2 cissp ® Official Study Guide Eighth Edition

Federated Identity Management and SSO
SSO is common on internal networks, and it also used on the internet. Many cloud-based 
applications use an SSO solution, making it easier for users to access resources over the 
internet. Many cloud-based applications use federated identity management (FIM), which is 
a form of SSO.
Identity management is the management of user identities and their credentials. FIM 
extends this beyond a single organization. Multiple organizations can join a federation, or 
group, where they agree on a method to share identities between them. Users in each orga-
nization can log on once in their own organization and their credentials are matched with a 
federated identity. They can then use this federated identity to access resources in any other 
organization within the group.
A federation can be composed of multiple unrelated networks within a single univer-
sity campus, multiple college and university campuses, multiple organizations sharing 
resources, or any other group that can agree on a common federated identity management 
system. Members of the federation match user identities within an organization to feder-
ated identities.
As an example, many corporate online training websites use federated SSO systems. 
When the organization coordinates with the online training company for employee access, 
they also coordinate the details needed for federated access. A common method is to match 
the user’s internal login ID with a federated identity. Users log on within the organiza-
tion using their normal login ID. When the user accesses the training website with a web 
browser, the federated identity management system uses their login ID to retrieve the 
matching federated identity. If it finds a match, it authorizes the user access to the web 
pages granted to the federated identity.

---

606
Chapter 13 
■
Managing Identity and Authentication
Administrators manage these details behind the scenes and the process is usually trans-
parent to users. Users don’t need to enter their credentials again.
A challenge with multiple companies communicating in a federation is finding a com-
mon language. They often have different operating systems, but they still need to share a 
common language. To solve this challenge, federated identity systems often use the Security 
Assertion Markup Language (SAML) and/or the Service Provisioning Markup Language 
(SPML). As background, here’s a short description of some markup languages.