3.3 Explain important concepts pertaining to identity and access management for server administration.

📘CompTIA Server+ (SK0-005)

1. What is Single Sign-On (SSO)?

Single Sign-On (SSO) is an authentication method that allows a user to:

Log in once
Access multiple systems, applications, or services
Without needing to log in again for each one

Key Idea:

👉 One login → Access many systems

2. How SSO Works (Simple Explanation)

SSO works by using a central authentication system that verifies the user and then shares that authentication with other systems.

Step-by-step process:

User logs in to a central system (called Identity Provider)
The system verifies the user’s credentials (username/password, MFA, etc.)
After successful login, a token or ticket is created
When the user accesses another system:
- The system checks the token
- If valid → access is granted without another login

3. Key Components of SSO

1. Identity Provider (IdP)

The system that authenticates the user
Stores user identities and credentials
Examples: Active Directory, Azure AD

2. Service Provider (SP)

The application or system the user wants to access
Relies on the IdP for authentication

3. Authentication Token

A secure digital object that proves the user is authenticated
Passed between systems

4. Common SSO Technologies and Protocols

You should know these for the exam:

1. SAML (Security Assertion Markup Language)

Uses XML-based messages
Common in enterprise environments
Works well with web-based applications

2. OAuth

Used for authorization, not authentication
Allows apps to access resources without sharing passwords

3. OpenID Connect (OIDC)

Built on OAuth 2.0
Adds authentication
Common in modern cloud applications

4. Kerberos

Ticket-based authentication protocol
Common in Windows domain environments
Uses tickets instead of passwords

5. Benefits of SSO

1. Improved User Experience

Users log in only once
No need to remember multiple passwords

2. Reduced Password Fatigue

Fewer passwords → less chance of weak passwords

3. Centralized Authentication

Easier to manage user access from one place

4. Faster Access to Systems

Saves time in enterprise environments

5. Better Productivity

Users spend less time logging in repeatedly

6. Security Advantages

1. Stronger Authentication Methods

SSO can be combined with MFA (Multi-Factor Authentication)

2. Centralized Security Control

Security policies applied in one place

3. Reduced Attack Surface (in some cases)

Fewer passwords stored across systems

7. Security Risks of SSO

Very important for the exam ⚠️

1. Single Point of Failure

If the SSO system is compromised:
👉 Attacker gains access to all connected systems

2. Token Theft

If authentication tokens are stolen, attackers can reuse them

3. Dependency on Availability

If the SSO server is down:
👉 Users cannot access multiple systems

4. Misconfiguration Risks

Incorrect setup can expose multiple services

8. Best Practices for SSO Implementation

1. Use Multi-Factor Authentication (MFA)

Adds extra layer of security

2. Use Secure Token Handling

Encrypt tokens
Use short expiration times

3. Monitor and Audit Access

Track login activity and anomalies

4. Apply Least Privilege

Give users only the access they need

5. Ensure High Availability

Use redundancy and failover systems

9. SSO in Real IT Environments (Exam-Focused Examples)

Example 1: Enterprise Network

User logs into a Windows domain
Gains access to:
- File servers
- Internal web apps
- Email systems

Example 2: Cloud Environment

User logs into a cloud identity system
Accesses:
- SaaS applications
- Cloud dashboards
- Collaboration tools

Example 3: Hybrid Environment

On-premises + cloud systems integrated
One login provides access to both environments

10. SSO vs Traditional Authentication

Feature	Traditional Login	SSO
Number of logins	Multiple	One
Password management	Complex	Simplified
User experience	Poor	Improved
Security risk	Distributed	Centralized risk

11. Important Exam Tips

SSO = One authentication, multiple access
Know the difference between:
- Authentication (SSO, OpenID Connect)
- Authorization (OAuth)
Understand:
- Kerberos uses tickets
- SAML uses XML assertions
Remember:
- SSO improves usability but introduces centralized risk
Always associate SSO with:
- Identity Provider (IdP)
- Service Provider (SP)

12. Quick Summary

SSO allows users to log in once and access multiple systems
Uses a central authentication system (IdP)
Works with protocols like:
- SAML
- OAuth
- OpenID Connect
- Kerberos
Benefits:
- Better user experience
- Centralized control
Risks:
- Single point of failure
- Token theft
Best secured with:
- MFA
- Monitoring
- Proper configuration