Using intranet SSO to access sites hosted on public cloud

Question

We are thinking to move some of our intranet sites to public cloud.

Is there any way to keep using company SSO to authorize access to those sites from the company intranet?

Answer 1

Sure it's possible. What you want to do is called Federation. How you set it up really depends on the applications and platforms you run though. There are a variety of protocols out there that can do what you want; e.g. SAML, WS-Federation, OpenAuth (to a degree), etc.

The applications need to be able to support the federation protocols though.

In theory you could also set up a VPN from the cloud provider to your intranet too.

If you are running an Active Directory domain you can use Active Directory Federation Services (v2) from Microsoft (http://msdn.microsoft.com/en-us/security/aa570351), and that will let you federate using SAML or WS-Fed to applications that support the protocol. If you are running another directory service there are a few other providers out there like PingFederate (https://www.pingidentity.com/). You could also use a product like (Full disclosure: I work for the company) AuthAnvil SSO (http://www.scorpionsoft.com/).

The questions you need to ask:

• Do the applications support a federation protocol or do you need to set up a VPN?
• Which option is more secure? This really should be threat modelled.
• How do you lock it down so only intranet users can access it?
• Do you allow users outside the intranet to access the application?
• How do you protect the external endpoint if you do allow external users?

Answer 2

SAML is a good approach if your cloud service provider support it. If not, you need to look for an sso solution that also support HTTP forms, which is how most providers authenticate users (user ID/password). Find out more at www.intel.com/go/identity.