Many cloud SSO providers now offer "password based SSO" (e.g. https://docs.microsoft.com/en-us/azure/active-directory/active-directory-appssoaccess-whatis ), where, even if the SaaS you want to log in to doesn't support SAML or the like, you can still do SSO, because the SSO service will parse the HTML, store your password, and log you in to the 3rd party SaaS app.
Microsoft is advertising this. And, for example, if you do a Google search of "Gusto SSO", you'll see many others that advertise it. (I pick on Gusto, because they have no SAML, and you can see from all the SSO services that claim they support it that it is an autogenerated template...).
Now, to me this is a major vulnerability: The main reason we want SSO is so that when we onboard someone, we do it in one place, and when they leave, we have only one password to revoke: not dozens. Otherwise, you're bound to forget that they also have the password to randomsaas.com...
But, that only works if the password doesnt go through their browser. If it's a password based SSO, and the SSO app is just autotyping their login the login goes through their browser, and so, they can sniff and store it. Therefore, even if you revoke the users SSO, they can still have stored the password.
Is there any solution for this?