Overview
These guidelines are high-level recommendations for selecting and implementing identity and single sign-on (SSO) architectures for University of Oregon applications and services.
Modern identity and SSO architecture should reduce unnecessary infrastructure dependencies, support university authentication requirements such as multifactor authentication (MFA), and improve resilience when primary identity or SSO services are unavailable.
Whenever feasible, identity and SSO should align with the hosting architecture of the application, favoring cloud-to-cloud or on-premises-to-on-premises integrations. University-required authentication controls, including MFA, may rely on shared services regardless of where the application is hosted. An alternate authentication method should be available when appropriate for continuity, recovery, or emergency access.
Guidance
Whenever practical, authentication should align with the hosting architecture of the application.
-
Cloud applications should use cloud-based identity and SSO services.
- Cloud-hosted applications and Software as a Service (SaaS) solutions should integrate directly with the university's cloud identity provider when supported.
- Avoid routing cloud application identity and SSO through on-premises infrastructure when a direct cloud integration is available.
- University-required MFA and other security controls continue to apply regardless of application hosting location.
-
On-premises applications should use appropriate on-premises identity and SSO services.
- Applications hosted within university infrastructure may continue to use supported on-premises identity and SSO services when those services meet the application's security and availability requirements.
- The use of university-required cloud-based security services, such as MFA, does not conflict with this architectural approach.
- Avoid introducing unnecessary identity and SSO dependencies between on-premises and cloud environments unless they provide a clear security, operational, or resilience benefit.
-
Hybrid identity architectures should be used intentionally.
- Some applications may require identity or SSO dependencies that span cloud and on-premises environments.
- These dependencies should be documented and evaluated for security, availability, continuity, and disaster recovery implications.
Design for authentication resilience
Authentication should be considered part of an application's availability and recovery architecture.
- Identify identity, SSO, and authentication dependencies as part of application continuity and disaster recovery planning.
- Understand how administrators will access the application if the primary identity provider or SSO service is unavailable.
- Ensure any alternate authentication method provides an independent recovery path and does not rely on the same failed identity or SSO components.
- Include alternate authentication in periodic continuity or recovery testing.
Need help?
For more information, see Information Security Engagement Request or select Create a Ticket from this page.