Questions tagged [openid-connect]
OpenID Connect is an optional standardization of identify and profile data on top of OAuth 2.0 when OAuth is used for authentication.
185
questions
0
votes
2
answers
26
views
Is it safe to use email from OAuth for authentication?
I am implementing OAuth (more specifically "Sign in with Google") for a website that has been using only email and password for years.
Now the guide that I'm reading suggests to read the uid ...
- 113
0
votes
0
answers
43
views
Why is OIDC more secure than oauth2?
If oauth2 is used with the state parameter (I know it's not required by the standard), wouldn't this ensure freshness, i.e. that authentication just happened? What additional security can OIDC bring?
0
votes
0
answers
16
views
Can I combine OpenID Connect and SAML2 protocols in OpenAM
We are using Forgerock OpenAM for managing authentication and authorization and I was wondering if it is possible to use this configuration:
Domain 1 -> App 1 -> Use SAML2
Domain 1 -> App 2 -...
0
votes
0
answers
12
views
Can I store subject from a JWT from an external auth server in my DB?
We are retrieving external users using OpenID with the PKCE flow. We are using the JWT returned from the auth server to authenticate the user. If it is valid, we extract the subject field from the ...
- 101
0
votes
0
answers
14
views
Leaving half open or full open connection having SYN cookie
Suppose an attacker collects a large number of initial sequence numbers sent by the server. Can the
attacker cause the server to create many fully open connections by sending ACKs with those initial
...
0
votes
0
answers
9
views
Creating half open or full open connection in presence of SYN cookie
Suppose an attacker knows that a target host uses SYN cookies. Can the attacker create half-open or fully open connections by simply sending an ACK packet to the target? Why or why not?
0
votes
1
answer
95
views
3rd party mobile app access our service via our APIs
We have a microservice backend system & we expose APIs for our customers to use. We are now developing our Authentication system with our identity provider service.
We have a customer(a company), ...
- 51
0
votes
0
answers
87
views
Using oauth2 to implement SSO between a desktop application and a web application
Is oauth2 designed to handle single-sign-on between a desktop application and a webapp?
The scenario looks like this:
The desktop app has a username/password login
After a user is authenticated in ...
- 43
0
votes
1
answer
53
views
Is passing an IDToken OK for seamless handover from app to website?
I am trying to assess the security implications for a session handover between an app and a website in the same company ecosystem.
The Setup
Mobile Application A and Website B use the same company ...
- 103
0
votes
0
answers
58
views
Using a spa login page for authentication in a openId connect servic
I am looking to create a brand new authentication service that follows the OpenId connect protocol. I would like to use a username/password combination for the authentication and the authorization ...
- 1
0
votes
0
answers
67
views
HTTP Bearer authentication with multiple identity providers?
Suppose I have a web application that uses OpenID Connect to enable users to log in with one of several 3rd party identity providers (e.g., "log in with Google", "log in with Facebook&...
- 376
0
votes
0
answers
55
views
What's the purpose of signing OIDC ID Tokens if they shouldn't be used as bearer tokens
It seems like signing ID Tokens invites misuse.
As I understand it, OIDC ID tokens should not be used as bearer tokens for authorizing API access. Instead, we should use access tokens.
However, the ID ...
- 133
0
votes
0
answers
176
views
OpenId with Biometrics - should I write a custom login + OIDC
We are trying to arrive at a solution for an enterprise app
Different Users have different Authentication Methods
User Type 1 - Password + Captcha
User type 2 - Biometric [Not device-based] + ...
0
votes
1
answer
129
views
What can attacker do with OpenID Connect id_token?
I have an application that stores the id_token in the localStorage of the browser.
Since there is no CSP and Web Storage does not have the same protections such as cookies (HttpOnly, SameSite) this &...
- 48
0
votes
0
answers
54
views
Native client OAuth without API supporting PKCE
I have a native windows app that can connect to multiple external API's using OAuth (Authorization Code + PKCE). I store the refresh tokens locally encrypted with the Windows Data Protection Api.
Now ...
- 101
0
votes
1
answer
117
views
Modern security flow/process for trusted Mobile and SPA apps with self-hosted OIDC
Currently, there are two common auth flows i know:
Resource Owner Password Flow
Authentication Code Flow + PKCE (didn't mention other, since this one is more robust within redirect-based)
This theme ...
- 101
0
votes
1
answer
62
views
OpenId connect: Grant all available scopes in ClientCredentials flow
I have a microservice system with an OpenId connect Identity Provider, implemented with IdentityServer4.
I have one special (very generic) service which needs to be able to communicate with all other ...
0
votes
1
answer
363
views
OpenID Connect with or without reverse proxy?
Many popular reverse proxies (tomcat, nginx, ...) seem to handle OpenID Connect and act as a Relying Party to hide the authentication complexity to all applications behind the reverse proxy, which ...
- 33
0
votes
1
answer
58
views
A Native Desktop App using PKCE - Can an id_token be consider valid authentication when passed to another protected server resource?
My understanding is that client impersonation cannot be prevented for Native Desktop Apps. If all standard controls: State, PKCE, Redirect_URI confirmation etc are in place, to prevent auth_code ...
- 13
0
votes
1
answer
126
views
How to encrypt REST body with openid connect OIDC
The big picture is:
an android application which authenticate user with an external openid provider (such as azure AD)
a Java EE server which expose rest endpoints securized with the validation of ...
1
vote
0
answers
190
views
Openid nonce replay attack in auth code flow
Looking at this question Openid connect nonce replay attack and the answer by @benbotto. I understand the replay attack in implicit flow but unable to understand it for auth code flow. Let's say an ...
- 11
0
votes
1
answer
161
views
Does "validating" a JWT token from prove authentication with OpenId?
I have a static react app which users login via an Okta SPA app.
The app receives a JWT, which it is stored in the browser, and passed to the backend API via Authentication header on every request.
...
- 143
0
votes
0
answers
104
views
Is a Keycloak User ID sensitive?
I am using Keycloak for OpenID Connect single sign on. I can see that the various users each have an ID in Keycloak, with the format similar to this example: a12346fb-bd93-fedc-abcd-0739865540cb.
Is ...
- 211
0
votes
1
answer
497
views
How to pentest oAuth2/oidc clients
imagine the following problem:
As a developer, I would like to check if my oAuth2 or OpenID Connect client is really secure.
I would like to check if it validates the JWT signature, uses the nonce etc....
- 2,393
1
vote
0
answers
82
views
What is Threat Profile is Microsoft addressing with the MSAL URI format?
Applications built for MSAL 1.0 and MSAL 2.0 have a default application URI of MSAL://GUIDHere/AppName
This is in contrast with what other IDP's are doing.
Can anyone explain the benefits or drawbacks ...
- 50.1k
2
votes
0
answers
70
views
Does OIDC explicitly handle refresh token exchange for multiple devices?
This question is inspired by this answer and question
I also use that method to handle the case where users can sign in and out of multiple devices, by storing a per-device refresh token for a device ...
- 139
0
votes
1
answer
355
views
Is PKCE really protecting public facing clients? Can't a rogue app steal the ClientID and Secret and make a AuthCode request of its own?
From what I have understood, for public facing clients such as JavaScript apps that run on the browser or mobile apps which have no backend there is no secure place to store client id and secret. ...
- 101
1
vote
0
answers
185
views
Implement an SPA with IFrames, but with Single Sign-on
I want to build an SPA with ASP.NET Core (Blazor server side) which some IFrames redirecting to other applications. In this example I have f.e. the SPA, Grafana to show graphs and Node-Red, but there ...
- 141
1
vote
1
answer
123
views
In Open ID Connect, why is the id token a JWT token whereas the access token is not?
I know that the access token can be of any format(it is up to the authorization server), but I noticed that most of the times the access token is not a JWT whereas the id token is a JWT. Why is that ...
- 315
4
votes
1
answer
2k
views
When using PKCE, are the state and nonce parameters still necessary protection from csrf and code injection?
When I'm using the authorization code flow with PKCE do I still need state and nonce?
For state (that prevents login-csrf), if an attacker sends me a malicious Authorization Response, the client may ...
- 492
1
vote
0
answers
71
views
Why do some "OAuth" providers ask for personal info?
I don't mean to start another OAuth vs OpenID discussion, but I want to share the underlying cause of my confusion.
When I want a Client to process my google docs for something, I have to go through ...
- 131
1
vote
0
answers
98
views
Change of domain without having to log in again
The question concerns the idea of transferring sessions between domains without having to log in again.
I would like to do it like this:
(user is logged in and changes the language to a language from ...
- 11
1
vote
3
answers
652
views
Does OpenID Connect provide CSRF and XSS protection?
I've been reading several articles recently about how storing JWTs in local or session storage is inherently insecure. The mitigation is apparently to implement a "session ID pattern", i.e. ...
2
votes
0
answers
536
views
Keycloak and Open ID Connect best practices
I'm a bit lost as to the best practice surrounding a production-ready access management based on keycloak and open id connect.
My understanding is that if you use Keycloak's provided adapters, instead ...
- 21
0
votes
1
answer
106
views
Benefits of Token Exchange protocol
Beginner question here, I don't seem to be able to wrap my head around the security benefits of the token exchange protocol as specified by RFC8693. To me it seems like a delegation pattern where a ...
- 101
0
votes
1
answer
201
views
OpenID Connect with a chain of Relying Parties
Is there a usage of OpenID Connect (OIDC) that allows for a chain of RP (terminology reference)
user -> RP#1
user <-redirect to chosen OP- RP#1
user -> OP: verifies identity
user <-...
- 129
0
votes
1
answer
276
views
Logout on OIDC Provider Refresh Token validity in comparison to OAuth
I have an Relying Party that has obtained an Access Token and Refresh Token (as well as an ID Token) from an OpenID Provider (not an offline token).
In all cases I have seen, the Refresh Token is ...
- 492
4
votes
1
answer
1k
views
Why is SAML still used for enterprise SSO instead of OIDC?
Im trying to wrap my head around the difference between SAML/OIDC/and OAuth
Is the only reason SAML is the most popular choice for enterprise SSO that its been around much longer? Is it expected to ...
- 155
0
votes
0
answers
97
views
Oauth2: should I increase the refresh token expiring date?
I want my clients to be able to schedule a purchase for a given date. When they perform this scheduling action, they are authenticated with an oauth2 token. However the date could be so far from now ...
- 21
1
vote
2
answers
382
views
Is it safe to pass an OpenID Connect ID token to my back-end API for verification?
I am currently adding single sign-on functionality between my application and an electronic health record (EHR) system. The SSO is done using the OpenID Connect authorization code flow, but unlike a ...
- 111
1
vote
1
answer
224
views
Can I use an ID token as proof of authentication?
I have a reverse proxy, configured as the Relying Party of an OpenID Connect identity provider. Then, it delegates the request processing to another web server, exposed on the internet. In order to ...
- 61
1
vote
1
answer
179
views
OAuth2, SAML, OpenID connect - Which one to use for my scenario?
I work for a company where we give customer (hundreds/thousands of users) access to 2 sites. One owned by a 3rd party SaaS and one owned by us. Customers spend alot of time registering for both sites ...
- 631
1
vote
1
answer
168
views
Is `iss` property in JWT tokens redundant?
I'm reading up on some OpenID Connect documentation trying to get my head around the protocol. I came across the issuer property that is common in the JWT tokens. How come this is required if we ...
- 175
1
vote
0
answers
212
views
Oauth2.0 | How to manage user session in Single Page application running in an iframe?
I'm new to security domain, and recently I have learned about Oauth2.0/OpenID connect and JWT tokens. I have an existing REST based web application where I need to implement security.
Server
...
- 11
1
vote
0
answers
77
views
Do id tokens need to be signed assymetrically?
Access tokens that are passed to the public in an OAuth flow clearly need to be signed using asymmetric encryption (e.g. RSA) so that they cannot be altered by the client to gain access to new scopes, ...
- 11
0
votes
1
answer
243
views
OpenID Connect with user bound roles and M2M access
I'm trying to get my head straight about how to properly design a OpenID connect provider and the roles to use with it. I understand the basic of scopes, claims and the different flow one can use. ...
- 175
1
vote
1
answer
336
views
Can OpenID Connect be used to implement social login?
Using OAuth to implement social login is insecure (https://www.rfc-editor.org/rfc/rfc6819#section-4.4.2.6) because OAuth doesn't provide authentication, only authorisation. The issue arises because ...
- 113
1
vote
1
answer
190
views
how does spotify do oauth(+open id connect) from the desktop app?
I understand what the workflow would be from the webpage, but how does oauth+open id work for desktop apps as they cannot open a browser page within the app. I see that when I click on log in with ...
- 111
-1
votes
2
answers
275
views
What are the security risks with rolling out your own Authorisation server implementation
Even though I'm working within .Net Core, this question is generally applicable to other platforms as well.
My question is to do with: Using a framework (such as IdentityServer) to manage ...
- 111
0
votes
0
answers
91
views
openID connect without resource owner authorization
the use case I have is, there are multiple systems that access each other over the internet, all sharing the same user base. openId connect seems to be the way of identity management. this means every ...
- 151