Single Sign-On is when a user can use the same set of authentication credentials to access multiple different services.

learn more… | top users | synonyms

0
votes
0answers
15 views

Any libraries or frameworks for building a SSO proxy? [migrated]

I've been tasked with determining the feasibility of building an application that would act as a proxy between platforms that offer single sign-on capabilities. Our "platform" offers SAML Service ...
-1
votes
0answers
10 views

Queries on config.php and ArtifactResolutionService.php - SimpleSAMLPHP [migrated]

We are using SimpleSAMLPHP for SSO. In config.php file, datastore type is configured to be phpsession by default. Since this cant be used, next option is memcache. As we dont make use of memcache, ...
0
votes
3answers
183 views

Is it secure to return a JWT to an already-logged-in user?

I'm using JWT to handle an SSO scheme where two systems (let's call them A and B) both require authentication, but the user datastore is in one system only (let's say A). Everything I've seen about ...
1
vote
0answers
17 views

Different timezone in WebSSO using ADFS as IDP

Is there a best practise when it comes to handling timezones in an international single-sign-on solution? I've been asked to include the clients timezone in our saml-ticket as an attribute. This will ...
4
votes
1answer
36 views

Seamless authentication from an iPad to several enterprise apps - what are the options?

What are the options for authenticating users of corporate iPads which are MDM managed to access sensitive corporate web apps exposed over the internet? The issue here is there are several web apps ...
7
votes
2answers
13k views

How to achieve seamless SSO without having the user to login again (SAML 2.0 & ADFS using OpenSSO)

We need to implement seamless SSO with ADFS SAML 2.0 using OpenSSO & we plan to go with IdP initiated GET binding. The user in client network will log in to ADFS with Windows credentials once ...
0
votes
2answers
78 views

SSO - What should happen when the user clicks “Log out”

We are adding the ability for enterprises to configure logon to our web application via external single-sign-on providers (initially via WS-FED, however future versions will support additional ...
2
votes
1answer
46 views

SAML without certificate

A company asked me if it is possible to use the SAML-protocol without any certificate at all. The standard doesn't require a SAML-ticket to be signed or encrypted so the answer would be yes? Is this a ...
13
votes
2answers
327 views

Why is OpenID considered secure when password reuse is not?

OpenID allows you to use your e.g. Google/Facebook/Microsoft account to log into a third party website. It can be used to log into Stack Exchange. Why is this considered an acceptable practice, ...
1
vote
0answers
33 views

Is our internal SSO design secure? [duplicate]

We use one primary web app that was built internally and 3 other web apps that we did not build but that we do host. I want users to only have to sign into the primary web app, which uses Google auth. ...
2
votes
0answers
39 views

How does Adobe Pass Auto-Authentication work?

At time marker 2:05 of this video, he describes that Adobe Pass can automatically identify you based on your broadband provider, and sign you in/authorize you for media content. Can anyone describe ...
0
votes
2answers
2k views

Security benefits of Single Sign-On [duplicate]

What are the benefits of a single sign-on implementation from the point of view of security? From my point of view, if the account is compromised the attacker has access to any resource, so ...
0
votes
1answer
179 views

Authentication SSO token security - SAML, OpenID Connect

I am trying to understand how works various SSO technologies like SAML 2.0, OpenID Connect 1.0. In general, they work in a similar way providing tokens (XML, JSON) through Identity Provider to ...
1
vote
3answers
244 views

Need help understanding Windows Authentication mechanism

Even if I enforce HTTPS and use anti-forgery tokens, it seems like Windows Authentication could be inherently insecure because it does not require that the user explicitly passes credentials from the ...
2
votes
1answer
91 views

Why would my SSO information be cached on my iphone?

I develop a lot of internal applications/websites for my work using our standard SSO. It uses SAML2 and has a few different levels of security available. We have vendor who is using it for one of ...
-1
votes
1answer
610 views

OpenID Connect as SSO

I recently research the SSO solution, and I went into the OpenID connect framework; but after several days of research, this makes me confused that the 'OpenID Connect' protocol does not define the ...
0
votes
0answers
160 views

In what ways may a SAML2 service provider interoperate with an agency using Common Access Cards (CAC)

I'm at a service provider organization that supports shibboleth-style and CAS third party authentication. I'm looking at the requirements to meet the low baseline of FedRamp (see FedRAMP Security ...
-1
votes
1answer
400 views

Authorization/authentication strategy for micro service apps

How can one enforce authorization/authentication for micro service apps? And also, how to achieve SSO (single sign-on) from an end user's perspective? E.g: Assume a shopping site which has many micro ...
4
votes
2answers
94 views

If the user registers for my site via e.g. Facebook login, should I force the user to also create a password on my site?

Most sites, when you register via e.g. Facebook, redirect you to a page afterwards asking you to enter additional information that the site needs. Very often this includes setting a password for the ...
1
vote
0answers
41 views

SSO Implementaion/Suggestions Needed

We have a partner who has integrated our services into their application. All API method call's from partner app to our services using standard API key/pwd credentials. But to make any changes on ...
0
votes
0answers
64 views

SSO implementation in a mobile application

We are currently in the process of implementing SSO for one of our enterprise client in our mobile application. To make it more user friendly we were considering the idea of adding a new endpoint to ...
0
votes
1answer
235 views

SSO software – where is symmetric key stored?

In SSO software (Oracle E-SSO …), I heard about (primary) key encrypting user’s credentials, but I can’t read anything about how this key is managed ? When using smartcard, I can understand that ...
0
votes
1answer
667 views

Drawbacks of using ADFS for SSO for external users

Is there any drawback for creating a separate AD forest for external users of organization to authenticate them to access some web applications? Is there any performance and synchronization issues ...
1
vote
5answers
158 views

Is there a term for Authorizing before Authenticating? Is it even common?

In most scenarios a person identifies who they are (authentication/AuthN) via something like a username and password. Afterwards a system would likely evaluate what that validated identity can perform ...
0
votes
1answer
119 views

single sign on across two servers

I have been wondering how and what kind of tools are needed to do single sign on in the following scenario: 1) Alice is logged in to site X hosted by server W 2) Alice navigates site Y hosted by ...
10
votes
4answers
1k views

How does SSO enhance security?

The following quote is from the CompTIA Security+ guide: Single sign-on enhances security by requiring users to use and remember only one set of credentials for authentication. How is that ...
6
votes
4answers
7k views

Can Central Authentication Service (CAS) do authorization?

I have a few web applications that I'm trying to tie in via CAS, but I'm a little confused about the authorization, which I read CAS isn't supposed to do. Yet, I see something like groups, but don't ...
8
votes
1answer
3k views

Designing single-sign-on with JSONP/CORS?

I like the way that OAuth/OpenID can authenticate/identify a user from another domain, but only if the other domain allows it (presumably on the user's instructions). I would like to do something ...
2
votes
4answers
1k views

Does referrer header checking offer any real world security improvement?

At work we use a central portal that provides basic SSO functionality to other applications. In addition to verifying the SSO data sent, all of our existing in-house applications (used by the public) ...
3
votes
1answer
282 views

SAML 2.0 IdP metadata security

Identity Providers (IdP) often provide a metadata file that is used when setting up SAML. This file needs to be entered into a Service Provider (SP). Do we need to keep this metadata file private and ...
0
votes
1answer
146 views

Single sign on - is this a secure way to log in?

I am fiddling about with a sort of single sign on procedure. Let's say there is site1 and site2 and both use an SSL certificate. Users are signed in on site1. I was wondering what the experts think ...
3
votes
1answer
460 views

pro and cons of having 2 Identity providers

My company has applications on cloud and intranet. Also, we have various roles such as employee, customers, partners etc. We would like ID federation between services hosted on public cloud and ...
0
votes
1answer
415 views

OIOSAML: assertion consumer does not work

I wrote a simple system with SP-initiating Web SSO scenario based on OIOSAML. To test the system, I deployed it on the remote host. However AssertionConsumerServiceURL, where I specified URL, on which ...
3
votes
3answers
644 views

How to prevent CAS from leaking user identity to arbitrary visited websites?

Summary evil.example.com could use a hidden frame to request a CAS ticket from corporation.example.net, then validate it to receive the username of the hapless user. This effectively deanonymizes the ...
0
votes
1answer
64 views

How to sync with multiple authentication services?

I have a peculiar case to work on. We are using a proprietary product which supports LDAP integration. However, it can be configured to use only one LDAP service. (most of the products are shipped ...
5
votes
1answer
915 views

SAML, and forcing a re-authentication

I have a use case forced upon me by industry regulation. I wish it wasn't there, but it is. A user logs in to my service, navigates around, etc. The user can perform many actions, but one of the ...
3
votes
1answer
1k views

Why is OAuth 2.0 being used for mobile devices, and not OpenID?

Microsoft Azure Mobile services exclusively uses OAuth 2.0 for authentication, and many other providers mention the use of OAuth 2.0 specifically when referring to mobile devices. Question What ...
0
votes
2answers
403 views

can a x.509 certificate alone be used for user authentication?

we have a scenario for implementing SSO using x.509 certificates. A secure client will download a x.509 certificate (only certificate...no private key is available) upon user logs into the windows ...
3
votes
1answer
360 views

How do you evaluate and audit Central Authentication Service (CAS)?

This is in reference to Jasig's CAS software and I'm looking for a checklist to audit the state of security of a CAS implementation. While the Jasig site has a lot of documentation and their mailing ...
1
vote
1answer
910 views

SSO via HMAC and shared key. Can this be improved?

Given an authenticated user on A.com, we want to redirect the user to B.com so that she'll be immedaitely authenticated. The scheme I'm considering is very basic: A.com and B.com both share key S. ...
1
vote
1answer
213 views

SAML2 encryption

I am new to SAML2 and have a question. We have a customer that is saying that they want to encrypt the user data they are sending to us. Here is an overview of how I have this implemented today: User ...
3
votes
1answer
1k views

Sharing login session from one website to another?

Given two companies managing two separate websites, the client wants the user to be able to log in to one website, and then click a link to navigate to a certain part of the second website. The client ...
3
votes
2answers
586 views

OAuth for Multiparty Authentication/Authorization

I work for a web company that's undergoing a massive rewrite in order to separate our Data out into its own RESTful service application - the goal is to be able to sell access to third parties and ...
2
votes
1answer
510 views

Communicate between two sites both with SSL

I now have two websites - site A and B, both with SSL-certificate, and they have exact same users. So when a user log into site A and click the link to site B, I want to make him auto log in to site ...
0
votes
2answers
419 views

In a SAML2 FSSO Web Browser profile (HTTP POST), should the IdP analyse the AuthnRequest before asking the user to authenticate? [closed]

Context: SAML2 Web Browser SSO profile. (HTTP POST binding). Federated SSO. If the IdP gets an <AuthnRequest> from the SP, should / must / can the IdP do the user authentication first, or ...
1
vote
5answers
1k views

What are the benefits and drawbacks of emailing a user a login token/link?

The Question I was reading a forum last night discussing the idea of emailing a user a login link, much like a password reset link, so they don't require a password. Their email address is already ...
13
votes
4answers
4k views

How do the STS token formats compare to each other SAML vs SWT vs JWT?

I'm configuring an Azure ACS STS and would like to know if there is any impact on security based on the following token formats or how they are used. The answers to this questions should apply to ...
5
votes
2answers
13k views

How is SAML solving the cross domain single sign-on problem?

Let's say I have two websites that live on separate domains, and their service providers both talk to the same identity provider on a third domain. I log into the first website and authenticate, and ...
3
votes
2answers
132 views

Can a good SSO protocol be built around a server signing tickets rather than validating them on demand?

CAS and its alternatives all seem to require a flow like this when one service is acting as a proxy for a user when accessing a back-end service: Service A makes a request to Service B on behalf of a ...
0
votes
1answer
362 views

How can I ensure privacy when outsourcing authentication to an IdP (Identity Provider)

I need to outsource authentication to an IdP (Identity Provider) but I don't want that IdP to know of the calling site. The two major issues are the callback URL and the referer header. Is there any ...