Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [openid]

An open Single Sign On (SSO) solution for the web, a problem also addressed by SAML.

1
vote
0answers
29 views

Did I get it right? OAuth2, OpenID and OpenID Connect

After a lot of research about authentication and authorization, I reached the following but not sure if what I reached is the correct thing so please help me out: Authentication is who you are. ...
0
votes
1answer
52 views

Is it safe to just forget OAuth tokens, and not invalidate them in a mobile app?

I have a mobile application that a user signs into using OpenId Connect and OAuth 2.0. Currently when the user logs out, I open up a webpage to the end_session_endpoint (http://docs.identityserver.io/...
1
vote
0answers
23 views

When is OAuth1 preferred over OAuth2

Scenario: I need to build a new API for a third party company who are building a tool to capture information of new users wishing to create accounts on our enterprise platform. -x- My preferred ...
0
votes
0answers
20 views

what were the impacts when a user affected with data breach when he signed up with third party authentication [duplicate]

Background : Recently quora got breached and database were reported to be stolen, Myself used to have a habit of signing in through google login. Problem statement : What were the possible ...
4
votes
1answer
85 views

How do I implement a Microsoft Login into my own website? [closed]

I am trying to make a website, which hosts a form for employees to enter their shift details into. The website itself is pretty basic, meaning it is mostly just HTML and PHP code. Obviously I need to ...
1
vote
1answer
1k views

Why does OpenID Connect (“OIDC”) use a `nonce` claim instead of the `jti` registered claim

According to the spec, OpenID Connect uses nonce as the registered claim name, but RFC 7519 already includes a registered claim named jti for this same purpose. Was this an oversight, or was there ...
3
votes
0answers
2k views

Are JWT refresh tokens in browser really that bad?

Note: I fully acknowledge there may be something I'm missing in the picture, which is part of my reason for posting. I'd like to get the opinion of people more experienced than I am on authN/Z related ...
0
votes
0answers
23 views

Open ID Connect: Second ID-Token only has “sub” attribute

I am implementing a customer-IAM solution using WSO2 Identity Server 4.5.1. One of the (few) applications integrating with me via Open ID connect has discovered an unexpected behaviour, and I need ...
0
votes
1answer
49 views

Non-standard OIDC flow: How safe is this?

I have been made aware of an application, at a client, that claims to use OIDC to authenticate users. This is however done via a non-standard flow that I find hard to assess from a security standpoint....
2
votes
1answer
145 views

Why was pseudo-authentication using OAuth more successful than actual authentication using OpenID?

A few years ago, OpenID was nearly everywhere, with support from what are currently the major OAuth providers -- Google, Facebook, and even Yahoo all provided OpenID authentication. Since then though,...
18
votes
3answers
4k views

Why isn't PKCE encouraged for Single-Page Apps?

A lot of services today still recommend the implicit flow for an OpenID Connect/Oauth2 token exchange when developing Single-Page Apps. (See Okta, Google, Auth0) Some newer guidance out there points ...
0
votes
1answer
50 views

What can an attacker do with an OpenID token

Say an attacker had access to a list of OpenID tokens, what could the attacker leverage with that to access a system? Would they need to have another piece of information, MITM? Or can they just use ...
1
vote
1answer
127 views

Authentication providers for applications with no internet connection

I have an interesting use case where users need to authenticate to applications running in environments that might not have internet access or even access to an authentication server. Administrators ...
3
votes
1answer
765 views

Securing a multi-tenant API with SSO and different roles per tenant

I am working on developing a REST API that will be used by first party clients that we develop, and third party clients in the future. The first party clients include a SPA client side application, ...
1
vote
0answers
15 views

Does Thinktecture V2 Require Round Trips on Requests

I am learning about the Thinktecture Identity Server v2 and considering deploying it as a single sign on solution for 3 to 4 apps/services our company is developing for our customers. The applications ...
1
vote
1answer
181 views

Any practical Single Sign-On (SSO) protocol/traffic analysis tool/method/analyzer? [closed]

I want to analyze the SSO protocol/traffic that is deployed in real environment, such as commercial website. The challenge is that most of them are black-box. Scenario 1. I read several papers about ...
2
votes
1answer
270 views

What web authentication protocol?

I need to implement a web-based authentication protocol so users I know can be given access to a third-party web application. I will work with the developers of that web application to implement both ...
1
vote
1answer
118 views

Is JSON web token further secured in OpenID, and how?

I have read the details of pure JSON web token (JWT), and found that it is signed (e.g. by SHA256) but not encrypted. Hence, attack can read the sensitive information by decoding the header and ...
1
vote
0answers
133 views

Is there any reason the Well-Known OpenID discovery endpoint is not signed?

Unlike WS-Federation/WS-Trust metadata, the OpenID discovery endpoint is not signed. This results in a number of threats that are possible on this endpoint. Is there any justification in not signing ...
10
votes
1answer
8k views

What are OpenID scopes and claims?

I need to implement SSO on our web API and I was reading about OpenID and IdentityServer. This is my first connection with SSO, OAuth and OpenID. In the presentation movies I heard a lot about scopes ...
0
votes
1answer
117 views

What is the difference of the word “Open” in OpenID vs. OpenID Connect

I am having a hard time in understanding the concept of OpenId and OpenId Connect. Both of them have the word "Open" in them but there is a difference in the meaning. Why is this so?
1
vote
1answer
1k views

Is SSO without SSL possible and/or secure?

Lets imagine a site where HTTPS is not used, for any good or bad reasons. The admin of this site still need a way to secure connections and think about using unique authentication with social networks ...
1
vote
0answers
273 views

What is the difference in implementation between HybridAuth and OpenID Connect?

I am installing a CMS login that is shared between two organizations, one a blog for community designed for ease of login and the other is a staff PHP application for a related nonprofit, to keep ...
1
vote
1answer
64 views

Reauthenticating a user for sensitive actions using OpenID

Normally, when you perform sensitive actions on a website, such as changing your password or enabling two factor authentication, you are required to reenter your password, presumably to protect ...
6
votes
1answer
435 views

Any scenario for using both, OpenID Connect and OAuth 2.0?

Since OpenID Connect builds on OAuth 2.0, I am assuming that everything that is possible with OAuth 2.0 is also possible with OpenID Connect. In particular, say that my website stores some ...
6
votes
4answers
953 views

Authentication Middleware

We run a large distributed system consisting of a number (>10) of Django-based web services and web applications with a consumer base of about 10000 university students. Currently, we use a single ...
1
vote
2answers
137 views

Why are Facebook, etc. considered as typical authorization servers in OpenId?

The OAuth2 specification says: The interaction between the authorization server and resource server is beyond the scope of this specification. The authorization server may be the same server ...
0
votes
2answers
2k views

multi tenancy and microservices API authentication/authorization

I'm seeking advice on how we may be able to implement authentication and authorization for multitenancy with slightly different number of scenarios. We are building a set of API's which of some are ...
16
votes
2answers
1k views

Why is OpenID considered secure when password reuse is not?

OpenID allows you to use your e.g. Google/Facebook/Microsoft account to log into a third party website. It can be used to log into Stack Exchange. Why is this considered an acceptable practice, ...
2
votes
1answer
184 views

How 'Logjam' attack affects openID since it uses Diffie-Hellman key exchange method?

According to the Diffie-Hellman key exchange get affected by logjam, and openID uses this to establish an association. So how this going to affect OpenID?
1
vote
0answers
746 views

Oauth authentication without state parameter

I have some security concerns about the first step of account authentication in my application. The authentication goes through an OpenID provider. If the response of such provider shows that the ...
2
votes
0answers
162 views

How is an OpenID Authenticated user Identified?

On a system that I'm working on a user signs up by means of an OpenID/Social Media account (Twitter, Google, Facebook), and then subsequently signs in using that path. The System comprises of a Back-...
2
votes
1answer
859 views

Why not oAuth for Authentication - AKA what is bad about OpenID Connect [duplicate]

I read many questions and answers on this forum stating that oAuth is for authorization, OpenID is for authentication and more than a few of them goes on to say that OpenID Connect provides ...
1
vote
2answers
295 views

Can I get rid of storing user secrets by using OpenID, and what do I need to store?

What information do you have to keep about a user to be an OpenID consumer? I want to use OpenID to let users register and authenticate on my system. So while I'm at it I want to not duplicate ...
0
votes
1answer
801 views

How to incorporate the man-in-the-middle

I am designing a web-based back-end for an online service. The service could support web based portals and mobile apps as front end. But I am stuck on how to support third-party, i.e untrusted, web ...
1
vote
2answers
97 views

Is it normal if user gets logged in Facebook or Twitter after they use Like or Tweet button? [closed]

Personally I don't use social networks, so I'm not sure about their behaviour. Currently I must code website which heavily depends on "Likes" and "Tweets" about articles. Each article has Like and ...
4
votes
2answers
765 views

Google+ Sign In - One Time Code Flow vs Pure Server Side flow

I'm reading the documentation about Google+ Sign In, more specifically, its server side flow. It says (https://developers.google.com/+/web/signin/redirect-uri-flow) that one-time code flow has ...
4
votes
0answers
91 views

What are appropriate measures to only allow logins from a given trusted OpenID-Provider?

I have a bunch of applications, where users need to log in. Not everyone can be a user, each user has to be approved of by an admin. The authentication should be a SSO solution, where user accounts ...
8
votes
4answers
2k views

Is 'Bring your own Identity' as the only authentication option a valid practice?

This question is mainly aimed at OpenID Connect, when it is fully realized. I understand the aversion to signing in with a social networking site, but from what I understand about OIDC, its supposed ...
3
votes
1answer
672 views

SAML and OpenID, centralized and decentralized

I'm learning SAML, which is said to be centralized. To understand the difference with decentralized, I'm reading about OpenID. I find it difficult to understand the difference between the two, ...
42
votes
6answers
15k views

Can someone explain the “Covert Redirect” vulnerability in OAuth and OpenID?

CNet is reporting that all OpenID and OAuth sites are vulnerable to an attack called "Covert Redirect". What is this attack, how does it work, and as an end user, how can I mitigate the risk?
8
votes
1answer
214 views

Why does a web site operator need to trust an openid provider?

I am working on a web site and am considering using OpenID for authentication. The site will have some low cost ($3-$5) premium services, but will not be protecting particularly sensitive user data, ...
11
votes
1answer
680 views

Is logging in using OAuth/OpenID also vulnerable to heartbleed?

If one has logged into a "heartbleed-vulnerable" site using OpenID, for example, using Google to log into StackExchange, does that mean that the Google password is now at risk as well?
1
vote
3answers
442 views

Can I trust profile data a 3rd party auth provider send to me?

This question may be related to this one, but I think we need to be sure. My website implement login via OpenID (or Google, or Facebook, etc.). On my website, authorization is based on user email ...
3
votes
1answer
755 views

Google Open ID connect and ID token

I am wondering if it is safe to send "id token", which is one of the items that are result of authenticating a user using Google Open Id Connect, to the client and use it for further authentication. ...
11
votes
2answers
236 views

Does any OpenID identity provider allow site-unique arbitrary email addresses?

Since OpenID officially furnishes email address to sites (with the user's permission) as a convenience rather than an attestation, is there any OpenID identity provider who'll allow you to ...
10
votes
2answers
803 views

How does an attacker abuse Facebook Connect with a leaked secret key?

I am reading about Facebook Connect and it looks a lot like OpenID Connect. Are these two similar enough that the Facebook Connect secret key is an OAuth Client Secret and therefore the same attacks ...
19
votes
3answers
18k views

When do you use OpenID vs. OpenID Connect

Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context? The reason I ask is because I'm trying to implement the following: User "Bob"...
115
votes
7answers
67k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
1
vote
2answers
202 views

Verify a user's affiliation with an organization

I'm in charge of IT at a students' organization. Let's call it FratA. FratA has ties to sister-organizations in other university cities in my country. Let's call those FratB through FratZ. These inter-...