{"id":8346,"date":"2023-09-14T10:49:00","date_gmt":"2023-09-14T08:49:00","guid":{"rendered":"https:\/\/www.idstory.com\/?p=8346"},"modified":"2023-09-06T14:45:08","modified_gmt":"2023-09-06T12:45:08","slug":"system-jednotneho-prihlaseni-single-sign-on-sso","status":"publish","type":"post","link":"https:\/\/www.idstory.com\/cs\/system-jednotneho-prihlaseni-single-sign-on-sso\/","title":{"rendered":"Syst\u00e9m jednotn\u00e9ho p\u0159ihl\u00e1\u0161en\u00ed \u2013 Single sign on SSO"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\tSyst\u00e9m jednotn\u00e9ho p\u0159ihl\u00e1\u0161en\u00ed \u2013 Single sign on SSO je n\u00e1stroj\u00a0\u00a0Identity a Access Managementu (IAM).\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Co je IAM?<\/h2>

Identity a Access Management (IAM) je centralizovan\u00e1 spr\u00e1va identit a p\u0159\u00edstup\u016f. Z\u00e1kladn\u00edm c\u00edlem syst\u00e9m\u016f IAM je jedna digit\u00e1ln\u00ed identita jednotlivce. Jakmile je tato digit\u00e1ln\u00ed identita (ID) vytvo\u0159ena, mus\u00ed b\u00fdt udr\u017eov\u00e1na, upravov\u00e1na a sledov\u00e1na pro ka\u017ed\u00e9ho u\u017eivatele.\u00a0<\/p>

Identity a Access Management (IAM) je tedy o\u00a0definov\u00e1n\u00ed, spr\u00e1v\u011b rol\u00ed a p\u0159\u00edstupov\u00fdch opr\u00e1vn\u011bn\u00ed\u00a0jednotliv\u00fdch u\u017eivatel\u016f s\u00edt\u011b. T\u011bmito u\u017eivateli mohou b\u00fdt z\u00e1kazn\u00edci nebo zam\u011bstnanci. D\u016fvodem, pro\u010d IAM je vyu\u017e\u00edv\u00e1na je, \u017ee IT syst\u00e9my jsou typicky heterogenn\u00ed a jsou dostupn\u00e9 po intern\u00ed s\u00edti. Spr\u00e1va je tak prov\u00e1d\u011bna z\u00e1sahem administr\u00e1tora v IdM nebo automatizovan\u00fdmi procesy.<\/p>

Co je syst\u00e9m jednotn\u00e9ho p\u0159ihl\u00e1\u0161en\u00ed \u2013 Single sign on (SSO)?<\/h2>

Pomoc\u00ed syst\u00e9mu jednotn\u00e9ho p\u0159ihl\u00e1\u0161en\u00ed (SSO<\/a>) se u\u017eivatel\u00e9 ov\u011b\u0159uj\u00ed pouze jednou (typicky do Access Managementu). Pot\u00e9 je u\u017eivateli umo\u017en\u011bn p\u0159\u00edstup do v\u0161ech syst\u00e9m\u016f bez nutnosti jednotliv\u00e9ho p\u0159ihl\u00e1\u0161en\u00ed do ka\u017ed\u00e9ho syst\u00e9mu. Kdy\u017e se nap\u0159\u00edklad u\u017eivatel p\u0159ihl\u00e1s\u00ed do Googlu, automaticky je p\u0159ihl\u00e1\u0161en do sv\u00fdch \u00fa\u010dt\u016f Gmail a YouTube. Jedn\u00e1 se o zjednodu\u0161en\u00ed pr\u00e1ce pro u\u017eivatele, kter\u00fd si nemus\u00ed pamatovat dal\u0161\u00ed hesla. Z\u00e1rove\u0148 lze z jedinn\u00e9ho m\u00edsta centralizovan\u011b p\u0159\u00edstup odebrat.<\/p>

Kolik \u010dasu helpdesk \u010dasto tr\u00e1v\u00ed na tom, \u017ee si u\u017eivatel zapomn\u011bl heslo a je nutn\u00e9 ho resetovat. Z\u00e1rove\u0148 jak\u00fd komfort m\u00e1 u\u017eivatel, pokud si m\u00e1 pamatovat 10 hesel a k tomu je\u0161t\u011b o r\u016fzn\u00e9 d\u00e9lce s r\u016fzn\u00fdmi znaky (nepo\u010d\u00edt\u00e1m, \u017ee do kritick\u00fdch syst\u00e9m\u016f si ho ka\u017ed\u00e9 3 m\u011bs\u00edce mus\u00ed m\u011bnit). Syst\u00e9m jednotn\u00e9ho p\u0159ihl\u00e1\u0161en\u00ed redukuje po\u010det hesel, zvy\u0161uje komfort u\u017eivateli a sni\u017euje n\u00e1klady na helpdesk. Nap\u0159\u00edklad l\u00e9ka\u0159 v nemocnici se m\u00e1 soust\u0159edit na l\u00e9\u010den\u00ed pacient\u016f a ne \u0159e\u0161en\u00ed, \u017ee si op\u011btovn\u011b zapomn\u011bl heslo.<\/p>

Federovan\u00e1 identita (Federated identity management)<\/h2>

Federovan\u00e1 spr\u00e1va identit umo\u017e\u0148uje sd\u00edlet digit\u00e1ln\u00ed ID s d\u016fv\u011bryhodn\u00fdmi partnery. Jedn\u00e1 se o mechanismus sd\u00edlen\u00ed autentizace, kter\u00fd umo\u017e\u0148uje u\u017eivatel\u016fm pou\u017e\u00edvat stejn\u00e9 u\u017eivatelsk\u00e9 jm\u00e9no, heslo nebo jin\u00e9 ID pro z\u00edsk\u00e1n\u00ed p\u0159\u00edstupu do v\u00edce ne\u017e jedn\u00e9 s\u00edt\u011b.\u00a0<\/p>

Syst\u00e9m jednotn\u00e9ho p\u0159ihl\u00e1\u0161en\u00ed (SSO) je d\u016fle\u017eitou sou\u010d\u00e1st\u00ed spr\u00e1vy federovan\u00fdch identit. Zat\u00edmco jednotn\u00e9 p\u0159ihl\u00e1\u0161en\u00ed SSO umo\u017e\u0148uje u\u017eivatel\u016fm p\u0159ihl\u00e1sit se k r\u016fzn\u00fdm syst\u00e9m\u016fm v organizaci, federovan\u00e1 identita d\u011bl\u00e1 tot\u00e9\u017e ve v\u00edce organizac\u00edch. Tento model funguje pouze mezi spolupracuj\u00edc\u00edmi organizacemi \u2013 d\u016fv\u011bryhodn\u00fdmi partnery, kte\u0159\u00ed v z\u00e1sad\u011b ru\u010d\u00ed za sv\u00e9 u\u017eivatele.\u00a0<\/p>

Pro \u0159e\u0161en\u00ed federace identit B2B lze vyu\u017e\u00edt nap\u0159\u00edklad Active Directory, Azure, SAML, LDAP a ADFS.\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

V\u00fdhody\u00a0syst\u00e9mu jednotn\u00e9ho p\u0159ihl\u00e1\u0161en\u00ed \u2013 Single sign on (SSO)<\/h2>

Mezi v\u00fdhody pou\u017e\u00edv\u00e1n\u00ed jednotn\u00e9ho p\u0159ihl\u00e1\u0161en\u00ed pat\u0159\u00ed:<\/p>

  • \u0160et\u0159\u00ed \u010das\u00a0 u\u017eivatel\u016fm p\u0159\u00ed zad\u00e1v\u00e1n\u00ed hesel do jednotliv\u00fdch syst\u00e9m\u016f<\/li>
  • Sni\u017euje n\u00e1klady na IT podporu poklesem po\u010dtu po\u017eadavk\u016f (nap\u0159\u00edklad reset hesel)<\/li>
  • Sni\u017euje riziko p\u0159\u00edstupu na weby t\u0159et\u00edch stran (pomoc\u00ed federovan\u00e9 identity ), proto\u017ee u\u017eivatelsk\u00e1 hesla nejsou ulo\u017eena ani spravov\u00e1na extern\u011b<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    „Mythbusters“ kolem SSO<\/h2>

    M\u00fdtus 1: SSO zpomaluje t\u00fdmy IT a zvy\u0161uje jejich pracovn\u00ed z\u00e1t\u011b\u017e.<\/strong>
    SSO d\u00edky automatizaci zvy\u0161uje efektivitu pr\u00e1ce IT.\u00a0 Poskytuje tak\u00e9 lep\u0161\u00ed zabezpe\u010den\u00ed a zp\u0159ehled\u0148uje pracovn\u00ed postupy. P\u0159\u00edmo \u0159e\u0161\u00ed hlavn\u00ed \u00fakol IT t\u00fdm\u016f, kter\u00fdm je hladce, bezpe\u010dn\u011b a rychle p\u0159ipojit zam\u011bstnance k n\u00e1stroj\u016fm, kter\u00e9 pot\u0159ebuj\u00ed k v\u00fdkonu sv\u00e9 pr\u00e1ce. SSO tak\u00e9 umo\u017e\u0148uje rychlej\u0161\u00ed \u0161k\u00e1lov\u00e1n\u00ed, lep\u0161\u00ed p\u0159ehled o p\u0159\u00edstupu k aplikac\u00edm a sn\u00ed\u017een\u00ed po\u010dtu ticket\u016f na helpdesku a n\u00e1klad\u016f na IT.<\/p>

    M\u00fdtus 2<\/strong>: SSO se obt\u00ed\u017en\u011b zav\u00e1d\u00ed.<\/strong>
    Star\u0161\u00ed n\u00e1stroje byly ve sv\u00e9 dob\u011b mo\u017en\u00e1 slo\u017eit\u00e9, ale modern\u00ed SSO se nasazuje rychle a jednodu\u0161e. Dne\u0161n\u00ed n\u00e1stroje SSO maj\u00ed p\u0159edp\u0159ipraven\u00e9 konektory k tis\u00edc\u016fm pravideln\u011b vyu\u017e\u00edvan\u00fdch aplikac\u00ed, co\u017e t\u00fdm\u016fm IT u\u0161et\u0159\u00ed nutnost ru\u010dn\u011b vytv\u00e1\u0159et integrace. Organizace tak\u00e9 mohou p\u0159ipojovat u\u017eivatele a importovat je ze st\u00e1vaj\u00edc\u00edch adres\u00e1\u0159\u016f, ani\u017e by musely konfigurovat, instalovat nebo podporovat sv\u016fj hardware nebo prov\u00e1d\u011bt zm\u011bny ve firewallu. SSO se snadno nasazuje, centralizuje zav\u00e1d\u011bn\u00ed nov\u00fdch u\u017eivatel\u016f a aplikac\u00ed, je vysoce dostupn\u00e9 a minimalizuje n\u00e1klady, \u010d\u00edm\u017e zaji\u0161\u0165uje jednoduch\u00fd a z\u00e1rove\u0148 bezpe\u010dn\u00fd p\u0159\u00edstup.<\/p>

    M\u00fdtus 3: SSO vytv\u00e1\u0159\u00ed jedin\u00fd bod selh\u00e1n\u00ed, tak\u017ee je m\u00e9n\u011b bezpe\u010dn\u00e9.<\/strong>
    Na prvn\u00ed pohled se m\u016f\u017ee zd\u00e1t, \u017ee po\u017eadavek na jedno heslo ze strany SSO vytv\u00e1\u0159\u00ed \u0161irok\u00fd prostor pro kybernetick\u00e9 \u00fatoky. Ve skute\u010dnost v\u0161ak hlavn\u00edm vstupn\u00edm bodem pro selh\u00e1n\u00ed je s\u00e1m u\u017eivatel. Kdy\u017e jsou u\u017eivatel\u00e9 nuceni \u017eonglovat s r\u016fzn\u00fdmi p\u0159ihla\u0161ovac\u00edmi \u00fadaji, \u010dasto se uchyluj\u00ed k recyklaci hesel a \u0161patn\u00e9 hygien\u011b hesel, co\u017e pro firmy p\u0159edstavuje bezpe\u010dnostn\u00ed riziko. T\u00edm, \u017ee SSO eliminuje pot\u0159ebu n\u011bkolika sad pov\u011b\u0159en\u00ed, umo\u017e\u0148uje t\u00fdm\u016fm IT nastavit z\u00e1sady hesel, kter\u00e9 standardizuj\u00ed b\u011b\u017en\u00e9 bezpe\u010dnostn\u00ed protokoly, a z\u00e1rove\u0148 monitoruj\u00ed kontext aplikace, u\u017eivatele, za\u0159\u00edzen\u00ed, um\u00edst\u011bn\u00ed a s\u00edt\u011b pro ka\u017ed\u00fd po\u017eadavek na p\u0159\u00edstup.<\/p>

    M\u00fdtus 4: SSO je tot\u00e9\u017e co spr\u00e1vce hesel.<\/strong>
    SSO a spr\u00e1vci hesel umo\u017e\u0148uj\u00ed u\u017eivatel\u016fm p\u0159\u00edstup k v\u00edce aplikac\u00edm pomoc\u00ed jednoho p\u0159ihl\u00e1\u0161en\u00ed, ale t\u00edm podobnost kon\u010d\u00ed. Spr\u00e1vci hesel jsou trezory, kter\u00e9 uchov\u00e1vaj\u00ed a pamatuj\u00ed si p\u0159ihla\u0161ovac\u00ed \u00fadaje u\u017eivatel\u016f pro r\u016fzn\u00e9 aplikace nebo webov\u00e9 str\u00e1nky chr\u00e1n\u011bn\u00e9 jedn\u00edm prim\u00e1rn\u00edm heslem. Zam\u011b\u0159uj\u00ed se v\u0161ak na ochranu hesel, kter\u00e1 p\u0159edstavuj\u00ed v\u00edce ne\u017e 80 % v\u0161ech naru\u0161en\u00ed bezpe\u010dnosti a nab\u00edzej\u00ed hacker\u016fm potenci\u00e1ln\u00ed vstupn\u00ed bod do organizace nebo identity. \u0158e\u0161en\u00ed SSO naproti tomu spravuj\u00ed p\u0159\u00edstup prost\u0159ednictv\u00edm d\u016fv\u011bry a vyu\u017e\u00edvaj\u00ed existuj\u00edc\u00ed vztahy k vytvo\u0159en\u00ed jedin\u00e9 dom\u00e9ny, v n\u00ed\u017e prob\u00edh\u00e1 ov\u011b\u0159ov\u00e1n\u00ed.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

    Syst\u00e9m jednotn\u00e9ho p\u0159ihl\u00e1\u0161en\u00ed \u2013 Single sign on SSO je n\u00e1stroj Identity a Access Managementu (IAM). <\/p>\n","protected":false},"author":6,"featured_media":8377,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"elementor_theme","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[32],"tags":[],"class_list":["post-8346","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-identity-manager"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/posts\/8346","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/comments?post=8346"}],"version-history":[{"count":0,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/posts\/8346\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/media\/8377"}],"wp:attachment":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/media?parent=8346"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/categories?post=8346"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/tags?post=8346"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}