2 — Authentication in distributed systems (OAuth 2.0, OpenID Connect, SAML, Kerberos)
Study time: ± 90 minutes (one long video + one short one)
The problem
On a single machine, checking a password is easy. In the real world your identity must be proven to many services spread across networks and clouds — without your password travelling to every one of them, and without you logging in fifty times a day. The solution pattern is always the same: one trusted party does the proving, everyone else trusts a ticket or token it issues.
The protocols you will actually meet
- OAuth 2.0 — a framework for delegated authorisation: letting app A access your data at service B without giving A your password. Strictly speaking it authorises, it does not authenticate.
- OpenID Connect (OIDC) — the thin identity layer on top of OAuth 2.0 that adds real authentication (a signed ID token). Together they are why "Log in with Google" works on a site that never sees your Google password. This is what you will most likely use in your own project.
- SAML — the older, XML-based standard for single sign-on, still everywhere in corporate and education environments (your school login almost certainly uses it).
- Kerberos — the ticket-based protocol behind Windows/Active Directory domains: a trusted Key Distribution Center hands out time-limited tickets so that passwords never cross the internal network.
- Historical root: the Needham-Schroeder protocol (1978) — the academic ancestor of Kerberos; worth knowing the name.
Around all of this sits identity management: the lifecycle of a digital identity — created when someone joins, changed when their role changes, and (the step organisations forget most often) removed when they leave. Orphaned accounts are a classic way in for attackers.
Core resources
- Watch: OAuth 2.0 and OpenID Connect (in plain English) — Nate Barbettini. The classic explainer: rationale, flows, tokens, and when to use what. (± 60 min — worth every minute before you build a login)
- Watch: Taming Kerberos — Computerphile — Dr Mike Pound explains the ticket dance in plain terms. (± 16 min)
- Reference: the CyBOK KA 14 sections on authentication in distributed systems (see the Start here document).
Check yourself
- Your project app offers "Log in with Google". Explain in two sentences why your app never sees the user's Google password.
- What is the difference in purpose between OAuth 2.0 and OpenID Connect?
- A colleague left the company three months ago and their account still works. Which part of AAA failed, and what is this problem called?