Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [sso]

Single Sign-On is when a user can use the same set of authentication credentials to access multiple different services.

Filter by
Sorted by
Tagged with
2 votes
0 answers
78 views

Analyzing impact of leaked client_secret in Authorization Code Flow in Keycloak (CVE-2020-27838)

CVE-2020-27838 describes that Keycloak has an open endpoint where it's possible to obtain client_secret information, as shown in the example below: /auth/realms/{realm}/clients-registrations/default/{...
Marcus's user avatar
  • 21
0 votes
0 answers
49 views

OAuth2 System Design for Single Sign-On | Auto-Detect Session?

I'm working on configuring my suite of services (in different domains) so that they can all be accessed via Single Sign-On. I'm using AWS Cognito as a wrapper around a SAML Idp (Azure AD). What I ...
Ryan Pierce Williams's user avatar
2 votes
0 answers
107 views

Entra ID issuing expired ID Tokens

We are integrating our application with SSO using Entra ID App Registrations and configuring OIDC. When our application receives the ID token from Microsoft Entra, the iap and exp values seem invalid. ...
Brian Swanson's user avatar
1 vote
2 answers
114 views

Verify user credentials via SAML (E-Signature)

I have a requirement to extend a quality assurance process in the customers CRM system so that when the user enters some data he or she is prompted to a screen with username and password and the ...
Jakub Zvonek's user avatar
1 vote
0 answers
94 views

What are the risks of SSO and logins in general in relation to privacy?

I recently started using the Brave browser for a little more privacy. However, I still don't understand much about the risks surrounding SSO and cookies. As an example, I am logged in to YouTube.com ...
EchtFettigerKeks's user avatar
1 vote
1 answer
237 views

Oracle Kerberos authentication on Linux host with SSSD

I have Linux servers which are members of AD domain, running SSSD demon. SSSD is "Kerberized" and I also do want use Kerberos for Oracle db authentication. NOTE: this is not purely about ...
ibre5041's user avatar
1 vote
1 answer
133 views

How to delegate SAML2 authentication between Service Providers (SPs)?

We have an existing SP called S1 that authenticates to multiple Idps. We have another service called S2, I want S2 to delegate authentication to S1 then to Idp, then back and notify S2 when ...
Marconi's user avatar
  • 111
0 votes
1 answer
90 views

How to store ClientID and ClientSecret in a K8 Env

I am trying integrate our service with SSO. I have generated the ClientID and ClientSecret. Is it a good security practice to store the ClientID and ClientSecret as a configmap? If not, what are the ...
warrior-oo7's user avatar
1 vote
0 answers
147 views

SSO Using API based login (not through UI redirection)

We have 3 different applications which have the same top level domain. a.example.com b.example.com example.com We have a login mechanism where the user provides a username + password and logs in. ...
gaurav5430's user avatar
0 votes
1 answer
634 views

SAML Authentication Across multiple Service providers

I am in the process of building an integration between 2 service providers (SP). I have setup my own Identity Provider, KeyCloak. What I am trying to achieve is as follows: A user signs into SP1 using ...
dingo's user avatar
  • 101
1 vote
2 answers
122 views

Security/Liability Concerns with Sign-In-Provider Account Merging

Assume my solution offers 5 identity providers that users can choose from Apple Facebook Github Google Microsoft These providers all take user identity very seriously. Is there any legitimate ...
user65023's user avatar
1 vote
0 answers
100 views

SSO and/or JWT: make sure web app's endpoints are protected

Let's say I'm building a web application (let's focus on the backend side) that is B2C. Users should be able to register with my application, using a SSO provider like Google or Facebook. Once they're ...
Rififi's user avatar
  • 157
1 vote
1 answer
242 views

How SSO with OpenID and Azure AD works?

I try to understand how the integration we are using with OpenID works. I have read documents and different websites, but I feel that something escapes me related with SSO - I didn´t find so much ...
Kenzo_Gilead's user avatar
1 vote
0 answers
110 views

Is using the same SSO for dev and prod considered safe?

My company has one SSO provider that we use for our back office apps. We're looking at tightening security for our SaaS offering. We have a fork in the road for implementation - we can either ...
Triple Gilaman's user avatar
0 votes
1 answer
108 views

IdP Personal/Signer Certificates

We are implementing SAML/OIDC-based SSO across our enterprise and wanted to get a feel for best practices when it comes to using Personal/Signer Certificates within our IdP. Historically we've ...
user1913559's user avatar
0 votes
0 answers
67 views

Automatic single sign-on for multiple providers

Our company's customers can use our IdP to sign-in into about a dozen various service providers we make available. All are third parties running their own sites/domains. We periodically get complaints ...
Kevin Denham's user avatar
0 votes
1 answer
271 views

Is is safe to pass an API key in a HMAC hash?

I have 2 websites: a.com and b.com To avoid using SAML for Single-Sign-On and making things complicated, I've taken this approach: a.com is the identity provider. All users will be asked to sign in on ...
Zach's user avatar
  • 3
0 votes
1 answer
131 views

Does splitting auth SSO and MFA parts, between client and service companies have any issues?

My company provides a single SaaS product for corporate clients. For one client we are implementing SSO with them as authentication provider (via Azure AD/SAML for now, but the library we are using is ...
Neil Slater's user avatar
6 votes
2 answers
956 views

Adding SSO to an existing website - should SSO login link to matching email address?

I am adding Single Sign-On (SSO) via Google and Microsoft identity providers to a web application where many thousands of user accounts already have existing credentials stored by username and ...
Jordan Rieger's user avatar
0 votes
1 answer
362 views

How can I have SSO with multiple login forms?

The most known SSO workflows require the Identity provider to provide the login page/form, for example Google's Authentication for its services. An example for that is the: Simple SAML SSO Workflow ...
Dimitrios Desyllas's user avatar
0 votes
1 answer
135 views

Using SSO for a cryptocurrency app

Let us say you have an app where the users will be required to deposit cryptocurrency. Is it safe to let users sign in with third-party authentication? For example "sign in with Google" or &...
YulePale's user avatar
  • 133
0 votes
1 answer
156 views

Does hashing really make this home rolled sso process more secure?

I had configured subdomains on a site to share forms authentication, however decisions were made to change one of websites over to a different domain. So now site A needs to send a user to the site B. ...
BVernon's user avatar
  • 181
35 votes
8 answers
14k views

Why don't some services offer Google/Facebook/Apple/Twitter login

Why don't some services offer Google/Facebook/Apple/Twitter login? Namely Crypto exchanges. I assume they want as many users as possible & this is a great way to get more. Is there some sort of ...
Trevor Wood's user avatar
0 votes
1 answer
147 views

Using SSO, does this count as only one authentication factor?

When using Google SSO, does this count as only one factor of authentication or as many factors as I use for my google account? If it counts as a single factor, would this be "something I have&...
Gamer2015's user avatar
  • 727
1 vote
0 answers
499 views

Implement an SPA with IFrames, but with Single Sign-on

I want to build an SPA with ASP.NET Core (Blazor server side) which some IFrames redirecting to other applications. In this example I have f.e. the SPA, Grafana to show graphs and Node-Red, but there ...
Max R.'s user avatar
  • 141
1 vote
0 answers
213 views

SSO - SAMLResponse security via localhost reply [duplicate]

We're currently in the process of enhancing our Windows .NET desktop application with SAML single sign-on. In order to retrieve the SAMLResponse from the IP we have the redirect/reply URL set to http:/...
nblackburn's user avatar
1 vote
0 answers
532 views

SAML/oauth2/openid-connect login via proxy as another user

I manage a set of service providers (SP1, SP2, SP3, etc), and we currently have this SAML SSO flow working where the SP causes a POST submit to the SAML IDP with an XML SAML request which includes an ...
DavidG's user avatar
  • 111
0 votes
1 answer
1k views

How an IDP sends SAML assertion to an SP?

I'm new to security concepts. I am studying how SAML works and I'm confused about how IDP sends SAML assertion to SP. I searched on the internet and I found out two scenarios are possible. First is ...
Ssaf's user avatar
  • 3
1 vote
1 answer
363 views

SSO SAML2: validating/verifying the SAMLResponse at the ACS

So it's unclear how much more security needs to happen at the ACS point. I can see that the IDP signs a signature that involves a certificate and private key. The SP can verify the signature with the ...
Luka's user avatar
  • 115
0 votes
1 answer
261 views

Are there security issues around controlled cross site sharing behind SSO?

Very simply we have a ton of websites at our company behind SSO. I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get ...
blankip's user avatar
  • 118
2 votes
3 answers
12k views

Cookie set from a server to a client with different domain(via XHR), but not recognized by Client domain

I have three domains but the same code base (Domain X, Domain Y, Domain Z) and Accounts website A If a user tries to sign in accounts from domain X, I wanted to SSO in the other two domains (Browser ...
Kannan M's user avatar
  • 121
2 votes
2 answers
2k views

Is normal that a web site which use OpenID as SSO sends all the cookie without samesite header?

Is normal that a web site which uses OpenID as SSO sends all the cookie without samesite header? Is this required in order to make OpenID work correctly?
Maicake's user avatar
  • 567
1 vote
2 answers
376 views

Verifying the security of SAML SSO

I run an instance of a log aggregation product in the cloud, installed on a VM. I've strictly configured it's networking settings, internal firewall, internal port redirection, strong admin password, ...
eden881's user avatar
  • 237
1 vote
2 answers
2k views

How does encryption, certificates in an end to end SSO flow?

So, I know how public-private key encryption works. I understand how/why certificates are required. I understand how a SSO flow (IdP initiated) works. But, I do not understand how the three of them ...
Saturnian's user avatar
  • 111
1 vote
1 answer
1k views

Why doesn't Keycloak allow user sign-up and sign-in through a client?

I'm in need of an authentication & authorization service that can manage our app's pool of users. I stumbled upon Keycloak and have been checking it for the past few days, but I'm wondering why ...
aIKid's user avatar
  • 113
1 vote
1 answer
460 views

OAuth2, SAML, OpenID connect - Which one to use for my scenario?

I work for a company where we give customer (hundreds/thousands of users) access to 2 sites. One owned by a 3rd party SaaS and one owned by us. Customers spend alot of time registering for both sites ...
Architect 's user avatar
0 votes
1 answer
268 views

App-to-app or service-to-service authentication using federated login

I have an application Foo that exposes a web-based portal as well as a REST API service via HTTPS. When a human user connects to the app Foo to use its web-based portal, the human user is first ...
Lone Learner's user avatar
0 votes
0 answers
108 views

How to verify the genuine user identity using Google signin API?

I'm developing a mobile app. I have a question, and here is the scenario. If a person is logging into the App with google sign in API in a public network. The website will verify the user with his ...
Apple prabha's user avatar
0 votes
0 answers
110 views

Should I put HR system and various business related systems under SSO?

We are building several systems for businesses, like employees schedule management and sharing, customer management and recently we are building HR System. We have put Schedule management and customer/...
user3563059's user avatar
0 votes
0 answers
155 views

Passing JWT Token in SSO

I'm in the midst of exploring the concept of Single Sign On with JWT. I'm planning to build sso.test.com using Laravel Referring to chart above, may I know: Is it safe to POST JWT token (that ...
Mavichow's user avatar
  • 133
1 vote
1 answer
339 views

How do enterprises deal with SSO and Google backing up WiFi credentials?

Single Sign On in a company means that you have one set of credentials for all the services the company uses / provides to their employees. Logically, these credentials might also be usable for Wifi. ...
PhilLab's user avatar
  • 205
2 votes
2 answers
355 views

SSO SP Initiated Single Sign Out - User Experience

I work on a software product that allows customers to use SAML or OAuth provisioning to their users. e.g to Azure AD. Now non technical savvy users understandably presume that logging off from our ...
Cyassin's user avatar
  • 515
1 vote
0 answers
174 views

SSO and browser vs. server

We've got implementations in a browser-based system right now that does both SAML and OpenID-connect login support, but does them differently and was looking for advice on the risks. Our SAML ...
Joe's user avatar
  • 456
1 vote
1 answer
155 views

Securing an API for 3rd party users

I'm having issues finding the right language to search for answers to my problem so hopefully I can explain it here. I am trying to create an API that will be accessed by a 3rd party. This 3rd party ...
Daniel Thiessen's user avatar
2 votes
1 answer
605 views

How does the browser know windows logged in user id or Kerberos TGT?

My organization uses SSO for its applications i.e. Once a user logs into his Windows 10 workstation, he accesses his web application without login. I was informed that the web applications uses NetIQ ...
ZEE's user avatar
  • 167
2 votes
1 answer
322 views

why use a CA-signed key pair to encrypt SAML2 assertions?

I have a customer who insists upon using only certificate-authority signed key-pair certificates for encrypting SAML2 assertions. In this use case, I hold the private key in my Service Provider, and ...
O. Jones's user avatar
  • 379
1 vote
1 answer
431 views

Secure REST API that only works for users authenticated by App with SSO (OAuth?)

I somehow need to accomplish the following: User accesses a application written in JavaScript. Application uses SSO to identify the user who is logged into Windows. Application obtains the access ...
Seth Able's user avatar
0 votes
0 answers
335 views

Understanding JWT and SSO

I'm having trouble understanding how to set up SSO between my app and another app we have deployed. I'm new to trying to set this kind of thing up, so I was hoping someone could explain whether I'm on ...
Dan's user avatar
  • 101
0 votes
2 answers
1k views

SSO Log Users Out Based on IP Address

We would like to implement SAML based SSO for our organization. We do not want employees to be able to access specific accounts outsides of specific hours and IP ranges. (We do not want to setup a VPN ...
user3748242's user avatar
0 votes
1 answer
167 views

Kerberos Authentication : Client authentication only

I am currently implementing a way to authenticate using Kerberos mechanism. Then only explanation have is "SSO using Kerberos". I know technically how works Kerberos (Keytab, SPNEGO, Token, KDC, SPN)...
Walfrat's user avatar
  • 416