Questions tagged [single-sign-on]
Single Sign On (SSO) is the process of authenticating once against a single system to gain access to multiple (often unrelated) systems.
50
questions
1
vote
0
answers
24
views
Pre-Hijacking Mitigation
I want to create a website with password login and social login (e.g. Google only.)
For password login, first I will send a verification email.
I want to prevent pre-hijacking.
For those who do not ...
- 11
2
votes
2
answers
73
views
How can a users plaintext password be acquired while using biometricID with the following security model?
This is a slightly tough one to explain with my current experience, lacking mainstream terminology. But here goes.
I have an encryption/security model whereby I do not store users plaintext passwords. ...
- 249
0
votes
0
answers
89
views
OpenID Connect for authenticating a web-api
I want to accomplish the following:
Having a web application or mobile app authenticating users using openid connect.
Having a REST Api authenticated using openid connect using the same user as for ...
0
votes
0
answers
16
views
Shared credentials logins between separate websites and trust issues
Brand A has multiple, separate websites - these websites reference each other as part of the brand family, but do not have a shared single sign on system.
Instead, each website has their own login and ...
- 542
1
vote
1
answer
75
views
Is single-sign-on making phishing attacks easier?
I am not questioning the security of the technical implementations of SSO, but the training of users to follow a potentially insecure access pattern.
Background
If you for example roll out SSO (single-...
- 111
2
votes
0
answers
205
views
Multiple Keycloak instances versus one instance with many realms?
I plan to use Keycloak to authenticate / authorize various users and services across the organization.
These include:
Service-to-service
End-users connecting from public internet
Intranet users ...
- 158
0
votes
0
answers
11
views
Site-specific account vs "single sign-on" for personal accounts?
The title of this question is a bit hard to word concisely, partially due to my own lack of terminology. What I am trying to ask is, when signing up for a service in a personal capacity (say Airbnb) ...
- 101
1
vote
1
answer
164
views
Is it possible to use cookie-based single sign-on authentication scheme if sites do not share a common DNS parent domain?
According to the "Single sign-on" page on Wikipedia:
A simple version of single sign-on can be achieved over IP networks using cookies but only if the sites share a common DNS parent domain....
- 361
1
vote
0
answers
93
views
How can I authorize access to a resource without knowing who I've authorized?
I have a database-backed web application, with authentication via
organizational single sign-on, modeling a library lending system for
digital books. I'd like to allow users to check out books and see ...
- 111
0
votes
0
answers
71
views
Multiple user specific APIs with a single Authentication Server
I’m currently in need of some clarification for an authentication/overall strategy. First I will describe the use case and then the questions that arise for me.
Use Case
I want to have a single docker ...
- 1
1
vote
0
answers
290
views
Implement an SPA with IFrames, but with Single Sign-on
I want to build an SPA with ASP.NET Core (Blazor server side) which some IFrames redirecting to other applications. In this example I have f.e. the SPA, Grafana to show graphs and Node-Red, but there ...
- 141
1
vote
1
answer
175
views
SSO SAML2: validating/verifying the SAMLResponse at the ACS
So it's unclear how much more security needs to happen at the ACS point.
I can see that the IDP signs a signature that involves a certificate and private key.
The SP can verify the signature with the ...
- 115
1
vote
2
answers
592
views
Is it safe to pass an OpenID Connect ID token to my back-end API for verification?
I am currently adding single sign-on functionality between my application and an electronic health record (EHR) system. The SSO is done using the OpenID Connect authorization code flow, but unlike a ...
- 111
6
votes
3
answers
14k
views
Should I disable TLS 1.0 and TLS 1.1 support on my web servers
Currently, my webserver support
TLS 1.0
TLS 1.1
TLS 1.2
One of your single sign-on clients will move to TLS 1.2 on 1st April 2020. Can I remove TLS 1.0 and TLS 1.1 now? Or I need to wait till ...
- 61
2
votes
1
answer
366
views
How does the browser know windows logged in user id or Kerberos TGT?
My organization uses SSO for its applications i.e. Once a user logs into his Windows 10 workstation, he accesses his web application without login. I was informed that the web applications uses NetIQ ...
- 157
0
votes
2
answers
143
views
What are some reasons a company should not go with single sign on?
A company I am working for is advocating for single sign on for their Ecommerce site and an Online clinical testing platform that contain sensitive patient information.
My concern is the sensitive ...
- 11
1
vote
2
answers
823
views
Passing Data between Mobile / Web Apps
We have a third party mobile app that will link to a dashboard in our web app. The user id needs to be passed from the mobile app to the web app in this interaction so that we can retrieve the user's ...
- 11
1
vote
0
answers
124
views
How to reflash/reformat enterprise Aladdin eToken Pro Java 72k for own certificate? [closed]
Is this eToken can be reformatted or re-flashed for using as smart-card for authentication?
I have this stick left from my former work and wanna re-use it some way, for example, for authentication in ...
- 282
1
vote
0
answers
123
views
Is there any advantage in using Google's IAM on Android?
We are building a few corporate apps for field workers / front office. In most cases each user will have their own device, but there are some shared devices (for example reception). The devices are ...
- 73
5
votes
1
answer
153
views
Poor Man's OAuth Grant - Review
A 3rd party company has requested that we implement single sign-on with them using the below approach. I'm familiar with OAuth grants and OIDC flows but this seems rather odd to me.
The user has ...
- 151
39
votes
2
answers
7k
views
How do universities and schools securely sync passwords between multiple services?
I'm a student and it seems every school or university I have been to has one password that you set for your user account for logging in to university services, which is also then synced to external ...
- 501
2
votes
1
answer
97
views
Is providing authentication data for other web applications unsecure?
I started to work on a company whose software engineers tried to reinvent everything. They did not use(or know) industry standarts and for authentication, they use their custom solution. Their "...
- 849
1
vote
0
answers
139
views
What is the essence of Google Chrome’s new controversial sign-in feature?
What is the essence of Google Chrome’s new controversial sign-in feature?
How does it work and how does it differ from what was it before?
What is the danger of it?
Is Chromium affected?
- 225
1
vote
1
answer
279
views
How to protect a login page redirect
I have several web based applications that will redirect unauthenticated users to an ADFS sign-in page. ADFS will subsequently redirect users back to a web application once authenticated with a token.
...
- 153
1
vote
1
answer
373
views
How to setup SAML?
I am learning about SAML and already read many articles and forums but I still having confusion about setup IdP.
I am using "https://simplesamlphp.org/"
For example, I have 3 websites "example.com", "...
- 111
0
votes
1
answer
161
views
Risks for implementing single sign on
I'm working with an organization that's integrating a lot of apps with LDAP in a Windows environment. They are doing a good job of implementing least privilege, so there aren't a lot of scenarios ...
1
vote
0
answers
169
views
Parent domain cookies for Single Sign on
Typically Single Sign On is implemented with existing protocols like SAML or OAuth. If all the sites belongs to the same parent domain such as a.example.com and b.example.com, we can also set a ...
- 125
0
votes
1
answer
1k
views
Opening browser with already authenticated user in other app
Scenario: I'm logged in some (java - swing) application. The authentication is typical: login and password checked by server (J2EE) on client application start, after that normal work in app including ...
- 11
5
votes
1
answer
1k
views
Is the idea of Single Sign-On (SSO) a flawed concept without Two-Factor Authentication (2FA)?
Before this gets flagged as a duplicate, I'm not asking a question about the disadvantages of single sign-on, I'm asking if the initial concept is flawed to begin with without enforcing two-factor ...
- 223
4
votes
2
answers
2k
views
Examples of Federated Identity Management, Third Party Identity Services and Single Sign-On
I am studying the domain of Identity and Access Management in CISSP, and I come across the three terms Federated Identity Management (FIM), Third Party Identity Services (3PIS) and Single Sign-On (SSO)...
- 51
6
votes
2
answers
4k
views
Is there any security difference between login via iFrame, Pop-up, or redirect?
There seems to be a number of techniques to authenticate a person on the web. Most commonly there are
Javascript Pop-ups (Google, Firefox Persona, Disqus, etc)
HTTP Redirects (OAuth, Facebook)
...
- 50.4k
1
vote
0
answers
58
views
Does Thinktecture V2 Require Round Trips on Requests
I am learning about the Thinktecture Identity Server v2 and considering deploying it as a single sign on solution for 3 to 4 apps/services our company is developing for our customers. The applications ...
- 153
2
votes
2
answers
387
views
Solutions for accessing webapp from inside and outside the corporate perimeter by same users?
I'm looking for solutions that could best address the following requirements.
We plan to develop a webapp and deploy it in the cloud.
Corporate users must be able to access the webapp from the ...
- 21
0
votes
2
answers
3k
views
Single Sign On vs NT Authentication
I did some Googling on this and I can't seem to find a direct answer.
What is the difference between SSO and NT Authentication?
Is SSO a type of NT Authentication? Are they related at all?
I'm a ...
- 201
4
votes
2
answers
1k
views
Encrypting data and SSO
I provide a service in which users can store data, files, etc in an encrypted form.
The service that I have built has two applications for the user's password with which they login to my service: 1) ...
- 63
2
votes
1
answer
1k
views
What is the security benefit of using PostMessage instead of a callback URL in OAuth/OIDC?
Of all the issuers I've found, (Facebook, Twitter, Azure AD, etc) only Apple's CloudKit has the feature of "post message" as a callback (unless it's buried in the other's SDK)
Here is a screenshot of ...
- 50.4k
1
vote
3
answers
1k
views
Why should the value of the cookie be encrypted?
I am working at a SSO project right now with CAS. I am using an RESTful API for communication with desktop-applications. The value of the Ticket Granting Cookie is encrypted. At first I didn't think ...
- 133
1
vote
2
answers
736
views
Is MD5 suitable for single sign on?
We are using an application which offers single sign to their systems which is then embedded as an iframe (i.e. the URL is visible in the source of the page)
The SSO security comes from using MD5 to ...
- 173
1
vote
0
answers
294
views
Logout from IdP, where should user end up?
When a user clicks Logoff on my website, it executes the following .NET code:
public ActionResult SLOService()
{
// Receive the single logout request or response.
// If a request is received ...
- 111
2
votes
1
answer
1k
views
How to know which secret key to use to create and verify JWT
We have several websites where users have to log in. For each website we want to support a single signon solution based on JWTs (JSON Web token).
There are also several (other) websites that can act ...
- 3,599
5
votes
2
answers
1k
views
Is "sign in with Facebook", "sign in with Google", etc. bad for security? [duplicate]
Is "sign in with Facebook", "sign in with Google", etc. bad for security? A hacker only needs to compromise your Facebook/Google/Yahoo/etc. account, and they'll have access to all of your other ...
- 152
4
votes
1
answer
218
views
How can I be sure if a webview in a desktop app shows the real web page?
When installing Postman (on Mac), you can log on using your Google account. For this, the logon view from Google is shown in a window (A kind of Webview I assume).
How can I be sure this is the real ...
- 549
4
votes
3
answers
1k
views
How does Single Sign On limit phishing risk
I was reading this article about SSO benefits and this sentence intrigues me :
Can reduce phishing – Phishing, a fraudulent process where victims are tricked into giving away sensitive user ...
- 1,724
1
vote
2
answers
745
views
Are third party authentification provider included via iframe by default considered (in)secure?
Authentification provider X is used by many non-related websites like A, B and C as (sole) authentification provider. X therefor provides a framework for athentification which includes a login form ...
- 2,998
2
votes
0
answers
262
views
Low-resolution account enumeration with Office365
I am interested in the intersection of account enumeration and single sign-on. Often, there will be SSO-only and non-SSO users alongside each other in an application, and in terms of improved ...
- 151
1
vote
0
answers
107
views
What is the most secure method for web session handling for multiple domain?
Based on the current standing of web security, what is the most secure / recommended method for web session handling: session cookies, cookie jars, web tokens, or anything else?
The requirement is to ...
- 133
0
votes
2
answers
140
views
Legality of cookie(set by other sites) tracking
I have created a website A which asks username & password, there exists another closed source website B which again asks for login credentials.
A user uses both these websites .I want to ...
4
votes
0
answers
131
views
What are appropriate measures to only allow logins from a given trusted OpenID-Provider?
I have a bunch of applications, where users need to log in. Not everyone can be a user, each user has to be approved of by an admin. The authentication should be a SSO solution, where user accounts ...
- 191
1
vote
3
answers
3k
views
Does it have sense a One-Time Session Cookie?
Recently I have faced a site that seems to implement something that we can call "one-time cookie". This cookie is used for single-sign on among different sites.
In each request the server sends a Set-...
- 2,759
110
votes
7
answers
129k
views
What is the difference between Federated Login and Single Sign On?
What is the difference between Federated Login and Single Sign On authentication methods?
- 1,203