localzuk Posted July 15, 2008 Posted July 15, 2008 One of the things I keep getting requests for is a single sign on system, which can integrate any software without needing modules etc... for it. Now the only packages I've come across that can do this are Citrix Platinum and another like that. The issue always turns up as being cost. We're talking hundreds of pounds per computer. Does anyone know of either a cheap system that does this or an open source project that is doing this? Or am I forever doomed to pass messages back that it is and always will be outside our financial reach?
tonyd Posted July 15, 2008 Posted July 15, 2008 (edited) If you're talking about an SSO for authenticating websites via AD then ISA 2006 might just do the job. As far as I can tell you should not need client licenses for this since you're providing access for your own (internal?) users. See http://technet.microsoft.com/en-us/library/bb794722(TechNet.10).aspx for details Edited July 15, 2008 by tonyd
plexer Posted July 15, 2008 Posted July 15, 2008 Shibboleth is probably what you want Shibboleth® Do you have examples of software packages you currently have that you want single sign on for? Ben
torledo Posted July 15, 2008 Posted July 15, 2008 If you're talking about an SSO for authenticating websites via AD then ISA 2006 might just do the job. As far as I can tell you should not need client licenses for this since you're providing access for your own (internal?) users. But i don't think ISA will provide SSO and identity management for *any* or all applications that a school might run... infact i don't think Citrix Password Manager would do this. Good thread though, i'd like to know the answer to this as most commerical products that do use modules, metadirectories and XML cost a mint. An open source solution or other reasonable priced product would be useful... Or is the answer really to web enable everything and tie it into AD and IIS. Sounds like square pegs and round holes to me.
plexer Posted July 15, 2008 Posted July 15, 2008 Allthough shibboleth is for web sites so may or may not be what you are after. Ben
localzuk Posted July 15, 2008 Author Posted July 15, 2008 If you're talking about an SSO for authenticating websites via AD then ISA 2006 might just do the job. As far as I can tell you should not need client licenses for this since you're providing access for your own (internal?) users. Nope. I'm talking about a system like Citrix SSO - it looks for any login box, regardless of system, and remembers usernames and passwords. So you only have to log in to the system once, and then each application only once.
localzuk Posted July 15, 2008 Author Posted July 15, 2008 So that people know how Citrix works with this, it works with any virtualised application, so it intercepts login boxes and fills them, and submits them. Citrix Systems » XenApp Feature Spotlight Single Sign-On
localzuk Posted July 15, 2008 Author Posted July 15, 2008 SIMS.net, FMS, Outlook, then online services include Expo Electro, GLPI, SiX ( somerset intranet), Joomla etc... For that lot, if they use all of them, they'd end up with 6 usernames and passwords. Not exactly user friendly.
stratisphere Posted July 15, 2008 Posted July 15, 2008 While i think SSO is a good way to go... I think we have to be careful. Imagine a member of staff setting a simple password (we all have them types!), some student guesses it and bingo... access to everything that staff can access with one simple password. Saying that, all of our sites use LDAP authentication which goes back to our AD. The only thing now which isnt SSO is Sim.Net... which im not that keen on making to be honest.
localzuk Posted July 15, 2008 Author Posted July 15, 2008 While i think SSO is a good way to go... I think we have to be careful. Imagine a member of staff setting a simple password (we all have them types!), some student guesses it and bingo... access to everything that staff can access with one simple password. Saying that, all of our sites use LDAP authentication which goes back to our AD. The only thing now which isnt SSO is Sim.Net... which im not that keen on making to be honest. This should be dealt with via password policies for your system(s).
CyberNerd Posted July 15, 2008 Posted July 15, 2008 I use kde wallet, but a quick wiki search revealed some more: KWallet - Wikipedia, the free encyclopedia GNOME Keyring - Wikipedia, the free encyclopedia KeePass - Wikipedia, the free encyclopedia NetworkManager - Wikipedia, the free encyclopedia Roboform - Wikipedia, the free encyclopedia Password Safe - Wikipedia, the free encyclopedia Keychain (Mac OS) - Wikipedia, the free encyclopedia +1 to plexer, shibboleth is going to be the way forwards - but they are only keen on LA's signing up as identity providers.
localzuk Posted July 15, 2008 Author Posted July 15, 2008 I use kde wallet, but a quick wiki search revealed some more: KWallet - Wikipedia, the free encyclopedia GNOME Keyring - Wikipedia, the free encyclopedia KeePass - Wikipedia, the free encyclopedia NetworkManager - Wikipedia, the free encyclopedia Roboform - Wikipedia, the free encyclopedia Password Safe - Wikipedia, the free encyclopedia Keychain (Mac OS) - Wikipedia, the free encyclopedia +1 to plexer, shibboleth is going to be the way forwards - but they are only keen on LA's signing up as identity providers. Nearly all of them are a) linux only b) password managers rather than single sign on programs c) for individual use rather than school scale (ie. centralised). KeePass looks interesting though, as it does deal with dialogs.
GrumbleDook Posted July 15, 2008 Posted July 15, 2008 +1 to plexer, shibboleth is going to be the way forwards - but they are only keen on LA's signing up as identity providers. There are a number of reasons for this ... you can only have one IDp ... it is the master DS and other services hook into it. You cannot have 2 IDps as this causes conflict with Shibboleth. All other connecting services are run as Service Providers (SP). RBCs / LAs do tend to have some pet projects for LAN login (still in beta in East Midlands) but yes, it is a move to centralised services and hosted services from 3rd parties.
DMcCoy Posted July 15, 2008 Posted July 15, 2008 SIMS.net, FMS, Outlook, then online services include Expo Electro, GLPI, SiX ( somerset intranet), Joomla etc... For that lot, if they use all of them, they'd end up with 6 usernames and passwords. Not exactly user friendly. Sims has some AD features I think, although I've never used it. Im not sure what the possibilities with FMS are now as it's also sql2005 so may be like .net. glpi has AD integration, I use it here. I'm not sure I'd see what Citrix does as SSO either, although it may feel the same to the user, it isn't. It's more like the apple keychain than a unified sign on.
CyberNerd Posted July 15, 2008 Posted July 15, 2008 Nearly all of them are a) linux only . you mean nearly all of them - except the ones like roboform, password safe, keepass which run exclusively on windows and keychain which runs on OSX !! so only 3/7 are linux only ?!
localzuk Posted July 15, 2008 Author Posted July 15, 2008 Sims has some AD features I think, although I've never used it. Im not sure what the possibilities with FMS are now as it's also sql2005 so may be like .net. glpi has AD integration, I use it here. I'm not sure I'd see what Citrix does as SSO either, although it may feel the same to the user, it isn't. It's more like the apple keychain than a unified sign on. How isn't what Citrix does single sign on? You put in a password a single time, and it signs you on. you mean nearly all of them - except the ones like roboform, password safe, keepass which run exclusively on windows and keychain which runs on OSX !! so only 3/7 are linux only ?! Ok, 4/7 are non windows. Of the remaining 3, Roboform and Password Safe are not what this thread is about - Roboform is browser only, and password safe is a password manager, not single sign on. But as I said, KeePass looks good. With some work, it could be altered to be centralised and compete with Citrix's SSO functionality.
DMcCoy Posted July 15, 2008 Posted July 15, 2008 How isn't what Citrix does single sign on? You put in a password a single time, and it signs you on. The user names and passwords aren't the same though and have no relationship with each other. I'd like it to be more like the one ring, something that ties them all together rather than an expensive login box watcher.
localzuk Posted July 15, 2008 Author Posted July 15, 2008 The user names and passwords aren't the same though and have no relationship with each other. I'd like it to be more like the one ring, something that ties them all together rather than an expensive login box watcher. Ah, but that is more than single sign on, that's more of a unified system - that'll never work fully, as it would require every software manufacturer to support it. Sure, you may get the key players supporting it (like many packages support LDAP authentication) but there will always be some which don't.
K.C.Leblanc Posted July 15, 2008 Posted July 15, 2008 Sims has some AD features I think, although I've never used it. Im not sure what the possibilities with FMS are now as it's also sql2005 so may be like .net. glpi has AD integration, I use it here. You can set sims to athenticate using the username of the current user instead of it's own user name a password. I think you have to altersomething in the local connect.ini. and also your AD and SIMS usernames have to match.
plexer Posted July 15, 2008 Posted July 15, 2008 True single sign on at least for web sites and what shibolleth is trying to do is you have one username and password and then you can sign into other resources using that You are authenticated at your home site and the others see you as a valid user and present themselves to you. Ben
localzuk Posted July 15, 2008 Author Posted July 15, 2008 True single sign on at least for web sites and what shibolleth is trying to do is you have one username and password and then you can sign into other resources using that You are authenticated at your home site and the others see you as a valid user and present themselves to you. Ben Indeed. That is the ultimate goal, but that is going to be many a year away. Until then, we have to try and manage the mess of passwords we all have to remember at the moment. So a faux SSO, password managing, login box intercepting database would be the ideal solution.
limbo Posted July 15, 2008 Posted July 15, 2008 The way forward has to be to use domain security / AD info at the heart of it, otherwise you will still be looking at one username and password to log on to a computer and then another one for everything else. We are about 80% of the way there at the moment with domain security offering web based outlook, access to H: drives and online handbooks, helpdesks, photocopying booking system and subscription websites. The only alternative username and password our staff need at the moment is for eportal - which I believe can be supported with AD integration but just not got around to it yet. This is mainly built around our school website using iis security options. But much easier because we do not use the LEA mail or learning platform at the moment.
maniac Posted July 15, 2008 Posted July 15, 2008 The only alternative username and password our staff need at the moment is for eportal - which I believe can be supported with AD integration but just not got around to it yet. Yes, E-portal does offer LDAP single sign on support, but even though the boxes appear in the data controller program, it is a chargeable extra! When I last checked I believe they charged per user as well!! Mike.
torledo Posted July 15, 2008 Posted July 15, 2008 i agree with limbo....tie it all back to AD where possible. That's the simplest and most cost effective way... Most pbx systems, email, web portals allow for authentication against AD...it can't be that difficult to get most apps on board - even open source apps. Regarding shibboleth, that obviously requires vendor participation but what does the sysadmin have to do...if it's primarily an application at LEA/RBC level does that preclude orgs from deploying their own shibboleth system ? I think products similar to citrix sso is a quick and dirty method of reducing password sprawl, but as others have mentioned it is in no way a complete identity management solution - that's where shibboleth and vendor products come in, the only confusion i have surrounding shibboleth is it's user friendliness.
CyberNerd Posted July 15, 2008 Posted July 15, 2008 Regarding shibboleth, that obviously requires vendor participation but what does the sysadmin have to do...if it's primarily an application at LEA/RBC level does that preclude orgs from deploying their own shibboleth system ? There is a growing number of software vendors willing to sell their products as a shibbolised service. I spoke to Nelson Thornes last week who promised to have their software shibbolised by the end of the year. No more installs means the network admins have less to do. For the LEA/RBC do the authentication means they must first centralise their authentication servers. (technically they could put a box in to do shibboleth, but I doubt many would be up for that as there are more advantages to central control). So no more Active Directory to maintain. This also has the added advantage that it makes the service much easier to outsource should BSF come along.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now