Single sign-on overview

A single sign-on solution is designed to alleviate the use of having multiple user names and passwords across your enterprise. Implementing a single sign-on solution benefits user, administrators, and application developers.

In traditional network environments, a user authenticates to a system or application by providing user credentials defined on and by that system or application. Traditionally, both authentication and authorization mechanisms use the same user registry when a user attempts to access a resource managed by the system or application. In a single sign-on environment, authentication and authorization mechanisms do not have to use the same user registry to enable users to resources managed by the system or application. Single sign-on environments use network authentication service (Kerberos authentication) as their authentication mechanism. In an single sign-on environment, the user registry used for authentication does not have to be the registry that the system or application defines. In a traditional network environment, this poses a problem for authorization.

In an single sign-on network environment, applications use Enterprise Identity Mapping (EIM) to solve this problem. EIM is a mechanism for mapping or associating a person or entity to the appropriate user identities in various registries throughout the enterprise. Application developers for IBM® i use EIM to build applications that use one user registry for authentication and another for authorization--without requiring the user to provide another set of credentials. The benefits of a single sign-on environment are numerous, and not just for users. Administrators and application developers can also benefit from the single sign-on solution.

Benefits for users

The single sign-on solution reduces the number of sign-ons that a user must perform to access multiple applications and servers. With single sign-on, authentication occurs only once when users sign into the network. Using EIM reduces the need for users to keep track of and manage multiple user names and passwords to access other systems in the network. After a user is authenticated to the network, the user can access services and applications across the enterprise without the need for multiple passwords to these different systems.

Benefits for administrators

For an administrator, single sign-on simplifies overall security management of an enterprise. Without single sign-on, users might cache passwords to different systems, which can compromise the security of the entire network. Administrators spend their time and money on solutions to diminish these security risks. Single sign-on reduces the administrative overhead in managing authentication while helping to keep the entire network secure. Additionally, single sign-on reduces the administrative costs of resetting forgotten passwords. Administrators can set up a single sign-on environment where a user for a Microsoft Windows operating system can sign-on once and have access to the entire network, thus minimizing authentication and identification management.

Benefits for application developers

For developers of applications that must run in heterogeneous networks, the challenge is to create multi-tiered applications where each tier is likely to be a different type of platform. By exploiting EIM, application developers are free to write applications that use the most appropriate existing user registry for authentication while using a different user registry for authorization. Not having to implement application specific user registries, associated security semantics, and application level security significantly lowers the cost of implementing multi-tiered, cross-platform applications.