SSO, Identity Flow, Authorization In Cloud Applications and Services – Challenges and Solution Approaches

Regardless of the physical deployment the high level schema of canonical cloud application can be described as follows.

SSO, Identity Flow, Authorization Challenges and Approaches

End user can have existing identities managed by industry strength identity providers such as Windows Live ID, Google, Yahoo!, Facebook, or enterprise Active Directory.
End user interacts with the system that requires authentication and authorization via Web Browser, or…
End user interacts with the system that requires authentication and authorization via Rich Client running either on desktop, smartphone, or inside browser (Silverlight, JavaScript, etc)
Web Application might interact with downstream web services that require authentication and authorization.

Following are the security related challenges and solution approaches when designing your system that fits the key characteristics above.

Challenge	Approach
How to externalize authentication for web applications?	Passive federation
How to externalize authentication for web services?	Active federation
How to use Internet credentials with different applications?	Integrating with Internet identity providers
How to use enterprise credentials with different applications?	Integrating with enterprise identity providers
How to flow security context through physical tiers?	Passing a set of claims in the token between client, relying party, identity provider, and ACS OAuth 2.0 protocol
How to transform user identity for further fine grained claims based authorization?	Claims token transformation
How to interoperate with others?	SWT Token and OAuth WRAP protocol WS-Federation protocol WS-Trust protocol SAML Token Live ID RPS protocol (Windows Live ID SDK)
How to secure communications?	Security Considerations Threats and Countermeasures
How to automate management?	Management service

What other questions left unasked and unanswered? Share in comments section below, please.

추가 리소스