Single Sign-On is when a user can use the same set of authentication credentials to access multiple different services.

learn more… | top users | synonyms

3
votes
1answer
486 views

Why is OAuth 2.0 being used for mobile devices, and not OpenID?

Microsoft Azure Mobile services exclusively uses OAuth 2.0 for authentication, and many other providers mention the use of OAuth 2.0 specifically when referring to mobile devices. Question What ...
3
votes
1answer
237 views

How to achieve seamless SSO without having the user to login again (SAML 2.0 & ADFS using OpenSSO)

We need to implement seamless SSO with ADFS SAML 2.0 using OpenSSO & we plan to go with IdP initiated GET binding. The user in client network will log in to ADFS with Windows credentials once ...
0
votes
2answers
40 views

can a x.509 certificate alone be used for user authentication?

we have a scenario for implementing SSO using x.509 certificates. A secure client will download a x.509 certificate (only certificate...no private key is available) upon user logs into the windows ...
-1
votes
0answers
16 views

How do Shibboleth and (Jasig) CAS's protocols differ?

I'm reading up on SSO, and am trying to identify the major differences between the CAS protocol (as implemented by Jasig CAS) and the SAML protocol (e.g. Shibboleth). Let's assume SAML 1 for the sake ...
3
votes
1answer
129 views

How do you evaluate and audit Central Authentication Service (CAS)?

This is in reference to Jasig's CAS software and I'm looking for a checklist to audit the state of security of a CAS implementation. While the Jasig site has a lot of documentation and their mailing ...
1
vote
1answer
137 views

SSO via HMAC and shared key. Can this be improved?

Given an authenticated user on A.com, we want to redirect the user to B.com so that she'll be immedaitely authenticated. The scheme I'm considering is very basic: A.com and B.com both share key S. ...
4
votes
3answers
3k views

Can Central Authentication Service (CAS) do authorization?

I have a few web applications that I'm trying to tie in via CAS, but I'm a little confused about the authorization, which I read CAS isn't supposed to do. Yet, I see something like groups, but don't ...
0
votes
1answer
51 views

SAML2 encryption

I am new to SAML2 and have a question. We have a customer that is saying that they want to encrypt the user data they are sending to us. Here is an overview of how I have this implemented today: User ...
1
vote
1answer
130 views

Sharing login session from one website to another?

Given two companies managing two separate websites, the client wants the user to be able to log in to one website, and then click a link to navigate to a certain part of the second website. The client ...
2
votes
2answers
154 views

OAuth for Multiparty Authentication/Authorization

I work for a web company that's undergoing a massive rewrite in order to separate our Data out into its own RESTful service application - the goal is to be able to sell access to third parties and ...
2
votes
1answer
162 views

Communicate between two sites both with SSL

I now have two websites - site A and B, both with SSL-certificate, and they have exact same users. So when a user log into site A and click the link to site B, I want to make him auto log in to site ...
0
votes
2answers
153 views

In a SAML2 FSSO Web Browser profile (HTTP POST), should the IdP analyse the AuthnRequest before asking the user to authenticate? [closed]

Context: SAML2 Web Browser SSO profile. (HTTP POST binding). Federated SSO. If the IdP gets an <AuthnRequest> from the SP, should / must / can the IdP do the user authentication first, or ...
1
vote
5answers
327 views

What are the benefits and drawbacks of emailing a user a login token/link?

The Question I was reading a forum last night discussing the idea of emailing a user a login link, much like a password reset link, so they don't require a password. Their email address is already ...
3
votes
2answers
233 views

How to prevent CAS from leaking user identity to arbitrary visited websites?

Summary evil.example.com could use a hidden frame to request a CAS ticket from corporation.example.net, then validate it to receive the username of the hapless user. This effectively deanonymizes the ...
2
votes
0answers
117 views

pro and cons of having 2 Identity providers

My company has applications on cloud and intranet. Also, we have various roles such as employee, customers, partners etc. We would like ID federation between services hosted on public cloud and ...
7
votes
4answers
2k views

How do the STS token formats compare to each other SAML vs SWT vs JWT?

I'm configuring an Azure ACS STS and would like to know if there is any impact on security based on the following token formats or how they are used. The answers to this questions should apply to ...
3
votes
2answers
2k views

How is SAML solving the cross domain single sign-on problem?

Let's say I have two websites that live on separate domains, and their service providers both talk to the same identity provider on a third domain. I log into the first website and authenticate, and ...
5
votes
0answers
773 views

Designing single-sign-on with JSONP/CORS?

I like the way that OAuth/OpenID can authenticate/identify a user from another domain, but only if the other domain allows it (presumably on the user's instructions). I would like to do something ...
1
vote
2answers
660 views

Security benefits of Single Sign-On [duplicate]

What are the benefits of a single sign-on implementation from the point of view of security? From my point of view, if the account is compromised the attacker has access to any resource, so ...
3
votes
2answers
86 views

Can a good SSO protocol be built around a server signing tickets rather than validating them on demand?

CAS and its alternatives all seem to require a flow like this when one service is acting as a proxy for a user when accessing a back-end service: Service A makes a request to Service B on behalf of a ...
0
votes
1answer
317 views

How can I ensure privacy when outsourcing authentication to an IdP (Identity Provider)

I need to outsource authentication to an IdP (Identity Provider) but I don't want that IdP to know of the calling site. The two major issues are the callback URL and the referer header. Is there any ...
2
votes
2answers
447 views

Is this SSO design secure?

We're working on an SSO implementation that would be used accross domains. I realize there are proven working models out there like CAS for this but I'm toying with a different approach and I want to ...
0
votes
1answer
911 views

How do I change the certificate of a Shibboleth service provider?

How do I change the certificate of a Shibboleth service provider? I have an existing identity provider (IDP) and service provider (SP) and I need to replace the certificate with a Verisign signed ...
3
votes
1answer
568 views

Are there any anonymous OpenID providers similar to Gawker's “burner”?

Gwaker has an anonymous commenting system called Burner. It is offered as an alternative to Facebook, Twitter and Google. What's the difference between Burner and creating a throwaway Google , ...
1
vote
1answer
253 views

How can a SAML Relying Party redirect to one of two IDPs?

We need to support the following Authentication flows User 1 logs into Salesforce using Salesforce Credentials User 2 logs into Salesforce using Arcot +Ping + Siteminder credentials User 2 logs into ...
0
votes
1answer
987 views

What are the potential vulnerabilities in a SAML-based SSO approach?

What level of access would an attacker need to obtain to compromise a SAML-based SSO system? Would stealing the private key used to sign SAML requests be enough? What if an attacker had root on the ...
4
votes
2answers
408 views

Using intranet SSO to access sites hosted on public cloud

We are thinking to move some of our intranet sites to public cloud. Is there any way to keep using company SSO to authorize access to those sites from the company intranet?
0
votes
2answers
481 views

Single sign-on models for a mixed environment

I'm not entirely sure if this is the right site for this, but I'll give it a shot. Basically, I'm looking into different ways of setting up a single sign-on service for an existing corporate ...
5
votes
2answers
1k views

How does openid implement Single sign on?

I'm wondering which security model is behind the OpenID. Is it anything like kerberos?
7
votes
2answers
274 views

Is the argument really over on SSO?

I got shot down on ServerFault recently for suggesting that SSO can be less secure than having different credentials for each service. What are the arguments against SSO?
15
votes
6answers
912 views

Appropriate password requirements for a login (OpenID) service/provider/delegate/thing

This is with regards* to Stack Exchange's upcoming OpenID provider (and in particular, discussion about password requirements). Currently, password requirements are: Must contain 3 of: lower case ...
1
vote
1answer
407 views

OpenSSO and Basic Auth together

Our project is moving towards OpenSSO, but we have some CGIs that are accessed via web services. For example, one CGI locates files on the server and supplies them to the client. I understand that ...
12
votes
6answers
5k views

How to set up a single sign-on for multiple domains?

I've set up a single-sign-on for two of our sites that live on the same domain: a.domain.com and b.domain.com I did it through cookies, but they are domain-dependant. And - as it is written in the ...