Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [identity-management]

The tag has no usage guidance.

0
votes
0answers
33 views

SIEM: Correlating remote logons to associate origin and target user

How is it possible to correlate or detect user logons eg via ssh/rdp to associate the origin user and target user. My use case is to know who actually (personal/identifiable) used a technical account ...
1
vote
1answer
39 views

What are the pieces of information delivered in a user profile at the end of a OpenID Connect flow?

From what I understand about using OpenID Connect (over OAuth2), is that we end up with some JSON containing information about the user. That information is transported as a JSON Web Token. ➥ What ...
2
votes
0answers
27 views

Is the 51% attack relevant for identity management systems based on proof-of-work?

51% Attack for Cryptocurrencies Cryptocurrencies using proof-of-work for the creation of consensus are vulnerable to the double-spending attack (51% attack), because an entity with more than 50% of ...
6
votes
6answers
336 views

Are there any objective reasons to use dedicated user/password instead of identity providers within a large organization?

I work for a large organization (thousands of employees + maybe tens of thousands of external users that have partial access to a fraction of internal information) and many of these people ...
4
votes
1answer
361 views

How to get better IAM understanding

I'm getting interested in Identity and Access Management (IAM), but I find it hard to find complete and understandable explanations that suit me, surely because I started wrong. I began with ...
1
vote
1answer
43 views

Should pin numbers expire?

We're using pin number for username retrieval process. Similar to a standard bank solution where a user must enter their ssn and account number to get their username. Is it necessary to expire this ...
2
votes
2answers
67 views

Is my (Chrome) email address available to websites when I'm logged into Chrome?

When I'm logged into Chrome (e.g. with my Gmail account) can websites view/obtain the email address associated with my Google/Chrome account? For example, as a means to "recognize" me?
1
vote
0answers
20 views

What's a good method for user to retrieve their unique identifiers?

This is an identity management question. After generating a unique identifier for users, what is the best way to allow them to retrieve their own uid for the first time? They get their uid shared ...
1
vote
1answer
127 views

Authentication providers for applications with no internet connection

I have an interesting use case where users need to authenticate to applications running in environments that might not have internet access or even access to an authentication server. Administrators ...
3
votes
1answer
172 views

How can we show our end-users that we are trusted by a bank?

We are developing an website which serves end users of many organizations (banks , municipalities etc). We have already setup meetings with the banks and they've agreed to work with us. Ok so let's ...
3
votes
1answer
112 views

Open challenges in Identity management for Internet of things

I am concerned with how identities are managed in the context of Internet of Things. How can IoT devices(e.g., RFID tag or smart vehicles) be able to authenticate with another. Is there any practical ...
20
votes
6answers
4k views

What extra security does a 2-step website login process with a PIN provide?

I am currently working on a web application with a significant security risk attached to its function. We're using Microsoft Identity Framework to handle user logins, with the system forcing strong ...
1
vote
1answer
650 views

How to deal with spam that contains my personal details?

I just noticed some spam in my inbox in GMail that is from a very suspicious e-mail address (partially redacted anonymous@webXXXXXXX.ad.aruba.it) containing a link to a similarly suspect URL (http://...
5
votes
3answers
408 views

What personal information is safe to share publicly? [closed]

What personal information is safe to share publicly (online)? I have a CV online with my email address, mobile number, land line number, ID number and year of birth (not date of birth). I live in ...
5
votes
1answer
3k views

Why should I trust a JSON Web Token (JWT)?

In the SAML and Kerberos authentication models, there is an explicit understanding of what authority has authenticated the user and issued the credential to be trusted by downstream systems. For ...
3
votes
2answers
466 views

Best practice for identity management methods with regards to confirming user existence

I'm working on a new site that uses asp.net identity to register users. I'm making use of email addresses as usernames and the email address has to be confirmed before the user can log in. I've been ...
7
votes
2answers
2k views

Using multiple oAuth identity services simultaneously

This question is somewhat acedemic in nature. While educating myself about the topic of Security via a Bearer Tokens for a back-end service that I am working on, and specifically about oAuth2, a few ...
2
votes
1answer
119 views

What are proper security precautions when enabling multiple connected social accounts or login/authorization methods?

It is popular today for frameworks and social sites to enable multiple authorization options when creating websites. For example, allowing a user to login with GitHub, Twitter, Facebook, etc. In ...
0
votes
1answer
106 views

Is there a way to securely lockdown a website to an Iphone?

So with a typical website, perhaps the fastest and most effective (arguably) way to secure the site is to add a simple .htaccess and restrict by ip addresses: .htaccess DENY from ALL ALLOW from xxx....
3
votes
1answer
700 views

Access rights management in large companies

I'm wondering how large companies with tens / hundred of applications are handling access-rights for their users. From what I've seen, it's a nightmare that never ends, and it requires full-time ...
0
votes
1answer
112 views

How to sync with multiple authentication services?

I have a peculiar case to work on. We are using a proprietary product which supports LDAP integration. However, it can be configured to use only one LDAP service. (most of the products are shipped ...
8
votes
2answers
5k views

What are best practices for implementing ACL

I have a website that has certain menu items that need to be hidden from end users. The web site has PHP in the front-end and Java and Spring in the back-end, deployed on a Linux OS in a VM ...
2
votes
2answers
580 views

Should every SAML identity provider provide a unique public certificate to the service provider?

When accepting public keys from someone setting up an identity provider for access to resources protected by a service provider using SAML 2.0, do you absolutely need to have a unique certificate? Is ...
1
vote
1answer
525 views

Is it safe to recycle unshredded credit card receipts?

Is it safe to recycle unshredded paper credit card receipts? Can identity theft be helped by data disclosed on most vendor's receipts?
4
votes
1answer
931 views

Pros and cons of having two identity providers

My company has applications on cloud and intranet. Also, we have various roles such as employee, customers, partners etc. We would like ID federation between services hosted on public cloud and ...
10
votes
3answers
32k views

How is SAML solving the cross domain single sign-on problem?

Let's say I have two websites that live on separate domains, and their service providers both talk to the same identity provider on a third domain. I log into the first website and authenticate, and ...
5
votes
4answers
1k views

How can I verify the identity of a US | UK -based person and prevent *fake identities* from being accepted?

Given that it's possible to fake ID cards and fake social security numbers are created, I need to ensure that all users of my site are US or UK based citizens, and don't have more than one account. A ...
0
votes
1answer
418 views

How can I ensure privacy when outsourcing authentication to an IdP (Identity Provider)

I need to outsource authentication to an IdP (Identity Provider) but I don't want that IdP to know of the calling site. The two major issues are the callback URL and the referer header. Is there any ...
5
votes
1answer
800 views

Are there risks of using the same OpenID provider for sites with different security levels?

I always use the same OpenID provider (Google, with a strong unique pw and 2-factor auth) in every site that supports it, without thinking twice. It's my understanding that, as long as the provider is ...
6
votes
2answers
1k views

Combining capability-based access control with SAML

I have been looking into various research on identity, PKI and access control trying to boil it down to a simplified methodology for IAM (Identity & Access Management). One thing which pops up in ...