The IT wants to audit the credentials: with the collaboration of the users, they login to the online vault (the colleague type the master password) and check which corporate credentials are saved.
IT (and users) don't like doing this by hand: it takes time and you see all stored credentials (both corporate and personal).
For simplicity, let say we want to check the credentials of the intranet application BUBU. Pitfalls of the manual auditing:
- User collaboration
The colleague must be present and honest. She/he can cheat and say "I don't user online vaults" ...
- Login to the vault
Sometimes the vault login coincides with the BUBU credentials. Sometimes the vault credentials are personal, and the BUBU ones are stored as application credentials inside the vault.
- Excessive disclosure of credentials
If the user hasn't corporate credentials stored in an internet vault, trying to login using userid/email and password is a disclosure of the credentials!
Is it possible to automate the audit?
My solution: ask to the online services to implement a specific API audit user credentials
input parameters: userid, sha256(userid + password)
output: YES if there is any credentials (vault login or application specific) matching the input ones
This API permits to audit the credentials with these advantages:
- company: the credentials not stored in a vault aren't disclosed;
- company: it can automate this test for every set of credentials of every user;
- vault service: no disclosure of the kind of credentials (master or application ones).
Is this a good solution? are there better ones?