Authentication methods

Supports the following authentication methods using web browser:

Federated (External) Authentication

  • LDAP allows internal users of Cornerstone Saba to use one username and password combination to access the application.

    The Lightweight Directory Access Protocol (LDAP) is an application protocol used to access information stored in an information directory over an IP (Internet Protocol) network. The LDAP authentication service allows internal users of Cornerstone Saba to use one username and password combination to access the application. Cornerstone Saba validates the usernames, and then validates the passwords corresponding to the usernames against the LDAP directory. Authentication is successful when each stage in this process passes. If authentication fails at any stage in the process, then the user receives an error message and the login process stops.

    The LDAP lookup simply verifies user accounts and passwords. The directory service is not used to check Cornerstone Saba application user privileges or configuration options. Cornerstone Saba manages privileges and configuration options.

    You can configure different LDAP servers to manage login credentials for different Cornerstone Saba application sites to handle employees, partners, and customers, for example.

  • Single sign-on (SSO) enables the application to accept the account information provided from a trusted source for access to the application.

    Single sign-on is a process that allows network users to access all authorized network resources without having to log in separately to each resource. Single sign-on allows you to validate usernames and passwords against your corporate user database or other client application rather than having separate user passwords managed by Cornerstone Saba.

    Cornerstone Saba offers the following ways to use single sign-on:
    • SAML

      SAML (Security Assertion Markup Language) is a XML-based open standard for exchanging authentication and authorization data between an authentication server and applications.

      Benefits of SAML SSO:

      • SAML abstracts the security framework away from vendor-specific implementations and architectures.
      • SAML does not require user credentials to be maintained and synchronized between directories.
    • OIDC

      Saba supports OpenID Connect (OIDC), which is a popular user authentication protocol. OIDC is an identity layer built on top of the OAuth 2.0 framework, enabling clients to verify the identity of an end user based on authentication performed by an authorization server and to obtain basic profile information. OIDC uses JSON Web Tokens (JWTs) for this purpose.

    • Token based

      Certificate/token based Single Sign-On (SSO) enables a user to receive a single challenge for credentials within a certain realm, and use the returned authentication token for access to other applications which require user authentication. The token is used to both uniquely identify and authenticate the user.

      When using certificate/token based SSO, the authentication token is provided by a user-authentication process running on the Authentication server. This token is used to gain access to the required client application.

    • JSON Web Token (JWT)

      JSON Web Token (JWT) is an open, industry standard method for representing claims securely between two parties. The claims in a JWT are encoded as a JavaScript Object Notation (JSON) object that is used as the payload of a JSON Web Signature (JWS) structure or as the plaintext of a JSON Web Encryption (JWE) structure, enabling the claims to be digitally signed or MACed and/or encrypted.

Non-federated (Internal) authentication

  • Saba Login Based Authentication: Saba Login Based Authentication is a method for an HTTP user agent (for example, a web browser) to provide a username and password when making a request.
    At the time of sigining in, you can view following two options:
    • Remember me: When a user selects the "Remember Me" option during login, their credentials will be automatically populated the next time they access the login page using the same browser. This auto-fill feature will continue until the associated cookie expires or the user logs in again without selecting the "Remember Me" option. Please note that this is a browser cookie-driven feature with a default expiration of 7 days.
    • Keep me Signed In: When a user selects the "Keep Me Signed In" option during login, they will be automatically logged in on subsequent visits using the same browser. This automatic login continues until the user explicitly logs out or the corresponding cookie expires. This feature relies on a browser cookie, which has a default expiry of 8 hours. This expiry limit can be configured in the site property "Keep Me Signed In Cookie Expiry". For more details regarding the property, see Web Variables.

Two-factor authentication

  • Two-factor authentication is an extra layer of security designed to ensure that you're the only person who can access your account, even if someone knows your password. Each time you sign in to your Cornerstone Saba Account, you'll need your password and an Security Code that is sent to your email address.
    Note: Two-factor authentication is applicable only for the following authentication methods:
    • LDAP
    • Saba Login Based Authentication

Also supports the following authentication methods for API authentication:

OAuth

  • Cornerstone Saba web services respond to requests from client code only if the requests are accompanied by authentication -- that is, by proof that the request is being made by a user with a valid Cornerstone Saba user ID and password.

    The authentication is provided in the form of an authentication certificate generated by the Authentication web service. The certificate must be included as a header parameter in calls to all Cornerstone Saba web services (other than the Authentication web service itself).

    Cornerstone Saba uses OAuth2 as its authentication method. OAuth is an authentication protocol that allows users to approve application to act on their behalf without sharing their password. More information about OAuth2 can be found at:
    • http://oauth.net/2/
    • http://tools.ietf.org/html/draft-ietf-oauth-v2-21#section-4.1
    • http://docs.opensocial.org/display/OSREF/OAuth+2.0+Flow+Support
    You as the system admin can generate/regenerate and retrieve the OAuth client secret keys required to use in Oauth for API authentication from Admin > System > Manage Integrations > API Dashboard
  • OAuth support for Saba Mobile

    Cornerstone Saba provides Token based authentication support for Saba Mobile. The system admin can configure and enable the Token based authentication for a Microsite.