Questions tagged [sso]
Single Sign-On is when a user can use the same set of authentication credentials to access multiple different services.
174 questions
6
votes
3
answers
1k
views
A website asks you to enter a Microsoft/Google/Facebook password. How do you know it is safe?
A website prompts me to log in to my Microsoft Account. In order to perform my task, it requires me to enter that password.
How does the "average user" avoid giving all their login details ...
- 757
3
votes
3
answers
229
views
How secure is the "Remember me" feature in Keycloak?
I am using Keycloak 25 to protect several web applications in our company (Open ID Connect). There is the "Remember me" option in Keycloak, which can be enabled for the entire realm.
...
- 151
4
votes
1
answer
129
views
What are the downsides of matching by email in SSO logins (e.g. Google, Facebook, Apple, Microsoft)?
Context
I've read somewhere that one should not match by email (e.g. the email given by the Google JWT token) when using SSO (e.g. OpenID Connect) but it's not clear to me why.
The recommended ...
- 143
1
vote
2
answers
134
views
Keycloak - SSO security best practices
I am using Keycloak as OIDC provider for several web applications. I have approximately 50 users and 5 applications. Some applications contain sensitive data and are used only by the company managers. ...
- 151
18
votes
1
answer
4k
views
How are you supposed to trust SSO popups in desktop and mobile applications?
When I was investigating how to add SSO to a local application to login to google drive, the standard approach seems to be to open a web view window, ask user to log in while also opening a localhost ...
- 1,430
2
votes
1
answer
97
views
What's the point of users having to authorize their SSH keys and tokens they created themselves when SAML single sign-on is enabled on GitHub?
In GitHub's Enterprise Cloud docs it says:
To use an SSH key with an organization that uses SAML single sign-on (SSO), you must first authorize the key.
I understand that organization admins could ...
- 121
1
vote
0
answers
41
views
Leveraging MS SSO for teams tab secure?
I have an app I want to embed as a tab in MS Teams. Users may already have an account outside of teams and I use magic login link to typically to log users in. I want to know if I can leverage teams ...
- 11
6
votes
1
answer
258
views
Is there a method of session revocation for SAML/Single Sign-on applications?
While running a red teaming exercise, we had taken over an account inside an organization's Identity Provider via social engineering attack (specifics of which aren't relevant to this question). Their ...
- 268
2
votes
0
answers
288
views
Analyzing impact of leaked client_secret in Authorization Code Flow in Keycloak (CVE-2020-27838)
CVE-2020-27838 describes that Keycloak has an open endpoint where it's possible to obtain client_secret information, as shown in the example below:
/auth/realms/{realm}/clients-registrations/default/{...
- 21
0
votes
0
answers
78
views
OAuth2 System Design for Single Sign-On | Auto-Detect Session?
I'm working on configuring my suite of services (in different domains) so that they can all be accessed via Single Sign-On. I'm using AWS Cognito as a wrapper around a SAML Idp (Azure AD).
What I ...
2
votes
0
answers
210
views
Entra ID issuing expired ID Tokens
We are integrating our application with SSO using Entra ID App Registrations and configuring OIDC.
When our application receives the ID token from Microsoft Entra, the iap and exp values seem invalid. ...
1
vote
2
answers
129
views
Verify user credentials via SAML (E-Signature)
I have a requirement to extend a quality assurance process in the customers CRM system so that when the user enters some data he or she is prompted to a screen with username and password and the ...
- 21
1
vote
0
answers
125
views
What are the risks of SSO and logins in general in relation to privacy?
I recently started using the Brave browser for a little more privacy.
However, I still don't understand much about the risks surrounding SSO and cookies.
As an example, I am logged in to YouTube.com ...
- 121
1
vote
1
answer
384
views
Oracle Kerberos authentication on Linux host with SSSD
I have Linux servers which are members of AD domain, running SSSD demon.
SSSD is "Kerberized" and I also do want use Kerberos for Oracle db authentication.
NOTE: this is not purely about ...
- 41
1
vote
1
answer
210
views
How to delegate SAML2 authentication between Service Providers (SPs)?
We have an existing SP called S1 that authenticates to multiple Idps. We have another service called S2, I want S2 to delegate authentication to S1 then to Idp, then back and notify S2 when ...
- 111
0
votes
1
answer
116
views
How to store ClientID and ClientSecret in a K8 Env
I am trying integrate our service with SSO. I have generated the ClientID and ClientSecret.
Is it a good security practice to store the ClientID and ClientSecret as a configmap? If not, what are the ...
- 53
1
vote
0
answers
180
views
SSO Using API based login (not through UI redirection)
We have 3 different applications which have the same top level domain.
a.example.com
b.example.com
example.com
We have a login mechanism where the user provides a username + password and logs in. ...
- 313
0
votes
1
answer
738
views
SAML Authentication Across multiple Service providers
I am in the process of building an integration between 2 service providers (SP). I have setup my own Identity Provider, KeyCloak.
What I am trying to achieve is as follows: A user signs into SP1 using ...
- 101
1
vote
2
answers
140
views
Security/Liability Concerns with Sign-In-Provider Account Merging
Assume my solution offers 5 identity providers that users can choose from
Apple
Facebook
Github
Google
Microsoft
These providers all take user identity very seriously. Is there any legitimate ...
- 11
1
vote
0
answers
118
views
SSO and/or JWT: make sure web app's endpoints are protected
Let's say I'm building a web application (let's focus on the backend side) that is B2C. Users should be able to register with my application, using a SSO provider like Google or Facebook. Once they're ...
- 157
1
vote
1
answer
294
views
How SSO with OpenID and Azure AD works?
I try to understand how the integration we are using with OpenID works. I have read documents and different websites, but I feel that something escapes me related with SSO - I didn´t find so much ...
- 113
1
vote
0
answers
146
views
Is using the same SSO for dev and prod considered safe?
My company has one SSO provider that we use for our back office apps. We're looking at tightening security for our SaaS offering. We have a fork in the road for implementation - we can either ...
- 111
0
votes
1
answer
123
views
IdP Personal/Signer Certificates
We are implementing SAML/OIDC-based SSO across our enterprise and wanted to get a feel for best practices when it comes to using Personal/Signer Certificates within our IdP.
Historically we've ...
- 117
0
votes
0
answers
71
views
Automatic single sign-on for multiple providers
Our company's customers can use our IdP to sign-in into about a dozen various service providers we make available. All are third parties running their own sites/domains. We periodically get complaints ...
- 101
0
votes
1
answer
296
views
Is is safe to pass an API key in a HMAC hash?
I have 2 websites: a.com and b.com
To avoid using SAML for Single-Sign-On and making things complicated, I've taken this approach:
a.com is the identity provider. All users will be asked to sign in on ...
- 3
0
votes
1
answer
156
views
Does splitting auth SSO and MFA parts, between client and service companies have any issues?
My company provides a single SaaS product for corporate clients.
For one client we are implementing SSO with them as authentication provider (via Azure AD/SAML for now, but the library we are using is ...
- 51
6
votes
2
answers
1k
views
Adding SSO to an existing website - should SSO login link to matching email address?
I am adding Single Sign-On (SSO) via Google and Microsoft identity providers to a web application where many thousands of user accounts already have existing credentials stored by username and ...
- 130
-1
votes
1
answer
522
views
How can I have SSO with multiple login forms?
The most known SSO workflows require the Identity provider to provide the login page/form, for example Google's Authentication for its services.
An example for that is the: Simple SAML SSO Workflow
...
0
votes
1
answer
150
views
Using SSO for a cryptocurrency app
Let us say you have an app where the users will be required to deposit cryptocurrency. Is it safe to let users sign in with third-party authentication? For example "sign in with Google" or &...
- 133
0
votes
1
answer
166
views
Does hashing really make this home rolled sso process more secure?
I had configured subdomains on a site to share forms authentication, however decisions were made to change one of websites over to a different domain. So now site A needs to send a user to the site B. ...
- 181
35
votes
7
answers
14k
views
Why don't some services offer Google/Facebook/Apple/Twitter login
Why don't some services offer Google/Facebook/Apple/Twitter login? Namely Crypto exchanges.
I assume they want as many users as possible & this is a great way to get more. Is there some sort of ...
- 533
0
votes
1
answer
156
views
Using SSO, does this count as only one authentication factor?
When using Google SSO, does this count as only one factor of authentication or as many factors as I use for my google account?
If it counts as a single factor, would this be "something I have&...
- 737
1
vote
0
answers
570
views
Implement an SPA with IFrames, but with Single Sign-on
I want to build an SPA with ASP.NET Core (Blazor server side) which some IFrames redirecting to other applications. In this example I have f.e. the SPA, Grafana to show graphs and Node-Red, but there ...
- 141
1
vote
0
answers
239
views
SSO - SAMLResponse security via localhost reply [duplicate]
We're currently in the process of enhancing our Windows .NET desktop application with SAML single sign-on. In order to retrieve the SAMLResponse from the IP we have the redirect/reply URL set to http:/...
- 111
1
vote
0
answers
580
views
SAML/oauth2/openid-connect login via proxy as another user
I manage a set of service providers (SP1, SP2, SP3, etc), and we currently have this SAML SSO flow working where the SP causes a POST submit to the SAML IDP with an XML SAML request which includes an ...
- 111
0
votes
1
answer
2k
views
How an IDP sends SAML assertion to an SP?
I'm new to security concepts. I am studying how SAML works and I'm confused about how IDP sends SAML assertion to SP. I searched on the internet and I found out two scenarios are possible.
First is ...
- 3
1
vote
1
answer
457
views
SSO SAML2: validating/verifying the SAMLResponse at the ACS
So it's unclear how much more security needs to happen at the ACS point.
I can see that the IDP signs a signature that involves a certificate and private key.
The SP can verify the signature with the ...
- 115
0
votes
1
answer
306
views
Are there security issues around controlled cross site sharing behind SSO?
Very simply we have a ton of websites at our company behind SSO.
I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get ...
- 118
2
votes
3
answers
13k
views
Cookie set from a server to a client with different domain(via XHR), but not recognized by Client domain
I have three domains but the same code base (Domain X, Domain Y, Domain Z) and
Accounts website A
If a user tries to sign in accounts from domain X, I wanted to SSO in the other two domains (Browser ...
- 121
2
votes
2
answers
2k
views
Is normal that a web site which use OpenID as SSO sends all the cookie without samesite header?
Is normal that a web site which uses OpenID as SSO sends all the cookie without samesite header?
Is this required in order to make OpenID work correctly?
- 567
1
vote
2
answers
475
views
Verifying the security of SAML SSO
I run an instance of a log aggregation product in the cloud, installed on a VM. I've strictly configured it's networking settings, internal firewall, internal port redirection, strong admin password, ...
- 237
1
vote
2
answers
2k
views
How does encryption, certificates in an end to end SSO flow?
So, I know how public-private key encryption works. I understand how/why certificates are required. I understand how a SSO flow (IdP initiated) works. But, I do not understand how the three of them ...
- 111
1
vote
1
answer
2k
views
Why doesn't Keycloak allow user sign-up and sign-in through a client?
I'm in need of an authentication & authorization service that can manage our app's pool of users. I stumbled upon Keycloak and have been checking it for the past few days, but I'm wondering why ...
- 113
1
vote
1
answer
508
views
OAuth2, SAML, OpenID connect - Which one to use for my scenario?
I work for a company where we give customer (hundreds/thousands of users) access to 2 sites. One owned by a 3rd party SaaS and one owned by us. Customers spend alot of time registering for both sites ...
- 671
1
vote
1
answer
297
views
App-to-app or service-to-service authentication using federated login
I have an application Foo that exposes a web-based portal as well as a REST API service via HTTPS.
When a human user connects to the app Foo to use its web-based portal, the human user is first ...
- 968
0
votes
0
answers
125
views
How to verify the genuine user identity using Google signin API?
I'm developing a mobile app. I have a question, and here is the scenario.
If a person is logging into the App with google sign in API in a public network. The website will verify the user with his ...
0
votes
0
answers
122
views
Should I put HR system and various business related systems under SSO?
We are building several systems for businesses, like employees schedule management and sharing, customer management and recently we are building HR System.
We have put Schedule management and customer/...
- 101
0
votes
0
answers
167
views
Passing JWT Token in SSO
I'm in the midst of exploring the concept of Single Sign On with JWT.
I'm planning to build sso.test.com using Laravel
Referring to chart above, may I know:
Is it safe to POST JWT token (that ...
- 133
1
vote
1
answer
389
views
How do enterprises deal with SSO and Google backing up WiFi credentials?
Single Sign On in a company means that you have one set of credentials for all the services the company uses / provides to their employees.
Logically, these credentials might also be usable for Wifi.
...
- 205
2
votes
2
answers
455
views
SSO SP Initiated Single Sign Out - User Experience
I work on a software product that allows customers to use SAML or OAuth provisioning to their users. e.g to Azure AD.
Now non technical savvy users understandably presume that logging off from our ...
- 525