Questions tagged [openid-connect]

OpenID Connect is an optional standardization of identify and profile data on top of OAuth 2.0 when OAuth is used for authentication.

Filter by
Sorted by
Tagged with
0 votes
2 answers
26 views

Is it safe to use email from OAuth for authentication?

I am implementing OAuth (more specifically "Sign in with Google") for a website that has been using only email and password for years. Now the guide that I'm reading suggests to read the uid ...
user avatar
0 votes
0 answers
43 views

Why is OIDC more secure than oauth2?

If oauth2 is used with the state parameter (I know it's not required by the standard), wouldn't this ensure freshness, i.e. that authentication just happened? What additional security can OIDC bring?
user avatar
0 votes
0 answers
16 views

Can I combine OpenID Connect and SAML2 protocols in OpenAM

We are using Forgerock OpenAM for managing authentication and authorization and I was wondering if it is possible to use this configuration: Domain 1 -> App 1 -> Use SAML2 Domain 1 -> App 2 -...
user avatar
0 votes
0 answers
12 views

Can I store subject from a JWT from an external auth server in my DB?

We are retrieving external users using OpenID with the PKCE flow. We are using the JWT returned from the auth server to authenticate the user. If it is valid, we extract the subject field from the ...
user avatar
  • 101
0 votes
0 answers
14 views

Leaving half open or full open connection having SYN cookie

Suppose an attacker collects a large number of initial sequence numbers sent by the server. Can the attacker cause the server to create many fully open connections by sending ACKs with those initial ...
user avatar
0 votes
0 answers
9 views

Creating half open or full open connection in presence of SYN cookie

Suppose an attacker knows that a target host uses SYN cookies. Can the attacker create half-open or fully open connections by simply sending an ACK packet to the target? Why or why not?
user avatar
0 votes
1 answer
95 views

3rd party mobile app access our service via our APIs

We have a microservice backend system & we expose APIs for our customers to use. We are now developing our Authentication system with our identity provider service. We have a customer(a company), ...
user avatar
0 votes
0 answers
87 views

Using oauth2 to implement SSO between a desktop application and a web application

Is oauth2 designed to handle single-sign-on between a desktop application and a webapp? The scenario looks like this: The desktop app has a username/password login After a user is authenticated in ...
user avatar
  • 43
0 votes
1 answer
53 views

Is passing an IDToken OK for seamless handover from app to website?

I am trying to assess the security implications for a session handover between an app and a website in the same company ecosystem. The Setup Mobile Application A and Website B use the same company ...
user avatar
  • 103
0 votes
0 answers
58 views

Using a spa login page for authentication in a openId connect servic

I am looking to create a brand new authentication service that follows the OpenId connect protocol. I would like to use a username/password combination for the authentication and the authorization ...
user avatar
0 votes
0 answers
67 views

HTTP Bearer authentication with multiple identity providers?

Suppose I have a web application that uses OpenID Connect to enable users to log in with one of several 3rd party identity providers (e.g., "log in with Google", "log in with Facebook&...
user avatar
0 votes
0 answers
55 views

What's the purpose of signing OIDC ID Tokens if they shouldn't be used as bearer tokens

It seems like signing ID Tokens invites misuse. As I understand it, OIDC ID tokens should not be used as bearer tokens for authorizing API access. Instead, we should use access tokens. However, the ID ...
user avatar
0 votes
0 answers
176 views

OpenId with Biometrics - should I write a custom login + OIDC

We are trying to arrive at a solution for an enterprise app Different Users have different Authentication Methods User Type 1 - Password + Captcha User type 2 - Biometric [Not device-based] + ...
user avatar
0 votes
1 answer
129 views

What can attacker do with OpenID Connect id_token?

I have an application that stores the id_token in the localStorage of the browser. Since there is no CSP and Web Storage does not have the same protections such as cookies (HttpOnly, SameSite) this &...
user avatar
0 votes
0 answers
54 views

Native client OAuth without API supporting PKCE

I have a native windows app that can connect to multiple external API's using OAuth (Authorization Code + PKCE). I store the refresh tokens locally encrypted with the Windows Data Protection Api. Now ...
user avatar
  • 101
0 votes
1 answer
117 views

Modern security flow/process for trusted Mobile and SPA apps with self-hosted OIDC

Currently, there are two common auth flows i know: Resource Owner Password Flow Authentication Code Flow + PKCE (didn't mention other, since this one is more robust within redirect-based) This theme ...
user avatar
  • 101
0 votes
1 answer
62 views

OpenId connect: Grant all available scopes in ClientCredentials flow

I have a microservice system with an OpenId connect Identity Provider, implemented with IdentityServer4. I have one special (very generic) service which needs to be able to communicate with all other ...
user avatar
0 votes
1 answer
363 views

OpenID Connect with or without reverse proxy?

Many popular reverse proxies (tomcat, nginx, ...) seem to handle OpenID Connect and act as a Relying Party to hide the authentication complexity to all applications behind the reverse proxy, which ...
user avatar
  • 33
0 votes
1 answer
58 views

A Native Desktop App using PKCE - Can an id_token be consider valid authentication when passed to another protected server resource?

My understanding is that client impersonation cannot be prevented for Native Desktop Apps. If all standard controls: State, PKCE, Redirect_URI confirmation etc are in place, to prevent auth_code ...
user avatar
0 votes
1 answer
126 views

How to encrypt REST body with openid connect OIDC

The big picture is: an android application which authenticate user with an external openid provider (such as azure AD) a Java EE server which expose rest endpoints securized with the validation of ...
user avatar
1 vote
0 answers
190 views

Openid nonce replay attack in auth code flow

Looking at this question Openid connect nonce replay attack and the answer by @benbotto. I understand the replay attack in implicit flow but unable to understand it for auth code flow. Let's say an ...
user avatar
0 votes
1 answer
161 views

Does "validating" a JWT token from prove authentication with OpenId?

I have a static react app which users login via an Okta SPA app. The app receives a JWT, which it is stored in the browser, and passed to the backend API via Authentication header on every request. ...
user avatar
  • 143
0 votes
0 answers
104 views

Is a Keycloak User ID sensitive?

I am using Keycloak for OpenID Connect single sign on. I can see that the various users each have an ID in Keycloak, with the format similar to this example: a12346fb-bd93-fedc-abcd-0739865540cb. Is ...
user avatar
0 votes
1 answer
497 views

How to pentest oAuth2/oidc clients

imagine the following problem: As a developer, I would like to check if my oAuth2 or OpenID Connect client is really secure. I would like to check if it validates the JWT signature, uses the nonce etc....
user avatar
  • 2,393
1 vote
0 answers
82 views

What is Threat Profile is Microsoft addressing with the MSAL URI format?

Applications built for MSAL 1.0 and MSAL 2.0 have a default application URI of MSAL://GUIDHere/AppName This is in contrast with what other IDP's are doing. Can anyone explain the benefits or drawbacks ...
user avatar
2 votes
0 answers
70 views

Does OIDC explicitly handle refresh token exchange for multiple devices?

This question is inspired by this answer and question I also use that method to handle the case where users can sign in and out of multiple devices, by storing a per-device refresh token for a device ...
user avatar
  • 139
0 votes
1 answer
355 views

Is PKCE really protecting public facing clients? Can't a rogue app steal the ClientID and Secret and make a AuthCode request of its own?

From what I have understood, for public facing clients such as JavaScript apps that run on the browser or mobile apps which have no backend there is no secure place to store client id and secret. ...
user avatar
1 vote
0 answers
185 views

Implement an SPA with IFrames, but with Single Sign-on

I want to build an SPA with ASP.NET Core (Blazor server side) which some IFrames redirecting to other applications. In this example I have f.e. the SPA, Grafana to show graphs and Node-Red, but there ...
user avatar
  • 141
1 vote
1 answer
123 views

In Open ID Connect, why is the id token a JWT token whereas the access token is not?

I know that the access token can be of any format(it is up to the authorization server), but I noticed that most of the times the access token is not a JWT whereas the id token is a JWT. Why is that ...
user avatar
4 votes
1 answer
2k views

When using PKCE, are the state and nonce parameters still necessary protection from csrf and code injection?

When I'm using the authorization code flow with PKCE do I still need state and nonce? For state (that prevents login-csrf), if an attacker sends me a malicious Authorization Response, the client may ...
user avatar
  • 492
1 vote
0 answers
71 views

Why do some "OAuth" providers ask for personal info?

I don't mean to start another OAuth vs OpenID discussion, but I want to share the underlying cause of my confusion. When I want a Client to process my google docs for something, I have to go through ...
user avatar
1 vote
0 answers
98 views

Change of domain without having to log in again

The question concerns the idea of transferring sessions between domains without having to log in again. I would like to do it like this: (user is logged in and changes the language to a language from ...
user avatar
1 vote
3 answers
652 views

Does OpenID Connect provide CSRF and XSS protection?

I've been reading several articles recently about how storing JWTs in local or session storage is inherently insecure. The mitigation is apparently to implement a "session ID pattern", i.e. ...
user avatar
2 votes
0 answers
536 views

Keycloak and Open ID Connect best practices

I'm a bit lost as to the best practice surrounding a production-ready access management based on keycloak and open id connect. My understanding is that if you use Keycloak's provided adapters, instead ...
user avatar
  • 21
0 votes
1 answer
106 views

Benefits of Token Exchange protocol

Beginner question here, I don't seem to be able to wrap my head around the security benefits of the token exchange protocol as specified by RFC8693. To me it seems like a delegation pattern where a ...
user avatar
  • 101
0 votes
1 answer
201 views

OpenID Connect with a chain of Relying Parties

Is there a usage of OpenID Connect (OIDC) that allows for a chain of RP (terminology reference) user -> RP#1 user <-redirect to chosen OP- RP#1 user -> OP: verifies identity user <-...
user avatar
  • 129
0 votes
1 answer
276 views

Logout on OIDC Provider Refresh Token validity in comparison to OAuth

I have an Relying Party that has obtained an Access Token and Refresh Token (as well as an ID Token) from an OpenID Provider (not an offline token). In all cases I have seen, the Refresh Token is ...
user avatar
  • 492
4 votes
1 answer
1k views

Why is SAML still used for enterprise SSO instead of OIDC?

Im trying to wrap my head around the difference between SAML/OIDC/and OAuth Is the only reason SAML is the most popular choice for enterprise SSO that its been around much longer? Is it expected to ...
user avatar
0 votes
0 answers
97 views

Oauth2: should I increase the refresh token expiring date?

I want my clients to be able to schedule a purchase for a given date. When they perform this scheduling action, they are authenticated with an oauth2 token. However the date could be so far from now ...
user avatar
  • 21
1 vote
2 answers
382 views

Is it safe to pass an OpenID Connect ID token to my back-end API for verification?

I am currently adding single sign-on functionality between my application and an electronic health record (EHR) system. The SSO is done using the OpenID Connect authorization code flow, but unlike a ...
user avatar
1 vote
1 answer
224 views

Can I use an ID token as proof of authentication?

I have a reverse proxy, configured as the Relying Party of an OpenID Connect identity provider. Then, it delegates the request processing to another web server, exposed on the internet. In order to ...
user avatar
1 vote
1 answer
179 views

OAuth2, SAML, OpenID connect - Which one to use for my scenario?

I work for a company where we give customer (hundreds/thousands of users) access to 2 sites. One owned by a 3rd party SaaS and one owned by us. Customers spend alot of time registering for both sites ...
user avatar
1 vote
1 answer
168 views

Is `iss` property in JWT tokens redundant?

I'm reading up on some OpenID Connect documentation trying to get my head around the protocol. I came across the issuer property that is common in the JWT tokens. How come this is required if we ...
user avatar
  • 175
1 vote
0 answers
212 views

Oauth2.0 | How to manage user session in Single Page application running in an iframe?

I'm new to security domain, and recently I have learned about Oauth2.0/OpenID connect and JWT tokens. I have an existing REST based web application where I need to implement security. Server ...
user avatar
1 vote
0 answers
77 views

Do id tokens need to be signed assymetrically?

Access tokens that are passed to the public in an OAuth flow clearly need to be signed using asymmetric encryption (e.g. RSA) so that they cannot be altered by the client to gain access to new scopes, ...
user avatar
0 votes
1 answer
243 views

OpenID Connect with user bound roles and M2M access

I'm trying to get my head straight about how to properly design a OpenID connect provider and the roles to use with it. I understand the basic of scopes, claims and the different flow one can use. ...
user avatar
  • 175
1 vote
1 answer
336 views

Can OpenID Connect be used to implement social login?

Using OAuth to implement social login is insecure (https://www.rfc-editor.org/rfc/rfc6819#section-4.4.2.6) because OAuth doesn't provide authentication, only authorisation. The issue arises because ...
user avatar
1 vote
1 answer
190 views

how does spotify do oauth(+open id connect) from the desktop app?

I understand what the workflow would be from the webpage, but how does oauth+open id work for desktop apps as they cannot open a browser page within the app. I see that when I click on log in with ...
user avatar
  • 111
-1 votes
2 answers
275 views

What are the security risks with rolling out your own Authorisation server implementation

Even though I'm working within .Net Core, this question is generally applicable to other platforms as well. My question is to do with: Using a framework (such as IdentityServer) to manage ...
user avatar
  • 111
0 votes
0 answers
91 views

openID connect without resource owner authorization

the use case I have is, there are multiple systems that access each other over the internet, all sharing the same user base. openId connect seems to be the way of identity management. this means every ...
user avatar