一种Web应用环境下的联合单点登录模型

单点登录是企业之间跨域分布式计算的一项关键技术,使用户可以无缝地访问多个服务器而无需多次认证。K erberos和SAM L是当前2种主流的单点登录模型,二者各有其优缺点。文中通过对这2种模型进行比较和融合,取长补短,提出了一种新的W eb应用环境下的联合单点登录模型。首先,对模型结构进行了分析,并重点分析了单点登录服务器、票据模型2个主要组成部分;然后,对模型所具有的特点如统一管理和控制、双向认证、安全和轻量级票据等进行了阐述;最后,针对用户登录、站点间跳转2种典型情况,探讨了单点登录的实施过程。

A Better Single Sign-On Model in Web Application Environment

Purpose.There exist already two leading SSO(Single Sign-On) models: Kerberos and SAML(Security Assertion Markup Language).We synthesize these two leading models and thus present a better one.In the full paper,we explain in much detail our synthesized or federated model;here we just list the three topics discussed in the detailed explanation:(1) leading SSO models,whose subtopics are Kerberos model and SAML model;(2) federated SSO model in web application environment;the subtopics are SSO server,ticket model,and characteristics of federated model;(3) SSO process,whose subtopics are user logging-in process,which consists of seven steps,and the process of jumping between sites,which consists of five steps.The synthesized or federated model has the following three characteristics:(1) unified management and control;(2) bi-direction authentication;(3