3.3 Explain important concepts pertaining to identity and access management for server administration.

📘CompTIA Server+ (SK0-005) 

---

1. What is Single Sign-On (SSO)?

Single Sign-On (SSO) is an authentication method that allows a user to:

• Log in once
• Access multiple systems, applications, or services
• Without needing to log in again for each one

Key Idea:

👉 One login → Access many systems

---

2. How SSO Works (Simple Explanation)

SSO works by using a central authentication system that verifies the user and then shares that authentication with other systems.

Step-by-step process:

1. User logs in to a central system (called Identity Provider)
2. The system verifies the user’s credentials (username/password, MFA, etc.)
3. After successful login, a token or ticket is created
4. When the user accesses another system:
   • The system checks the token
   • If valid → access is granted without another login

---

3. Key Components of SSO

1. Identity Provider (IdP)

• The system that authenticates the user
• Stores user identities and credentials
• Examples: Active Directory, Azure AD

2. Service Provider (SP)

• The application or system the user wants to access
• Relies on the IdP for authentication

3. Authentication Token

• A secure digital object that proves the user is authenticated
• Passed between systems

---

4. Common SSO Technologies and Protocols

You should know these for the exam:

1. SAML (Security Assertion Markup Language)

• Uses XML-based messages
• Common in enterprise environments
• Works well with web-based applications

2. OAuth

• Used for authorization, not authentication
• Allows apps to access resources without sharing passwords

3. OpenID Connect (OIDC)

• Built on OAuth 2.0
• Adds authentication
• Common in modern cloud applications

4. Kerberos

• Ticket-based authentication protocol
• Common in Windows domain environments
• Uses tickets instead of passwords

---

5. Benefits of SSO

1. Improved User Experience

• Users log in only once
• No need to remember multiple passwords

2. Reduced Password Fatigue

• Fewer passwords → less chance of weak passwords

3. Centralized Authentication

• Easier to manage user access from one place

4. Faster Access to Systems

• Saves time in enterprise environments

5. Better Productivity

• Users spend less time logging in repeatedly

---

6. Security Advantages

1. Stronger Authentication Methods

• SSO can be combined with MFA (Multi-Factor Authentication)

2. Centralized Security Control

• Security policies applied in one place

3. Reduced Attack Surface (in some cases)

• Fewer passwords stored across systems

---

7. Security Risks of SSO

Very important for the exam ⚠️

1. Single Point of Failure

• If the SSO system is compromised:
  👉 Attacker gains access to all connected systems

2. Token Theft

• If authentication tokens are stolen, attackers can reuse them

3. Dependency on Availability

• If the SSO server is down:
  👉 Users cannot access multiple systems

4. Misconfiguration Risks

• Incorrect setup can expose multiple services

---

8. Best Practices for SSO Implementation

1. Use Multi-Factor Authentication (MFA)

• Adds extra layer of security

2. Use Secure Token Handling

• Encrypt tokens
• Use short expiration times

3. Monitor and Audit Access

• Track login activity and anomalies

4. Apply Least Privilege

• Give users only the access they need

5. Ensure High Availability

• Use redundancy and failover systems

---

9. SSO in Real IT Environments (Exam-Focused Examples)

Example 1: Enterprise Network

• User logs into a Windows domain
• Gains access to:
  • File servers
  • Internal web apps
  • Email systems

Example 2: Cloud Environment

• User logs into a cloud identity system
• Accesses:
  • SaaS applications
  • Cloud dashboards
  • Collaboration tools

Example 3: Hybrid Environment

• On-premises + cloud systems integrated
• One login provides access to both environments

---

10. SSO vs Traditional Authentication

Feature	Traditional Login	SSO
Number of logins	Multiple	One
Password management	Complex	Simplified
User experience	Poor	Improved
Security risk	Distributed	Centralized risk

---

11. Important Exam Tips

• SSO = One authentication, multiple access
• Know the difference between:
  • Authentication (SSO, OpenID Connect)
  • Authorization (OAuth)
• Understand:
  • Kerberos uses tickets
  • SAML uses XML assertions
• Remember:
  • SSO improves usability but introduces centralized risk
• Always associate SSO with:
  • Identity Provider (IdP)
  • Service Provider (SP)

---

12. Quick Summary

• SSO allows users to log in once and access multiple systems
• Uses a central authentication system (IdP)
• Works with protocols like:
  • SAML
  • OAuth
  • OpenID Connect
  • Kerberos
• Benefits:
  • Better user experience
  • Centralized control
• Risks:
  • Single point of failure
  • Token theft
• Best secured with:
  • MFA
  • Monitoring
  • Proper configuration