Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We are thinking to move some of our intranet sites to public cloud.

Is there any way to keep using company SSO to authorize access to those sites from the company intranet?

share|improve this question
    
just to be clear, you want these resources to be publicly accessible now? –  neil Jan 28 '12 at 0:47
    
basically 2 types of app. One is entirely intranet with no public access, another one has admin tools which should be availably only if user logs in from intranet –  arkadiy Jan 28 '12 at 23:39
1  
so really it would all be in a closed off cloud. Take a look at EC2's Virtual Private Cloud. Easy setup, keep it locked down, VPN link between that and your office site, no reason you could keep using the same auth system you're using now. –  neil Jan 29 '12 at 0:16
    
Thanks! I guess I should have mentioned we are currently looking into PaaS kind of solutions. Like Heroku, for example. Probably we should include IaaS in the scope as well :). –  arkadiy Jan 29 '12 at 0:41

2 Answers 2

up vote 7 down vote accepted

Sure it's possible. What you want to do is called Federation. How you set it up really depends on the applications and platforms you run though. There are a variety of protocols out there that can do what you want; e.g. SAML, WS-Federation, OpenAuth (to a degree), etc.

The applications need to be able to support the federation protocols though.

In theory you could also set up a VPN from the cloud provider to your intranet too.

If you are running an Active Directory domain you can use Active Directory Federation Services (v2) from Microsoft (http://msdn.microsoft.com/en-us/security/aa570351), and that will let you federate using SAML or WS-Fed to applications that support the protocol. If you are running another directory service there are a few other providers out there like PingFederate (https://www.pingidentity.com/). You could also use a product like (Full disclosure: I work for the company) AuthAnvil SSO (http://www.scorpionsoft.com/).

The questions you need to ask:

  • Do the applications support a federation protocol or do you need to set up a VPN?
  • Which option is more secure? This really should be threat modelled.
  • How do you lock it down so only intranet users can access it?
  • Do you allow users outside the intranet to access the application?
  • How do you protect the external endpoint if you do allow external users?
share|improve this answer
    
the applications are developed by internal IT, so I guess it won't be hard to tweak them to support the Federation. Thanks! –  arkadiy Jan 28 '12 at 23:43

SAML is a good approach if your cloud service provider support it. If not, you need to look for an sso solution that also support HTTP forms, which is how most providers authenticate users (user ID/password). Find out more at www.intel.com/go/identity.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.