Questions tagged [sso]
Single Sign-On is when a user can use the same set of authentication credentials to access multiple different services.
164
questions
1
vote
1
answer
48
views
Verify user credentials via SAML (E-Signature)
I have a requirement to extend a quality assurance process in the customers CRM system so that when the user enters some data he or she is prompted to a screen with username and password and the ...
- 11
1
vote
0
answers
31
views
What are the risks of SSO and logins in general in relation to privacy?
I recently started using the Brave browser for a little more privacy.
However, I still don't understand much about the risks surrounding SSO and cookies.
As an example, I am logged in to YouTube.com ...
- 121
1
vote
0
answers
68
views
Oracle Kerberos authentication on Linux host with SSSD
I have Linux servers which are members of AD domain, running SSSD demon.
SSSD is "Kerberized" and I also do want use Kerberos for Oracle db authentication.
NOTE: this is not purely about ...
- 41
1
vote
1
answer
57
views
How to delegate SAML2 authentication between Service Providers (SPs)?
We have an existing SP called S1 that authenticates to multiple Idps. We have another service called S2, I want S2 to delegate authentication to S1 then to Idp, then back and notify S2 when ...
- 111
0
votes
1
answer
43
views
How to store ClientID and ClientSecret in a K8 Env
I am trying integrate our service with SSO. I have generated the ClientID and ClientSecret.
Is it a good security practice to store the ClientID and ClientSecret as a configmap? If not, what are the ...
- 43
1
vote
0
answers
89
views
SSO Using API based login (not through UI redirection)
We have 3 different applications which have the same top level domain.
a.example.com
b.example.com
example.com
We have a login mechanism where the user provides a username + password and logs in. ...
- 283
0
votes
0
answers
25
views
how do you support sign in on android mobile applications for users who can only access the application via their institutions account
I am a student learning Android Application development
I am a newbee to SSO oAuth2 etc and Im interested to learn.
I am comfortable with signing in a user using their username/password and obtaining ...
- 125
0
votes
1
answer
440
views
SAML Authentication Across multiple Service providers
I am in the process of building an integration between 2 service providers (SP). I have setup my own Identity Provider, KeyCloak.
What I am trying to achieve is as follows: A user signs into SP1 using ...
- 101
0
votes
2
answers
70
views
Security/Liability Concerns with Sign-In-Provider Account Merging
Assume my solution offers 5 identity providers that users can choose from
Apple
Facebook
Github
Google
Microsoft
These providers all take user identity very seriously. Is there any legitimate ...
1
vote
0
answers
53
views
SSO and/or JWT: make sure web app's endpoints are protected
Let's say I'm building a web application (let's focus on the backend side) that is B2C. Users should be able to register with my application, using a SSO provider like Google or Facebook. Once they're ...
- 157
1
vote
1
answer
136
views
How SSO with OpenID and Azure AD works?
I try to understand how the integration we are using with OpenID works. I have read documents and different websites, but I feel that something escapes me related with SSO - I didn´t find so much ...
- 113
1
vote
0
answers
66
views
Is using the same SSO for dev and prod considered safe?
My company has one SSO provider that we use for our back office apps. We're looking at tightening security for our SaaS offering. We have a fork in the road for implementation - we can either ...
- 111
0
votes
1
answer
71
views
IdP Personal/Signer Certificates
We are implementing SAML/OIDC-based SSO across our enterprise and wanted to get a feel for best practices when it comes to using Personal/Signer Certificates within our IdP.
Historically we've ...
- 105
0
votes
0
answers
36
views
Automatic single sign-on for multiple providers
Our company's customers can use our IdP to sign-in into about a dozen various service providers we make available. All are third parties running their own sites/domains. We periodically get complaints ...
- 101
0
votes
1
answer
215
views
Is is safe to pass an API key in a HMAC hash?
I have 2 websites: a.com and b.com
To avoid using SAML for Single-Sign-On and making things complicated, I've taken this approach:
a.com is the identity provider. All users will be asked to sign in on ...
- 3
0
votes
1
answer
90
views
Does splitting auth SSO and MFA parts, between client and service companies have any issues?
My company provides a single SaaS product for corporate clients.
For one client we are implementing SSO with them as authentication provider (via Azure AD/SAML for now, but the library we are using is ...
- 51
3
votes
2
answers
676
views
Adding SSO to an existing website - should SSO login link to matching email address?
I am adding Single Sign-On (SSO) via Google and Microsoft identity providers to a web application where many thousands of user accounts already have existing credentials stored by username and ...
- 131
0
votes
1
answer
245
views
How can I have SSO with multiple login forms?
The most known SSO workflows require the Identity provider to provide the login page/form, for example Google's Authentication for its services.
An example for that is the: Simple SAML SSO Workflow
...
0
votes
1
answer
101
views
Using SSO for a cryptocurrency app
Let us say you have an app where the users will be required to deposit cryptocurrency. Is it safe to let users sign in with third-party authentication? For example "sign in with Google" or &...
- 133
0
votes
1
answer
126
views
Does hashing really make this home rolled sso process more secure?
I had configured subdomains on a site to share forms authentication, however decisions were made to change one of websites over to a different domain. So now site A needs to send a user to the site B. ...
- 181
35
votes
8
answers
14k
views
Why don't some services offer Google/Facebook/Apple/Twitter login
Why don't some services offer Google/Facebook/Apple/Twitter login? Namely Crypto exchanges.
I assume they want as many users as possible & this is a great way to get more. Is there some sort of ...
- 533
0
votes
1
answer
122
views
Using SSO, does this count as only one authentication factor?
When using Google SSO, does this count as only one factor of authentication or as many factors as I use for my google account?
If it counts as a single factor, would this be "something I have&...
- 717
1
vote
0
answers
430
views
Implement an SPA with IFrames, but with Single Sign-on
I want to build an SPA with ASP.NET Core (Blazor server side) which some IFrames redirecting to other applications. In this example I have f.e. the SPA, Grafana to show graphs and Node-Red, but there ...
- 141
1
vote
0
answers
157
views
SSO - SAMLResponse security via localhost reply [duplicate]
We're currently in the process of enhancing our Windows .NET desktop application with SAML single sign-on. In order to retrieve the SAMLResponse from the IP we have the redirect/reply URL set to http:/...
- 111
1
vote
0
answers
470
views
SAML/oauth2/openid-connect login via proxy as another user
I manage a set of service providers (SP1, SP2, SP3, etc), and we currently have this SAML SSO flow working where the SP causes a POST submit to the SAML IDP with an XML SAML request which includes an ...
- 111
0
votes
1
answer
840
views
How an IDP sends SAML assertion to an SP?
I'm new to security concepts. I am studying how SAML works and I'm confused about how IDP sends SAML assertion to SP. I searched on the internet and I found out two scenarios are possible.
First is ...
1
vote
1
answer
280
views
SSO SAML2: validating/verifying the SAMLResponse at the ACS
So it's unclear how much more security needs to happen at the ACS point.
I can see that the IDP signs a signature that involves a certificate and private key.
The SP can verify the signature with the ...
- 115
0
votes
1
answer
211
views
Are there security issues around controlled cross site sharing behind SSO?
Very simply we have a ton of websites at our company behind SSO.
I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get ...
- 118
2
votes
3
answers
10k
views
Cookie set from a server to a client with different domain(via XHR), but not recognized by Client domain
I have three domains but the same code base (Domain X, Domain Y, Domain Z) and
Accounts website A
If a user tries to sign in accounts from domain X, I wanted to SSO in the other two domains (Browser ...
- 121
2
votes
2
answers
2k
views
Is normal that a web site which use OpenID as SSO sends all the cookie without samesite header?
Is normal that a web site which uses OpenID as SSO sends all the cookie without samesite header?
Is this required in order to make OpenID work correctly?
- 567
1
vote
2
answers
293
views
Verifying the security of SAML SSO
I run an instance of a log aggregation product in the cloud, installed on a VM. I've strictly configured it's networking settings, internal firewall, internal port redirection, strong admin password, ...
- 237
1
vote
2
answers
2k
views
How does encryption, certificates in an end to end SSO flow?
So, I know how public-private key encryption works. I understand how/why certificates are required. I understand how a SSO flow (IdP initiated) works. But, I do not understand how the three of them ...
- 111
1
vote
1
answer
1k
views
Why doesn't Keycloak allow user sign-up and sign-in through a client?
I'm in need of an authentication & authorization service that can manage our app's pool of users. I stumbled upon Keycloak and have been checking it for the past few days, but I'm wondering why ...
- 113
1
vote
1
answer
383
views
OAuth2, SAML, OpenID connect - Which one to use for my scenario?
I work for a company where we give customer (hundreds/thousands of users) access to 2 sites. One owned by a 3rd party SaaS and one owned by us. Customers spend alot of time registering for both sites ...
- 651
0
votes
1
answer
231
views
App-to-app or service-to-service authentication using federated login
I have an application Foo that exposes a web-based portal as well as a REST API service via HTTPS.
When a human user connects to the app Foo to use its web-based portal, the human user is first ...
- 958
0
votes
0
answers
81
views
How to verify the genuine user identity using Google signin API?
I'm developing a mobile app. I have a question, and here is the scenario.
If a person is logging into the App with google sign in API in a public network. The website will verify the user with his ...
0
votes
0
answers
82
views
Should I put HR system and various business related systems under SSO?
We are building several systems for businesses, like employees schedule management and sharing, customer management and recently we are building HR System.
We have put Schedule management and customer/...
- 101
0
votes
0
answers
127
views
Passing JWT Token in SSO
I'm in the midst of exploring the concept of Single Sign On with JWT.
I'm planning to build sso.test.com using Laravel
Referring to chart above, may I know:
Is it safe to POST JWT token (that ...
- 133
1
vote
1
answer
307
views
How do enterprises deal with SSO and Google backing up WiFi credentials?
Single Sign On in a company means that you have one set of credentials for all the services the company uses / provides to their employees.
Logically, these credentials might also be usable for Wifi.
...
- 205
2
votes
2
answers
305
views
SSO SP Initiated Single Sign Out - User Experience
I work on a software product that allows customers to use SAML or OAuth provisioning to their users. e.g to Azure AD.
Now non technical savvy users understandably presume that logging off from our ...
- 513
1
vote
0
answers
138
views
SSO and browser vs. server
We've got implementations in a browser-based system right now that does both SAML and OpenID-connect login support, but does them differently and was looking for advice on the risks.
Our SAML ...
- 456
1
vote
1
answer
131
views
Securing an API for 3rd party users
I'm having issues finding the right language to search for answers to my problem so hopefully I can explain it here.
I am trying to create an API that will be accessed by a 3rd party. This 3rd party ...
2
votes
1
answer
523
views
How does the browser know windows logged in user id or Kerberos TGT?
My organization uses SSO for its applications i.e. Once a user logs into his Windows 10 workstation, he accesses his web application without login. I was informed that the web applications uses NetIQ ...
- 157
2
votes
1
answer
250
views
why use a CA-signed key pair to encrypt SAML2 assertions?
I have a customer who insists upon using only certificate-authority signed key-pair certificates for encrypting SAML2 assertions.
In this use case, I hold the private key in my Service Provider, and ...
- 379
1
vote
1
answer
394
views
Secure REST API that only works for users authenticated by App with SSO (OAuth?)
I somehow need to accomplish the following:
User accesses a application written in JavaScript.
Application uses SSO to identify the user who is logged into Windows.
Application obtains the access ...
- 13
0
votes
0
answers
304
views
Understanding JWT and SSO
I'm having trouble understanding how to set up SSO between my app and another app we have deployed. I'm new to trying to set this kind of thing up, so I was hoping someone could explain whether I'm on ...
- 101
0
votes
2
answers
899
views
SSO Log Users Out Based on IP Address
We would like to implement SAML based SSO for our organization. We do not want employees to be able to access specific accounts outsides of specific hours and IP ranges. (We do not want to setup a VPN ...
0
votes
1
answer
144
views
Kerberos Authentication : Client authentication only
I am currently implementing a way to authenticate using Kerberos mechanism. Then only explanation have is "SSO using Kerberos".
I know technically how works Kerberos (Keytab, SPNEGO, Token, KDC, SPN)...
- 416
1
vote
1
answer
190
views
Which grant type : Implicit or Auth code (with No secret key) is suitable for Single Page Application(SPA)?
I went thru multiple posts saying how implicit grant is a security risk and why auth code grant with AJAX request to Authorization server should be used after redirecting to application (without ...
- 111
1
vote
0
answers
508
views
Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?
I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
- 11