Advanced Search

Content Type

Topics

Publication Date

T-Check in Technologies for Interoperability: Web Services and Security—Single Sign-On

Abstract

A single sign-on (SSO) solution is intended to provide a single authentication point for a set of Web services. The SSO solution for-wards the necessary authentication information to the Web services, which in turn authenticate the end user to legacy systems that implement the Web services' functionality. This technical note presents the results of applying the T-Check approach in an initial investigation of two Web services standards, WS-Security and SAML, to create an SSO solution that works inside a single organization. This approach involves (1) formulating hypotheses about the technology and (2) examining these hypotheses against specific criteria through hands-on experimentation. The outcome of this two-stage approach is that the hypotheses are either fully or partially sustained or refuted. In this report, four hypotheses—based on claims found in experience reports and on vendor Web sites—are examined: (1) it is possible to implement SSO for the two Web services using SAML and WS-Security; (2) it is fairly easy to implement a basic SSO solution; (3) the SSO solution will not have a major impact on the runtime behavior of the system; and (4) the SSO solution can provide the required access control. The first three hypotheses were sustained; it was not necessary to implement the fourth one to list options for adding access control.

Cite This Report

Show Citation Formats

SEI

Wrage, Lutz; Simanta, Soumya; Lewis, Grace; & Jaspan, Saul. T-Check in Technologies for Interoperability: Web Services and Security—Single Sign-On (CMU/SEI-2008-TN-026). Software Engineering Institute, Carnegie Mellon University, 2008. http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=8623

IEEE

Wrage. Lutz, Simanta. Soumya, Lewis. Grace, and Jaspan. Saul, "T-Check in Technologies for Interoperability: Web Services and Security—Single Sign-On," Software Engineering Institute, Carnegie Mellon University, Pittsburgh, Pennsylvania, Technical Note CMU/SEI-2008-TN-026, 2008. http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=8623

APA

Wrage, Lutz., Simanta, Soumya., Lewis, Grace., & Jaspan, Saul. (2008). T-Check in Technologies for Interoperability: Web Services and Security—Single Sign-On (CMU/SEI-2008-TN-026). Retrieved August 21, 2014, from the Software Engineering Institute, Carnegie Mellon University website: http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=8623

CHI

Lutz Wrage, Soumya Simanta, Grace Lewis, & Saul Jaspan. T-Check in Technologies for Interoperability: Web Services and Security—Single Sign-On (CMU/SEI-2008-TN-026). Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University, 2008. http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=8623

MLA

Wrage, Lutz., Simanta, Soumya., Lewis, Grace., & Jaspan, Saul. 2008. T-Check in Technologies for Interoperability: Web Services and Security—Single Sign-On (Technical Report CMU/SEI-2008-TN-026). Pittsburgh: Software Engineering Institute, Carnegie Mellon University. http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=8623