Implementasi Single Sign-On (SSO) dengan Pendekatan Alaca's Framework untuk Peningkatan Keamanan Layanan Web Terintegrasi
DOI:
https://doi.org/10.26418/jp.v11i1.81743Keywords:
SSO, REST API, Web Integration, Alaca"™s SSO System Evaluation FrameworkAbstract
Disintegrasi beberapa layanan yang menyangkut pengguna yang sama dapat membuat proses autentikasi menjadi redundan dan mengurangi kenyamanan pengguna. Single Sign On (SSO) membuat seorang pengguna bisa menggunakan sebuah kredensial untuk mengakses beberapa layanan dengan identitas yang sama. Sistem SSO dapat membuat pengguna melakukan satu proses autentikasi untuk mengakses beberapa layanan dan sumber daya. Penelitian ini bertujuan untuk mengatasi tantangan integrasi layanan web yang sudah ada menggunakan SSO untuk menghilangkan redundansi. Sebuah aplikasi SSO baru dirancang dan diimplementasikan untuk mengintegrasikan layanan-layanan tersebut dengan memenuhi persyaratan fungsional dan non-fungsional, termasuk kebijakan keamanan yang ketat. Dengan menggunakan Alaca's SSO System Evaluation Framework, manfaat dari aplikasi ini dievaluasi, menunjukkan keunggulan dibandingkan skema OpenID Connect, terutama dalam memberikan jaminan sinyal kepada Penyedia Layanan.
References
D. Anand, V. Khemchandani, M. Sabharawal, O. Cheikhrouhou, and O. Ben Fredj, “Lightweight Technical Implementation of Single Sign-On Authentication and Key Agreement Mechanism for Multiserver Architecture-Based Systems,†Security and Communication Networks, vol. 2021, 2021, doi: 10.1155/2021/9940183.
F. Alaca and P. C. V. Oorschot, “Comparative Analysis and Framework Evaluating Web Single Sign-on Systems,†ACM Comput Surv, vol. 53, no. 5, Sep. 2020, doi: 10.1145/3409452.
A. Syarif, A. A. Nazmi, M. Nur Soleh, A. A. Sukmandhani, and J. Ohliati, “Implementation of Single Sign-on System for User Management at PT.XYZ,†in Proceedings of 2022 International Conference on Information Management and Technology, ICIMTech 2022, Institute of Electrical and Electronics Engineers Inc., 2022, pp. 67–72. doi: 10.1109/ICIMTech55957.2022.9915069.
I. Gita Anugrah and M. Aldi Rifai Imam Fakhruddin, “Development Authentication and Authorization Systems of Multi Information Systems Based REst API and Auth Token,†IRJ: Innovation Research Journal, 2020.
P. A. M. Serrano and J. J. S. Onate, “Integration of RESTFul API to Student Information System for Secured Data Sharing and Single Sign-on,†in 2021 IEEE 13th International Conference on Humanoid, Nanotechnology, Information Technology, Communication and Control, Environment, and Management, HNICEM 2021, Institute of Electrical and Electronics Engineers Inc., 2021. doi: 10.1109/HNICEM54116.2021.9731898.
J. Ofoeda, R. Boateng, and J. Effah, “Application programming interface (API) research: A review of the past to inform the future,†International Journal of Enterprise Information Systems, vol. 15, no. 3. IGI Global, pp. 76–95, Jul. 01, 2019. doi: 10.4018/IJEIS.2019070105.
A. Ehsan, M. A. M. E. Abuhaliqa, C. Catal, and D. Mishra, “RESTful API Testing Methodologies: Rationale, Challenges, and Solution Directions,†Applied Sciences (Switzerland), vol. 12, no. 9. MDPI, May 01, 2022. doi: 10.3390/app12094369.
K. Reese, T. Smith, J. Dutson, J. Armknecht, J. Cameron, and K. Seamons, “A Usability Study of Five Two-Factor Authentication Methods,†in The Fifteenth Symposium on Usable Privacy and Security, Santa Clara: Usenix, Aug. 2019.
A. A. Wahid, “Analisis Metode Waterfall Untuk Pengembangan Sistem Informasi,†Jurnal Ilmu-ilmu Informatika dan Manajemen STMIK, 2020.
A. R. Pratama, F. M. Firmansyah, and F. Rahma, “Security awareness of single sign-on account in the academic community: the roles of demographics, privacy concerns, and Big-Five personality,†PeerJ Comput Sci, vol. 8, 2022, doi: 10.7717/PEERJ-CS.918.
P. A. Grassi et al., “Digital identity guidelines: authentication and lifecycle management,†Gaithersburg, MD, Jun. 2017. doi: 10.6028/NIST.SP.800-63b.
P. Mishra and C. Gupta, “Cookies in a Cross-site scripting Type, Utilization, Detection, Protection and Remediation,†2020 8th International Conference on Reliability, Infocom Technologies and Optimization (Trends and Future Directions) (ICRITO), pp. 1056–1059, 2020.
H. Kwon, H. Nam, S. Lee, C. Hahn, and J. Hur, “(In-)Security of Cookies in HTTPS: Cookie Theft by Removing Cookie Flags,†IEEE Transactions on Information Forensics and Security, vol. 15, pp. 1204–1215, 2020, doi: 10.1109/TIFS.2019.2938416.
K. Reese, T. Smith, J. Dutson, J. Armknecht, J. Cameron, and K. Seamons, “A Usability Study of Five Two-Factor Authentication Methods,†in The Fifteenth Symposium on Usable Privacy and Security, Santa Clara: Usenix, Aug. 2019.
I. R. Munthe, B. H. Rambe, R. Pane, D. Irmayani, and M. Nasution, ““UML Modeling and Black Box Testing Methods in the School Payment Information System,†Mantik, vol. 4, no. 3, pp. 1634–1640, Nov. 2020.
