I have 100 domains with authentication backed by the same LDAP database. There is a single-sign on, but it's not implemented with OAuth. That is to say, per user, each domain accepts the same user/password credential for authentication.

Under the normal workflow with something like Chrome, the user would be forced to copy-paste that user/password into multiple sites, creating multiple entries in the browser's password-manager. Each time, the burden is on the user to check to make sure they're copying the password into a "safe" site. On password-change, it's the user's job to update the password on each site

After having entered in the same username and password on 99 sites, the hundreth could reasonably be a bad site, and it's largely a numbers game. I would like to have the ability to establish a list of sites for the credentials to be valid for early on.

This would mean after the user logs into to a site once, they would no longer know what sites they can apply those credentials too.

What is the best way to secure a client against phishing attacks where single-domain OAuth is not a solution and a login is shared across sites?

  • 4
    Is there a good reason not to implement a real identity provider on a single domain and use it for the rest? What you are asking would just be a workaround; a non-standard client-side hack. – Esa Jokinen Apr 23 '19 at 4:49
  • 3
    Sorry, but you state the problem without asking a question? I would go one step back and ask how are the sites logically related? one site "knowing" the credentials to login to another site does not seem very correct from a privacy/security perspective. I guess your setup is in a very specific context (closed/private network?), so your description and question should be more specific. – papajony Apr 23 '19 at 12:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.