SSO - Single Sign On?

[CPS-Stimmers]

Hi All,

 

I've been asked to look into SSO and if it could be useful to us as a school. We use a lot of online platforms, for example Dr Frost, EduLink, Kerboodle. While our EduLink is linked to our AD, the others are controlled by the subject departments.

My immediate reaction is one of concern, I'm trying to push out MFA and SSO, while great in theory, may not be what best for school security. What are others thoughts? have any of you used SSO in schools?

 

also, in my research, the term O-Auth came up, does this mean that if platforms don't support O-Auth they they cant be connected via SSO?

 

Thanks all!

[jmak]

In terms of security, you're almost always better off with an SSO arrangement and then enforce complicated passwords (with no time expiry). Otherwise you end up with the same password used on loads of systems and much greater risk of compromise, which still gives access to all the systems due to re-use.

 

Obviously MFA is better, but not necessarily realistic for all of the pupils (you'd need to give them devices or allow use of phones).

 

O-Auth or proper integration with Azure AD is best and there's no good reason that suppliers can't build it in, but realistically a lot don't. There are a few SSO platforms which get round this and can themselves integrate with either AD, Azure AD or Google accounts.

 

Take a look at RM Unify and Airhead (https:http://www.airhead.io)

Edited May 19, 2021 by jmak

[supportman]

We use Office 365 Single Sign on for virtually everything here.

 

I've set Azure to notify me if someone requests to connect from a new platform and authorize in Azure as necessary. That gives me a list of all the 3rd party sites using the login info and we can disable or restrict if needed. Not that we ever has as it seems quite secure.

 

Works well so far.

Edited May 19, 2021 by supportman

[CPS-Stimmers]

Thanks for this!

MFA is for our staff, and SSO would be for all users, but I will definitely take a look at the two you suggested!

[Boredguy]

Likewise for all our SSO, it is all handled via Azure 365 for us, and for those sites that don't support Office 365 login and only google, we also have G-Suite setup which authenticates back to Azure so if users select to sign-in with google they still get the familiar Office 365 login.

[MYK-IT]

...... Edited May 19, 2021 by MYK-IT

[MYK-IT]

We use Office 365 Single Sign on for virtually everything here.

 

I've set Azure to notify me if someone requests to connect from a new platform and authorize in Azure as necessary. That gives me a list of all the 3rd party sites using the login info and we can disable or restrict if needed. Not that we ever has as it seems quite secure.

 

Works well so far.

Any chance you could advise how you set this up and monitor new (and existing) requests?

 

Many thanks.

[supportman]

Any chance you could advise how you set this up and monitor new (and existing) requests?

 

Many thanks.

 

Think its this setting

 

Edited May 20, 2021 by supportman

[dhicks]

in my research, the term O-Auth came up, does this mean that if platforms don't support O-Auth they they cant be connected via SSO?

 

Oauth is a standard, implemented by various identity providers (Microsoft, Google, Facebook, Twitter, etc). It's the protocol that the "Log in with Google" buttons or similar you see on some sites use. Most schools will probably have Office 365 or Google Workspace set up with accounts for each child and member of staff - Office 365 in your case, by the sounds of it, so you want vendors that provide a "Log in with your Microsoft Account" button.

[HPlum78]

I have covered this in past posts, so I will give some broad brush strokes here. SSO is not the same as authentication or authorisation they are all distinct but we in the world of IT tend to use them interchangeably.

 

MFA on the other hand is a mechanism to protect your organisation and your users identities from nefarious activity (it is neither responsible for authentication nor authorisation).

 

So as for your concern around SSO, I will put it like this for all of those systems that require a login if you use application identities the bigger risk to you is that your users are probably just using the same passwords as they use for their AD account! And these are being stored in another place. My next statement may split the crowd but those applications in the most part will be far less secure than AD and using AD to authenticate against (I am deliberately not throwing in cloud based auth here) as kerberos with the correct browser settings is essentially what is traditionally what we call SSO.

 

There are a number of protocols that are available to use for authentication you mention OAuth (Oauth2) but there are others that can be leveraged including but not limited to to SAML (multiple versions), openid connect WS-Fed.. The list goes on.

 

Azure AD can support a number of authentication methods that should support most of your applications and you should look at hooking your applications up and leveraging these capabilities. If you find an on premise application that cannot support modern auth then you should look at putting these behind an app proxy this allows you to leverage all the Cloudy auth goodness along with MFA and let's you remove the server from having a direct Internet connection. You are also in a position to leverage conditional access policies (if you use Azure) to allow you to say things like if the request comes from a known device and IP address subnet then don't challenge this via MFA and such likes.

 

I could go on and on and have started to drift (like I do) but happy to talk directly in more detail.

Edited May 20, 2021 by HPlum78