Questions tagged [sso]
Single Sign-On is when a user can use the same set of authentication credentials to access multiple different services.
154
questions
0
votes
0
answers
15
views
How does the SAML based SSO differ for Internal (employees) and External users (external resources)?
We are trying to set up(I am not part of the setting up process) an SSO based login for an ITSM application. Our organisation has some users working for us although they use their own organisation ...
- 101
0
votes
1
answer
58
views
Does splitting auth SSO and MFA parts, between client and service companies have any issues?
My company provides a single SaaS product for corporate clients.
For one client we are implementing SSO with them as authentication provider (via Azure AD/SAML for now, but the library we are using is ...
- 51
3
votes
1
answer
122
views
Adding SSO to an existing website - should SSO login link to matching email address?
I am adding Single Sign-On (SSO) via Google and Microsoft identity providers to a web application where many thousands of user accounts already have existing credentials stored by username and ...
- 131
0
votes
0
answers
15
views
Instead of 301 redirecting can I generate unique login endpoint in order to utilize an Http POST request during SAML Auth?
Whilst I was looking for an SAML authentication workflows I stumbled upon this link.
But instead of 301 redirect (or any kind of http redirect), I thought that once the app finds out that SAML ...
0
votes
1
answer
35
views
How can I have SSO with multiple login forms?
The most known SSO workflows require the Identity provider to provide the login page/form, for example Google's Authentication for its services.
An example for that is the: Simple SAML SSO Workflow
...
0
votes
0
answers
27
views
Authenticate via SAML without establishing SSO session
My SaaS application offers enterprise customers the option to use SAML to authenticate their user population against their own Identity Provider. This normally works fine, however I am looking for ...
- 1
0
votes
1
answer
84
views
Using SSO for a cryptocurrency app
Let us say you have an app where the users will be required to deposit cryptocurrency. Is it safe to let users sign in with third-party authentication? For example "sign in with Google" or &...
- 133
0
votes
0
answers
62
views
New rule on verifying domain for azureAD app registration
ref:
https://docs.microsoft.com/en-us/azure/active-directory/develop/reference-breaking-changes#appid-uri-in-single-tenant-applications-will-require-use-of-default-scheme-or-verified-domains
We setup ...
0
votes
1
answer
113
views
Does hashing really make this home rolled sso process more secure?
I had configured subdomains on a site to share forms authentication, however decisions were made to change one of websites over to a different domain. So now site A needs to send a user to the site B. ...
- 181
35
votes
8
answers
13k
views
Why don't some services offer Google/Facebook/Apple/Twitter login
Why don't some services offer Google/Facebook/Apple/Twitter login? Namely Crypto exchanges.
I assume they want as many users as possible & this is a great way to get more. Is there some sort of ...
- 535
0
votes
1
answer
109
views
Using SSO, does this count as only one authentication factor?
When using Google SSO, does this count as only one factor of authentication or as many factors as I use for my google account?
If it counts as a single factor, would this be "something I have&...
- 695
0
votes
0
answers
82
views
Are there specific reasons why ADFS certificates are generated for 2 years?
Azure Active Directory generates certificates for federated SSO that have a lifespan of 3 years.
in the case of an on premises AD, this is two years by default, and can be changed.
Are there any ...
- 8,913
1
vote
0
answers
170
views
Implement an SPA with IFrames, but with Single Sign-on
I want to build an SPA with ASP.NET Core (Blazor server side) which some IFrames redirecting to other applications. In this example I have f.e. the SPA, Grafana to show graphs and Node-Red, but there ...
- 141
1
vote
0
answers
60
views
SSO - SAMLResponse security via localhost reply [duplicate]
We're currently in the process of enhancing our Windows .NET desktop application with SAML single sign-on. In order to retrieve the SAMLResponse from the IP we have the redirect/reply URL set to http:/...
- 111
1
vote
0
answers
291
views
SAML/oauth2/openid-connect login via proxy as another user
I manage a set of service providers (SP1, SP2, SP3, etc), and we currently have this SAML SSO flow working where the SP causes a POST submit to the SAML IDP with an XML SAML request which includes an ...
- 111
0
votes
1
answer
197
views
How an IDP sends SAML assertion to an SP?
I'm new to security concepts. I am studying how SAML works and I'm confused about how IDP sends SAML assertion to SP. I searched on the internet and I found out two scenarios are possible.
First is ...
1
vote
1
answer
138
views
SSO SAML2: validating/verifying the SAMLResponse at the ACS
So it's unclear how much more security needs to happen at the ACS point.
I can see that the IDP signs a signature that involves a certificate and private key.
The SP can verify the signature with the ...
- 115
0
votes
1
answer
170
views
Are there security issues around controlled cross site sharing behind SSO?
Very simply we have a ton of websites at our company behind SSO.
I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get ...
- 108
1
vote
3
answers
3k
views
Cookie set from a server to a client with different domain(via XHR), but not recognized by Client domain
I have three domains but the same code base (Domain X, Domain Y, Domain Z) and
Accounts website A
If a user tries to sign in accounts from domain X, I wanted to SSO in the other two domains (Browser ...
- 111
2
votes
2
answers
725
views
Is normal that a web site which use OpenID as SSO sends all the cookie without samesite header?
Is normal that a web site which uses OpenID as SSO sends all the cookie without samesite header?
Is this required in order to make OpenID work correctly?
- 477
1
vote
1
answer
111
views
Verifying the security of SAML SSO
I run an instance of a log aggregation product in the cloud, installed on a VM. I've strictly configured it's networking settings, internal firewall, internal port redirection, strong admin password, ...
- 237
1
vote
2
answers
650
views
How does encryption, certificates in an end to end SSO flow?
So, I know how public-private key encryption works. I understand how/why certificates are required. I understand how a SSO flow (IdP initiated) works. But, I do not understand how the three of them ...
- 111
1
vote
1
answer
309
views
Why doesn't Keycloak allow user sign-up and sign-in through a client?
I'm in need of an authentication & authorization service that can manage our app's pool of users. I stumbled upon Keycloak and have been checking it for the past few days, but I'm wondering why ...
- 113
1
vote
1
answer
166
views
OAuth2, SAML, OpenID connect - Which one to use for my scenario?
I work for a company where we give customer (hundreds/thousands of users) access to 2 sites. One owned by a 3rd party SaaS and one owned by us. Customers spend alot of time registering for both sites ...
- 631
0
votes
1
answer
187
views
App-to-app or service-to-service authentication using federated login
I have an application Foo that exposes a web-based portal as well as a REST API service via HTTPS.
When a human user connects to the app Foo to use its web-based portal, the human user is first ...
- 958
0
votes
0
answers
76
views
How to verify the genuine user identity using Google signin API?
I'm developing a mobile app. I have a question, and here is the scenario.
If a person is logging into the App with google sign in API in a public network. The website will verify the user with his ...
0
votes
0
answers
72
views
Should I put HR system and various business related systems under SSO?
We are building several systems for businesses, like employees schedule management and sharing, customer management and recently we are building HR System.
We have put Schedule management and customer/...
- 101
0
votes
0
answers
96
views
Passing JWT Token in SSO
I'm in the midst of exploring the concept of Single Sign On with JWT.
I'm planning to build sso.test.com using Laravel
Referring to chart above, may I know:
Is it safe to POST JWT token (that ...
- 133
1
vote
1
answer
253
views
How do enterprises deal with SSO and Google backing up WiFi credentials?
Single Sign On in a company means that you have one set of credentials for all the services the company uses / provides to their employees.
Logically, these credentials might also be usable for Wifi.
...
- 205
2
votes
2
answers
210
views
SSO SP Initiated Single Sign Out - User Experience
I work on a software product that allows customers to use SAML or OAuth provisioning to their users. e.g to Azure AD.
Now non technical savvy users understandably presume that logging off from our ...
- 493
1
vote
0
answers
99
views
SSO and browser vs. server
We've got implementations in a browser-based system right now that does both SAML and OpenID-connect login support, but does them differently and was looking for advice on the risks.
Our SAML ...
- 426
1
vote
1
answer
119
views
Securing an API for 3rd party users
I'm having issues finding the right language to search for answers to my problem so hopefully I can explain it here.
I am trying to create an API that will be accessed by a 3rd party. This 3rd party ...
2
votes
1
answer
312
views
How does the browser know windows logged in user id or Kerberos TGT?
My organization uses SSO for its applications i.e. Once a user logs into his Windows 10 workstation, he accesses his web application without login. I was informed that the web applications uses NetIQ ...
- 157
2
votes
1
answer
119
views
why use a CA-signed key pair to encrypt SAML2 assertions?
I have a customer who insists upon using only certificate-authority signed key-pair certificates for encrypting SAML2 assertions.
In this use case, I hold the private key in my Service Provider, and ...
- 369
1
vote
1
answer
297
views
Secure REST API that only works for users authenticated by App with SSO (OAuth?)
I somehow need to accomplish the following:
User accesses a application written in JavaScript.
Application uses SSO to identify the user who is logged into Windows.
Application obtains the access ...
- 13
0
votes
0
answers
258
views
Understanding JWT and SSO
I'm having trouble understanding how to set up SSO between my app and another app we have deployed. I'm new to trying to set this kind of thing up, so I was hoping someone could explain whether I'm on ...
- 101
0
votes
2
answers
457
views
SSO Log Users Out Based on IP Address
We would like to implement SAML based SSO for our organization. We do not want employees to be able to access specific accounts outsides of specific hours and IP ranges. (We do not want to setup a VPN ...
0
votes
1
answer
125
views
Kerberos Authentication : Client authentication only
I am currently implementing a way to authenticate using Kerberos mechanism. Then only explanation have is "SSO using Kerberos".
I know technically how works Kerberos (Keytab, SPNEGO, Token, KDC, SPN)...
- 406
1
vote
1
answer
156
views
Which grant type : Implicit or Auth code (with No secret key) is suitable for Single Page Application(SPA)?
I went thru multiple posts saying how implicit grant is a security risk and why auth code grant with AJAX request to Authorization server should be used after redirecting to application (without ...
- 111
1
vote
0
answers
398
views
Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?
I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
- 11
0
votes
1
answer
161
views
How to authorize access to a resource when requested with CORS and validate the origin?
I'll try to make the explanation simple and to the point (keyword try). And if that's not sufficient, then maybe I can expand on the question.
Imagine two sites: resources.example.com and www.example....
- 123
1
vote
3
answers
297
views
Is it advisable to create a system that stores passwords?
Please bear with me, I'm a total newbie about security.
I work in a company whose main goal is to maximize profits and use free stuff as much as possible. It's effect is that we use tons of freeware ...
- 115
0
votes
1
answer
141
views
Shibboleth SP two resources and two IDPs
I am looking for some recommendation / advice, with the following scenario:
Using apache 2.4 and Shib 2.
The setup is SP initiated.
Only one Apache web server
I am protecting two resources.
example....
- 1,092
3
votes
1
answer
191
views
SSO level of trust external identity providers
I'm wondering how much I should trust our clients and their SSO implementations. We have an identity provider set up for @our-domain.com and most users of that domain have a lot of rights in our ...
- 133
2
votes
0
answers
142
views
'Fake SSO & self registration' access to a web api
I was asked to design and implement a solution that I have some security concerns about.
The customer has a web application into which users log in using their credentials.
The customer wants to add ...
- 121
0
votes
1
answer
169
views
SSO authentication & authorization architecture/implemenation
We got a bunch of different services (SPAs + API GW, legacy JavaEE apps, etc.). Each of those is usually ran in multiple instances (customer specific instances). The plan is to federate them under a ...
- 157
4
votes
1
answer
6k
views
SAML assertion encryption and using same key for encryption as signing
I am working with a company that has product that supports SAML based authentication.
We do not facilitate for just in time federation and only accept the user identifier in assertion responses (the ...
- 493
3
votes
1
answer
3k
views
SHA1 signature in a SAML request
I'm currently looking at the security of a KeyCloak implementation, which again uses SAML 2.0 identity provider.
I'm not too familiar with SAML, but during the authentication, the sent SAMLRequest ...
- 139
0
votes
1
answer
137
views
Do you need to validate compensating controls of a certified organization?
Our web application uses Google's G Suite Single Sign-on for authentication into our application. As part of writing documentation around compensating controls, the PCI DSS requires "Validation of ...
3
votes
0
answers
76
views
SAML - when creating new users, how do I get essential fields?
My company runs a saas product; as we move into enterprise customers, we're getting more and more requests for SSO.
I understand the SAML workflow for authentication, and roughly how we'd implement ...
- 183