1

We have a single web platform, where users can log in to different workspaces.
Each workspace has its own list of users with email and password credentials and various permissions for each of those users. Email and password pairs can be duplicated across the workspaces. The passwords are hashed and stored in a database alongside the user data.

There'll only be a single login page, and we'll log the user into the workspace that has matching credentials.

However, if there are multiple workspaces that have a matching email and password – we want to log them into all of those matching workspaces.

Does this pose a security issue?

Follow-up question:
Would it be best to share the password hashes across workspaces? (this would add some complexity to the app)
Or can it be done without sharing the hashes? – and simply checking the password across all workspaces for that email (where there might be different salts, but the underlying password would be the same)

Improve this question

1 Answer 1

Reset to default
5

A typical solution for this problem would be delegating the authentication to an external single sign-on (SSO) service instead of comparing the passwords against many different databases. Here, the different workspaces would work as service providers (SP) and the login page as an identity provider (IdP). Only the IdP needs to be aware of the password hashes, and the SPs trusts this identity, giving access based on the matching username (or email).

Despite this might add some complexity at first, it's much easier both for the users and for the management in the long run. You don't have to reinvent the wheel as there are many SSO services both open source and proprietary. Some of them are based on the Security Assertion Markup Language (SAML), some works with the Kerberos authentication etc. It's probably possible to find a solution that is at least close to your current authentication scheme. You could start by looking at the List of single sign-on implementations.

Improve this answer
3
  • We will allow SSO (through Google), however the email/password solution is very important to us, and always relegating to SSO (even if it's our own internal one) will be awkward for our users. In Slack for example, you have a separate account for each of your workspaces – but you can be notified by email which workspaces your email is part of. Would it be okay for Slack to log me into all the workspaces that my email/password combination matches? (it doesn't do that right now) I realize a solution like this does make security more lax, but my hope is that it's not a critical flaw?
    – qff
    Apr 8, 2020 at 7:52
  • What's the system performing the comparison? Is the login page directly aware of all the hashes, or does it send the username and password to the workspaces? If it does, beware that every workspace knows every attempted password.
    – Esa Jokinen
    Apr 8, 2020 at 10:30
  • All the workspaces live in same platform as the login page, so for our usecase the email and password never leaves the webserver. The webserver would then create the appropriate password hash for each matching email in each workspace and check equality.
    – qff
    Apr 9, 2020 at 11:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .