Questions tagged [sso]

Single Sign-On is when a user can use the same set of authentication credentials to access multiple different services.

Filter by
Sorted by
Tagged with
0 votes
0 answers
15 views

How does the SAML based SSO differ for Internal (employees) and External users (external resources)?

We are trying to set up(I am not part of the setting up process) an SSO based login for an ITSM application. Our organisation has some users working for us although they use their own organisation ...
user avatar
  • 101
0 votes
1 answer
58 views

Does splitting auth SSO and MFA parts, between client and service companies have any issues?

My company provides a single SaaS product for corporate clients. For one client we are implementing SSO with them as authentication provider (via Azure AD/SAML for now, but the library we are using is ...
user avatar
3 votes
1 answer
122 views

Adding SSO to an existing website - should SSO login link to matching email address?

I am adding Single Sign-On (SSO) via Google and Microsoft identity providers to a web application where many thousands of user accounts already have existing credentials stored by username and ...
user avatar
0 votes
0 answers
15 views

Instead of 301 redirecting can I generate unique login endpoint in order to utilize an Http POST request during SAML Auth?

Whilst I was looking for an SAML authentication workflows I stumbled upon this link. But instead of 301 redirect (or any kind of http redirect), I thought that once the app finds out that SAML ...
user avatar
0 votes
1 answer
35 views

How can I have SSO with multiple login forms?

The most known SSO workflows require the Identity provider to provide the login page/form, for example Google's Authentication for its services. An example for that is the: Simple SAML SSO Workflow ...
user avatar
0 votes
0 answers
27 views

Authenticate via SAML without establishing SSO session

My SaaS application offers enterprise customers the option to use SAML to authenticate their user population against their own Identity Provider. This normally works fine, however I am looking for ...
user avatar
0 votes
1 answer
84 views

Using SSO for a cryptocurrency app

Let us say you have an app where the users will be required to deposit cryptocurrency. Is it safe to let users sign in with third-party authentication? For example "sign in with Google" or &...
user avatar
  • 133
0 votes
0 answers
62 views

New rule on verifying domain for azureAD app registration

ref: https://docs.microsoft.com/en-us/azure/active-directory/develop/reference-breaking-changes#appid-uri-in-single-tenant-applications-will-require-use-of-default-scheme-or-verified-domains We setup ...
user avatar
0 votes
1 answer
113 views

Does hashing really make this home rolled sso process more secure?

I had configured subdomains on a site to share forms authentication, however decisions were made to change one of websites over to a different domain. So now site A needs to send a user to the site B. ...
user avatar
  • 181
35 votes
8 answers
13k views

Why don't some services offer Google/Facebook/Apple/Twitter login

Why don't some services offer Google/Facebook/Apple/Twitter login? Namely Crypto exchanges. I assume they want as many users as possible & this is a great way to get more. Is there some sort of ...
user avatar
0 votes
1 answer
109 views

Using SSO, does this count as only one authentication factor?

When using Google SSO, does this count as only one factor of authentication or as many factors as I use for my google account? If it counts as a single factor, would this be "something I have&...
user avatar
  • 695
0 votes
0 answers
82 views

Are there specific reasons why ADFS certificates are generated for 2 years?

Azure Active Directory generates certificates for federated SSO that have a lifespan of 3 years. in the case of an on premises AD, this is two years by default, and can be changed. Are there any ...
user avatar
  • 8,913
1 vote
0 answers
170 views

Implement an SPA with IFrames, but with Single Sign-on

I want to build an SPA with ASP.NET Core (Blazor server side) which some IFrames redirecting to other applications. In this example I have f.e. the SPA, Grafana to show graphs and Node-Red, but there ...
user avatar
  • 141
1 vote
0 answers
60 views

SSO - SAMLResponse security via localhost reply [duplicate]

We're currently in the process of enhancing our Windows .NET desktop application with SAML single sign-on. In order to retrieve the SAMLResponse from the IP we have the redirect/reply URL set to http:/...
user avatar
1 vote
0 answers
291 views

SAML/oauth2/openid-connect login via proxy as another user

I manage a set of service providers (SP1, SP2, SP3, etc), and we currently have this SAML SSO flow working where the SP causes a POST submit to the SAML IDP with an XML SAML request which includes an ...
user avatar
  • 111
0 votes
1 answer
197 views

How an IDP sends SAML assertion to an SP?

I'm new to security concepts. I am studying how SAML works and I'm confused about how IDP sends SAML assertion to SP. I searched on the internet and I found out two scenarios are possible. First is ...
user avatar
1 vote
1 answer
138 views

SSO SAML2: validating/verifying the SAMLResponse at the ACS

So it's unclear how much more security needs to happen at the ACS point. I can see that the IDP signs a signature that involves a certificate and private key. The SP can verify the signature with the ...
user avatar
  • 115
0 votes
1 answer
170 views

Are there security issues around controlled cross site sharing behind SSO?

Very simply we have a ton of websites at our company behind SSO. I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get ...
user avatar
  • 108
1 vote
3 answers
3k views

Cookie set from a server to a client with different domain(via XHR), but not recognized by Client domain

I have three domains but the same code base (Domain X, Domain Y, Domain Z) and Accounts website A If a user tries to sign in accounts from domain X, I wanted to SSO in the other two domains (Browser ...
user avatar
  • 111
2 votes
2 answers
725 views

Is normal that a web site which use OpenID as SSO sends all the cookie without samesite header?

Is normal that a web site which uses OpenID as SSO sends all the cookie without samesite header? Is this required in order to make OpenID work correctly?
user avatar
  • 477
1 vote
1 answer
111 views

Verifying the security of SAML SSO

I run an instance of a log aggregation product in the cloud, installed on a VM. I've strictly configured it's networking settings, internal firewall, internal port redirection, strong admin password, ...
user avatar
  • 237
1 vote
2 answers
650 views

How does encryption, certificates in an end to end SSO flow?

So, I know how public-private key encryption works. I understand how/why certificates are required. I understand how a SSO flow (IdP initiated) works. But, I do not understand how the three of them ...
user avatar
  • 111
1 vote
1 answer
309 views

Why doesn't Keycloak allow user sign-up and sign-in through a client?

I'm in need of an authentication & authorization service that can manage our app's pool of users. I stumbled upon Keycloak and have been checking it for the past few days, but I'm wondering why ...
user avatar
  • 113
1 vote
1 answer
166 views

OAuth2, SAML, OpenID connect - Which one to use for my scenario?

I work for a company where we give customer (hundreds/thousands of users) access to 2 sites. One owned by a 3rd party SaaS and one owned by us. Customers spend alot of time registering for both sites ...
user avatar
0 votes
1 answer
187 views

App-to-app or service-to-service authentication using federated login

I have an application Foo that exposes a web-based portal as well as a REST API service via HTTPS. When a human user connects to the app Foo to use its web-based portal, the human user is first ...
user avatar
0 votes
0 answers
76 views

How to verify the genuine user identity using Google signin API?

I'm developing a mobile app. I have a question, and here is the scenario. If a person is logging into the App with google sign in API in a public network. The website will verify the user with his ...
user avatar
0 votes
0 answers
72 views

Should I put HR system and various business related systems under SSO?

We are building several systems for businesses, like employees schedule management and sharing, customer management and recently we are building HR System. We have put Schedule management and customer/...
user avatar
0 votes
0 answers
96 views

Passing JWT Token in SSO

I'm in the midst of exploring the concept of Single Sign On with JWT. I'm planning to build sso.test.com using Laravel Referring to chart above, may I know: Is it safe to POST JWT token (that ...
user avatar
  • 133
1 vote
1 answer
253 views

How do enterprises deal with SSO and Google backing up WiFi credentials?

Single Sign On in a company means that you have one set of credentials for all the services the company uses / provides to their employees. Logically, these credentials might also be usable for Wifi. ...
user avatar
  • 205
2 votes
2 answers
210 views

SSO SP Initiated Single Sign Out - User Experience

I work on a software product that allows customers to use SAML or OAuth provisioning to their users. e.g to Azure AD. Now non technical savvy users understandably presume that logging off from our ...
user avatar
  • 493
1 vote
0 answers
99 views

SSO and browser vs. server

We've got implementations in a browser-based system right now that does both SAML and OpenID-connect login support, but does them differently and was looking for advice on the risks. Our SAML ...
user avatar
  • 426
1 vote
1 answer
119 views

Securing an API for 3rd party users

I'm having issues finding the right language to search for answers to my problem so hopefully I can explain it here. I am trying to create an API that will be accessed by a 3rd party. This 3rd party ...
user avatar
2 votes
1 answer
312 views

How does the browser know windows logged in user id or Kerberos TGT?

My organization uses SSO for its applications i.e. Once a user logs into his Windows 10 workstation, he accesses his web application without login. I was informed that the web applications uses NetIQ ...
user avatar
  • 157
2 votes
1 answer
119 views

why use a CA-signed key pair to encrypt SAML2 assertions?

I have a customer who insists upon using only certificate-authority signed key-pair certificates for encrypting SAML2 assertions. In this use case, I hold the private key in my Service Provider, and ...
user avatar
  • 369
1 vote
1 answer
297 views

Secure REST API that only works for users authenticated by App with SSO (OAuth?)

I somehow need to accomplish the following: User accesses a application written in JavaScript. Application uses SSO to identify the user who is logged into Windows. Application obtains the access ...
user avatar
0 votes
0 answers
258 views

Understanding JWT and SSO

I'm having trouble understanding how to set up SSO between my app and another app we have deployed. I'm new to trying to set this kind of thing up, so I was hoping someone could explain whether I'm on ...
user avatar
  • 101
0 votes
2 answers
457 views

SSO Log Users Out Based on IP Address

We would like to implement SAML based SSO for our organization. We do not want employees to be able to access specific accounts outsides of specific hours and IP ranges. (We do not want to setup a VPN ...
user avatar
0 votes
1 answer
125 views

Kerberos Authentication : Client authentication only

I am currently implementing a way to authenticate using Kerberos mechanism. Then only explanation have is "SSO using Kerberos". I know technically how works Kerberos (Keytab, SPNEGO, Token, KDC, SPN)...
user avatar
  • 406
1 vote
1 answer
156 views

Which grant type : Implicit or Auth code (with No secret key) is suitable for Single Page Application(SPA)?

I went thru multiple posts saying how implicit grant is a security risk and why auth code grant with AJAX request to Authorization server should be used after redirecting to application (without ...
user avatar
  • 111
1 vote
0 answers
398 views

Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?

I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
user avatar
  • 11
0 votes
1 answer
161 views

How to authorize access to a resource when requested with CORS and validate the origin?

I'll try to make the explanation simple and to the point (keyword try). And if that's not sufficient, then maybe I can expand on the question. Imagine two sites: resources.example.com and www.example....
user avatar
1 vote
3 answers
297 views

Is it advisable to create a system that stores passwords?

Please bear with me, I'm a total newbie about security. I work in a company whose main goal is to maximize profits and use free stuff as much as possible. It's effect is that we use tons of freeware ...
user avatar
  • 115
0 votes
1 answer
141 views

Shibboleth SP two resources and two IDPs

I am looking for some recommendation / advice, with the following scenario: Using apache 2.4 and Shib 2. The setup is SP initiated. Only one Apache web server I am protecting two resources. example....
user avatar
  • 1,092
3 votes
1 answer
191 views

SSO level of trust external identity providers

I'm wondering how much I should trust our clients and their SSO implementations. We have an identity provider set up for @our-domain.com and most users of that domain have a lot of rights in our ...
user avatar
  • 133
2 votes
0 answers
142 views

'Fake SSO & self registration' access to a web api

I was asked to design and implement a solution that I have some security concerns about. The customer has a web application into which users log in using their credentials. The customer wants to add ...
user avatar
  • 121
0 votes
1 answer
169 views

SSO authentication & authorization architecture/implemenation

We got a bunch of different services (SPAs + API GW, legacy JavaEE apps, etc.). Each of those is usually ran in multiple instances (customer specific instances). The plan is to federate them under a ...
user avatar
  • 157
4 votes
1 answer
6k views

SAML assertion encryption and using same key for encryption as signing

I am working with a company that has product that supports SAML based authentication. We do not facilitate for just in time federation and only accept the user identifier in assertion responses (the ...
user avatar
  • 493
3 votes
1 answer
3k views

SHA1 signature in a SAML request

I'm currently looking at the security of a KeyCloak implementation, which again uses SAML 2.0 identity provider. I'm not too familiar with SAML, but during the authentication, the sent SAMLRequest ...
user avatar
0 votes
1 answer
137 views

Do you need to validate compensating controls of a certified organization?

Our web application uses Google's G Suite Single Sign-on for authentication into our application. As part of writing documentation around compensating controls, the PCI DSS requires "Validation of ...
user avatar
3 votes
0 answers
76 views

SAML - when creating new users, how do I get essential fields?

My company runs a saas product; as we move into enterprise customers, we're getting more and more requests for SSO. I understand the SAML workflow for authentication, and roughly how we'd implement ...
user avatar