search menu icon-carat-right cmu-wordmark

T-Check in Technologies for Interoperability: Web Services and Security—Single Sign-On

Technical Note
This technical note presents the results of applying the T-Check approach in an initial investigation of two Web services standards, WS-Security and SAML, to create an SSO solution that works inside a single organization
Publisher

Software Engineering Institute

CMU/SEI Report Number
CMU/SEI-2008-TN-026
DOI (Digital Object Identifier)
10.1184/R1/6584780.v1

Abstract

A single sign-on (SSO) solution is intended to provide a single authentication point for a set of Web services. The SSO solution for-wards the necessary authentication information to the Web services, which in turn authenticate the end user to legacy systems that implement the Web services' functionality. This technical note presents the results of applying the T-Check approach in an initial investigation of two Web services standards, WS-Security and SAML, to create an SSO solution that works inside a single organization. This approach involves (1) formulating hypotheses about the technology and (2) examining these hypotheses against specific criteria through hands-on experimentation. The outcome of this two-stage approach is that the hypotheses are either fully or partially sustained or refuted. In this report, four hypotheses—based on claims found in experience reports and on vendor Web sites—are examined: (1) it is possible to implement SSO for the two Web services using SAML and WS-Security; (2) it is fairly easy to implement a basic SSO solution; (3) the SSO solution will not have a major impact on the runtime behavior of the system; and (4) the SSO solution can provide the required access control. The first three hypotheses were sustained; it was not necessary to implement the fourth one to list options for adding access control.

Cite This Technical Note

Wrage, L., Simanta, S., Lewis, G., & Jaspan, S. (2008, January 1). T-Check in Technologies for Interoperability: Web Services and Security—Single Sign-On. (Technical Note CMU/SEI-2008-TN-026). Retrieved November 28, 2023, from https://doi.org/10.1184/R1/6584780.v1.

@techreport{wrage_2008,
author={Wrage, Lutz and Simanta, Soumya and Lewis, Grace and Jaspan, Saul},
title={T-Check in Technologies for Interoperability: Web Services and Security—Single Sign-On},
month={Jan},
year={2008},
number={CMU/SEI-2008-TN-026},
howpublished={Carnegie Mellon University, Software Engineering Institute's Digital Library},
url={https://doi.org/10.1184/R1/6584780.v1},
note={Accessed: 2023-Nov-28}
}

Wrage, Lutz, Soumya Simanta, Grace Lewis, and Saul Jaspan. "T-Check in Technologies for Interoperability: Web Services and Security—Single Sign-On." (CMU/SEI-2008-TN-026). Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, January 1, 2008. https://doi.org/10.1184/R1/6584780.v1.

L. Wrage, S. Simanta, G. Lewis, and S. Jaspan, "T-Check in Technologies for Interoperability: Web Services and Security—Single Sign-On," Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, Technical Note CMU/SEI-2008-TN-026, 1-Jan-2008 [Online]. Available: https://doi.org/10.1184/R1/6584780.v1. [Accessed: 28-Nov-2023].

Wrage, Lutz, Soumya Simanta, Grace Lewis, and Saul Jaspan. "T-Check in Technologies for Interoperability: Web Services and Security—Single Sign-On." (Technical Note CMU/SEI-2008-TN-026). Carnegie Mellon University, Software Engineering Institute's Digital Library, Software Engineering Institute, 1 Jan. 2008. https://doi.org/10.1184/R1/6584780.v1. Accessed 28 Nov. 2023.

Wrage, Lutz; Simanta, Soumya; Lewis, Grace; & Jaspan, Saul. T-Check in Technologies for Interoperability: Web Services and Security—Single Sign-On. CMU/SEI-2008-TN-026. Software Engineering Institute. 2008. https://doi.org/10.1184/R1/6584780.v1