Chat now with support
Chat with Support

Cloud Access Manager 8.1 - Security and Best Practice Guide

Security Assertion Markup Language (SAML) federation and WS-Federation

Many modern web applications support Single Sign-On (SS0) using identity federation protocols. These methods rely on a separate, independent web system, called an identity provider or Security Token Service which performs the task of authenticating the user.
When multiple applications rely on the same identity provider you only need to enter your credentials once, so SSO is achieved. Dell™ One Identity Cloud Access Manager operates as an identity provider for applications which support SAML or WS-Federation SSO.
This method is generally considered the fastest, most cost-effective, reliable, and efficient way to implement single sign-on for those applications which support it. Some Software-as-a-Service (SaaS) providers levy an additional charge for use of federated SSO, however this should be weighed against the significant advantages of this approach.

HTTP Basic and NTLM

Applications which require HTTP Basic or NT LAN Manager (NTLM) authentication rely on the browser to capture your credentials using a pop-up dialog. Information is then passed to the application in HTTP headers which the application uses to check if the supplied credentials are correct. It is typical for web applications which accept HTTP basic or NTLM authentication to run on an internal corporate network.
When such an application is accessed using the Dell™ One Identity Cloud Access Manager proxy, the proxy can automatically construct the HTTP headers, as the browser would do. By using the username and password previously stored for a user, sign on to the application is automated.
If the application accepts HTTP Basic or NTLM authentication, this approach to Single Sign-On (SS0) is preferred over form-fill techniques, for further information please refer to Proxied form-fill.

Proxied form-fill

Some web applications do not accept HTTP basic or NT LAN Manager (NTLM) authentication, and instead prompt for your credentials by presenting a login form, this is known as forms-based authentication. Forms-based authentication is a common method of authenticating users for both public software as a service (SaaS) and on-premise web applications.
The Dell™ One Identity Cloud Access Manager proxy can automatically insert JavaScript which detects a username and password entered into a login form, and can save that information in your Cloud Access Manager password wallet over a secure channel. Then, once your credentials have been saved and the application is launched again, Cloud Access Manager can detect the username and password fields on an application login form, automatically insert your credentials into the correct fields, and submit the form.
* 
NOTE: This technique is appropriate for applications which do not accept HTTP basic, NTLM, SAML or WS-Federation.

Unproxied form-fill

For certain applications where credentials are captured using a login form, you can configure Dell™ One Identity Cloud Access Manager to automate sign on to the application without the need to proxy it. In this case Cloud Access Manager sends a login request directly to the application with your username and password inserted.
The advantages of this compared to proxied form-fill are:
•
Responsiveness of application, as latency is reduced without an intermediate proxy
•
Reduced IT costs, with a reduced load on the proxy
•
Reliability is increased, as complications caused by URL rewrite are avoided.
The potential disadvantages are:
•
No support for capturing credentials as you must enter your credentials into the Cloud Access Manager Password Wallet
•
No support for change password forms, the old password field will not be prefilled with your current password, and any new passwords will not be captured
•
Does not work with applications which send a pre-authentication cookie to the browser.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating