Skip to content
BoKSA

2 — Authentication in distributed systems (OAuth 2.0, OpenID Connect, SAML, Kerberos)

2 — Authentication in distributed systems (OAuth 2.0, OpenID Connect, SAML, Kerberos)

Study time: ± 90 minutes (one long video + one short one)

The problem

On a single machine, checking a password is easy. In the real world your identity must be proven to many services spread across networks and clouds — without your password travelling to every one of them, and without you logging in fifty times a day. The solution pattern is always the same: one trusted party does the proving, everyone else trusts a ticket or token it issues.

The protocols you will actually meet

  • OAuth 2.0 — a framework for delegated authorisation: letting app A access your data at service B without giving A your password. Strictly speaking it authorises, it does not authenticate.
  • OpenID Connect (OIDC) — the thin identity layer on top of OAuth 2.0 that adds real authentication (a signed ID token). Together they are why "Log in with Google" works on a site that never sees your Google password. This is what you will most likely use in your own project.
  • SAML — the older, XML-based standard for single sign-on, still everywhere in corporate and education environments (your school login almost certainly uses it).
  • Kerberos — the ticket-based protocol behind Windows/Active Directory domains: a trusted Key Distribution Center hands out time-limited tickets so that passwords never cross the internal network.
  • Historical root: the Needham-Schroeder protocol (1978) — the academic ancestor of Kerberos; worth knowing the name.

Around all of this sits identity management: the lifecycle of a digital identity — created when someone joins, changed when their role changes, and (the step organisations forget most often) removed when they leave. Orphaned accounts are a classic way in for attackers.

Core resources

  • Watch: OAuth 2.0 and OpenID Connect (in plain English) — Nate Barbettini. The classic explainer: rationale, flows, tokens, and when to use what. (± 60 min — worth every minute before you build a login)
  • Watch: Taming Kerberos — Computerphile — Dr Mike Pound explains the ticket dance in plain terms. (± 16 min)
  • Reference: the CyBOK KA 14 sections on authentication in distributed systems (see the Start here document).

Check yourself

  1. Your project app offers "Log in with Google". Explain in two sentences why your app never sees the user's Google password.
  2. What is the difference in purpose between OAuth 2.0 and OpenID Connect?
  3. A colleague left the company three months ago and their account still works. Which part of AAA failed, and what is this problem called?