Skip to content

ITIS-468-47605: Certified Information Systems Security Professional (CISSP) Cert Exam Prep

Fall 2026

Single Sign-On and Federated Identity

SSO technologies

  • Kerberos — symmetric-key SSO using a KDC with an authentication service and ticket granting service. Tickets are time-stamped, so clock skew breaks it and the KDC is a single point of failure.
  • LDAP / directory services — the identity store queried for authentication and attributes.
  • RADIUS, TACACS+, and Diameter — AAA protocols; TACACS+ encrypts the full payload and separates authentication, authorization, and accounting.

Federation

Federated identity lets a user authenticate at their home identity provider and access resources at a separate service provider without a second account. SAML carries assertions between the identity provider and service provider; OAuth 2.0 grants delegated authorization; OpenID Connect adds an identity layer on top of OAuth.

SSO trade-off

SSO improves usability and reduces password fatigue, but it concentrates risk: one compromised credential opens every connected system. Pair SSO with strong multifactor authentication.