In this lesson,
we will learn about identity and authentication.
Identity and authentication
involve verifying a user's identity
to ensure they are authorized
to access resources and perform actions.
Identity and authentication concepts include attestations,
single sign-on, federation,
identity providers and service providers.
Let's learn more about these identity
and authentication concepts.
First, we have identity providers.
In the world of identity and authentication,
identity providers play a central role
in managing users' identities across multiple systems.
A real world example of an identity provider is Google,
which allows users
to log into various services using their Google credentials.
Google manages the authentication process,
ensuring that the user's identity
is verified before granting access to resources.
By centralizing authentication,
an identity provider simplifies user management
across multiple platforms
while maintaining security and consistency.
Second, we have single sign-on or SSO.
Once a user's identity is verified by an identity provider,
single sign-on lets them access multiple applications
or services within the same domain without logging in again.
This makes things easier for users
because they only need to authenticate once,
usually when logging into their computer
or when getting access to a resource.
After that, they can access systems like email,
file servers, or internal applications
without having to enter those credentials again.
The systems that depend on the identity provider
for authentication are called service providers.
We will discuss service providers
in more detail a bit later.
One common protocol that facilitates sign-on
in enterprise environments is Kerberos.
Kerboros is widely used in systems
like Microsoft Active Directory to secure
and manage single sign-on within a corporate network.
When a user logs in, the Kerberos Key Distribution Center,
or KDC, issues the user a Ticket Granting Ticket or a TGT
after verifying the user's identity.
This Ticket Granting Ticket allows the user
to request access to multiple services
without needing to enter their credentials again.
The client then uses the Ticket Granting Ticket
to request a service ticket
from the Key Distribution Center's Ticket Granting Service
or TGS for each service
or resource that they need access to.
The client can then present the service ticket,
which they receive
from the Key Distribution Center's Ticket Granting Service
to applications, which are service providers,
ensuring they can access resources like email, file storage,
or internal applications without re-authenticating.
Another protocol used to facilitate single sign-on
and federated identity management is shibboleth.
Shibboleth is an open source solution
that allows users to authenticate once
and access resources across multiple organizations
without revealing their individual identity
to the service provider.
This is especially useful when privacy is a concern.
In this case, the origin server
verifies the user's identity, but the target server,
which is the service provider, only receives confirmation
that the user has been authenticated
without any additional identifying information.
This protects the user's privacy
while ensuring secure access to resources.
Third, we have service providers.
These are the applications or systems
that rely on an identity provider for authentication.
In a domain, service providers include tools
that are used for different purposes.
For example, service providers in a company
may include the company's messaging platform, shared drives,
and customer relationship management systems.
All of these services use the same identity provider
to manage user access.
Service providers trust the identity provider
to authenticate the user
and deliver an attestation that the user has been verified.
The service provider then grants access
based on the user's verified identity.
Examples of service providers include platforms like Slack,
Dropbox, or Salesforce, which allow users
to log in using their Google
or other identity provider credentials.
This division of responsibilities
makes it easier for service providers
to manage access while maintaining security
as they delegate the identity verification process
to trusted identity providers.
In some systems, JavaScript Object Notation Web Tokens
or JWTs, pronounced jots,
are used to transfer this authentication information
between the identity provider and the service provider.
A JWT contains key information
about the user in a JSON format
or JavaScript Object Notation format,
and is signed for security.
The JWT allows service providers to verify a user's identity
and authorize access to the necessary resources,
simplifying the interaction between systems.
Fourth, we have federation.
Federation builds on the concept of single sign-on
by enabling multiple organizations
to collaborate on identity management.
In a federated environment,
organizations trust a common identity provider
for authentication.
An example of federation is the eduGAIN network,
which connects national identity federations in the research
and education sectors globally.
This allows students, researchers,
and staff from different universities
to access shared services
using their home institution's credentials.
Federation agreements establish trust
and ensure secure access across institutions
by adhering to common identity and security standards.
In a federated system,
trust can also extend across multiple federations.
This is called transitive trust.
Transitive trust means that if federation A
trusts federation B, and federation B trust federation C,
then federation A automatically trusts federation C.
This allows users authenticated in federation A
to access resources in federation C
without needing additional authentication,
even though federation A
and federation C do not have a direct trust relationship.
This layered trust system
extends across multiple federations
and further streamlines cross-organizational access.
It allows users to securely access resources
across multiple institutions or sectors,
maintaining the same level of security
and trust as within a single federation.
Fifth and last, we have attestation
to ensure that trust is maintained.
Attestations are used to communicate identity verification
between an identity provider and a service provider.
Attestation is a message
sent by the identity provider to the service provider
that confirms the user has been authenticated
and specifies what access rights they have.
For example, when you log into a service provider
using Google, the identity provider sends an attestation
that tells the service provider who you are
and what level of access you have.
These attestations can be transmitted
using various protocols like SAML
or the Security Assertion Markup Language,
OpenID, or others.
In the case of the Security Assertion Markup Language
or SAML, the attestation is in an extensible markup language
or XML-based message that contains information
about the user's identity and permissions.
This allows the service provider
to trust that the user has been properly verified
without handling the authentication process itself.
So, remember, identity and authentication
involve verifying a user's identity
to ensure they are authorized
to access resources and perform actions.
Key concepts include attestations, single sign-on,
federation, identity providers, and service providers.
These elements work together to simplify access management
and enhance security across systems.
Identity providers manage user identities
while SSO allows users
to access multiple services after a single authentication.
In a federation,
organizations collaborate to manage identities,
allowing users to access resources
across different institutions securely
through shared trust agreements.