Questions tagged [sso]
Single Sign-On is when a user can use the same set of authentication credentials to access multiple different services.
2
votes
0answers
36 views
'Fake SSO & self registration' access to a web api
I was asked to design and implement a solution that I have some security concerns about.
The customer has a web application into which users log in using their credentials.
The customer wants to add ...
0
votes
0answers
28 views
Solutions for sharing a single web session among services in different languages
I have a system where I am running apps written a mix of Java and another language (TCL), and I am looking for there to be a single login session of the application.
By single login session I mean
...
0
votes
0answers
27 views
SSO authentication & authorization architecture/implemenation
We got a bunch of different services (SPAs + API GW, legacy JavaEE apps, etc.). Each of those is usually ran in multiple instances (customer specific instances). The plan is to federate them under a ...
1
vote
1answer
33 views
SAML assertion encryption and using same key for encryption as signing
I am working with a company that has product that supports SAML based authentication.
We do not facilitate for just in time federation and only accept the user identifier in assertion responses (the ...
2
votes
1answer
41 views
SHA1 signature in a SAML request
I'm currently looking at the security of a KeyCloak implementation, which again uses SAML 2.0 identity provider.
I'm not too familiar with SAML, but during the authentication, the sent SAMLRequest ...
0
votes
1answer
30 views
Do you need to validate compensating controls of a certified organization?
Our web application uses Google's G Suite Single Sign-on for authentication into our application. As part of writing documentation around compensating controls, the PCI DSS requires "Validation of ...
3
votes
0answers
30 views
SAML - when creating new users, how do I get essential fields?
My company runs a saas product; as we move into enterprise customers, we're getting more and more requests for SSO.
I understand the SAML workflow for authentication, and roughly how we'd implement ...
2
votes
1answer
172 views
Using third party authentication like google/facebook to login to a site, is there any security risk when the site is hacked?
Sites like stackoverflow, quora, and many more offers sign in from Google/Facebook. In the event that there is a data breach or the site is hacked, is there any security risk to your Google/Facebook ...
0
votes
1answer
57 views
Where to save the token information?
I'm currently working on an end user Windows 10 application using the Microsoft UWP platform. Within this application the end user will be able to authenticate themselves using an oauth2 SSO service.
...
1
vote
1answer
51 views
Is signature validation mandatory if encrypted assertions are sent over HTTPs in SAML 2.0?
We are using SAML Web Browser SSO Profile (SAML 2.0)
We have a SP using SAML2.0. All communication between IdP and SP is over HTTPs.
If AuthnResponse from IdP is sent over HTTPs, is it mandatory for ...
1
vote
0answers
21 views
Passing token/session values from one application to its sub application
My client currently has an existing ASP.NET web portal, which runs fine. It's hosted on their on-premise IIS Server. I will call this one the "parent application".
Now I'm working on another web ...
0
votes
1answer
60 views
How to setup SAML?
I am learning about SAML and already read many articles and forums but I still having confusion about setup IdP.
I am using "https://simplesamlphp.org/"
For example, I have 3 websites "example.com", "...
0
votes
1answer
191 views
How could this SSO implementation possibly work without browser cookies?
Our corporate Windows 7 desktop setup is now using SSO with our Confluence instance (browser-based wiki-type website) but the strangest thing is that even after logging out AND clearing the browser ...
0
votes
0answers
29 views
Can klist be used to detect expiry dates for forged kerberos tickets?
I have observed that klist is used to list locally cached kerberos tickets. For golden tickets with indefinite expiry dates (say ~10 years), is it possible to list all the tickets submitted to a ...
5
votes
1answer
330 views
Is it secure to use CORS to implement SSO?
I implement SSO to integrate some web login mechanism to the centralized member system which is OAuth2 provider.
And currently OAuth2 authorization works well.
However, I would like to implement much ...
-1
votes
0answers
45 views
How to do authentication of SaaS implementation for uploading, processing, and retrieving documents
We would like to provide a B2B SaaS with the following flow:
Our customer's end-users upload their document using our custom
upload UI which should be embedded using an iframe
Once the user finishes ...
0
votes
0answers
106 views
What are the risks with logging in with Google or FB auth to third party sites? [duplicate]
You can now log in via FB or Google to sites like this one. That's because, presumably, once you've been authenticated from either, you can be trusted to manage information of a less-confidential ...
0
votes
1answer
2k views
OpenID Connect: How to maintain a single sign-on experience between multiple web clients of the same umbrella application?
I'm considering how to take a fairly complex tiered application with multiple web apps that delegate back to the same application server, and migrate it to use OIDC authentication with auth code flow. ...
2
votes
3answers
931 views
Best practice for connecting publicly available server to internal LDAP/Active Directory?
We have a public website. The site also contains the intranet (although none of the data on the intranet pages are terribly secret). Users have to login to the website using their Active Directory ...
5
votes
1answer
2k views
How to implement cross-domain, auto-login SSO without browser redirects for unlogged users?
I need to implement an SSO solution with the following requirements:
Cross-domain: Let's assume I have a.com, b.com and sso.com. If I become logged in through a.com, I shouldn't need to login when I ...
1
vote
2answers
718 views
Where are passwords stored in SAML? On the IdP or on the SP side?
I understand the basic flow of SAML but is still unclear to me where the passwords are stored.
This image shows "APP VERIFIES SAML RESPONSE & LOGS USER IN" from onelogin looks like the password ...
3
votes
1answer
94 views
Is there a way to tell if an Android app really uses SSO(Single Sign On)?
In the last few years, SSO protocols like OAuth and SAML are becoming increasingly used to enable 3rd parties access some user's resources from some service without the need for user to provide ...
2
votes
1answer
280 views
Do we need to maintain Authentication and Authorization Logic separately? [closed]
We are using Keycloak Identity server which will take care of Authentication and Authorization for our new Multi Level Marketing Website.
There was a discussion going on within our team to maintain ...
0
votes
2answers
288 views
Would it be possible to store Kerberos tickets on a YubiKey?
Kerberos supports different ways (ccache types) of storing tickets, such as:
FILE
MEMORY
KEYRING
I was wondering whether it would technically be possible to also store the Ticket-granting-ticket and ...
1
vote
0answers
1k views
Exception: krb_error 0 Do not have keys of types listed in default_tkt_enctypes
I am looking for your help with one Exception we are getting while setting up our Kerberos SSO. I will briefly give an overview of our setup and things we tried till now and exception we are getting:
...
-1
votes
1answer
131 views
Reasons to limit password length [duplicate]
We are currently using a third party software for SSO Login in a hybrid landscape with SAP, ADFS, etc.
The users have to change their password in the client software, which is then sent to a central ...
1
vote
0answers
449 views
SSO - Client Certificate vs SAML
For me SSO is sign on where one need not type the password explicitly.
I see one of the possible way to achieve it is by using Certificates loaded in browser.
SAML/OAuth delegates the job of ...
1
vote
1answer
181 views
Any practical Single Sign-On (SSO) protocol/traffic analysis tool/method/analyzer? [closed]
I want to analyze the SSO protocol/traffic that is deployed in real environment, such as commercial website. The challenge is that most of them are black-box.
Scenario 1. I read several papers about ...
0
votes
1answer
186 views
Storing SAML Idp certificates in APP_Data folder
We provided a SAML2 Service Provider to our client, so they can use that to configure their Identity Provider to our Service Provider.
My questions is about our client certificate, I'm worried that ...
0
votes
1answer
96 views
Is it possible to analyze real Single Sign-On (SSO) messages via network sniffing?
I am thinking how to gain and analyze the information in the real SSO (request/response) messages, for some commercial SSO solutions.
The challenge is that most commercial SSO solutions are black-box ...
1
vote
1answer
131 views
SSO: Who is the idp (identity provider) for Google Apps?
If I am a user for different Google Apps. Google Apps (gmail, google calender, games logging in using Google email account, etc.) are different service providers. Who will be the identity provider (...
1
vote
1answer
118 views
Is JSON web token further secured in OpenID, and how?
I have read the details of pure JSON web token (JWT), and found that it is signed (e.g. by SHA256) but not encrypted. Hence, attack can read the sensitive information by decoding the header and ...
0
votes
1answer
40 views
Claims based authentication to log on to a device
Are there operating systems that allow logging on to the device (laptop, tablet etc.) using claims based authentication?
3
votes
1answer
420 views
Encrypting data and SSO
I provide a service in which users can store data, files, etc in an encrypted form.
The service that I have built has two applications for the user's password with which they login to my service: 1) ...
1
vote
0answers
42 views
Objectively speaking, what is the expected standard to prepare for an interview as network admin? [closed]
I have an interview middle of next month for a position as network admin.
As I understand things, clients are running Windows but some servers may be running Linux.
What is the expected standard in ...
1
vote
1answer
135 views
Is SSO/OAuth inherently broken?
The way I understand it, the whole concept of OAuth/SSO involves allowing a user the ability to have a central password they can use on a multitude of sites without compromising it because really they'...
1
vote
1answer
67 views
SSO Understainding Credentials and Authentication [closed]
I would like to create a SSO where my users can login to machines and wordpress (php) websites.
So far I have LDAP with Kerberos working. I can login with the same credentials to every service, ...
5
votes
1answer
4k views
Self-signed certificate for a IdP-initiated SAML SSO
We act as a Service Provider in a SAML SSO integration with our customers. During the dev and stage testing, we usually exchange metadata files and SSO endpoints.
When forming our metadata we use the ...
2
votes
1answer
231 views
Why do we need IdP when directory services already authenticate and authorize users?
Why do we need Identity Providers when enabling SSO? Why can't directory services do it itself when they already have users identity and can verify it (I'm thinking here about MS AD and the need of AD ...
4
votes
1answer
282 views
Can password based SSO be trivially compromised?
Many cloud SSO providers now offer "password based SSO" (e.g. https://docs.microsoft.com/en-us/azure/active-directory/active-directory-appssoaccess-whatis ), where, even if the SaaS you want to log in ...
0
votes
1answer
36 views
SSO DNS SRV lookup
I'm pen testing the page (IdpInitiatedSignOn.aspx) of a web app which uses an SSO mechanism (Active Directoy Federated Services). The username field requires a domain (e.g. company) to preface the ...
2
votes
3answers
2k views
HTTPS and encrypted cookie for session
Currently I am developing an SSO system with CAS. CAS uses an ticket granting ticket (TGT) that can be seen as the SSO-session. CAS by default will encrypt the TGT. And by default you also have HTTPS ...
1
vote
2answers
430 views
Is MD5 suitable for single sign on?
We are using an application which offers single sign to their systems which is then embedded as an iframe (i.e. the URL is visible in the source of the page)
The SSO security comes from using MD5 to ...
1
vote
1answer
316 views
ADFS with multiple IDP stops doing the SSO [closed]
I'm facing an issue when we enable a second IDP (add Claims Provider Trust), then we are not able to navigate between apps without stopping in the HRD (Home Realm Discovery) page.
Is there a way to ...
0
votes
0answers
154 views
JWT Token SSO - Is this method permissible?
I have a doubt about the authentication method we follow. Don't think this has anything to do with OAuth at this time.
Browser hits a URL which shows a login page.
After the user logs in the browser ...
1
vote
1answer
1k views
Is SSO without SSL possible and/or secure?
Lets imagine a site where HTTPS is not used, for any good or bad reasons. The admin of this site still need a way to secure connections and think about using unique authentication with social networks ...
0
votes
1answer
30 views
Client app auto-updating passwords, no SSO [closed]
My customer has an ActiveDirectory server and a work server, both without SSO. Employees use their ActiveDirectory account to connect to the work server.
They change passwords every month.
My app ...
0
votes
1answer
685 views
2FA using Kerberos and SSO within CDE
I was wondering if anyone is using Kerberos for their 2FA solution into their CDE for PCI DSS compliance. Also what does PCI DSS say about SSO once 2FA has occured through Raduis Server.
Thanks for ...
1
vote
2answers
848 views
Is it safe to allow HTTP for SAML 2.0 Issuer URL?
I've implemented SAML 2.0 using the ruby-saml gem in my Rails app. In this app, clients can specify their SAML idp for their account. I have a client who insists that requiring HTTPS for the Issuer ...
1
vote
1answer
37 views
Instant signin links for users from trusted third party sites
I'm owning web app "A" and want to work with a third party service "X". User "Alice" has accounts on both platforms. App A knows the user ID of alice on X, but X doesn't care about Alice being on A or ...
