SSO 和多重身份验证
我感兴趣的是如何使用 SiteMinder 和 OpenSSO 管理以下场景（
给定两个 Web 应用程序），并强制在它们之间使用 SSO。应用程序 A 是一个简单的应用程序，仅需要用户名/密码组合。应用程序 B 需要多重身份验证。
我们应该如何管理两个应用程序之间的不同身份验证级别？有没有办法在像 SiteMinder 这样的工具中表达这一点，以便用户在登录应用程序 A 时可以被分配“基本身份验证级别”，但如果他们访问应用程序 B，他们将面临第二个因素的挑战？
我的直觉是，第二个因素需要在 SiteMinder 级别进行管理，因为应用程序 B 位于其后面，从其角度来看，身份验证是由应用程序服务器/SSO 管理器强制执行的二元决策：即应用程序被“告知” “用户是否经过身份验证......应用程序 B 将无法控制用户所拥有的身份验证级别。
SiteMinder 是否管理这种不同级别的身份验证的想法，是否可以用 SAML 来表达？
我本以为这是一种常见的模式，但我似乎找不到任何有关配置、最佳实践等的文档。
提前致谢，
Fintan
I'm interested in how the following scenario would be managed using SiteMinder and OpenSSO
Given two web applications, and mandated to use SSO across them. App A is a simple application that requires only a username / password combination. App B requires multi-factor authentication.
How should we manage the differing authentication levels across the two applications? Is there a way of expressing this in tools like SiteMinder, so a user can be assigned a "base authentication level" if they sign in to App A, but if they hit App B, they will be challenged for the second factor?
My instinct is that the second factors need to be managed at the SiteMinder level, because App B is sitting behind it, and from its perspective authentication is a binary decision that is mandated by the App Server / SSO manager: i.e. the application is "told" that users are authenticated or not....App B wont have a handle on the level of authentication that the user has.
Does SiteMinder manage this idea of varying levels of authentication, is it something that can perhaps be expressed in SAML?
I would have thought this is a common pattern that arises, but I cannot seem to find any documents on configuration, best practices etc.
Thanks in advance,
Fintan
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这是 SiteMinder 绝对可以做到的事情。有时它被称为“逐步身份验证” - 这基本上意味着在需要时使用更强的身份验证形式对用户进行身份验证。
它应该由 SiteMinder 的策略引擎集中控制。其他 Web 访问管理产品也有类似的方法。
当您谈论联合域外的应用程序时，SAML 可能会发挥作用。在 SAML 中，您可以指定 AuthnContext，向其他方指示需要/已执行的身份验证级别。
This is something SiteMinder could definitely do. Sometimes it is referred to as "step-up authentication" - which basically means authenticate the user with a stronger form of authentication when the need arises.
It should be controlled centrally by SiteMinder's policy engine. Other Web Access Management products have a similar approach.
SAML may come into play when you're talking about federating to applications outside of your domain. Within SAML you can specify an AuthnContext which indicates to other party what authentication level is required/has been performed.
SiteMinder 中满足此要求的功能似乎是分配给每个领域的保护级别。这可用于模拟额外的授权级别，具体取决于您最初进行身份验证的方式/地点。至少这是我设计解决方案的方式。
It seems the feature in SiteMinder to fulfill this requirement is the Protection Level assigned to each Realm. This can be used to simulate that extra level of authorization that depends on how / where you originally authenticated. At least this is how I'm designing our solution.