Managed Device Local Account Access Switching During SSO Outages
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing devices face challenges in balancing accessibility and security when an Identity Provider (IDP) for Single Sign-On (SSO) is unavailable, leading to potential security risks from using weaker local accounts.
Innovation Solution
Implementing a system that conditions access to a local account based on the availability of the IDP, allowing SSO access when available and switching to a local account only when the IDP is unreachable, with a timer-based check for IDP availability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If access is always allowed through local accounts, then accessibility is improved, but security deteriorates when IDP is available
Solution Approach 1:
The system dynamically adjusts authentication requirements based on IDP availability. When IDP is available, SSO authentication is enforced; when unavailable, local account authentication is enabled. This dynamic switching resolves the contradiction by adapting security measures to current system conditions rather than using a static authentication policy.
Solution Approach 2:
The authentication mode parameter changes based on IDP availability status. The system monitors IDP reachability and switches between SSO mode (when IDP is available) and local account mode (when IDP is unavailable), thereby adjusting the security parameter to match operational conditions and resolve the accessibility-security tradeoff.
2Reliability
If SSO is always enforced, then security is improved, but accessibility deteriorates when IDP is unavailable
Solution Approach 1:
The system prepares local account authentication as a backup mechanism before IDP unavailability occurs. By having local accounts pre-configured and ready to use, the system cushions against accessibility deterioration when IDP becomes unavailable, ensuring continuous operation while maintaining security when possible.
Solution Approach 2:
The local account serves as an intermediary authentication mechanism between the user and the system when the primary IDP-based SSO system is unavailable. This intermediary approach maintains accessibility during IDP outages while the system continues to enforce SSO when the identity provider is reachable.
3Ease of operation
If local account access is always allowed, then accessibility is improved, but resource usage deteriorates due to repeated IDP checks
Solution Approach 1:
Instead of continuously checking IDP availability, the system implements periodic checks at authentication decision points. This periodic action reduces resource consumption compared to continuous monitoring while still maintaining the ability to enforce SSO when IDP is available, thereby resolving the contradiction between accessibility and resource usage.
Data Source
AI summary
A managed device may include multiple techniques to login and use resources. One example may include a single sign-on (SSO) login procedure that utilizes an identity provider that may authenticate the user. Another example may include a local account, which may allow access by the user inputting credentials, such as a login ID and a password. The managed device may condition access to the local account based on whether the identity provider is available. If the identity provider is available, then the managed device may disallow access through the local account. However, if the identity provider is unavailable, then the managed device may allow access through the local account.