Secure Single Sign-On using CAS and OpenID

Abstract

As the number of connected applications increases, user convenience makes them use the same password, which can create vulnerabilities in an organization’s infrastructure. Therefore, those with security concerns regarding these activities, conducted in the electronic environment, came to support the idea of ​​Single Sign-On systems, having the user in mind. This concept facilitates the authentication process to various resources available on the Internet, or locally, using a single pair of credentials, only once, so it makes the „one for all” password, the method of writing passwords on post-it’s glued to the monitor , or keeping them stored in unsecured text files, sent into oblivion. This paper aims to make a comprehensive analysis of the infrastructure of security and authentication systems on the market. On the other hand, the project presents the implementation of several open source solutions such as OpenID, NTLM in PHP or the Central Authentication Service. For the application that uses OpenID an online store that has an administration page, to which access is restricted using OpenID credentials, was further secured by filtering these IDs in a MySQL database to prevent access to anyone having a valid OpenID credential. For the demonstration of NTLM enabled SSO, another website is used in which access has been blocked to a page. For accessing the page, a valid Windows authentication credential is required. Both the online-shop and demonstration site for NTLM are written in PHP. In addition, the systems using them are implemented also using PHP. For implementing the CAS demo, two Tomcat servlets have been used for demonstration purposes, additional filtering being done by an ApacheDS server.