Content Comparison

...

1. Web SSO authentication via Entra
2. Web SSO authentication via Shibboleth
   1. Web SSO is the preferred authentication method for applications within the University network. If an application supports Shibboleth, it is required to use it, unless the service has been granted an exception by the CISO.  Single Sign-On is most effective if it is adopted by the largest number of applications. It is also a more secure method of handling the NetID and password since the application itself never sees it.
   2. Web SSO provides two-factor, which provides a greater level of security and is required when available.
   3. New applications must operate within this Web SSO environment. If the standard product cannot operate in this way, an exception request must be submitted to the CISO along with a rationale about why this product is the preferred solution. 
3.  Active Directory authentication
   1. The definition of the central Active Directory schema is managed by ITS.
   2. Schools and divisions may not operate a dedicated AD Domain or Forest for authentication. 
   3. The application software must not require superuser or write access to the Active Directory in order to authenticate users and retrieve attributes.
   4. All connections to Active Directory must be completed in a secure fashion, using SSL or something that provides a comparable security level.
4. LDAP authentication via 389 
   1. Access to LDAP Registry authentication services are by request only and are limited to specific application credentials at specific IP addresses. Anonymous binding to the LDAP Registry is not supported.
   2. Connection to the LDAP Registry must be over an LDAPS (SSL protected) protocol link.
   3. The definition of the LDAP Registry schema is managed by ITS and extension to accommodate additional data elements is reviewed on a case-by-case basis. 

...