SSO Definitions

• Authentication - the ability for online systems to validate an identity like a username for purposes of signing into said system.
• Authorization - after an identity has been authenticated, authorization determines if the current identity’s roles are sufficient enough to access certain resources.
• Login Credentials - the information a user needs to provide to confirm their identity. Ex. username + password
• Multifactor Authentication - signing into a system with multiple steps of validation ex. username/password + sms code
• Azure Active Directory (a.k.a. Azure AD or AAD) - a commonly used enterprise cloud work directory provided by Microsoft that keeps track of all users in a work environment. We actually partially use this here at EB!
• Single Sign-on (SSO) - the ability to sign into a 3rd party system with credentials that the 3rd party system does not store. The 3rd party system never stores your login password at any point. Ex. When you use your eventbooking email to sign into a website using the google sign in button. That website does not check your password but instead trusts that since Google authenticated you that you are who you say you are.
• Single Sign-on with VenueOps - the ability for our customers to use their own work credentials to sign into VenueOps. The users then never have to create a password with VenueOps itself! SSO with VenueOps will work directly with Azure Active Directory. VenueOps will be establishing trust with our clients work directories!
• OAuth 2.0 - an authorization standard that dictates how users are granted access to resources. This standard helps developers/IT professionals easily create login systems that can be understood and adopted by other developers. Many developers and IT professionals generally need to be familiar with this standard, for everyone else, just know it’s a behind-the-scenes standard for getting access to systems.
• Cognito - an AWS cloud service that manages user authentication. This service is where usernames and passwords are stored as well as phone numbers for sending SMS text messages.
• Cognito with VenueOps - all user login information and credentials will no longer be stored by VenueOps Databases but rather they will be managed and stored by AWS Cognito. This will allow us to take full advantage of Cognito’s features such as to allow multifactor authentication for our users and to establish SSO with our client’s AAD instances.
• SAML - a markup language that makes Single Sign-on possible. When someone says SAML just know they are talking about Single Sign-on for now. More documentation will be released in the future discussing this subject for the Client Success Team as this will help us troubleshoot any issues our clients experience with enabling Single Sign-on.
• Identity Provider - a directory that contains and tracks all users. Ex. Azure AD, Okta
• Okta - an Identity Provider that companies use to manage and track their employees’ identity information. This company also provides special authentication/authorization services. It operates similar to how Azure AD operates.
• Active Directory (AD) - not to be confused with “Azure Active Directory (AAD)”. This was the predecessor of Azure Active Directory and is an identity provider/directory service for employees at various companies. Unlike Azure Active Directory, this service is not hosted on the cloud SaaS solution.
• Active Directory Federated Services (AD FS) - old school Active Directory that lives behind non publicly accessible networks use AD FS to perform user authentication. This service acts as a middleman between an Active Directory instance and the internet. The use of ADFS is very common in large scale older enterprise environments. Using this with SSO is a possible solution vs SSO against Active Directory.