Sims.net Single Sign On

[webbobfc]

Hi All,

 

We have been recently been asked to look into single sign on for Sims.net. We are aware this is possible but we have never had any great need or wanted to do this until now. Does anyone have any information on how we set this up, linking the AD accounts to the Sims accounts, as it stands both accounts are seperate with different usernames for both. We have a inhouse Sims server so we are not hosted or anything. The information I have found up until now is very vague mainly editing the connect.ini files.

 

Also has anyone got any good\bad experiances of the above, I'm very reluctant to do it to be honest, I think it takes away a layer of security and there's always a risk a staff member could leave a PC logged on with access to Sims. Adding short locking screens to the PCs brings its own problems.

 

Any info\opinions would be great.

 

Thanks

Webbobfc

[Steve21]

Basically it's the change in the ini to use trusted, and then their sims username changed to their AD username etc. So it matches them when logging in.

 

But as you said I wouldn't do it, anyone who accesses a machine could access SIMs and then there's problems with things like what happens if a machine is logging off and gets stuck on a "this program won't let it close" etc, a short lock won't resolve any of those.

 

Steve

[webbobfc]

Thanks Steve,

 

Same opinion as you, think we may need to dig our heels in a bit.

[jthompson]

We use the trusted auth option. From a technical standpoint, it's reliable and saves us quite a lot of faff. My only concern is that yes, there's that risk of it being left open to abuse. We have at least got the principle of least privilege applied in terms of privileges within SIMS.

 

Even if you decide to make use of trusted authentication, you can apply it on a per user basis, so if there were some situations where you felt it was reasonably safe (e.g. in admin offices where students aren't found) you could use it there, but make teachers' account use a separate password to open SIMS (laptop left open in a rowdy classroom, etc.).

[thimon]

I was originally all for this and asked similar questions regarding SSO on here. We've now moved over to Hosted SIMS where each user is given a seperate @Hosted.sims.co.uk username which requires a complex password which expires every 3 months, all seperate from AD. After thinking about it and taking on board advice from people I think this is the best method of signing into SIMS. There's SO MUCH confidential information on SIMS regarding staff and students, we shouldn't make it difficult for staff to log into SIMS, but I really don't think SSO or an AD sync is the right way to go about it. My few pence, but each to their own!

[Quatermass]

We looked at this long ago and decided not to do it. Having separate logins for SIMS isn't a sophisticated security measure but every little helps...

[Steve21]

Even if you decide to make use of trusted authentication, you can apply it on a per user basis,

 

I'm curious, how's that work? Or does setting the trusted within the ini still fall back to the standard password if their username isn't changed within SIMs?

 

Steve

[HPlum78]

How does having a separate login stop kids access a laptop that has been left open in the classroom? chances are from what I have seen in the past SIMS (insert your own MIS/ web service here ) will be open anyhow!

 

The issue is understanding that SSO is only part of IAM (Identity and Access Management) if you just talk about SSO then you are missing a much larger picture and you will always fail to deliver a seamless user experience and introduce identity/ password fatigue. You could deliver SSO to your MIS solution and enable two factor authentication to increase the assurance around who is actually accessing it for instance (you could also limit the token life, to solve the issue of the application being left open). I will include this https://social.technet.microsoft.com/wiki/contents/articles/15530.the-four-pillars-of-identity-identity-management-in-the-age-of-hybrid-it.aspx#Defining_Identity_and_Identity_Infrastructure its a little old now and has been updated but its a starter for ten.

Edited September 18, 2017 by HPlum78

[jthompson]

I'm curious, how's that work? Or does setting the trusted within the ini still fall back to the standard password if their username isn't changed within SIMs?

 

Steve

That's right. If the current Windows user account isn't associated with any SIMS user account, it'll say something like 'User not recognised' and then put up a standard SIMS login dialogue.

[jthompson]

How does having a separate login stop kids access a laptop that has been left open in the classroom? chances are from what I have seen in the past SIMS (insert your own MIS/ web service here ) will be open anyhow!

 

True, but if SIMS is not left open on an unattended machine, it's not just a case of them launching the app. Also, I'd argue that SIMS .net is so awkward to use for even a legitimate user that it is its own line of defense against untrained intruders. /s

[HPlum78]

Also, I'd argue that SIMS .net is so awkward to use for even a legitimate user that it is its own line of defense against untrained intruders.

 

Yeah I suppose putting a seamless SSO solution in front of SIMS is like putting lipstick on a pig! :-P

[Quatermass]

Indeed! And BTW our separate logins aren't just separate, they're different. And I guess even an identical login might slow down an opportunist if they were trying to quickly jump on an unattended machine in the teacher's absence? Edited September 18, 2017 by Quatermass

[HPlum78]

Indeed! And BTW our separate logins aren't just separate, they're different. And I guess even an identical login might slow down an opportunist if they were trying to quickly jump on an unattended machine in the teacher's absence?

 

And none of your staff have just hit the remember button in their browsers?

[alfatec]

On a technical side of how to achieve it, put the trusted connect.ini in the SIMS.net (ConnectionType=TrustedAuto). Then in Sims, System Manager, Manage users, and on the Login details change the login to the Active Directory username and that

will then give you SSO for SIMS.Net. With regards to the policy of using it will be dependent on each schools security policy. Some schools will some won't.

[thimon]

And none of your staff have just hit the remember button in their browsers?

The browser may remember the login details for SIMS ID but not for the Hosted SIMS remote session (it can remember the username however).

[webbobfc]

Thanks for all your feedback, seems a unwanted risk for very little benefit to me, will have to bring it up with the powers that be.

 

Thanks Again.

[Quatermass]

And none of your staff have just hit the remember button in their browsers?

 

Indeed - although we advise them not to use that - but doesn't affect SIMS (until that's online, but that will be a while...)

Edited September 18, 2017 by Quatermass

[Sylv3r]

We originally had self-hosted SIMS Learning Gateway which would allow staff to SSO into a browser to access registers etc, as we no longer use that day-to-day I setup our SIMS.net client to automatically logon using the AD credentials as it's no less secure than what we already had. I agree, it's possibly not the best way of doing it, but as staff are asked to do so much in the initial stages of a lesson etc, one less password was the best way of giving them a little more time.

[Quatermass]

Ah, SLG. Yeah we used an early hosted version of that *shiver* (although I know it's somewhat slicker nowadays!)

[DrCheese]

We've had Trusted auth since 2007, I think you're all over-reacting with the security risks of it, we've never had a problem. Generally people have SIMS open all day regardless.

You also don't have separate passwords for every bit of different data on your network, i.e shared workarea's and online resources (i.e email)

 

You just need strict policies about not leaving computers unlocked & backup from management if they violate it.

[HPlum78]

I think you're all over-reacting with the security risks

 

ALL maybe over stating it! I am in your camp just not as blunt.

[zag]

We've had SSO for sims for 10 years. Not a single issue here.

[IrritableTech]

I can see both sides of this argument. I always find that an increased amount of different credentials has a direct effect on the number of post-it notes stuck onto monitors. Equally I can see that a user may leave themselves logged in and casual bypasser may open sims and it would be nice if it prompted for credentials.

 

Is there a half way house - trusted AD logins for sims but requesting for re-authentication?

[3s-gtech]

Not really; closest is setting ConnectionType=Trusted rather than ConnectionType=TrustedAuto

 

Which gives you:

 

 

We wrote a program which separately re-prompts for authentication (it's basically another program which we point the shortcut to, that then fires up SIMS if the password is correct) then set ConnectionType=TrustedAuto

 

We also took a lot of flak for making it, but it serves us very well indeed.

[matt40k]

I've said it before and I'll say it again, SIMS logins aren't secure. For starters they don't expire, they aren't case sensitive and they are vulnerable to brute force attacks.. Windows Auth and teaching staff "Windows + L" is much better solution.

 

We also took a lot of flak for making it, but it serves us very well indeed.

 

You wrote a man-in-the-middle program ! I'd be surprised if you didn't!