## 1 Introduction
However, some security risks concerning authentication, authorization, and accountability arise on the provider end when it comes to comprehensive management and the blending of services and technologies. Various vendor services often use the same shared environment under the roof of a single service provider [9]. A federated trust at the vendor level can be configured between multiple vendors to address consumer needs under a single service level agreement (SLA). Various cross-domain access control (CDAC) protocols such as Shibboleth manage identity-based federation services in a multi-cloud environment. Shibboleth is an open-source platform designed by Howard University for testing and educational purposes. Shibboleth has an identity provider end managed by the university and used to deploy and implement single sign-on (SSO) in different federations. It is used to justify attributes designed by the identity provider (idp) and rules based on those attributes designed by the service provider. Shibboleth access for an internal database is maintained and handled by security assertion and markup language (SAML). To maintain trust between different federated domains, a Shibboleth digital signature model is used [10]. In the current digital era, end-users need to prove their authentic identities and be authorized to access various Internet services by using a user ID and password. Consequently, one password is not enough and can be compromised easily over the Internet, where we access plenty of services with the same password on different service accounts. Password managers are also used to protect access, but they are still accessible using a password over the Internet. In the research, we have learned that about 73% of people have trouble to remembering their password, 72% use the same password for all accounts over the internet, and 50% do not care about their password security and concerns [11,12]. Dual factor authentication was introduced to verify and validate user authentication details for service accounts. Dual factor authentication uses email to send an access code, but email accounts need to use a password to fetch that access code over the Internet. On the other hand, multifactor authentication uses alternative options, e.g., SMS, call, and app authentication, for user authentication as a secondary method rather than a password. When a particular user has to access multiple services under a single user identity, users need to provide multiple passwords over the Internet. Passwords can be compromised over the web or an app access portal through various threats and attacks. In SSO, a single source of thought is used to manage multiple passwords, and hence users get verification and authorization using a single password. With an SSO managing passwords on one end, if that password is compromised then all that is required is to change only that one password; the rest of the passwords are revoked. Secondly, password requirements vary on different service accounts, e.g., length of a password, complex character, and password expiration duration. These requirements raise the level of complexity for an ordinary end user who needs to remember multiple passwords. In SSO, we can access various services from a single password. When we use a combination of SSO and MFA, if a user's single password is compromised, then the user's identity and other information related to user's attributes will not be comprised. Thus, the current research will be beneficial in terms of security compliance and end-user usability with minimum cost. In this paper, we created a federated trust between an xyz.com hosted site and an abc.com client site, with all incoming traffic from all over the internet divided into three phases. The federated client domain user places an order as a service on the hosted or service provider end. A low risk was defined as one against the client federated user that authenticating outside the hosted domain over the web, an SSO deployed with the help of Shibboleth idp.