Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [openid]

An open Single Sign On (SSO) solution for the web, a problem also addressed by SAML.

1
vote
0answers
18 views

When is OAuth1 preferred over OAuth2

Scenario: I need to build a new API for a third party company who are building a tool to capture information of new users wishing to create accounts on our enterprise platform. -x- My preferred ...
0
votes
0answers
20 views

what were the impacts when a user affected with data breach when he signed up with third party authentication [duplicate]

Background : Recently quora got breached and database were reported to be stolen, Myself used to have a habit of signing in through google login. Problem statement : What were the possible ...
4
votes
1answer
79 views

How do I implement a Microsoft Login into my own website? [closed]

I am trying to make a website, which hosts a form for employees to enter their shift details into. The website itself is pretty basic, meaning it is mostly just HTML and PHP code. Obviously I need to ...
1
vote
1answer
708 views

Why does OpenID Connect (“OIDC”) use a `nonce` claim instead of the `jti` registered claim

According to the spec, OpenID Connect uses nonce as the registered claim name, but RFC 7519 already includes a registered claim named jti for this same purpose. Was this an oversight, or was there ...
3
votes
0answers
1k views

Are JWT refresh tokens in browser really that bad?

Note: I fully acknowledge there may be something I'm missing in the picture, which is part of my reason for posting. I'd like to get the opinion of people more experienced than I am on authN/Z related ...
0
votes
0answers
21 views

Open ID Connect: Second ID-Token only has “sub” attribute

I am implementing a customer-IAM solution using WSO2 Identity Server 4.5.1. One of the (few) applications integrating with me via Open ID connect has discovered an unexpected behaviour, and I need ...
0
votes
1answer
39 views

Non-standard OIDC flow: How safe is this?

I have been made aware of an application, at a client, that claims to use OIDC to authenticate users. This is however done via a non-standard flow that I find hard to assess from a security standpoint....
2
votes
1answer
131 views

Why was pseudo-authentication using OAuth more successful than actual authentication using OpenID?

A few years ago, OpenID was nearly everywhere, with support from what are currently the major OAuth providers -- Google, Facebook, and even Yahoo all provided OpenID authentication. Since then though,...
15
votes
1answer
2k views

Why isn't PKCE encouraged for Single-Page Apps?

A lot of services today still recommend the implicit flow for an OpenID Connect/Oauth2 token exchange when developing Single-Page Apps. (See Okta, Google, Auth0) Some newer guidance out there points ...
0
votes
1answer
48 views

What can an attacker do with an OpenID token

Say an attacker had access to a list of OpenID tokens, what could the attacker leverage with that to access a system? Would they need to have another piece of information, MITM? Or can they just use ...
1
vote
1answer
117 views

Authentication providers for applications with no internet connection

I have an interesting use case where users need to authenticate to applications running in environments that might not have internet access or even access to an authentication server. Administrators ...
3
votes
1answer
698 views

Securing a multi-tenant API with SSO and different roles per tenant

I am working on developing a REST API that will be used by first party clients that we develop, and third party clients in the future. The first party clients include a SPA client side application, ...
1
vote
0answers
15 views

Does Thinktecture V2 Require Round Trips on Requests

I am learning about the Thinktecture Identity Server v2 and considering deploying it as a single sign on solution for 3 to 4 apps/services our company is developing for our customers. The applications ...
1
vote
1answer
177 views

Any practical Single Sign-On (SSO) protocol/traffic analysis tool/method/analyzer? [closed]

I want to analyze the SSO protocol/traffic that is deployed in real environment, such as commercial website. The challenge is that most of them are black-box. Scenario 1. I read several papers about ...
2
votes
1answer
254 views

What web authentication protocol?

I need to implement a web-based authentication protocol so users I know can be given access to a third-party web application. I will work with the developers of that web application to implement both ...
1
vote
1answer
107 views

Is JSON web token further secured in OpenID, and how?

I have read the details of pure JSON web token (JWT), and found that it is signed (e.g. by SHA256) but not encrypted. Hence, attack can read the sensitive information by decoding the header and ...
1
vote
0answers
128 views

Is there any reason the Well-Known OpenID discovery endpoint is not signed?

Unlike WS-Federation/WS-Trust metadata, the OpenID discovery endpoint is not signed. This results in a number of threats that are possible on this endpoint. Is there any justification in not signing ...
9
votes
1answer
7k views

What are OpenID scopes and claims?

I need to implement SSO on our web API and I was reading about OpenID and IdentityServer. This is my first connection with SSO, OAuth and OpenID. In the presentation movies I heard a lot about scopes ...
0
votes
1answer
110 views

What is the difference of the word “Open” in OpenID vs. OpenID Connect

I am having a hard time in understanding the concept of OpenId and OpenId Connect. Both of them have the word "Open" in them but there is a difference in the meaning. Why is this so?
1
vote
1answer
1k views

Is SSO without SSL possible and/or secure?

Lets imagine a site where HTTPS is not used, for any good or bad reasons. The admin of this site still need a way to secure connections and think about using unique authentication with social networks ...
1
vote
0answers
270 views

What is the difference in implementation between HybridAuth and OpenID Connect?

I am installing a CMS login that is shared between two organizations, one a blog for community designed for ease of login and the other is a staff PHP application for a related nonprofit, to keep ...
1
vote
1answer
61 views

Reauthenticating a user for sensitive actions using OpenID

Normally, when you perform sensitive actions on a website, such as changing your password or enabling two factor authentication, you are required to reenter your password, presumably to protect ...
6
votes
1answer
421 views

Any scenario for using both, OpenID Connect and OAuth 2.0?

Since OpenID Connect builds on OAuth 2.0, I am assuming that everything that is possible with OAuth 2.0 is also possible with OpenID Connect. In particular, say that my website stores some ...
6
votes
4answers
936 views

Authentication Middleware

We run a large distributed system consisting of a number (>10) of Django-based web services and web applications with a consumer base of about 10000 university students. Currently, we use a single ...
1
vote
2answers
136 views

Why are Facebook, etc. considered as typical authorization servers in OpenId?

The OAuth2 specification says: The interaction between the authorization server and resource server is beyond the scope of this specification. The authorization server may be the same server ...
0
votes
2answers
2k views

multi tenancy and microservices API authentication/authorization

I'm seeking advice on how we may be able to implement authentication and authorization for multitenancy with slightly different number of scenarios. We are building a set of API's which of some are ...
16
votes
2answers
1k views

Why is OpenID considered secure when password reuse is not?

OpenID allows you to use your e.g. Google/Facebook/Microsoft account to log into a third party website. It can be used to log into Stack Exchange. Why is this considered an acceptable practice, ...
2
votes
1answer
184 views

How 'Logjam' attack affects openID since it uses Diffie-Hellman key exchange method?

According to the Diffie-Hellman key exchange get affected by logjam, and openID uses this to establish an association. So how this going to affect OpenID?
1
vote
0answers
727 views

Oauth authentication without state parameter

I have some security concerns about the first step of account authentication in my application. The authentication goes through an OpenID provider. If the response of such provider shows that the ...
2
votes
0answers
162 views

How is an OpenID Authenticated user Identified?

On a system that I'm working on a user signs up by means of an OpenID/Social Media account (Twitter, Google, Facebook), and then subsequently signs in using that path. The System comprises of a Back-...
2
votes
1answer
843 views

Why not oAuth for Authentication - AKA what is bad about OpenID Connect [duplicate]

I read many questions and answers on this forum stating that oAuth is for authorization, OpenID is for authentication and more than a few of them goes on to say that OpenID Connect provides ...
1
vote
2answers
291 views

Can I get rid of storing user secrets by using OpenID, and what do I need to store?

What information do you have to keep about a user to be an OpenID consumer? I want to use OpenID to let users register and authenticate on my system. So while I'm at it I want to not duplicate ...
0
votes
1answer
774 views

How to incorporate the man-in-the-middle

I am designing a web-based back-end for an online service. The service could support web based portals and mobile apps as front end. But I am stuck on how to support third-party, i.e untrusted, web ...
1
vote
2answers
97 views

Is it normal if user gets logged in Facebook or Twitter after they use Like or Tweet button? [closed]

Personally I don't use social networks, so I'm not sure about their behaviour. Currently I must code website which heavily depends on "Likes" and "Tweets" about articles. Each article has Like and ...
4
votes
2answers
759 views

Google+ Sign In - One Time Code Flow vs Pure Server Side flow

I'm reading the documentation about Google+ Sign In, more specifically, its server side flow. It says (https://developers.google.com/+/web/signin/redirect-uri-flow) that one-time code flow has ...
4
votes
0answers
91 views

What are appropriate measures to only allow logins from a given trusted OpenID-Provider?

I have a bunch of applications, where users need to log in. Not everyone can be a user, each user has to be approved of by an admin. The authentication should be a SSO solution, where user accounts ...
8
votes
4answers
2k views

Is 'Bring your own Identity' as the only authentication option a valid practice?

This question is mainly aimed at OpenID Connect, when it is fully realized. I understand the aversion to signing in with a social networking site, but from what I understand about OIDC, its supposed ...
3
votes
1answer
653 views

SAML and OpenID, centralized and decentralized

I'm learning SAML, which is said to be centralized. To understand the difference with decentralized, I'm reading about OpenID. I find it difficult to understand the difference between the two, ...
42
votes
6answers
15k views

Can someone explain the “Covert Redirect” vulnerability in OAuth and OpenID?

CNet is reporting that all OpenID and OAuth sites are vulnerable to an attack called "Covert Redirect". What is this attack, how does it work, and as an end user, how can I mitigate the risk?
8
votes
1answer
212 views

Why does a web site operator need to trust an openid provider?

I am working on a web site and am considering using OpenID for authentication. The site will have some low cost ($3-$5) premium services, but will not be protecting particularly sensitive user data, ...
11
votes
1answer
680 views

Is logging in using OAuth/OpenID also vulnerable to heartbleed?

If one has logged into a "heartbleed-vulnerable" site using OpenID, for example, using Google to log into StackExchange, does that mean that the Google password is now at risk as well?
1
vote
3answers
428 views

Can I trust profile data a 3rd party auth provider send to me?

This question may be related to this one, but I think we need to be sure. My website implement login via OpenID (or Google, or Facebook, etc.). On my website, authorization is based on user email ...
3
votes
1answer
751 views

Google Open ID connect and ID token

I am wondering if it is safe to send "id token", which is one of the items that are result of authenticating a user using Google Open Id Connect, to the client and use it for further authentication. ...
11
votes
2answers
235 views

Does any OpenID identity provider allow site-unique arbitrary email addresses?

Since OpenID officially furnishes email address to sites (with the user's permission) as a convenience rather than an attestation, is there any OpenID identity provider who'll allow you to ...
10
votes
2answers
779 views

How does an attacker abuse Facebook Connect with a leaked secret key?

I am reading about Facebook Connect and it looks a lot like OpenID Connect. Are these two similar enough that the Facebook Connect secret key is an OAuth Client Secret and therefore the same attacks ...
18
votes
3answers
17k views

When do you use OpenID vs. OpenID Connect

Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context? The reason I ask is because I'm trying to implement the following: User "Bob"...
113
votes
7answers
63k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
1
vote
2answers
199 views

Verify a user's affiliation with an organization

I'm in charge of IT at a students' organization. Let's call it FratA. FratA has ties to sister-organizations in other university cities in my country. Let's call those FratB through FratZ. These inter-...
3
votes
1answer
1k views

Why is OAuth 2.0 being used for mobile devices, and not OpenID?

Microsoft Azure Mobile services exclusively uses OAuth 2.0 for authentication, and many other providers mention the use of OAuth 2.0 specifically when referring to mobile devices. Question What ...
5
votes
1answer
142 views

If a service that I registered with FB/Twitter/G+ is hacked, what mischief can be done with the oauth token?

Case in point, TrueCaller. I had logged into TC using a proxy twitter account. I am assuming that as part of the authentication process, an access_token must have been saved by TC. If the hackers ...