Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [single-sign-on]

Single Sign On (SSO) is the process of authenticating once against a single system to gain access to multiple (often unrelated) systems.

1
vote
1answer
18 views

sp initiated saml sso authentication

I am working on SP initiated saml sso and it is completely new to me. I have gone through lots of articles and videos(wikipedia, centrify chalktalk, medium posts) but i am not able to understand some ...
39
votes
2answers
7k views

How do universities and schools securely sync passwords between multiple services?

I'm a student and it seems every school or university I have been to has one password that you set for your user account for logging in to university services, which is also then synced to external ...
2
votes
1answer
46 views

Is providing authentication data for other web applications unsecure?

I started to work on a company whose software engineers tried to reinvent everything. They did not use(or know) industry standarts and for authentication, they use their custom solution. Their "...
1
vote
0answers
80 views

What is the essence of Google Chrome’s new controversial sign-in feature?

What is the essence of Google Chrome’s new controversial sign-in feature? How does it work and how does it differ from what was it before? What is the danger of it? Is Chromium affected?
1
vote
1answer
61 views

How to protect a login page redirect

I have several web based applications that will redirect unauthenticated users to an ADFS sign-in page. ADFS will subsequently redirect users back to a web application once authenticated with a token. ...
0
votes
1answer
51 views

How to setup SAML?

I am learning about SAML and already read many articles and forums but I still having confusion about setup IdP. I am using "https://simplesamlphp.org/" For example, I have 3 websites "example.com", "...
0
votes
1answer
85 views

Risks for implementing single sign on

I'm working with an organization that's integrating a lot of apps with LDAP in a Windows environment. They are doing a good job of implementing least privilege, so there aren't a lot of scenarios ...
1
vote
0answers
36 views

Parent domain cookies for Single Sign on

Typically Single Sign On is implemented with existing protocols like SAML or OAuth. If all the sites belongs to the same parent domain such as a.example.com and b.example.com, we can also set a ...
0
votes
2answers
122 views

Opening browser with already authenticated user in other app

Scenario: I'm logged in some (java - swing) application. The authentication is typical: login and password checked by server (J2EE) on client application start, after that normal work in app including ...
3
votes
1answer
455 views

Is the idea of Single Sign-On (SSO) a flawed concept without Two-Factor Authentication (2FA)?

Before this gets flagged as a duplicate, I'm not asking a question about the disadvantages of single sign-on, I'm asking if the initial concept is flawed to begin with without enforcing two-factor ...
4
votes
2answers
438 views

Examples of Federated Identity Management, Third Party Identity Services and Single Sign-On

I am studying the domain of Identity and Access Management in CISSP, and I come across the three terms Federated Identity Management (FIM), Third Party Identity Services (3PIS) and Single Sign-On (SSO)...
5
votes
2answers
948 views

Is there any security difference between login via iFrame, Pop-up, or redirect?

There seems to be a number of techniques to authenticate a person on the web. Most commonly there are Javascript Pop-ups (Google, Firefox Persona, Disqus, etc) HTTP Redirects (OAuth, Facebook) ...
1
vote
0answers
15 views

Does Thinktecture V2 Require Round Trips on Requests

I am learning about the Thinktecture Identity Server v2 and considering deploying it as a single sign on solution for 3 to 4 apps/services our company is developing for our customers. The applications ...
2
votes
2answers
263 views

Solutions for accessing webapp from inside and outside the corporate perimeter by same users?

I'm looking for solutions that could best address the following requirements. We plan to develop a webapp and deploy it in the cloud. Corporate users must be able to access the webapp from the ...
0
votes
2answers
829 views

Single Sign On vs NT Authentication

I did some Googling on this and I can't seem to find a direct answer. What is the difference between SSO and NT Authentication? Is SSO a type of NT Authentication? Are they related at all? I'm a ...
3
votes
1answer
357 views

Encrypting data and SSO

I provide a service in which users can store data, files, etc in an encrypted form. The service that I have built has two applications for the user's password with which they login to my service: 1) ...
0
votes
0answers
493 views

Single Sign On : Get user name pc before authentication on Identity Provider

Well, I am new in security (SSO, SAML, etc). The scenario We have a Web Application , we want to catch user name (for example windows user) before it has been sent to be authenticated with the ...
2
votes
1answer
249 views

What is the security benefit of using PostMessage instead of a callback URL in OAuth/OIDC?

Of all the issuers I've found, (Facebook, Twitter, Azure AD, etc) only Apple's CloudKit has the feature of "post message" as a callback (unless it's buried in the other's SDK) Here is a screenshot of ...
1
vote
3answers
690 views

Why should the value of the cookie be encrypted?

I am working at a SSO project right now with CAS. I am using an RESTful API for communication with desktop-applications. The value of the Ticket Granting Cookie is encrypted. At first I didn't think ...
1
vote
2answers
411 views

Is MD5 suitable for single sign on?

We are using an application which offers single sign to their systems which is then embedded as an iframe (i.e. the URL is visible in the source of the page) The SSO security comes from using MD5 to ...
1
vote
0answers
178 views

Logout from IdP, where should user end up?

When a user clicks Logoff on my website, it executes the following .NET code: public ActionResult SLOService() { // Receive the single logout request or response. // If a request is received ...
0
votes
1answer
836 views

How to know which secret key to use to create and verify JWT

We have several websites where users have to log in. For each website we want to support a single signon solution based on JWTs (JSON Web token). There are also several (other) websites that can act ...
5
votes
2answers
525 views

Is “sign in with Facebook”, “sign in with Google”, etc. bad for security? [duplicate]

Is "sign in with Facebook", "sign in with Google", etc. bad for security? A hacker only needs to compromise your Facebook/Google/Yahoo/etc. account, and they'll have access to all of your other ...
4
votes
1answer
126 views

How can I be sure if a webview in a desktop app shows the real web page?

When installing Postman (on Mac), you can log on using your Google account. For this, the logon view from Google is shown in a window (A kind of Webview I assume). How can I be sure this is the real ...
3
votes
3answers
588 views

How does Single Sign On limit phishing risk

I was reading this article about SSO benefits and this sentence intrigues me : Can reduce phishing – Phishing, a fraudulent process where victims are tricked into giving away sensitive user ...
0
votes
2answers
305 views

Are third party authentification provider included via iframe by default considered (in)secure?

Authentification provider X is used by many non-related websites like A, B and C as (sole) authentification provider. X therefor provides a framework for athentification which includes a login form ...
1
vote
0answers
137 views

Low-resolution account enumeration with Office365

I am interested in the intersection of account enumeration and single sign-on. Often, there will be SSO-only and non-SSO users alongside each other in an application, and in terms of improved ...
1
vote
0answers
69 views

What is the most secure method for web session handling for multiple domain?

Based on the current standing of web security, what is the most secure / recommended method for web session handling: session cookies, cookie jars, web tokens, or anything else? The requirement is to ...
0
votes
2answers
100 views

Legality of cookie(set by other sites) tracking

I have created a website A which asks username & password, there exists another closed source website B which again asks for login credentials. A user uses both these websites .I want to ...
4
votes
0answers
91 views

What are appropriate measures to only allow logins from a given trusted OpenID-Provider?

I have a bunch of applications, where users need to log in. Not everyone can be a user, each user has to be approved of by an admin. The authentication should be a SSO solution, where user accounts ...
0
votes
3answers
2k views

Does it have sense a One-Time Session Cookie?

Recently I have faced a site that seems to implement something that we can call "one-time cookie". This cookie is used for single-sign on among different sites. In each request the server sends a Set-...
75
votes
6answers
95k views

What is the difference between Federated Login and Single Sign On?

What is the difference between Federated Login and Single Sign On authentication methods?