1
Concepts and Architecture

This chapter provides a high-level overview of Oracle9iAS Single Sign-On.

This chapter contains these topics:

Introduction to Oracle9iAS Single Sign-On

Oracle9iAS Single Sign-On is a component of Oracle9iAS Portal that provides a framework for secure single sign-on; allowing users to log in to multiple Web-based applications, such as expense reporting, e-mail, and benefits information, using a single username and password.

Oracle9iAS Single Sign-On provides the following benefits:

Reduced administrative costs associated with supporting multiple accounts and passwords for each user
Convenient login experience, because users do not need to maintain a separate username and password for each application they access
Increased security, because when the password is only required once, users are less likely to use simple, easy-to-remember passwords or write them down

Oracle9iAS Single Sign-On Components

This section describes the following Oracle9iAS Single Sign-On components:

Login Server

The core of the Oracle9iAS Single Sign-On technology is the Login Server. For partner applications, which rely on the Login Server for authentication, the Login Server authenticates users and passes their identities to the applications. For external applications, which do not use the Login Server authentication mechanism, the Login Server provides single sign-on through a centralized password repository.

When a user first tries to access a Oracle9iAS Single Sign-On enabled application, the Login Server:

Authenticates the user by means of username and password
Stores an encrypted login cookie on the authenticated client
Passes the client's identity to the Oracle9iAS Single Sign-On enabled application

During subsequent user logins, the login cookie provides the Login Server with the user's identity and indicates that authentication has already been performed. If there is no login cookie, the Login Server presents the user with a login page.

To guard against eavesdropping, the Login Server can send the login cookie to the client browser over an encrypted SSL channel.

The login cookie expires with the session, either at the end of a time interval specified by the administrator, or when the user exits the browser. The login cookie is never written to disk.

Note:

To log out of a partner application and log in as another user, the user must also log out of the Login Server session; otherwise the authentication request returns the partner application to the logged in state of the previous user.

Partner Applications

Partner applications are integrated with the Login Server. They support a single sign-on mechanism that enables them to accept a user's username and password as validated by the Login Server. Partner applications are generally written using the Oracle9iAS Single Sign-On SDK or Login Server specification.

A partner application delegates its authentication to the Login Server. If a partner application is registered with the Login Server, users can log into it using the single sign-on mechanism.

A partner application is responsible for determining whether a user authenticated by Oracle9iAS Single Sign-On has the requisite privileges for using the partner application. It also controls user access within the application.

An example of a partner application is the Oracle9iAS Portal itself.

External Applications

External applications retain their own authentication logic and do not delegate authentication to the Login Server. External applications therefore require application-specific usernames and passwords for providing access.

External applications typically use HTML login forms to accept the username and password. The username for the application can be different from the Oracle9iAS Single Sign-On username, in which case Login Server provides the required mapping.

Examples of external applications that use HTML login forms include Oracle Mobile and Yahoo! Mail. A unique username and password may be required to access each external application.

The Login Server provides usernames and passwords to external applications on behalf of the user. Users have the option of mapping external application authentication information to one or more usernames and passwords that are stored in the Login Server's password store. To map a password, the user selects the Remember My Login Information For This Application checkbox for the external application.

See Also:

"Specifying External Application Login Information" in Chapter 4, "Application Management" for information about the Remember My Login Information For This Application checkbox.

A single Login Server account can be mapped to several external application usernames and passwords. When the user attempts to log in, the Login Server automatically checks the mappings and sends the user's authentication information to the appropriate external application.

Note:

Only a system administrator can add external applications accessed by the Login Server.

See Also:

"Adding Partner and External Applications" in Chapter 4, "Application Management" for information about adding external applications.

Oracle9iAS Single Sign-On Software Development Kit

The Oracle9iAS Single Sign-On Software Development Kit (SDK) enables the following functionality:

Applications can communicate with the Login Server and accept a user's identity as validated by the Login Server
Administrators can manage the application's association with the Login Server

See Also:
The Oracle9iAS Single Sign-On Application Developer's Guide for information about the Oracle9iAS Single Sign-On Development Kit.

Oracle9iAS Single Sign-On Authentication Methods

Oracle9iAS Single Sign-On uses the following authentication methods:

Local User Authentication

Local user authentication uses a lookup table within the Login Server schema on the Oracle database associated with Oracle9iAS Portal. The table contains usernames, passwords, and Login Server privilege levels for the users. The incoming password is one-way hashed and compared to the entry in the table.

External Repository Authentication

External repository authentication typically relies on an LDAP-compliant directory, specifically Oracle Internet Directory. In this case, the Login Server binds to Oracle Internet Directory, then looks up the user credentials stored in the directory. External repository authentication includes LDAP and other methods that can be custom developed.

Oracle9iAS Single Sign-On Processes

Before a user can access a Oracle9iAS Single Sign-On enabled application, the Login Server must authenticate the user.

This section describes the following Oracle9iAS Single Sign-On processes:

Authenticating to the Login Server

Figure 1-1 illustrates the Login Server authentication process.

Figure 1-1 Authenticating to the Login Server

Text description of concepta.gif follows

Text description of the illustration concepta.gif

See Also:

"Login Server" for information about the login cookie

Accessing a Partner Application

Figure 1-2 illustrates the process that occurs when a user seeks access to a partner application.

Figure 1-2 Accessing a Partner Application

Text description of concept2.gif follows

Text description of the illustration concept2.gif

In Step 2 of this process, the partner application redirects the user to the Login Server only if the application requires it, based on the requested URL. Some URLs may be public and no redirection to the Login Server is required. When necessary, the partner application protects itself from unauthenticated access by its own session management.

If, during the same session, the user again seeks access to the same or to a different partner application, the Login Server does not prompt the user for a username and password. Instead, the Login Server obtains the information from the login cookie that is already on the client browser.

Partner Application Development Requirements

To implement an authentication check:

If the URL is publicly accessible, no authorization check is implemented.
Protected URLs check for an application session cookie for authorization.
If an application session cookie does not exist, the browser redirects the user to the Login Server.

To implement a sign-on URL:

The URL must establish an application session cookie using the identity information sent by the Login Server.
The browser redirects the user to the requested URL.

Accessing an External Application

You can access an external application through Oracle9iAS Portal. In this scenario, Oracle9iAS Portal functions as a partner application.

This section contains these topics:

Authenticating to Oracle9iAS Portal

When a user seeks access to an external application through Oracle9iAS Portal, the Login Server authenticates the user to Oracle9iAS Portal by the process described in Figure 1-3.

Figure 1-3 Authenticating to the Oracle9iAS Portal

Text description of concept3.gif follows

Text description of the illustration concept3.gif

If, during the same session, the user again seeks access to Oracle9iAS Portal, the Login Server does not prompt the user for a username and password. Instead, it obtains that information from the login cookie on the client browser.

Authenticating to an External Application for the First Time

Oracle9iAS Single Sign-On uses the process described in Figure 1-4 if the user:

Has authenticated to the Oracle9iAS Portal
Is accessing an external application for the first time through Oracle9iAS Portal

Figure 1-4 Authenticating to an External Application for the First Time

Text description of concept4.gif follows

Text description of the illustration concept4.gif

Authenticating to an External Application After the First Time

Oracle9iAS Single Sign-On uses the process described in Figure 1-5 if the user:

Has authenticated to the Oracle9iAS Portal
Has a username and password stored in the Login Server password store. (If the username and password are not stored in the Login Server password store, Oracle9iAS Single Sign-On follows the process described in "Authenticating to an External Application for the First Time".)
Is accessing an external application after the first time

Figure 1-5 Authenticating to an External Application After the First Time

Text description of concept5.gif follows

Text description of the illustration concept5.gif

1 Concepts and Architecture