Single Sign-On is when a user can use the same set of authentication credentials to access multiple different services.
1
vote
0answers
64 views
How to prevent CAS from leaking user identity to arbitrary visited websites?
Summary
evil.example.com could use a hidden frame to request a CAS ticket from corporation.example.net, then validate it to receive the username of the hapless user. This effectively deanonymizes the ...
4
votes
0answers
83 views
Designing single-sign-on with JSONP/CORS?
I like the way that OAuth/OpenID can authenticate/identify a user from another domain, but only if the other domain allows it (presumably on the user's instructions).
I would like to do something ...
1
vote
2answers
86 views
Security benefits of Single Sign-On [duplicate]
What are the benefits of a single sign-on implementation from the point of view of security?
From my point of view, if the account is compromised the attacker has access to any resource, so ...
-2
votes
0answers
36 views
Certificate usage [closed]
My company wants to have security by using a certificate stored at the client. The certificate will be used by other mobile webapps as well.
What are products which can be used for this situation? Do ...
1
vote
0answers
44 views
How do you evaluate and audit Central Authentication Service (CAS)?
This is in reference to Jasig's CAS software and I'm looking for a checklist to audit the state of security of a CAS implementation. While the Jasig site has a lot of documentation and their mailing ...
3
votes
2answers
57 views
Can a good SSO protocol be built around a server signing tickets rather than validating them on demand?
CAS and its alternatives all seem to require a flow like this when one service is acting as a proxy for a user when accessing a back-end service:
Service A makes a request to Service B on behalf of a ...
1
vote
1answer
271 views
How can I ensure privacy when outsourcing authentication to an IdP (Identity Provider)
I need to outsource authentication to an IdP (Identity Provider) but I don't want that IdP to know of the calling site. The two major issues are the callback URL and the referer header.
Is there any ...
2
votes
2answers
191 views
Is this SSO design secure?
We're working on an SSO implementation that would be used accross domains. I realize there are proven working models out there like CAS for this but I'm toying with a different approach and I want to ...
4
votes
2answers
609 views
Are some STS token formats better than others (SAML vs SWT vs JWT)
I'm configuring an Azure ACS STS and would like to know if there is any impact on security based on the following token formats or how they are used.
The corresponding help link takes me to MSDN ...
0
votes
1answer
464 views
How do I change the certificate of a Shibboleth service provider?
How do I change the certificate of a Shibboleth service provider? I have an existing identity provider (IDP) and service provider (SP) and I need to replace the certificate with a Verisign signed ...
2
votes
1answer
336 views
Are there any anonymous OpenID providers similar to Gawker's “burner”?
Gwaker has an anonymous commenting system called Burner. It is offered as an alternative to Facebook, Twitter and Google.
What's the difference between Burner and creating a throwaway Google , ...
1
vote
1answer
152 views
How can a SAML Relying Party redirect to one of two IDPs?
We need to support the following Authentication flows
User 1 logs into Salesforce using Salesforce Credentials
User 2 logs into Salesforce using Arcot +Ping + Siteminder credentials
User 2 logs into ...
0
votes
1answer
545 views
What are the potential vulnerabilities in a SAML-based SSO approach?
What level of access would an attacker need to obtain to compromise a SAML-based SSO system?
Would stealing the private key used to sign SAML requests be enough? What if an attacker had root on the ...
4
votes
2answers
298 views
Using intranet SSO to access sites hosted on public cloud
We are thinking to move some of our intranet sites to public cloud.
Is there any way to keep using company SSO to authorize access to those sites from the company intranet?
0
votes
2answers
329 views
Single sign-on models for a mixed environment
I'm not entirely sure if this is the right site for this, but I'll give it a shot.
Basically, I'm looking into different ways of setting up a single sign-on service for an existing corporate ...
4
votes
3answers
1k views
Can Central Authentication Service (CAS) do authorization?
I have a few web applications that I'm trying to tie in via CAS, but I'm a little confused about the authorization, which I read CAS isn't supposed to do. Yet, I see something like groups, but don't ...
5
votes
2answers
724 views
How does openid implement Single sign on?
I'm wondering which security model is behind the OpenID. Is it anything like kerberos?
7
votes
2answers
241 views
Is the argument really over on SSO?
I got shot down on ServerFault recently for suggesting that SSO can be less secure than having different credentials for each service. What are the arguments against SSO?
13
votes
6answers
688 views
Appropriate password requirements for a login (OpenID) service/provider/delegate/thing
This is with regards* to Stack Exchange's upcoming OpenID provider (and in particular, discussion about password requirements).
Currently, password requirements are:
Must contain 3 of: lower case ...
1
vote
1answer
367 views
OpenSSO and Basic Auth together
Our project is moving towards OpenSSO, but we have some CGIs that are accessed via web services. For example, one CGI locates files on the server and supplies them to the client. I understand that ...
10
votes
6answers
3k views
How to set up a single sign-on for multiple domains?
I've set up a single-sign-on for two of our sites that live on the same domain: a.domain.com and b.domain.com
I did it through cookies, but they are domain-dependant. And - as it is written in the ...
