Which access control mechanism allows for multiple systems to use a central authentication server (CAS) that permits users to authenticate once and…

Single Sign-On (SSO) is an authentication scheme that allows a user to log in with a single set of credentials to a central authentication service and gain access to multiple, independent software systems without being prompted to log in again. This mechanism relies on a trust relationship between a service provider and an identity provider. The scenario described, involving a central authentication server (CAS) that permits users to authenticate once for access to multiple systems, is the definition of SSO. It enhances user experience and simplifies password management while centralizing authentication control.

A. Role Based Access Control (RBAC): This is an authorization model that grants access to resources based on a user's defined role within an organization, not an authentication mechanism for multiple systems.

B. Discretionary Access Control (DAC): This is an authorization model where the owner of a resource determines who can access it. It is not a centralized authentication scheme.

D. Windows authentication: This refers to specific authentication protocols used by Microsoft Windows (e.g., Kerberos, NTLM). While it can be part of an SSO implementation, SSO is the general mechanism described, not a vendor-specific technology.

1. National Institute of Standards and Technology (NIST). (2017). NIST Special Publication 800-63-3: Digital Identity Guidelines. Section 6

"Federation and Assertions

" describes the framework for SSO

stating

"Federation allows a subject to use attributes from an identity provider... to authenticate to a relying party without having to establish a separate identifier and credentials at that relying party." (Page 33).

Available at: https://doi.org/10.6028/NIST.SP.800-63-3

2. Hu

V. C.

Ferraiolo

D.

Kuhn

R.

Schnitzer

A.

Sandlin

K.

Miller

R.

& Scarfone

K. (2009). Guide to Access Control Systems. NIST Interagency Report 7316. Section 2.1

"Access Control Policies

" defines DAC and RBAC

clearly distinguishing them as authorization policies rather than authentication schemes. (Pages 2-1 to 2-3).

Available at: https://csrc.nist.gov/publications/detail/nistir/7316/final

3. Paci

F.

& Ghafoor

A. (2008). A Web Services-Based Access Control System for Digital Libraries. IEEE Transactions on Services Computing

1(2)

119-132. This paper discusses access control models

stating

"In the Role-Based Access Control (RBAC) model

permissions are associated with roles

and users are made members of appropriate roles." This highlights RBAC's focus on authorization via roles. (Page 120

Section 2.A).

DOI: https://doi.org/10.1109/TSC.2008.11