Questions tagged [federation]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
59 views

OAuth2 component scopes

I'm currently implementing a system which consists of a collection of apps. Similar to the way Microsoft 365 consists of Word, Excel, etc. Ideally I'd like to log in once, then navigate between apps. ...
Andy N's user avatar
  • 502
0 votes
1 answer
78 views

Simplest federated authentication protocol: is this the right way to do it?

I've been struggling to find very simple, low level explanations of federated authentication protocols. Previously I've seen SAML and oauth, but they both seem to be very high level and far more ...
Jachdich's user avatar
  • 103
0 votes
0 answers
48 views

I want to join our organisation AD with a recently acquired company's AD for federated access. What are the security risks I should consider?

As per the title. What risks and controls should I consider? Are there any questions i need to ask the external party AD before setting up the 'Trust' between the 2 ADs?
Architect 's user avatar
0 votes
1 answer
120 views

Using SSO for a cryptocurrency app

Let us say you have an app where the users will be required to deposit cryptocurrency. Is it safe to let users sign in with third-party authentication? For example "sign in with Google" or &...
YulePale's user avatar
  • 133
0 votes
1 answer
252 views

App-to-app or service-to-service authentication using federated login

I have an application Foo that exposes a web-based portal as well as a REST API service via HTTPS. When a human user connects to the app Foo to use its web-based portal, the human user is first ...
Lone Learner's user avatar
0 votes
3 answers
202 views

Do we need to guard against federated identity servers lying about who signed in?

Having successfully integrated my old web forms app with an ADFS server I got to thinking about how the process works as a whole. The old app passes the user to the remote ADFS, then eventually the ...
Caius Jard's user avatar
0 votes
0 answers
153 views

What is multi-party federation?

I am asked to prepare a write up on Identity Federation. I have nearly completed the write up. There is a term multi-party federation which I am confuesed at. Does it simply mean alloting multiple ...
Anonymous Platypus's user avatar
2 votes
0 answers
395 views

Does my app need authentication in addition to Spotify authorization?

I have an app that revolves entirely around Spotify. I have followed the authorization guide from Spotify and am using the Authorization Code Flow so the access token can be refreshed. My thinking was ...
Scott Garland's user avatar
1 vote
1 answer
1k views

Difference between Trust and Federation

In the context of Identity and Access Management, is my understanding that Trust is between directory services and Federation is between IdP servers correct? I have also come across terms that are ...
aquaman's user avatar
  • 93
3 votes
0 answers
148 views

Are the default Azure AD Authentication Certificates global?

When authenticating against an AzureAD instance (using WS-Federation and SAML 2 tokens) the relying/authenticating application requests authentication metadata from a fixed URL on the auth servers, ...
redcalx's user avatar
  • 133
4 votes
1 answer
271 views

Are there documented best practices when federating identity to a third party using OIDC?

We are creating an OpenId Provider (using Identity Server 4) that has the ability to federate authentication to other IdPs based on email (eg, we first ask for email and then determine how to ...
James Brantly's user avatar
1 vote
0 answers
90 views

Is it possible to verify that it's safe to enter social media credentials in a given [IOS, Android, Win10] app?

When logging into web sites using federated login, it's easy to verify that the site that I'm entering my credentials into the site of the identity provider by looking at the address bar and ensuring ...
bshacklett's user avatar
2 votes
2 answers
374 views

Web Application Using Identity Federation & OTP

We are running a web application using a client's identity federation to authenticate users. A new requirement is to use 2FA, we have decided to use an OTP algorithm using Java, similar to this one ...
K.Pil's user avatar
  • 121
5 votes
1 answer
430 views

Are there any proposals for email verification without a confirmation email?

Being able to confirm your email without waiting for a verification email would be a major improvement to many registration processes. In theory this could be done using a technique based on OAuth, ...
paj28's user avatar
  • 33.4k
4 votes
2 answers
2k views

Examples of Federated Identity Management, Third Party Identity Services and Single Sign-On

I am studying the domain of Identity and Access Management in CISSP, and I come across the three terms Federated Identity Management (FIM), Third Party Identity Services (3PIS) and Single Sign-On (SSO)...
GreenPenguin's user avatar
3 votes
1 answer
2k views

Do we need CSRF protection for WS-Federation Passive Requestor Profile?

Consider the steps involved in WS-Federation Passive Requestor Profile1: The above figure shows a sequence diagram of a user (requestor) accessing a web application with his browser. Since the user ...
Frank Tan's user avatar
  • 131
0 votes
1 answer
235 views

What do I need to ask 3rd party to add trust

We have ADFS and want to add a 3rd party application as trusted to it. I have certificate and metadata (xml) URI to give them but want to have a checklist what they need to give me. So far HTTP ...
Rott's user avatar
  • 15
7 votes
2 answers
6k views

How to safely store bearer tokens on server?

Imagine you're running a service that implements an OAuth 2.0 flow to allow your end users to log into 3rd party apps, and authorize those apps to consume your service's data through some API. Upon ...
derabbink's user avatar
  • 241
0 votes
1 answer
3k views

Drawbacks of using ADFS for SSO for external users

Is there any drawback for creating a separate AD forest for external users of organization to authenticate them to access some web applications? Is there any performance and synchronization issues ...
Goli E's user avatar
  • 915
0 votes
1 answer
168 views

Is there any security concern if I sent the security token, issued from a trusted IdP, to javaScript?

Is there any problem if I sent the identity token, which has been issued from a trusted IdP, to javaScript code in order to use it in an Ajax call to a web method with authentication? Is there any ...
Homam's user avatar
  • 101
1 vote
0 answers
772 views

Using a bearer token to get a federation token from ADFS

Why is it not possible to use a bearer token from an IdP STS to get ADFS (2.1) to issue a token? All issuedtoken endpoints require a symmetric or asymmetric key in the IdP token. Is there a specific ...
MvdD's user avatar
  • 169
1 vote
1 answer
744 views

Use TLS certificate as both server and client?

For a federated server-to-server protocol with domain-based identities, I am thinking of using TLS client certificates as authentication mechanism. I figured that re-using each peer's TLS server ...
Denis Washington's user avatar
1 vote
2 answers
1k views

Security of cloud-based password manager (Dashlane, LastPass) vs. federated login (OpenID, Google, Yahoo, Microsoft, Facebook)

Many websites offer the option to log in with your existing Google or Facebook account (among others). For a long time I've resisted doing this because I use a password manager and I figured it was ...
rob's user avatar
  • 249
42 votes
2 answers
26k views

Role Based Authorization vs. Claim Based Authorization

What is the difference between "role based authorization" and "claim based authorization"? Under which circumstances would it be appropriate to implement each of these authorization models?
Imran Qadir Baksh - Baloch's user avatar
3 votes
1 answer
508 views

Theory about split data in several isolated (different physical server) DBMS to gain in security?

Suppose the following scenario: 1- A web app (on WEBSERVER1) and its database (on DBMS1) having very sensible information deployed in the same physical server (lets said that for simplification). ...
user avatar
4 votes
1 answer
1k views

Pros and cons of having two identity providers

My company has applications on cloud and intranet. Also, we have various roles such as employee, customers, partners etc. We would like ID federation between services hosted on public cloud and ...
Jimm's user avatar
  • 141
1 vote
3 answers
412 views

Should WS-Fed, Mozilla's Persona or OpenID ever be used with a Banking application?

Most banking sites I've seen use a sign in process that is proprietary, or otherwise won't integrate with an external IDP. Should banks offer integration with services like OpenID, WS-Fed, or ...
makerofthings7's user avatar
1 vote
2 answers
7k views

authorization vs federation vs entitlement

I am vague among the three following terms: authorization, federation, entitlement (as stated by the OpenAM product: OpenAM provides open source Authentication, Authorization, Entitlement and ...
Bao Ho's user avatar
  • 113
3 votes
1 answer
559 views

What are the benefits of federated identity management over bare bones public key encryption?

What are the main reasons for having a federated identity system such as OpenID over having identities based purely on a public key? OpenID uses an Identity Provider to confirm that a user owns a ...
Daniel's user avatar
  • 221
5 votes
2 answers
1k views

Shibboleth user attribute encryption

How does Shibboleth guarantee that 3rd parties do not get access to user attributes contained in SAML 2.0 assertion exchanged between IdP and SP? Is it correct that all user attributes are encrypted ...
niklr's user avatar
  • 591
111 votes
7 answers
131k views

What is the difference between Federated Login and Single Sign On?

What is the difference between Federated Login and Single Sign On authentication methods?
c card's user avatar
  • 1,213
6 votes
2 answers
1k views

Combining capability-based access control with SAML

I have been looking into various research on identity, PKI and access control trying to boil it down to a simplified methodology for IAM (Identity & Access Management). One thing which pops up in ...
Rolf Rander's user avatar
12 votes
1 answer
2k views

What encryption prevents the tampering of Windows Identity Foundation (WIF) FedAuth cookies?

It occurred to me that the WIF FedAuth cookies contain identity information, that if tampered with, could permit someone to assume the identity of another user. Fortunately, WIF does ...
makerofthings7's user avatar
19 votes
2 answers
2k views

Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML

It's clear there there is no consistent set of features among any of the popular authentication providers. Below is an attempt to aggregate the similarities and differences I've noticed, but I ...
makerofthings7's user avatar
1 vote
1 answer
869 views

What risk can untrusted WS-Federation metadata pose?

I'm adding support for SAML/ADFS/Azure ACS and read that untrusted metadata poses a risk. Considering that ADFS does background refreshes of the metadata, as do some RPs, can someone explain the risk,...
makerofthings7's user avatar
21 votes
3 answers
7k views

What are the main advantages and disadvantages of webid compared to browserid?

What are the main advantages and disadvantages of webid compared to browserid? This question is inspired by this answer which got a number of upvotes despite being very vague on the topic of that ...
Hendrik Brummermann's user avatar
45 votes
5 answers
9k views

What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?

Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook. One advantage ...
Hendrik Brummermann's user avatar
3 votes
2 answers
1k views

OAuth User revoke token

I haven't read it myself but a colleague told me that the end-user can revoke his/her OAuth token. I searched but I couldn't find enough docs on: is this true / is the end-user the one to revoke the ...
Stefany's user avatar
  • 1,277
12 votes
2 answers
5k views

How does openid implement Single sign on?

I'm wondering which security model is behind the OpenID. Is it anything like kerberos?
user avatar
8 votes
2 answers
1k views

How does external authentication work?

For example, I can log in to stackexchange websites by logging in to external websites such as OpenID, Yahoo, etc. How does this work? How do the websites (SE and Yahoo!, for example) communicate? How ...
Fitri's user avatar
  • 445
16 votes
4 answers
487 views

Are malicious relying parties able to abuse OpenID logins?

if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me? Are they able to steal my contact info, name, etc (assuming I'm using Gmail ...
Pacerier's user avatar
  • 3,303
7 votes
2 answers
6k views

Verify SAML Response is from a Trusted Source

I'm in the process of making changes to my site so that we can be a SAML 2.0 Service Provider. We will be doing IdP initiated SAML with Out-of-Band account federation. My question is this: Given a ...
theycallmemorty's user avatar
4 votes
1 answer
666 views

How does the "Service Identity" feature of Azure ACS compare (and contrast) to a real IDP?

It appears that the ACS has IDP-style features within the "Service Identities" section. How does the ACS treat these in comparison to a real IDP? What is missing? Some examples I'm thinking of ...
makerofthings7's user avatar
5 votes
2 answers
2k views

How do Azure ACS 2.0 security features compare to ADFS 2.0?

I'm configuring my relying party (a website) to use either ADFS or Azure ACS 2.0. ADFS 2.0 has some interesting features such as Token Replay prevention (in the SQL version) and may have other SAML ...
makerofthings7's user avatar
9 votes
2 answers
2k views

Storing third-party auth info securely

Suppose there's a multi-user web application that requires access to user's mailbox (on third-party service, like gmail, etc.). This access needs to be persistent. Which means we'd have to store user ...
StasM's user avatar
  • 1,901
9 votes
1 answer
2k views

What were the specific security flaws with OAuth 1.0? How are they being addressed in 2.0?

I read an article documenting Twitter abruptly pulling its OAuth support back in April 2009. The article said it wouldn't specify the hole for security reasons, but mentioned "social engineering" is ...
eskerber's user avatar
  • 193
21 votes
3 answers
597 views

Isn't openid with http an issue?

Many openid enabled sites default to http identifiers, even if the openid provider supports https (such as myopenid.com). Does this pose a threat beside the identity being exposed? The second step of ...
Hendrik Brummermann's user avatar
3 votes
2 answers
334 views

How does LiveID work? Is there any documentation on the LiveID provisioning site msm.live.com?

I'm trying to learn details on how LiveID works, when compared to other federation technologies. To be honest, I'm a bit overwhelmed by all the options at https://msm.live.com/ and want to understand ...
makerofthings7's user avatar
8 votes
2 answers
8k views

What is the exact difference between SAMLp and WS-Trust?

They seem to be similar on the surface, but I'm not sure how deep the differences are. Can someone explain to me the difference between SAMLp and WS-Trust? ADFSv2 gives me a choice between these ...
makerofthings7's user avatar
0 votes
1 answer
2k views

How can I decrypt ADFS-based SAML/p or WS-Trust claims?

I'd like to audit the claims that are sent to a client from a SAML/p or WS-Trust authentication. What private keys do I need and how would I decrypt this information? If it makes any difference, I'm ...
makerofthings7's user avatar