Questions tagged [sso]
Single Sign-On is when a user can use the same set of authentication credentials to access multiple different services.
1
vote
1answer
16 views
sp initiated saml sso authentication
I am working on SP initiated saml sso and it is completely new to me. I have gone through lots of articles and videos(wikipedia, centrify chalktalk, medium posts) but i am not able to understand some ...
3
votes
0answers
30 views
SAML - when creating new users, how do I get essential fields?
My company runs a saas product; as we move into enterprise customers, we're getting more and more requests for SSO.
I understand the SAML workflow for authentication, and roughly how we'd implement ...
2
votes
1answer
155 views
Using third party authentication like google/facebook to login to a site, is there any security risk when the site is hacked?
Sites like stackoverflow, quora, and many more offers sign in from Google/Facebook. In the event that there is a data breach or the site is hacked, is there any security risk to your Google/Facebook ...
0
votes
1answer
54 views
Where to save the token information?
I'm currently working on an end user Windows 10 application using the Microsoft UWP platform. Within this application the end user will be able to authenticate themselves using an oauth2 SSO service.
...
1
vote
1answer
35 views
Is signature validation mandatory if encrypted assertions are sent over HTTPs in SAML 2.0?
We are using SAML Web Browser SSO Profile (SAML 2.0)
We have a SP using SAML2.0. All communication between IdP and SP is over HTTPs.
If AuthnResponse from IdP is sent over HTTPs, is it mandatory for ...
1
vote
0answers
18 views
Passing token/session values from one application to its sub application
My client currently has an existing ASP.NET web portal, which runs fine. It's hosted on their on-premise IIS Server. I will call this one the "parent application".
Now I'm working on another web ...
0
votes
1answer
51 views
How to setup SAML?
I am learning about SAML and already read many articles and forums but I still having confusion about setup IdP.
I am using "https://simplesamlphp.org/"
For example, I have 3 websites "example.com", "...
0
votes
1answer
180 views
How could this SSO implementation possibly work without browser cookies?
Our corporate Windows 7 desktop setup is now using SSO with our Confluence instance (browser-based wiki-type website) but the strangest thing is that even after logging out AND clearing the browser ...
0
votes
0answers
28 views
Can klist be used to detect expiry dates for forged kerberos tickets?
I have observed that klist is used to list locally cached kerberos tickets. For golden tickets with indefinite expiry dates (say ~10 years), is it possible to list all the tickets submitted to a ...
5
votes
1answer
290 views
Is it secure to use CORS to implement SSO?
I implement SSO to integrate some web login mechanism to the centralized member system which is OAuth2 provider.
And currently OAuth2 authorization works well.
However, I would like to implement much ...
0
votes
0answers
25 views
Mobile apps AUTH flow
When the user enters username and password into an mobile app( iOS ,Android or windows app)it calls a thirds party oAuth login web service which responds back with oAuth access token and refresh token....
0
votes
0answers
43 views
How to do authentication of SaaS implementation for uploading, processing, and retrieving documents
We would like to provide a B2B SaaS with the following flow:
Our customer's end-users upload their document using our custom
upload UI which should be embedded using an iframe
Once the user finishes ...
0
votes
0answers
104 views
What are the risks with logging in with Google or FB auth to third party sites? [duplicate]
You can now log in via FB or Google to sites like this one. That's because, presumably, once you've been authenticated from either, you can be trusted to manage information of a less-confidential ...
0
votes
0answers
99 views
Ouath2 SSO with SPA using proxy
I have a single page application (client side) that interacts with a set of backend rest APIs - microservices architecture, to achieve SSO, I used the Oauth2 protocol (Spring implementation).
Now, to ...
0
votes
1answer
1k views
OpenID Connect: How to maintain a single sign-on experience between multiple web clients of the same umbrella application?
I'm considering how to take a fairly complex tiered application with multiple web apps that delegate back to the same application server, and migrate it to use OIDC authentication with auth code flow. ...
2
votes
3answers
837 views
Best practice for connecting publicly available server to internal LDAP/Active Directory?
We have a public website. The site also contains the intranet (although none of the data on the intranet pages are terribly secret). Users have to login to the website using their Active Directory ...
4
votes
1answer
2k views
How to implement cross-domain, auto-login SSO without browser redirects for unlogged users?
I need to implement an SSO solution with the following requirements:
Cross-domain: Let's assume I have a.com, b.com and sso.com. If I become logged in through a.com, I shouldn't need to login when I ...
1
vote
2answers
606 views
Where are passwords stored in SAML? On the IdP or on the SP side?
I understand the basic flow of SAML but is still unclear to me where the passwords are stored.
This image shows "APP VERIFIES SAML RESPONSE & LOGS USER IN" from onelogin looks like the password ...
3
votes
1answer
94 views
Is there a way to tell if an Android app really uses SSO(Single Sign On)?
In the last few years, SSO protocols like OAuth and SAML are becoming increasingly used to enable 3rd parties access some user's resources from some service without the need for user to provide ...
2
votes
1answer
274 views
Do we need to maintain Authentication and Authorization Logic separately? [closed]
We are using Keycloak Identity server which will take care of Authentication and Authorization for our new Multi Level Marketing Website.
There was a discussion going on within our team to maintain ...
0
votes
2answers
263 views
Would it be possible to store Kerberos tickets on a YubiKey?
Kerberos supports different ways (ccache types) of storing tickets, such as:
FILE
MEMORY
KEYRING
I was wondering whether it would technically be possible to also store the Ticket-granting-ticket and ...
1
vote
0answers
1k views
Exception: krb_error 0 Do not have keys of types listed in default_tkt_enctypes
I am looking for your help with one Exception we are getting while setting up our Kerberos SSO. I will briefly give an overview of our setup and things we tried till now and exception we are getting:
...
-1
votes
1answer
128 views
Reasons to limit password length [duplicate]
We are currently using a third party software for SSO Login in a hybrid landscape with SAP, ADFS, etc.
The users have to change their password in the client software, which is then sent to a central ...
1
vote
0answers
405 views
SSO - Client Certificate vs SAML
For me SSO is sign on where one need not type the password explicitly.
I see one of the possible way to achieve it is by using Certificates loaded in browser.
SAML/OAuth delegates the job of ...
1
vote
1answer
177 views
Any practical Single Sign-On (SSO) protocol/traffic analysis tool/method/analyzer? [closed]
I want to analyze the SSO protocol/traffic that is deployed in real environment, such as commercial website. The challenge is that most of them are black-box.
Scenario 1. I read several papers about ...
0
votes
1answer
177 views
Storing SAML Idp certificates in APP_Data folder
We provided a SAML2 Service Provider to our client, so they can use that to configure their Identity Provider to our Service Provider.
My questions is about our client certificate, I'm worried that ...
0
votes
1answer
91 views
Is it possible to analyze real Single Sign-On (SSO) messages via network sniffing?
I am thinking how to gain and analyze the information in the real SSO (request/response) messages, for some commercial SSO solutions.
The challenge is that most commercial SSO solutions are black-box ...
1
vote
1answer
129 views
SSO: Who is the idp (identity provider) for Google Apps?
If I am a user for different Google Apps. Google Apps (gmail, google calender, games logging in using Google email account, etc.) are different service providers. Who will be the identity provider (...
1
vote
1answer
107 views
Is JSON web token further secured in OpenID, and how?
I have read the details of pure JSON web token (JWT), and found that it is signed (e.g. by SHA256) but not encrypted. Hence, attack can read the sensitive information by decoding the header and ...
0
votes
1answer
39 views
Claims based authentication to log on to a device
Are there operating systems that allow logging on to the device (laptop, tablet etc.) using claims based authentication?
3
votes
1answer
357 views
Encrypting data and SSO
I provide a service in which users can store data, files, etc in an encrypted form.
The service that I have built has two applications for the user's password with which they login to my service: 1) ...
1
vote
0answers
42 views
Objectively speaking, what is the expected standard to prepare for an interview as network admin? [closed]
I have an interview middle of next month for a position as network admin.
As I understand things, clients are running Windows but some servers may be running Linux.
What is the expected standard in ...
1
vote
1answer
126 views
Is SSO/OAuth inherently broken?
The way I understand it, the whole concept of OAuth/SSO involves allowing a user the ability to have a central password they can use on a multitude of sites without compromising it because really they'...
1
vote
1answer
65 views
SSO Understainding Credentials and Authentication [closed]
I would like to create a SSO where my users can login to machines and wordpress (php) websites.
So far I have LDAP with Kerberos working. I can login with the same credentials to every service, ...
5
votes
1answer
4k views
Self-signed certificate for a IdP-initiated SAML SSO
We act as a Service Provider in a SAML SSO integration with our customers. During the dev and stage testing, we usually exchange metadata files and SSO endpoints.
When forming our metadata we use the ...
2
votes
1answer
231 views
Why do we need IdP when directory services already authenticate and authorize users?
Why do we need Identity Providers when enabling SSO? Why can't directory services do it itself when they already have users identity and can verify it (I'm thinking here about MS AD and the need of AD ...
4
votes
1answer
239 views
Can password based SSO be trivially compromised?
Many cloud SSO providers now offer "password based SSO" (e.g. https://docs.microsoft.com/en-us/azure/active-directory/active-directory-appssoaccess-whatis ), where, even if the SaaS you want to log in ...
0
votes
1answer
35 views
SSO DNS SRV lookup
I'm pen testing the page (IdpInitiatedSignOn.aspx) of a web app which uses an SSO mechanism (Active Directoy Federated Services). The username field requires a domain (e.g. company) to preface the ...
2
votes
3answers
2k views
HTTPS and encrypted cookie for session
Currently I am developing an SSO system with CAS. CAS uses an ticket granting ticket (TGT) that can be seen as the SSO-session. CAS by default will encrypt the TGT. And by default you also have HTTPS ...
1
vote
2answers
411 views
Is MD5 suitable for single sign on?
We are using an application which offers single sign to their systems which is then embedded as an iframe (i.e. the URL is visible in the source of the page)
The SSO security comes from using MD5 to ...
1
vote
1answer
278 views
ADFS with multiple IDP stops doing the SSO [closed]
I'm facing an issue when we enable a second IDP (add Claims Provider Trust), then we are not able to navigate between apps without stopping in the HRD (Home Realm Discovery) page.
Is there a way to ...
0
votes
0answers
151 views
JWT Token SSO - Is this method permissible?
I have a doubt about the authentication method we follow. Don't think this has anything to do with OAuth at this time.
Browser hits a URL which shows a login page.
After the user logs in the browser ...
1
vote
1answer
1k views
Is SSO without SSL possible and/or secure?
Lets imagine a site where HTTPS is not used, for any good or bad reasons. The admin of this site still need a way to secure connections and think about using unique authentication with social networks ...
0
votes
1answer
30 views
Client app auto-updating passwords, no SSO [closed]
My customer has an ActiveDirectory server and a work server, both without SSO. Employees use their ActiveDirectory account to connect to the work server.
They change passwords every month.
My app ...
0
votes
1answer
647 views
2FA using Kerberos and SSO within CDE
I was wondering if anyone is using Kerberos for their 2FA solution into their CDE for PCI DSS compliance. Also what does PCI DSS say about SSO once 2FA has occured through Raduis Server.
Thanks for ...
1
vote
2answers
792 views
Is it safe to allow HTTP for SAML 2.0 Issuer URL?
I've implemented SAML 2.0 using the ruby-saml gem in my Rails app. In this app, clients can specify their SAML idp for their account. I have a client who insists that requiring HTTPS for the Issuer ...
1
vote
1answer
37 views
Instant signin links for users from trusted third party sites
I'm owning web app "A" and want to work with a third party service "X". User "Alice" has accounts on both platforms. App A knows the user ID of alice on X, but X doesn't care about Alice being on A or ...
35
votes
5answers
12k views
Why do I need Kerberos when I could just use a username and password to access services?
I have read that Kerberos is used for authenticating users who wish to access services on various servers in an enterprise network, but I still do not understand the purpose of Kerberos. Why doesn't ...
6
votes
4answers
936 views
Authentication Middleware
We run a large distributed system consisting of a number (>10) of Django-based web services and web applications with a consumer base of about 10000 university students. Currently, we use a single ...
4
votes
1answer
2k views
Azure AD B2C vs Auth0 [closed]
I am trying to work on security architecture for our SaaS application.
The good finding was Azure AD B2C which is launched recently. And first comparison was with Auth0.
Is this is correct comparison?...
