using SSO. This paper also properties and usage, these architectures can be applied to
various situations accordingly. The detailed description of
discusses the combination of SSO with Multi Factor
these architectures is discussed below [3].
Authentication (MFA) in Section 5. In Section 6, some focus

18
 International Journal of Computer Applications (0975 – 8887)
Volume 151 – No.11, October 2016

1) Secure Client-side Credential Caching: It is client

based SSO solution. Here all the authentication related
information is kept into a client-side credential storage. It
allows the user to authenticate himself/herself once and
afterwards the rest of the information for subsequent
requests is being provided by the system automatically
without the user’s intervention. If the credentials
provided by the end-users are valid then the users will be
transparently authenticated to the other application
servers. A high secure credential cache resides on client-
side as shown in Figure 2. The cached credentials have to
be stored securely as this cached information may be
used to access some sensitive information or confidential
web service. Thus, it’s not advisable to be used from a
portable client device or on some operating system Fig 3: Secure Server-Side Crendential Caching
having security issues. This solution has little flexibility 3) Single Sign-On with Single Set of Credentials: The
as all the credentials are stored on a client-side credential services that provide the management of services,
cache. A user may face some sign-on problems while implement the Single Sign On with single set of
signing on via some other workstation. Also, the client- credentials. The feature of this SSO architecture is that it
side credential cache has to be updated with the is well suited for homogenous environment where single
information of every new application server added. naming account format and same authentication
protocols are supported and identified by every entity in
the whole network system.
4) PKI-based Single Sign-On: This approach makes use of
the public key cryptography for user authentication. The
system relies on the role of Certification Authority (CA)
for the issuance and management of the digital
certificates and hence users’ digital identities. The user
first has to identify herself/himself to an authentication
authority which issues a public key certificate to the
authenticated user as shown in Figure 4. Whenever the
authenticated user wants to access a protected resource in
subsequent authentication request, he/she creates a token
and includes its digital certificate (public key) in it and
signs it with her/his private key. On the reception of the
Fig 2: Secure Client-Side Credential Caching
request, the target server contacts the CA in order to
2) Secure Server-side Credential Caching: Also known verify the identity of the requesting user. There is a
as server based SSO solution where all the authentication relationship of trust between the primary CA and the
details are stored in a central repository but the cache is secondary CA as the latter’s certificate is being issued by
stored on server side. The task of administering all the the former one. This enables any secondary CA to accept
different passwords and providing the needed the certificate issued by the primary CA. The private key
information directly to the application asking for them is is a long series of random binary data and is hard to be
done by the central server. Figure 3 shows Secure postulated down on paper or to memorize but the key can
Server-side Credential Caching with two credential be easily transmitted over a network, hence prone to
databases. These are primary credential database and thefts by any intruder. Examples of PKI based SSO
secondary credential database. The primary credential solutions are Verisign, Globalsign etc.
database contains the primary credentials of different
users and the mapping between primary credentials and
secondary credentials while the secondary credential
database contains only an image of secondary
credentials. The mappings between these credential
databases needs to be synchronized. The synchronization
can be achieved in three ways. These are:
1) Integration of the credential synchronization services
into the primary credential database.
2) Using an external software to handle the credential
synchronization process.
3) Synchronization performed by the administrators
themselves. Fig 4: PKI Based SSO
A trust relationship, depending on the need of credential 5) Token-based Single Sign-On: In this architecture, a
synchronization, has to be set between the secondary user after signing into the primary authentication
authentication authorities and primary authentication authority receives a temporary token as shown in Figure
authorities. 5 which it can use further to access the resources or
services without any re-authentication process. This is

19
 International Journal of Computer Applications (0975 – 8887)
Volume 151 – No.11, October 2016

possible as there is a relationship of trust between privacy needs that differentiates it with the previous
primary and secondary authentication authorities. Figure models.
5 shows that a user uses his temporary token to access
the resource without being prompted to authenticate 2.4 Different Types of SSO
himself again to the Secondary Authentication Authority. There are three main variants of SSO: Web SSO, Legacy Web
An example for this authentication strategy is the SSO, Federated SSO. We have given a brief description of
Kerberos authentication protocol. each of them below [3]:
1) Web Single Sign On: Web Single Sign On is sometimes
called as web access management. It enables a user to
provide its credentials and only after the successful
completion of authentication process, it establishes a
relationship of trust that grants a user right to access all
the resources for which he/she has been permitted.
2) Legacy Web Single Sign On: Legacy SSO is also
termed as Enterprise SSO. After a successful
authentication event, it manages multiple logins to
specific applications. Web SSO and legacy SSO are
almost identical in their structures. The difference lies in
the fact that Web SSO only manages the web based
service, while the Legacy SSO extends the SSO
functionality to the traditional legacy applications and
Fig 5: Token Based SSO network resources, typically within an enterprise’s
internal network.
2.3 Trust Models of SSO
Different trust models need to be defined in order to evaluate 3) Federated Single Sign On: Federated SSO has a much
various SSO solutions. These models vary depending on the broader concept than Web SSO. It uses Simple Object
scenario of business in which they are implemented. The Access Protocol (SOAP) and Security Assertion Markup
model generally defines the various entities and their Language (SAML) to enable users to sign on once into a
interaction and the overall system characteristics. Based on member of affiliated group of organizations and
the services that the SSO environment support, three models henceforth, access all the websites within that trusted
have been defined. These are [4]: federation. It extends the functionality of SSO from
user’s home domain to another foreign domain. This
1) Authentication and Authorization Model (AAM): function of Federated SSO is its main advantage.
AAM describes all the necessary frameworks that Enterprises using federated SSO are allowed to maintain
provide the basic two features that are authentication and the control of their local services and the exposure of
authorization. The model being a traditional trust model these resources to a larger class of users without the
represents the basic mechanism in which there is a enterprise’s direct administration.
service that checks all the users’ credentials to decide
whether an access should be granted or not to a user that 3. SINGLE SIGN ON ENABLING
is requesting an access. Here two major entities are
involved: users that are requesting access to resources
TECHNOLOGIES AND PROTOCOLS
and services that share these resources. AAM model thus There are multiple protocols that can be used for SSO
is based on a classic client-server architecture providing implementation like Kerberos, Security Assertion Markup
a generic protocol of authentication and authorization. Language (SAML) etc. Few of them are listed below [5]:
2) Federated Model (FM): It is one of the emergent trust 1) Kerberos: The Internet Engineering Task Force (IETF)
model wherein several homogenous entities interact to has defined the Kerberos protocol as an open standard
provide the required services. Again here two major that is used on many platforms. The protocol makes use
entities are identified: users that request access to of Key Distribution Centre (KDC) as the server. It
resources and the services that share these resources. The provides strong token based authentication using secret
major difference between AAM and FM model lies in key cryptography for client/server applications. KDC
the definition and composition of services. In the latter authenticates the users to other servers for a particular
one, the services do not reside on the same domain. session. The primary and secondary authentication
Hence are distributed on different domains that are built domains share a trust relationship that is based on
on the same level, thus allowing mutual trust and cryptographic methods and is used to validate the user
functionalities like cross-authentication are also being token. The transportation of authentication tickets is done
provided. using Remote Procedure Calls(RPC). Kerberos is a good
3) Full Identity Management Model (FIMM): This choice for organizations that wish to authenticate users
model is one the most challenging trust model and could using SSO to multiple applications across different
merge the above two models. The model in addition technologies but the system applications should support
provides mechanisms of identity and account Kerberos for this work.
management and privacy protection. Here three major 2) Lightweight Directory Access Protocol (LDAP): The
entities are involved: users which request access to servers that centralize information about an organization
resources, services that share these resources and identity such as employee names, employee address, telephone
manager, which manages the user identities by providing numbers and credentials are called directory servers and
the necessary functionalities. The model tries to fulfil the LDAP is used to query these servers. Active Directory a

20
 International Journal of Computer Applications (0975 – 8887)
Volume 151 – No.11, October 2016

Microsoft’s version of LDAP enables true SSO using involved in SAML are the user, the Identity Provider
Kerberos but for Window’s environment only. For (IdP) and the Service Provider (SP) as shown below. The
application authentication, central LDAP is more IdP makes ‘assertions’ about the user’s identity and
practical than building authentication into each attributes to the SPs. Service provider (SP) provides a
application. specific service or hosts a target application.
3) RADIUS Protocol: The acronym stands for Remote
Authentication Dial-In User Service. The protocol is
used for authentication of remote users for example users
that connect via Virtual Private Network (VPN). The
protocol is a connectionless client/server protocol based
on User Datagram Protocol (UDP). RADIUS server
which is usually a daemon running on UNIX or windows
machine when provided with the user credentials, can
support various authentication mechanisms such as PAP,
PPP or Unix login.
4) Agent Scripts: When security policies are revised or
passwords are changed, scripts that run on a central
authentication authority can be used to synchronize a
user’s password across systems. This can be done via
Extensible Markup Language (XML) scripts and
Structured Query Language(SQL) can be used for
encryption to manipulate the data in databases.
5) Cookies: The pieces of software that are downloaded
Fig 6: Protocol Flow of SAML
onto the client machine are called cookies. Cookies are
token based SSO technology for HTTP environment that Figure 6 shows the flow of SAML. The three main
are used to authenticate sessions for certain time periods. entities are: user, Service provider and the Identity
The user will have to re-authenticate itself after the provider. The steps involved in the working of SAML
cookie expires. are shown in Figure 6 where a user first requests Service
provider like GOOGLE to access its application. The
6) Digital Certificates and Public Key Infrastructure
Service Provider can make a proper access control
(PKI): A system used for storing and maintaining
decision i.e., whether to perform a requested service for
encryption keys is referred to as a Public Key
the particular user or not based on the assertion which is
Infrastructure (PKI). This approach makes use of the
being provided by the Identity provider on request of the
public key cryptography for user authentication. The
concerned Service Provider [6].
system relies on the role of Certification Authority (CA)
for the issuance and management of the digital 2) OpenID: OpenID is an open and promising user-centric
certificates and hence users’ digital identities. The user Web SSO solution. A web SSO solution has separated
first has to identify herself/himself to an authentication the role of Identity provider (IDP) from that of Relying
authority which issues a public key certificate to the party (RP). An IdP collects user identity information and
authenticated user. Whenever the authenticated user authenticates users, while for further authorization
wants to access a protected resource in subsequent decisions, RP relies on the authenticated identity. In
authentication request, he/she creates a token and OpenID, the existence of trust relationship between IdP
includes its digital certificate (public key) in it and signs and RP is not required and users are free to choose or
it with her/his private key. On the reception of the setup their own OpenID providers [7].
request, the target server contacts the CA in order to
verify the identity of the requesting user. There is a Figure 7 shows the protocol flow of OpenID. Its flow
relationship of trust between the primary CA and the may vary with different implementations. Here, the user
secondary CA as the latter’s certificate is being issued by selects it’s IdP or enters his/her own OpenID via a login
the former one. This enables any secondary CA to accept form presented by a RP. The RP discovers IdP (OpenID
the certificate issued by the primary CA. provider) endpoint and redirects his/her OpenID to the
IdP for authentication of the user. The user enters his/her
7) Web Security Service: It supports cross domain and username and password and hence authenticates itself to
cross platform communication among different business the IdP and then consents the IdP to the release of his/her
entities. profile. The IdP verifies the user’s credentials and if
valid, redirects the OpenID and profile signed by it to the
According to our study, the protocols used in web SSO are:
RP. Ultimately, the user gets an access to the application
1) Security Assertion Markup Language (SAML): he/she wished to access [7].
Security Assertion Markup Language (SAML) is a
XML-based protocol developed by Organization for the
Advancement of Structured Information Standards
(OASIS). It is basically a platform independent, non-pro
proprietary protocol that is used for communicating user
identities between parties- who usually conduct business
with each other. SAML is a key aspect of Federated
SSO. It allows the communication between domains
having different authentication mechanisms. The entities

21
 International Journal of Computer Applications (0975 – 8887)
Volume 151 – No.11, October 2016

quite hectic. The solution to this can be SSO. With SSO

the enterprises can easily centralize their authentication
management and allow users to login once and
henceforth access all the shared applications. Thus, helps
the collaborative partners to reduce production time,
deliver better products on time [9].
5) Security: As the concept of SSO allows users to
remember just one password, the users prefer to choose
complex, hard to crack password instead of using
multiple simple passwords. This improved the system
security [3].

4.2 Drawbacks of Using SSO

The drawbacks of using SSO are as follows [8]:

1) Scalability problem: The SSO implementation can be

difficult, time consuming and expensive to fit into
existing applications.
Fig 7: Protocol Flow of OpenID 2) Logged in desktops: Although the SSO implementation
reduces security risks but the threats can be manifold.
4. BENEFITS AND DRAWBACKS OF For instance, a legitimate user might sometimes just walk
SSO away from his system leaving his/her account logged in.
The implementation of SSO has both positive as well as A malicious user can easily gain access of it and hence
negative impact. The pros and cons of SSO are discussed all the authorized resources are compromised. Although,
below: this problem can encounter with security generally, but
the after effects with SSO are worse as without SSO only
4.1 Benefits of Using SSO one resource gets comprised because separate logins are
Following are the benefits of using SSO [8]: required for other applications.
1) Increased user productivity: With the advent of SSO, 3) Single point of failure: The arrangement is prone to
users no longer need to memorize multiple IDs and denial of service attack as the authentication mechanism
passwords. Thus, SSO truly shouldered the burden of is centralized.
users by eradicating the hassle of multiple passwords.
The users just need to go through single login step and 4.3 Challenges in the Growth of SSO
enjoy access to multiple applications. There are many challenges in the growth of SSO. Few of them
are as follows [7]:
2) Increased developer productivity: The implementation
of SSO provides a monotonous authentication framework 1) Resistance to change: Most of the users are comfortable
to the developers. The developers need not to worry with the existing system of multiple login system and
about authentication at all if the SSO mechanism is don’t want to switch from this traditional system to a
independent. When once a request for an application is new method of single step authentication. They mostly
accompanied by a username, the developers can assume prefer to use the password manager feature of browsers.
that the authentication has already taken place.
2) Security issues: Most of the people are in an impression
3) Simple administration: The administration burden of that by using single sign on mechanism, they are
user account management is also simplified when providing directly their usernames and passwords to the
applications participate in SSO protocol. As SSO deals server and hence, their sensitive information is stored
only with authentication, the level of simplification locally somewhere.
depends merely on the applications. Thus, some user
specific requirements may still be required to be set up 3) Phishing issues: The users also highlight phishing
by the applications. attacks as one of the main reasons that hinder the SSO
adoption as they couldn’t really find any distinguished
4) B2B collaboration: In today’s world, most of the difference between the real websites and the bogus ones.
companies do not work alone but rather join hands and
work as partners to bring out something fruitful. This 4) Trust issues: This factor is the most crucial one. The
collaboration of various businesses is of large scale and users often hesitate to provide their personal and
is functional only if the participating businesses are sensitive information to the websites using SSO. Often
interoperable that is they should be able to interact with the websites using SSO feature ask the users to permit
their disparate IT systems and should exchange data with them to access their contact list, location and other
ease. To make it happen, the enterprises make use of sensitive information which clicks every users’ mind
extranets. Here, enterprises allow their trading partners, before he/she agrees to the clause. Depending upon the
service providers etc. to access not only their data but popularity of the website and the trust relationship
also some company owned applications. Thus, as a result between the user and the website, user either adopts the
various users need to perform multiple logins to various SSO approach or decides to go for multiple sign-on
applications; some belonging to their own organization sessions, thereby avoiding the situations where their
while some to their business partners. Hence, the information may get compromised somehow.
authentication and authorization mechanism becomes

22
 International Journal of Computer Applications (0975 – 8887)
Volume 151 – No.11, October 2016

5) Linking of accounts: The users mostly are not familiar 5. COMBINATION OF (SSO) WITH
with the account linking process and when asked by a
website to login by their existing social networking MULTI FACTOR
accounts, they get confused and frustrated and eventually AUTHENTICATION (MFA)
drop the plan of SSO. The process of proving your identity and verifying that you
are the same entity as you claim to be is referred as
If the above factors are properly addressed, then the SSO authentication. There are a variety of mechanisms available
technology may gain momentum in the lives of the socially for authentication, these are: Biometrics, One Time
active users. They may switch to the concept of “All the eggs Passwords, Digital Signatures etc. The authentication is called
in one basket”. Among all, the trust factor is the most as Multi-Factor Authentication (MFA) if at least two of the
significant one as the trust and privacy share inverse three authentication mechanisms listed below are satisfied at a
relationship i.e., as the trust increases, privacy decreases particular instance of time by a user [5]. These mechanisms
automatically. The websites following SSO mechanism are:
should have proper design interfaces with least errors. If the
users perceive a website to be honest, competent and 1) Something you know (a password or a PIN)
convenient in delivering its services they would trust it and
hence will easily accept the websites’ terms and conditions 2) Something you have (say a smart card or a mobile
and will provide the correct and accurate information [7]. phone)

For all the information and resources kept in the system like 3) Something you are (as represented by, say, a fingerprint)
personal detail information, users’ profiles, addresses, cost An ATM based transaction is an example of Multi Factor
documents, certificates and policies related to the company, Authentication as here two of the above three conditions need
privacy has a role to play. These important documents must to be satisfied for a successful transaction. The ATM card
be stored securely so that the information will never get holder must have his/her ATM for a transaction satisfying the
compromised. SSO identities carry the personal information type “Something you have” and besides this, he/she must have
of the user. Due to this reason, privacy is more important in the pin code of the same which satisfies the another condition
the open SSO environments than the closed one. Several “Something you know”. Multi Factor Authentication if used
organizations are thus looking for SSO identities that do not in collaboration with SSO can help to reduce the security
carry personal details and support unlink ability feature for issues related to SSO and hence, making it more secure [5].
those identities which they are transporting inside the
network. The proxy servers should be used to carry traffic
between the users and the SP (Service Provider) in order to
ensure that the user’s real network address is replaced by the
proxy one [7].

4.4 Users Adaptability for SSO

Most of the users nowadays may like to switch over to SSO
because of the following reasons:
1) The Registration Challenge: 86% of the people may
leave a website when asked to create a new account due
to way lengthy forms. 42% of the people find registration
forms too lengthy, or ask too many questions. Fig 8: Combination of SSO with MFA

2) Password Fatigue: 50% of the users dislike the idea of Figure 8 shows the combination of SSO with MFA where a
creating new password combination. Moreover, often the user first signs in via Single Sign On approach (PKI
users already have to remember at least 5-6 passwords encryption) and has to get through second authentication step
besides this new one. Almost 40% use the forgot using MFA like One Time Password (OTP) before getting
password feature every month. Even some people even access to the resource. OTP can be delivered to the user via
have a thought like solving the world’s peace problem is SMS, phone call or using some mobile application. The time
even easier than remembering so many passwords. limit of the OTP is fixed after which the session expires
making the code invalid.
3) Trust: Trust is a problem. 88% of the users have
admitted that they have lied on a registration form but 5.1 Advantages of Using SSO with MFA
60% would give more information, if they knew how it Following are the benefits of combining SSO with MFA [5]:
would be used.
1) Enhanced user productivity and user satisfaction: The
Though password manager feature shoulder the password SSO approach increased user productivity and
fatigue burden but they can’t resolve the registration satisfaction as users need to spend less amount of time on
challenge. Then the choice users are left with is “Social logging into systems.
Login”, introduced in 2008. Almost 77% prefer social logins.
2) Reduced IT costs: SSO reduced the no. of password
Social logins occur when users use their existing IDs from a
reset calls to the IT help desk up to 95% as now the users
social network or email provider. Facebook is the most
need not to memorize multiple passwords, it’s just one
popular one. 54% are using Facebook social login. For the
password and 90% of the users’ work is done.
first time since Janrain has been reporting, Facebook has
Furthermore, the installation, maintenance of separate
exceeded 50% of the aggregate total of all social logins. Thus,
authentication systems also is reduced as SSO provides
the burden of registration is overcome by the concept of social
central management of users. There is further reduction
logins. Most people like to return to a website if they get
in IT costs and improvement in efficiency as the cost of
automatic recognition through social network [10].

23
 International Journal of Computer Applications (0975 – 8887)
Volume 151 – No.11, October 2016

MFA systems like fingerprint scanners is decreasing but has three different accounts, he would prefer to set easy and
not at the cost of reliability. almost same password to access each of its account say “his
birthdate” or “his best friend’s name” and so on.
3) Improved Corporate data security: The risk of a
hacker getting “key to the castle” which was a major SSO systems can centralize authentication on special servers
breakthrough in SSO is reduced by the coupled usage of as they are often based on complex systems management
SSO with MFA and also this implementation gives more applications. Thus can make a positive contribution to an
assurance of a user’s true identity- sometimes required information security program of an enterprise. This can be
for systems or transactions of higher risk to an done by using dedicated servers that hold SSO modules.
organization. The attacks like phishing and malicious These servers act as gate keepers, thus making sure that all the
code attacks also can be prevented as though the traffic trespasses through the SSO server first, which then
password can get compromised somehow but the passes along the credential it has stored for authenticating the
additional authentication factors like biometrics or tokens particular application registered with the SSO system. To
cannot be obtained easily. prevent malicious access, this centralization requires more
planning, tuning and auditing than single authentication
4) Enhanced business customer base: The prime systems. The secure storage of authentication credentials and
requirement of an account creation with a password often encryption keys in SSO systems make the hackers job even
impede users from registering on retailer websites which more challenging. Keeping track of users, pruning out inactive
can badly affect the business of owners. SSO via its accounts of long-gone employees and monitoring suspicious
technology of OpenID, allows users to register even activity are all part of SSO and can increase an organization's
without a password. Hence, encouraging more registrants IT security [12].
and business.
Also by using the SSO in collaboration with MFA can help to
5.2 Challenges in SSO/MFA reduce the risk of loss of “Single key to the castle” as for now
Implementation even if the master key gets compromised somehow, still the
Some of the challenges associated with SSO/MFA hacker can’t get access to the sensitive information of the user
implementation are [5]: without crossing the second step of authentication [5].

1) Although MFA minimizes security problems related to Hence SSO approach altogether helps the users to easily
access control but still there are some security issues like access and manage different applications and services
the OTP tokens that can be compromised by man-in-the- securely. Although there are some risks involved but if the
middle phishing attack, smartcards can be hacked or user manages to keep the key secret, then SSO may be of
stolen, the Trojan horses can be used by attackers to great benefits.
piggyback the user sessions after they have logged in.
Though MFA can be cracked yet it does enhance the 6.2 Is SSO a Risk Factor?
security of corporate networks rather that of Internet as SSO helps to avoid the loop of authentication but at the cost
the attackers keep on changing their tactics. of some drawbacks. The users may be unable to authenticate
themselves if the SSO provider goes down, thereby bringing
2) The success of SSO and MFA implementation relies on the whole system’s working to halt. This failure is called as
user acceptance. The users may resist to carry tokens single point of failure. Also, it is quite possible for a SSO
with them or get fingerprinted. Tokens can easily get server to get hacked or breached, which may lead to data loss.
misplaced by users or stolen by attackers. Thus, user Furthermore, all of the crucial and confidential data of a user
acceptance is a key challenge to SSO/MFA may get compromised in just a single shot, as all of the
implementation. authentication credentials are in the same basket and the key
to the basket may get revealed if the coupled usage of SSO
3) Depending on the size of an organization and the type of
and MFA is not implemented. Thus, it cannot be considered a
SSO/MFA technology used, system costs can be
total security tool. Sharing of user data with a third party is
extremely high. Some systems like client software may
another underlying factor which enhances the risk factor of
not support MFA devices and hence, new compatible
SSO usage. In order to cover a good portion of potential users,
devices (hardware and software) need to be purchased,
the right choice of Identity provider is vital. Hence, the
configured and installed. Hence, a proper cost analysis
disadvantages of relying on a third party is overwhelming and
can correctly determine the worth of SSO and MFA.
needs to be addressed to minimise the risk factor involved in
6. ANALYSIS SSO [12].
6.1 Is SSO a Security Practice? 7. CONCLUSION
The concept of Single Sign On has gained momentum in SSO is an access control method that allows a user to access
recent years with the increasing popularity of social multiple domains on a single step of authentication. Thus,
networking. One login type applications provide access to relieves the user from the hassle of remembering numerous
tons of accounts across the panel, particularly in social media passwords for multiple applications. SSO is used for user
[6]. Most of the users prefer to use SSO approach because it is convenience. However, if the main key of the authentication
convenient for them as it allows them to access scores of is breached, then the user’s crucial details may get
individual accounts just by remembering a single password compromised. As discussed, this threat of losing master key
and henceforth saving them from the hassle of setting unique can be reduced by using SSO with MFA. The combination of
set of username and password to each of their accounts. SSO and MFA may allow a user to not worry about the
Besides these benefits, SSO has some negative impact too but negative consequences of losing his/her master key. Due to
still the risks of SSO users are less than those of non-SSO second step authentication, an intruder cannot access a user’s
users as the latter tend to keep almost same password to confidential data by acquiring just a key. However, MFA also
access their internal and external applications and mostly store has a bottleneck. It can get compromised by phishing or man-
their passwords in unsafe areas [11]. For example, if a person

24
 International Journal of Computer Applications (0975 – 8887)
Volume 151 – No.11, October 2016

in-the-middle attacks. For example, a fraudster somehow may Organizations – A Critical Evaluation Using TOE
steal a legitimate user’s OTP which is possible by installation Framework. J. Issues in Informing Science and
of malicious software on the target’s device and hence, Information Technology, (May 2010), 172-184.
bypassing the traffic meant for it. However, these threats can
be addressed by several ways like disabling key logging and [6] [Online]https://wiki.eclipse.org/images/e/ec/Saml2idp-
screen capturing of OTP, securing authentication and 1.png
communication against malware attacks etc. Thus, the [7] Sun, S. T., Pospisil, E., Muslukhov, I., Dindar, N.,
benefits of using SSO are worth mentioning and if its Hawkey, K., and Beznosov, K. What Makes Users
disadvantages are properly addressed and tackled, it will be Refuse Web Single Sign-On? An Empirical Investigation
user convenient and will help them to access applications with of OpenID. J. Symposium on Usable Privacy and
ease and security. As a part of future work, we would like to Security (SOUPS), (Jul. 2011), 1-3.
focus on implementing security mechanisms in combination
of SSO and MFA. [8] "The Advantages and Disadvantages of Single-Sign-On
(SSO) Technology", Secure Connexion, 2012. [Online]
8. REFERENCES https://secureconnexion.wordpress.com/2012/08/24/the-
[1] Li, B., Ge, S., Wo, T. Y. and Ma, D.F. 2004. Research advantages-and-disadvantages-of-single-sign-on-sso-
and Implementation of Single Sign-On Mechanism for technology-mini-whitepaper/.
ASP Pattern. In Proceedings of the Third International
[9] Villanueva, J. 2014 "5 Big Business Benefits of Using
Conference on Grid and Cooperative Computing.
SSO (Single Sign-On)" Managed File Transfer and
[2] [Online]http://blogs.vmware.com/vfabric/files/2013/03/a Network Solutions.
uthentication_chart.png
[10] [Online]
[3] Patil, A., Prof. Pandit, R., and Prof. Patel, S. 2013.
http://janrain.com/wp-content/uploads/2012/10/how-to-
Analysis of Single Sign on for Multiple Web
solve-the-online-registration-challenge.png
Applications. J. Advanced Research in Electrical,
Electronics and Instrumentation Engineering, (Aug. [11] "Does single sign-on (SSO) improve
2013), 4104-4107. security?” SearchSecurity, 2016. [Online]
[4] Ardagna, C. A., Damiani, E., Vimercati, S. C., Frati, http://searchsecurity.techtarget.com/answer/Does-single-
F.and Samarati, P. 2006. CAS++: an Open Source Single sign-on-SSO-improve-security.
Sign-On Solution for Secure e-Services. In Proceedings [12] Davis, M. 2013 "The Pros And Cons Of Single Sign-On
of the 21st International Information Security Conference for Web Services", Future Hosting, [Online]
on Security and Privacy in Dynamic Environments. https://www.futurehosting.com/blog/the-pros-and-cons-
[5] Alphonso, M. D., and Lane, M. 2010. The Adoption of of-single-sign-on-for-web-services/.
Single Sign-On and Multifactor Authentication in

IJCATM : www.ijcaonline.org 25

View publication stats