That is, is it possible with a Single-Sign-On tool to give employee "Joe Smith" access to app "SocialMedia App1" for him to do this job. But when Joe leaves the company, can I have complete confidence he does not have the password and there is no need to change it?

  • Assuming they are all in house you can create a by pass for your specific IP allowing users from within the on IP address access to the web app. Can you provide more details? its hard to suggest so many ideas its all based on location, control of the application, do you own the web app? are you willing to add some development for this single sign in? – TheHidden Oct 2 '15 at 13:49
  • 3
    @silverpenguin whilst I'm no OP my guess is that he's thinking of things like company facebook/twitter accounts where specific users post as the company but you'd hope they wouldn't be able to after they've left. – Rory McCune Oct 2 '15 at 13:52
  • Well the good thing about today is that you dont need usernames and passwords handed out you can just use keychains. Some keychains allow access without showing the credentials (like google chrome) the only downside to chrome is if you know the password of the machine you can view it... – TheHidden Oct 2 '15 at 13:55
  • 1
    Take a look at privileged identity management. I am not sure how many tools would support something like facebook but this seems to be a good use-case for your privilege identity management solution. – jhash Oct 3 '15 at 11:11

Generally, when a user departs, you can never have complete confidence they don't have passwords or other confidential information saved. As a result, your offboarding process needs to have controls for all the contingencies.

There are various systems (e.g. the proprietary OneLogin) that allow you to integrate a corporate identity management service (e.g. Active Directory) with logins to social media sites/other web applications. However, this works similar to LastPass in that it stores a randomly-generated password in a vault; and this password can be intercepted.

The issue is that it is always technically possible, if the user is an administrator to the computer and has access to some technical savvy, to obtain the password.

There are ways to mitigate this: e.g. enable login notifications on Facebook and two-factor authentication. Only setup a non-rooted phone with the correct 2FA token. Still, the user might take steps to migrate the 2FA token to another device, so you can't be 100% confident this system will work.

In the end, the best practice will always be to reset passwords for any and all accounts that the former employee had access to. If the app is directly integrated with a directory service you can be certain that when the directory account is disabled access is denied (e.g. Google+ using OAuth) -- but, if there's separate logins to external sites those will always need to be changed. Even if you're 99% confident that they don't have the password or they won't be logging in, the 1% exception is surely motivation enough to lock things down.

|improve this answer|||||
  • 1
    I'll just add that this is the importance of keeping separate user accounts, even for administrators. User accounts should be disabled/removed when employees leave. – Steven Walton Oct 3 '15 at 1:07

Management of shared identities (like enterprise account on facebook, twitter) would typically fall in the purview of Privileged Identity Management processes. Due to the shared nature of these identity, regular user management process are not applicable and additional processes/scenarios must be considered.

The privileged identity management processes have additional checks and balances to ensure that nobody besides the person working on system knows the applicable password. Typically this involves the authorized person to "checkout" the password, perform the work he needs to do and then "checkin" the password.

If this feels like an overkill from your requirement perspective, I would suggest that

  1. Identify the facebook (or corresponding shared account) as a service account so that it is not deleted and ownership is transferred to appropriate new owner automatically as part of offboarding process.
  2. As part of ownership transfer process, you may change the password and update the new owner about the password.
|improve this answer|||||

If you have a correct user management process (which includes revocation of access to a centralized authentication database upon leave) then using an SSO for your "SocialMedia App1" which is bound to that centralized authentication mechanism will ensure that he will not be able to connect to that service once his account is disabled.

You could also directly authenticate "SocialMedia App1" against this service (though I guess that it is not under your control and offers SSO)

|improve this answer|||||
  • If the "SocialMedia App1" cannot integrate with standard SSO technologies (e.g. SAML), you can also find out if it supports OAuth or OpenID-based APIs. If so, you may be able to build/find some GUI that allows shared access managed by your own infrastructure. – billc.cn Oct 6 '15 at 12:20

One option is to use LastPass with Shared Folders. I think this feature requires enterprise license.


Say, you as an administrator create the Shared folder and share it with Joe Smith, then in the settings, you can choose to hide the passwords in the shared folder from Joe.

LastPass has browser Plugins for all major browsers, so when Joe opens the "SocialMedia App1", the username and password are automatically filled in for Joe(The LastPass Plugin can also automatically sign the user in too if setup correctly). In the entire process Joe never sees the password.

(This is just one way to do it)

|improve this answer|||||
  • 1
    LastPass does not prevent the user from getting the password. Trivial extensions (eg: ShowPassword) will let the user see the clear text password. – Neil Smithline Oct 2 '15 at 17:16
  • @Neil Smithline , thanks. now i know that those extensions exist. – JOW Oct 5 '15 at 8:24
  • 1
    will keep this answer open as it tells folks what NOT to do – JOW Oct 6 '15 at 13:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.