- [Instructor] Identification and authentication
can be an annoying process for end-users,
and difficult to manage for organizations.
The concepts of federation and single sign-on
seek to reduce some of this burden.
Federated identity management leverages the fact
that a single individual may have accounts
across a wide variety of systems.
When organizations agree to federate their identity
management systems they share some of this information
across the organizations.
This reduces the number of individual identities
that a user must have and eases the burden
on both the user and the organization.
You're probably already familiar with some
federated identity management systems.
When you log on to websites using your Google account,
Facebook Connect, or Twitter account
you're using federated identity management.
Single sign-on goes a step further
and shares authenticated sessions across systems.
Many organizations create SSO solutions
within their organizations to help users
avoid the burden of repeatedly authenticating.
In an SSO approach users log on to the first
SSO-enabled system they encounter and then
that log on session persists across other systems
until it reaches its expiration time.
If the organization sets the expiration period
to the link of a business day it means that users
only need to log on once per day,
and then their single sign-on will last the entire day.
Trust relationships across different authentication domains
are described in terms of their direction
and their transitivity.
Let's talk about direction first.
Trusts can be either one-way or two-way.
If a one-way trust exists from domain one to domain two,
domain one will trust authenticated sessions
from domain two but domain two will not trust
sessions from domain one.
If the trust relationship is two-way
domains one and two will mutually trust each other.
The second attribute of a domain trust
is its transitivity.
Trusts can be either transitive or nontransitive.
In a transitive trust, trust relationships
transfer across domains.
For example, if domain one has a transitive trust
with domain two and domain two has a transitive trust
with domain three, domains one and three
will have a trust relationship as well
without the administrator explicitly creating the trust.
In a nontransitive trust on the other hand
this trust relationship will not be automatically inferred.
Domain one will not trust domain three
unless the administrator creates that trust.