Towards Adoption of Authentication and Authorization in Identity Management and Single Sign On

Abstract

Identity and Access Management (IAM) and Single Sign on (SSO) are two security concepts that are related to each other. IAM governs the user access in an organization whereas SSO facilitates the user by authenticating to one centralized application and not having to re-authenticate when trying to access other applications. This paper addresses the different benefits that an IAM and SSO tool can provide to reduce the security risk within an organization. Since, authentication and authorization are one of the major concerns in the cyber security; this paper analyzes common problems that are faced during authentication and authorization. We have also analyzed prior researches that have been done in the IAM and SSO space along with conducting a survey to understand the different issues and benefits of IAM and SSO. From the survey that has been conducted, we have addressed different issues when implementing IAM and SSO solutions along with understanding the architecture, in which these solutions have been deployed into. The surveys conducted have been compared with prior researches done in IAM and SSO space to understand the benefits that the solution provides. The results from the survey have been analyzed to provide the best practices when implementing IAM and SSO solutions along with the benefits provided by the solution.

The Single Sign On Model Using SAML and OAuth for Online Application of UPNYK

“…SAML has generally been able to provide cross-domain authentication security with high mechanism efficiency [8]. But SAML can be integrated with OAuth to provide layered security, where SAML encrypted can be encrypted by Oauth running on Transport Layer Security (TLS) then it can achieve mutual authentication without the help of trusted third parties, [9].…”

Evaluasi Penerapan Single Sign-on Saml Dan Oauth 2.0: Studi Pada Perguruan Tinggi Yogyakarta

“…Praktik yang direkomendasikan untuk diikuti dapat bervariasi berdasarkan klasifikasi dan kebutuhan perguruan tinggi. Klasifikasi perguruan tinggi dikelompokkan menjadi kecil, sedang, dan besar berdasarkan jumlah aplikasi yang dimiliki [22] Berdasarkan survei yang dilakukan dapat disimpulkan bahwa sebagian besar perguruan tinggi masuk dalam klasifikasi kecil dengan mengelola kurang dari 50 aplikasi, yaitu sebesar 54.5% (Gambar 3). Hanya 13.6% responden dari 2 perguruan tinggi yang masuk dalam klasifikasi besar dengan mengelola lebih dari 150 aplikasi.…”