Front cover - IBM Redbooks

282 Lotus Security Handbook
► A single sign-on for each user into the SSO domain, typically only once per
day.
The benefits to security administrators include:
► A single common registry of user information to manage and secure.
► The ability to enforce common enterprise-wide password and security policies
enables end-to-end security, possibly across application and system
boundaries. Avoids the issues with inconsistent password complexity and
change requirements on different systems.
► It is easier to verify user security information and update when necessary,
rather than tracking down all individual systems the user has access to. This
is particularly valuable when users move to new roles with different access
levels.
The potential drawbacks of SSO are:
► The effort for initial implementation can be significant based on the number of
existing disparate systems.
► A compromised user credential can provide access to a large number of
applications.
► Open standard mechanisms are either non-existent or vendor support for
standards may be inconsistent and incompatible with other products.
The challenge to provide SSO is working with independent security
architectures, directories, and so forth, for each different existing application
platform. To facilitate SSO, we need to make all our applications somehow use a
common security infrastructure for authentication that can be passed seamlessly
between applications. This requires some common format for representing
authentication information or credentials that all the applications can understand
and accept. And we need to be able to ensure the credentials are trustworthy.
From a technical perspective, there are several different methods or tools that
can be used to provide an SSO user experience with WebSphere and Lotus
applications. The following SSO enablement methods that IBM Software
products support are described in this chapter:
► HTTP headers
► Lightweight Third Party Authentication (LTPA)
► X.509 certificates
► DSAPI