Microsoft Sharepoint Products and Technologies Resource Kit eBook

694 Part VIII: Securing SharePoint Products and Technologies
The single sign-on functionality enables scenarios where multiple Web Parts access
different enterprise applications, which each use a different type of authentication.
Each Web Part can automatically sign on to its enterprise application without
prompting the user to provide credentials each time. There are endless uses of single
sign-on functionality within an enterprise environment. For example, let’s consider
two different scenarios—a human resources intranet site and a business intelligence
site, as follows:
■ A standard human resources (HR) portal site or page might include several
Web Parts that display employee information from a back-end employee management
system. This employee data is stored in a dedicated HR database system,
frequently based on SAP or PeopleSoft. These HR databases do not
support Microsoft Windows IDs, might not run on Windows-based operating
systems and, in fact, might include proprietary logon protocols. The Web Parts
on the portal site should retrieve the individual employee data without prompting
for a separate logon. In this example, the individual employee does not
have a separate logon to the HR system, but uses a group account that provides
generic read access to the database. In other words, the employee does
not know the user name and password required to log on to the system he or
she is accessing.
■ An executive might use a portal site to provide a dynamic, aggregated view of
relevant business information. This data is stored in two places: Siebel stores the
customer relationship information, and SAP tracks accounts and payments.
To see an integrated view, the portal must log on to and access both back-end
systems. Prompting the user for additional passwords is an unacceptable user
experience. In this example, the executive does not need to know the user
names and the passwords required for logon to the back-end systems. In addition,
multiple Web Parts are used to ensure this integration. By default, each
Web Part separately authenticates the user to the appropriate back-end system.
As these examples show, by using single sign-on you can centralize information
from multiple back-end applications through a single portal that uses application
definitions. In addition, SharePoint Portal Server 2003 provides a programming
interface for developers to use and extend this feature.
Single Sign-On Architecture
For each enterprise application that SharePoint Portal Server connects to, there is a
corresponding enterprise application definition configured by an administrator. This
application definition is used by a Web Part to integrate with the enterprise application
within a portal site. The application definition controls how credentials for a
particular business application are stored and mapped. The code within the Web Part