Software Engineering Institute

A single sign-on (SSO) solution is intended to provide a single authentication point for a set of Web services. The SSO solution for-wards the necessary authentication information to the Web services, which in turn authenticate the end user to legacy systems that implement the Web services' functionality. This technical note presents the results of applying the T-Check approach in an initial investigation of two Web services standards, WS-Security and SAML, to create an SSO solution that works inside a single organization. This approach involves (1) formulating hypotheses about the technology and (2) examining these hypotheses against specific criteria through hands-on experimentation. The outcome of this two-stage approach is that the hypotheses are either fully or partially sustained or refuted. In this report, four hypotheses—based on claims found in experience reports and on vendor Web sites—are examined: (1) it is possible to implement SSO for the two Web services using SAML and WS-Security; (2) it is fairly easy to implement a basic SSO solution; (3) the SSO solution will not have a major impact on the runtime behavior of the system; and (4) the SSO solution can provide the required access control. The first three hypotheses were sustained; it was not necessary to implement the fourth one to list options for adding access control.