SSO是什么?
发布网友
发布时间：2022-03-29 02:02
共4个回答
懂视网
时间：2022-03-29 06:23
SSO英文全称Single Sign On，单点登录。SSO是在多个应用系统中，用户只需要登录一次就可以访问所有相互信任的应用系统。它包括可以将这次主要的登录映射到其他应用中用于同一个用户的登录的机制。它是目前比较流行的企业业务整合的解决方案之一。
统一的认证系统是SSO的前提之一。认证系统的主要功能是将用户的登录信息和用户信息库相比较，对用户进行登录认证；认证成功后，认证系统应该生成统一的认证标志（ticket），返还给用户。另外，认证系统还应该对ticket进行校验，判断其有效性。实现SSO的功能，让用户只登录一次，就必须让应用系统能够识别已经登录过的用户。应用系统应该能对ticket进行识别和提取，通过与认证系统的通讯，能自动判断当前用户是否登录过，从而完成单点登录的功能。
热心网友
时间：2022-03-29 03:31
如果用户的客户端和SPS2003服务器以及其他一些服务器（例如Exchange Server）在同一个域中，那么通过SPS2003的网站，访问其他的信息是一件轻而易举的事情，但在很多时候，可能会遇到下面的问题：
1. 客户端并没有加入到域中，或者客户端通过虚拟专用网（VPN）接入公司网络。此时，在访问所有的服务器时，都需要输入用户信息。
2. 用户会使用一些第三方的产品，无法将这些服务器加入到域中。此时，即使登录了SPS2003的网站，在访问其他服务器的时候，还是会出现需要用户信息的窗口。
正是基于以上的需求，在SPS2003中，有一项新的功能—Single Sign On(以下简称SSO)。SSO的基本思想就是：
建立一个加密的数据库，把用户的认证信息，存放到这个数据库中。当成功地验证了登录SPS2003网站的用户身份以后，就可以从加密的数据库中，获得用户的信息，从而用来访问其他的服务器或者一些第三方的服务器。
热心网友
时间：2022-03-29 04:49
Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed.(September 2010)Benefits include:Reces phishing success, because users are not trained to enter password everywhere without thinking.Recing password fatigue from different user name and password combinationsRecing time spent re-entering passwords for the same identityCan support conventional authentication such as Windows credentials (i.e., username/password)Recing IT costs e to lower number of IT help desk calls about passwordsSecurity on all levels of entry/exit/access to systems without the inconvenience of re-prompting usersCentralized reporting for compliance adherence.SSO uses centralized authentication servers that all other applications and systems utilize for authentication purposes, and combines this with techniques to ensure that users do not actively have to enter their credentials more than once.SSO users need not remember so many passwords to login to different systems or applications.[edit]CriticismsThis section does not cite any references or sources.
Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed.(September 2010)The term enterprise reced sign-on is preferred by some authors[who?] who believe single sign-on to be impossible in real use cases.As single sign-on provides access to many resources once the user is initially authenticated ("keys to the castle"), it increases the negative impact in case the credentials are available to other persons and misused. Therefore, single sign-on requires an increased focus on the protection of the user credentials, and should ideally be combined with strong authentication methods like smart cards and one-time password tokens.Single sign-on also makes the authentication systems highly critical; a loss of their availability can result in denial of access to all systems unified under the SSO. SSO can thus be undesirable for systems to which access must be guaranteed at all times, such as security or plant-floor systems.[edit]Common Single Sign-On Configurations[edit]Kerberos basedInitial sign-on prompts the user for credentials, and gets a Kerberos ticket-granting ticket (TGT).Additional software applications requiring authentication, such as email clients, wikis, revision control systems, etc., use the ticket-granting ticket to acquire service tickets, proving the user's identity to the mailserver / wiki server / etc. without prompting the user to re-enter credentials.Windows environment - Windows login fetches TGT. Active Directory-aware apps fetch service tickets, so user is not prompted to re-authenticate.UNIX/Linux environment - Login via Kerberos PAM moles fetches TGT. Kerberized client applications such as Evolution, Firefox, and SVN use service tickets, so user is not prompted to re-authenticate.[edit]Smart card basedInitial sign on prompts the user for the smart card. Additional software applications also use the smart card, without prompting the user to re-enter credentials. Smart card-based single sign-on can either use certificates or passwords stored on the smart card.[edit]OTP TokenAlso referred to as one-time password token. Two-factor authentication with OTP tokens [1] follows instry best practices for authenticating users[2]. This OTP token method is more secure and effective at prohibiting unauthorized access than other authentication methods.[3][edit]Integrated Windows AuthenticationIntegrated Windows Authentication is a term associated with Microsoft procts and refers to the SPNEGO, Kerberos, and NTLMSSP authentication protocols with respect to SSPI functionality introced with Microsoft Windows 2000 and included with later Windows NT-based operating systems. The term is used more commonly for the automatically authenticated connections between Microsoft Internet Information Services and Internet Explorer. Cross-platform Active Directory integration vendors have extended the Integrated Windows Authentication paradigm to UNIX, Linux and Mac systems.[edit]Shared authentication schemes which are not single sign-onThis section does not cite any references or sources.
Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed.(September 2010)Single sign on requires that users literally sign in once to establish their credentials. Systems which require the user to log in multiple times to the same identity are inherently not single sign on. For example, an environment where users are prompted to log in to their desktop, then log in to their email using the same credentials, is not single sign on.[edit]See alsoList of single sign-on implementationsRelated conceptsCentral Authentication ServiceIdentity managementPassword fatigueOpenID[edit]References^ Examples are tokens by RSA Data Security, Vasco, Actividentity or Aladdin^ OTP use meets the guidelines in DOE Order 205.1 as well^ FAQ on OTP Tokens - One Time Password Tokens[edit]External linksSingle Sign-on Intro with DiagramsSPNEGO Http Servlet Filter - Open Source SSO LibraryCampusEAI Consortium myCampus QuickLaunch Single Sign-On and Central Authentication ServiceCategories: Identity management systems | Password authentication
热心网友
时间：2022-03-29 06:40
