SSO made so easy with OSS

In the past years the number of web-based Inter- and Intranet applications has increased drastically. Most of these applications need some form of user authentication, leaving the user with a lot of different Internet identities. Even the Dutch government has identified the potential security risks caused by this growing digital key chain, let alone the user unfriendliness of having to sign in separately for each individual application. Still most organizations are scared to introduce single sign-on (SSO), because it seems too complex and expensive and the advantages are not well understood. However, current open-source solutions make it easier to implement SSO than you might think, with minimal impact on your existing applications. 

This technical session will demystify the complexity of SSO and present the concepts and open source solutions currently available, supported by practical examples. After quickly explaining the basic concepts, a comparison is made between the different open source alternatives. After that, for some of the alternatives a step-by-step tutorial will be given with real-life code and configuration examples that shows you how to SSO-enable your existing application. Finally some best practices and lessons learned will be discussed to get you right up to speed and start implementing SSO tomorrow. 

Level Intermediate. 

Track in which the content is to be categorized Enterprise.

Prerequisite knowledge
Although this session will shortly introduce single sign-on concepts, basic knowledge of web development in general and security in particular helps in understanding the details in this session.

Outline of the presentation
The presentation is structured as follows:

• Introduction
• e-Herkenning
• The basic concepts of SSO
• Authentication and authorization as infrastructure service
• Cross-domain SSO
• Identity Federation
• Identity Providers and Service Providers
• SAML
• XACML
• Comparison of the main open source players
• OpenSSO - Open Web SSO
• JOSSO - Java Open Single Sign-On
• A-Select Authentication System
• JBoss Identity
• JA-SIG CAS - Central Authentication Service
• Setting up SSO
• Step-by-step SSO enabling applications with code examples
• Troubleshooting SSO with WebScarab, LiveHTTP Headers and HackBar
• Conclusion
• Best-practices and lessons learned
• Questions and answers

Eelco Klaver  E.Consulting Eelco Klaver is sinds 2006 werkzaam als senior consultant bij E.Consulting, wat zich specialiseert in Enterprise Java consultancy en training. Hij houdt zich hier bezig met Enterprise Java architectuur, security workshops, software reviews en security audits. Eelco heeft ruim 11 jaar hands-on ervaring met het ontwikkelen van enterprise applicaties in Java en J2EE bij verschillende werkgevers en voor diverse grote opdrachtgevers. De laatste jaren heeft hij zich gespecialiseerd in de beveiligingsaspecten van op J2EE gebaseerde enterprise applicaties.