Microsoft Sharepoint Products and Technologies Resource Kit eBook

Chapter 26: Single Sign-On in SharePoint Portal Server 2003 697
user who accesses the Web Part belongs to the mapped Windows group, the access
credentials are already stored in the single sign-on credentials store. The code in the
Web Part retrieves the credentials, submits them to the enterprise application, and
retrieves the necessary information. The Web Part is then displayed to the requesting
user. In this scenario, the whole process is transparent to the user. The user is not
aware of any authentication information required for the enterprise application; it is
only known to the administrator.
Security Recommendations Regarding the Topology of the Server Farm
When using the single sign-on service, you can help enhance security by distributing
your resources in the server farm. Specifically, the configuration of the front-end
Web server, the job server, and the computer storing the single sign-on database can
affect security.
■ Less secure configuration. Everything is deployed on one server. This configuration
is less secure because the front-end Web server, the single sign-on
database stored in SQL Server, and the encryption key are on the same computer.
This configuration is not recommended.
■ More secure configuration. Two-computer configuration where one computer
is the front-end Web server. The second computer is the job server containing
the single sign-on database stored in SQL Server and the encryption key.
■ Recommended configuration for better security. Configuration of three
or more computers in which the front-end Web server, the job server containing
the encryption key, and the server containing the single sign-on database
stored in SQL Server are different computers.
If you are using single sign-on in a shared services scenario, the user credentials
stored in the parent server farm are available to the administrators of all child
server farms. It is recommended that you run applications using single sign-on on
the parent portal site only and use an iFrame in the application for child portal sites.
You should disable the single sign-on service on child server farms. We will discuss
how to disable the SSOSrv service later in this chapter.
Configuring Single Sign-On
To configure single sign-on for the first time, you must complete the following tasks:
1. Determine and set up necessary Windows accounts.
2. Enable the single sign-on service on the job server.
3. Configure the single sign-on settings.
4. Create a new application definition.