Bootstrapping a global SSO from network access control mechanisms

Authors:
Manuel Sánchez;Gabriel López;Óscar Cánovas;Antonio F. Gómez-Skarmeta
Affiliations:
Department of Information and Communications Engineering, University of Murcia, Spain;Department of Information and Communications Engineering, University of Murcia, Spain;Department of Computer Engineering, University of Murcia, Spain;Department of Information and Communications Engineering, University of Murcia, Spain
Venue:
EuroPKI'07 Proceedings of the 4th European conference on Public Key Infrastructure: theory and practice
Year:
2007

Citing 3
Cited 2

Risks of the passport single signon protocol

Proceedings of the 9th international World Wide Web conference on Computer networks : the international journal of computer and telecommunications netowrking
A network access control approach based on the AAA architecture and authorization attributes

Journal of Network and Computer Applications
Kerberos: an authentication service for computer networks

IEEE Communications Magazine

Levels of Assurance and Reauthentication in Federated Environments

EuroPKI '08 Proceedings of the 5th European PKI workshop on Public Key Infrastructure: Theory and Practice
Performance analysis of a cross-layer SSO mechanism for a roaming infrastructure

Journal of Network and Computer Applications

Quantified Score

Hi-index	0.00

Visualization

Abstract

This paper presents the details of a Single Sign On proposal which takes advantage of previously deployed authentication mechanisms. The main goal is to establish a link between authentication methods at different levels in order to provide a seamless global SSO. Specifically, the users will be authenticated once, during the network access control phase. Next, having authenticated to get on to the network using 802.1X, that authentication will automatically fetch the necessary signed tokens so that there would be no need to repeat the login at the application layer. Therefore, the application level authentication would be bootstrapped from the network access. As we will see, this involves the generation of SAML signed tokens that will be obtained by the users using a PEAP channel able to deliver the appropriate authentication credentials. Then, users will contact a federation-level validation service and there will no need to re-authenticate the user, only a query of the related user attributes will be necessary in some cases.