Questions tagged [sso]
Single Sign-On is when a user can use the same set of authentication credentials to access multiple different services.
128
questions
0
votes
0answers
38 views
SSO - How Auth Code flow with PKCE is secure?
I've run into this docs when I was studying some SSO concepts;
This grant adds the concept of a code_verifier to the Authorization Code Grant. When the Client asks for an Authorization Code it ...
0
votes
0answers
48 views
Can I leverage Shibboleth to avoid recurring metadata exchanges with our customer?
we provide various web services for our customers, leveraging their IdP to have the customers' employees sign in with their company-issued accounts. Sometimes we operate web services for one customer ...
0
votes
0answers
47 views
Is this a flawed custom SSO design?
My company is working with a CRM that has a custom SSO implementation that we use. So they serve as our IdP.
The basic workflow:
1: User attempts to access secure app.
2: App routes user to IdP ...
0
votes
0answers
28 views
Azure AD - Guest user SSO to RDP
We have two Azure subscription, (1) of the parent company where all the users live in Azure AD (synchronised from on premises AD), and (2) that holds the 365 apps which are dedicated to our company.
...
2
votes
1answer
73 views
How does the browser know windows logged in user id or Kerberos TGT?
My organization uses SSO for its applications i.e. Once a user logs into his Windows 10 workstation, he accesses his web application without login. I was informed that the web applications uses NetIQ ...
2
votes
1answer
44 views
why use a CA-signed key pair to encrypt SAML2 assertions?
I have a customer who insists upon using only certificate-authority signed key-pair certificates for encrypting SAML2 assertions.
In this use case, I hold the private key in my Service Provider, and ...
1
vote
1answer
58 views
Secure REST API that only works for users authenticated by App with SSO (OAuth?)
I somehow need to accomplish the following:
User accesses a application written in JavaScript.
Application uses SSO to identify the user who is logged into Windows.
Application obtains the access ...
0
votes
0answers
119 views
Understanding JWT and SSO
I'm having trouble understanding how to set up SSO between my app and another app we have deployed. I'm new to trying to set this kind of thing up, so I was hoping someone could explain whether I'm on ...
0
votes
1answer
86 views
SSO Log Users Out Based on IP Address
We would like to implement SAML based SSO for our organization. We do not want employees to be able to access specific accounts outsides of specific hours and IP ranges. (We do not want to setup a VPN ...
0
votes
1answer
56 views
Kerberos Authentication : Client authentication only
I am currently implementing a way to authenticate using Kerberos mechanism. Then only explanation have is "SSO using Kerberos".
I know technically how works Kerberos (Keytab, SPNEGO, Token, KDC, SPN)...
1
vote
1answer
58 views
Which grant type : Implicit or Auth code (with No secret key) is suitable for Single Page Application(SPA)?
I went thru multiple posts saying how implicit grant is a security risk and why auth code grant with AJAX request to Authorization server should be used after redirecting to application (without ...
1
vote
0answers
78 views
Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?
I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
0
votes
1answer
71 views
How to authorize access to a resource when requested with CORS and validate the origin?
I'll try to make the explanation simple and to the point (keyword try). And if that's not sufficient, then maybe I can expand on the question.
Imagine two sites: resources.example.com and www.example....
0
votes
0answers
31 views
Single Sign On: Concept for multiple resources and login server below the same domain
I am learning about SSO right now and am trying to work out a way to authenticate a few websites under the same domain (example.com), based on the setups I read about in the internet.
I would prefer ...
1
vote
3answers
236 views
Is it advisable to create a system that stores passwords?
Please bear with me, I'm a total newbie about security.
I work in a company whose main goal is to maximize profits and use free stuff as much as possible. It's effect is that we use tons of freeware ...
0
votes
1answer
64 views
Shibboleth SP two resources and two IDPs
I am looking for some recommendation / advice, with the following scenario:
Using apache 2.4 and Shib 2.
The setup is SP initiated.
Only one Apache web server
I am protecting two resources.
example....
0
votes
0answers
38 views
SSO using SAML 2.0/OIDC
I have a scenario in mind and I am wondering if this is, in general, a drawback to SSO using SAML 2.0/OIDC or if there are any known ways to mitigate such a scenario:
Background:
1. A user is able to ...
3
votes
1answer
113 views
SSO level of trust external identity providers
I'm wondering how much I should trust our clients and their SSO implementations. We have an identity provider set up for @our-domain.com and most users of that domain have a lot of rights in our ...
2
votes
0answers
56 views
'Fake SSO & self registration' access to a web api
I was asked to design and implement a solution that I have some security concerns about.
The customer has a web application into which users log in using their credentials.
The customer wants to add ...
0
votes
1answer
80 views
SSO authentication & authorization architecture/implemenation
We got a bunch of different services (SPAs + API GW, legacy JavaEE apps, etc.). Each of those is usually ran in multiple instances (customer specific instances). The plan is to federate them under a ...
2
votes
1answer
2k views
SAML assertion encryption and using same key for encryption as signing
I am working with a company that has product that supports SAML based authentication.
We do not facilitate for just in time federation and only accept the user identifier in assertion responses (the ...
2
votes
1answer
801 views
SHA1 signature in a SAML request
I'm currently looking at the security of a KeyCloak implementation, which again uses SAML 2.0 identity provider.
I'm not too familiar with SAML, but during the authentication, the sent SAMLRequest ...
0
votes
1answer
59 views
Do you need to validate compensating controls of a certified organization?
Our web application uses Google's G Suite Single Sign-on for authentication into our application. As part of writing documentation around compensating controls, the PCI DSS requires "Validation of ...
3
votes
0answers
38 views
SAML - when creating new users, how do I get essential fields?
My company runs a saas product; as we move into enterprise customers, we're getting more and more requests for SSO.
I understand the SAML workflow for authentication, and roughly how we'd implement ...
5
votes
2answers
315 views
Using third party authentication like google/facebook to login to a site, is there any security risk when the site is hacked?
Sites like stackoverflow, quora, and many more offers sign in from Google/Facebook. In the event that there is a data breach or the site is hacked, is there any security risk to your Google/Facebook ...
0
votes
1answer
74 views
Where to save the token information?
I'm currently working on an end user Windows 10 application using the Microsoft UWP platform. Within this application the end user will be able to authenticate themselves using an oauth2 SSO service.
...
1
vote
1answer
141 views
Is signature validation mandatory if encrypted assertions are sent over HTTPs in SAML 2.0?
We are using SAML Web Browser SSO Profile (SAML 2.0)
We have a SP using SAML2.0. All communication between IdP and SP is over HTTPs.
If AuthnResponse from IdP is sent over HTTPs, is it mandatory for ...
1
vote
0answers
27 views
Passing token/session values from one application to its sub application
My client currently has an existing ASP.NET web portal, which runs fine. It's hosted on their on-premise IIS Server. I will call this one the "parent application".
Now I'm working on another web ...
0
votes
1answer
179 views
How to setup SAML?
I am learning about SAML and already read many articles and forums but I still having confusion about setup IdP.
I am using "https://simplesamlphp.org/"
For example, I have 3 websites "example.com", "...
0
votes
1answer
367 views
How could this SSO implementation possibly work without browser cookies?
Our corporate Windows 7 desktop setup is now using SSO with our Confluence instance (browser-based wiki-type website) but the strangest thing is that even after logging out AND clearing the browser ...
5
votes
1answer
651 views
Is it secure to use CORS to implement SSO?
I implement SSO to integrate some web login mechanism to the centralized member system which is OAuth2 provider.
And currently OAuth2 authorization works well.
However, I would like to implement much ...
0
votes
1answer
3k views
OpenID Connect: How to maintain a single sign-on experience between multiple web clients of the same umbrella application?
I'm considering how to take a fairly complex tiered application with multiple web apps that delegate back to the same application server, and migrate it to use OIDC authentication with auth code flow. ...
2
votes
3answers
1k views
Best practice for connecting publicly available server to internal LDAP/Active Directory?
We have a public website. The site also contains the intranet (although none of the data on the intranet pages are terribly secret). Users have to login to the website using their Active Directory ...
10
votes
2answers
4k views
How to implement cross-domain, auto-login SSO without browser redirects for unlogged users?
I need to implement an SSO solution with the following requirements:
Cross-domain: Let's assume I have a.com, b.com and sso.com. If I become logged in through a.com, I shouldn't need to login when I ...
1
vote
2answers
1k views
Where are passwords stored in SAML? On the IdP or on the SP side?
I understand the basic flow of SAML but is still unclear to me where the passwords are stored.
This image shows "APP VERIFIES SAML RESPONSE & LOGS USER IN" from onelogin looks like the password ...
3
votes
1answer
96 views
Is there a way to tell if an Android app really uses SSO(Single Sign On)?
In the last few years, SSO protocols like OAuth and SAML are becoming increasingly used to enable 3rd parties access some user's resources from some service without the need for user to provide ...
2
votes
1answer
322 views
Do we need to maintain Authentication and Authorization Logic separately? [closed]
We are using Keycloak Identity server which will take care of Authentication and Authorization for our new Multi Level Marketing Website.
There was a discussion going on within our team to maintain ...
0
votes
2answers
406 views
Would it be possible to store Kerberos tickets on a YubiKey?
Kerberos supports different ways (ccache types) of storing tickets, such as:
FILE
MEMORY
KEYRING
I was wondering whether it would technically be possible to also store the Ticket-granting-ticket and ...
1
vote
0answers
2k views
Exception: krb_error 0 Do not have keys of types listed in default_tkt_enctypes
I am looking for your help with one Exception we are getting while setting up our Kerberos SSO. I will briefly give an overview of our setup and things we tried till now and exception we are getting:
...
-1
votes
1answer
141 views
Reasons to limit password length [duplicate]
We are currently using a third party software for SSO Login in a hybrid landscape with SAP, ADFS, etc.
The users have to change their password in the client software, which is then sent to a central ...
1
vote
0answers
550 views
SSO - Client Certificate vs SAML
For me SSO is sign on where one need not type the password explicitly.
I see one of the possible way to achieve it is by using Certificates loaded in browser.
SAML/OAuth delegates the job of ...
1
vote
1answer
201 views
Any practical Single Sign-On (SSO) protocol/traffic analysis tool/method/analyzer? [closed]
I want to analyze the SSO protocol/traffic that is deployed in real environment, such as commercial website. The challenge is that most of them are black-box.
Scenario 1. I read several papers about ...
0
votes
1answer
271 views
Storing SAML Idp certificates in APP_Data folder
We provided a SAML2 Service Provider to our client, so they can use that to configure their Identity Provider to our Service Provider.
My questions is about our client certificate, I'm worried that ...
0
votes
1answer
123 views
Is it possible to analyze real Single Sign-On (SSO) messages via network sniffing?
I am thinking how to gain and analyze the information in the real SSO (request/response) messages, for some commercial SSO solutions.
The challenge is that most commercial SSO solutions are black-box ...
1
vote
1answer
164 views
SSO: Who is the idp (identity provider) for Google Apps?
If I am a user for different Google Apps. Google Apps (gmail, google calender, games logging in using Google email account, etc.) are different service providers. Who will be the identity provider (...
2
votes
1answer
145 views
Is JSON web token further secured in OpenID, and how?
I have read the details of pure JSON web token (JWT), and found that it is signed (e.g. by SHA256) but not encrypted. Hence, attack can read the sensitive information by decoding the header and ...
0
votes
1answer
41 views
Claims based authentication to log on to a device
Are there operating systems that allow logging on to the device (laptop, tablet etc.) using claims based authentication?
3
votes
1answer
742 views
Encrypting data and SSO
I provide a service in which users can store data, files, etc in an encrypted form.
The service that I have built has two applications for the user's password with which they login to my service: 1) ...
1
vote
0answers
44 views
Objectively speaking, what is the expected standard to prepare for an interview as network admin? [closed]
I have an interview middle of next month for a position as network admin.
As I understand things, clients are running Windows but some servers may be running Linux.
What is the expected standard in ...
1
vote
1answer
161 views
Is SSO/OAuth inherently broken?
The way I understand it, the whole concept of OAuth/SSO involves allowing a user the ability to have a central password they can use on a multitude of sites without compromising it because really they'...
