Questions tagged [sso]
Single Sign-On is when a user can use the same set of authentication credentials to access multiple different services.
123
questions
1
vote
1answer
37 views
why use a CA-signed key pair to encrypt SAML2 assertions?
I have a customer who insists upon using only certificate-authority signed key-pair certificates for encrypting SAML2 assertions.
In this use case, I hold the private key in my Service Provider, and ...
1
vote
1answer
52 views
Secure REST API that only works for users authenticated by App with SSO (OAuth?)
I somehow need to accomplish the following:
User accesses a application written in JavaScript.
Application uses SSO to identify the user who is logged into Windows.
Application obtains the access ...
0
votes
0answers
81 views
Understanding JWT and SSO
I'm having trouble understanding how to set up SSO between my app and another app we have deployed. I'm new to trying to set this kind of thing up, so I was hoping someone could explain whether I'm on ...
0
votes
1answer
66 views
SSO Log Users Out Based on IP Address
We would like to implement SAML based SSO for our organization. We do not want employees to be able to access specific accounts outsides of specific hours and IP ranges. (We do not want to setup a VPN ...
0
votes
1answer
40 views
Kerberos Authentication : Client authentication only
I am currently implementing a way to authenticate using Kerberos mechanism. Then only explanation have is "SSO using Kerberos".
I know technically how works Kerberos (Keytab, SPNEGO, Token, KDC, SPN)...
1
vote
1answer
46 views
Which grant type : Implicit or Auth code (with No secret key) is suitable for Single Page Application(SPA)?
I went thru multiple posts saying how implicit grant is a security risk and why auth code grant with AJAX request to Authorization server should be used after redirecting to application (without ...
1
vote
0answers
55 views
Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?
I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
0
votes
1answer
62 views
How to authorize access to a resource when requested with CORS and validate the origin?
I'll try to make the explanation simple and to the point (keyword try). And if that's not sufficient, then maybe I can expand on the question.
Imagine two sites: resources.example.com and www.example....
0
votes
0answers
29 views
Single Sign On: Concept for multiple resources and login server below the same domain
I am learning about SSO right now and am trying to work out a way to authenticate a few websites under the same domain (example.com), based on the setups I read about in the internet.
I would prefer ...
1
vote
3answers
232 views
Is it advisable to create a system that stores passwords?
Please bear with me, I'm a total newbie about security.
I work in a company whose main goal is to maximize profits and use free stuff as much as possible. It's effect is that we use tons of freeware ...
0
votes
1answer
54 views
Shibboleth SP two resources and two IDPs
I am looking for some recommendation / advice, with the following scenario:
Using apache 2.4 and Shib 2.
The setup is SP initiated.
Only one Apache web server
I am protecting two resources.
example....
0
votes
0answers
35 views
SSO using SAML 2.0/OIDC
I have a scenario in mind and I am wondering if this is, in general, a drawback to SSO using SAML 2.0/OIDC or if there are any known ways to mitigate such a scenario:
Background:
1. A user is able to ...
3
votes
1answer
92 views
SSO level of trust external identity providers
I'm wondering how much I should trust our clients and their SSO implementations. We have an identity provider set up for @our-domain.com and most users of that domain have a lot of rights in our ...
2
votes
0answers
50 views
'Fake SSO & self registration' access to a web api
I was asked to design and implement a solution that I have some security concerns about.
The customer has a web application into which users log in using their credentials.
The customer wants to add ...
0
votes
1answer
71 views
SSO authentication & authorization architecture/implemenation
We got a bunch of different services (SPAs + API GW, legacy JavaEE apps, etc.). Each of those is usually ran in multiple instances (customer specific instances). The plan is to federate them under a ...
2
votes
1answer
1k views
SAML assertion encryption and using same key for encryption as signing
I am working with a company that has product that supports SAML based authentication.
We do not facilitate for just in time federation and only accept the user identifier in assertion responses (the ...
2
votes
1answer
530 views
SHA1 signature in a SAML request
I'm currently looking at the security of a KeyCloak implementation, which again uses SAML 2.0 identity provider.
I'm not too familiar with SAML, but during the authentication, the sent SAMLRequest ...
0
votes
1answer
52 views
Do you need to validate compensating controls of a certified organization?
Our web application uses Google's G Suite Single Sign-on for authentication into our application. As part of writing documentation around compensating controls, the PCI DSS requires "Validation of ...
3
votes
0answers
35 views
SAML - when creating new users, how do I get essential fields?
My company runs a saas product; as we move into enterprise customers, we're getting more and more requests for SSO.
I understand the SAML workflow for authentication, and roughly how we'd implement ...
3
votes
2answers
231 views
Using third party authentication like google/facebook to login to a site, is there any security risk when the site is hacked?
Sites like stackoverflow, quora, and many more offers sign in from Google/Facebook. In the event that there is a data breach or the site is hacked, is there any security risk to your Google/Facebook ...
0
votes
1answer
67 views
Where to save the token information?
I'm currently working on an end user Windows 10 application using the Microsoft UWP platform. Within this application the end user will be able to authenticate themselves using an oauth2 SSO service.
...
1
vote
1answer
115 views
Is signature validation mandatory if encrypted assertions are sent over HTTPs in SAML 2.0?
We are using SAML Web Browser SSO Profile (SAML 2.0)
We have a SP using SAML2.0. All communication between IdP and SP is over HTTPs.
If AuthnResponse from IdP is sent over HTTPs, is it mandatory for ...
1
vote
0answers
26 views
Passing token/session values from one application to its sub application
My client currently has an existing ASP.NET web portal, which runs fine. It's hosted on their on-premise IIS Server. I will call this one the "parent application".
Now I'm working on another web ...
0
votes
1answer
156 views
How to setup SAML?
I am learning about SAML and already read many articles and forums but I still having confusion about setup IdP.
I am using "https://simplesamlphp.org/"
For example, I have 3 websites "example.com", "...
0
votes
1answer
325 views
How could this SSO implementation possibly work without browser cookies?
Our corporate Windows 7 desktop setup is now using SSO with our Confluence instance (browser-based wiki-type website) but the strangest thing is that even after logging out AND clearing the browser ...
5
votes
1answer
540 views
Is it secure to use CORS to implement SSO?
I implement SSO to integrate some web login mechanism to the centralized member system which is OAuth2 provider.
And currently OAuth2 authorization works well.
However, I would like to implement much ...
0
votes
1answer
3k views
OpenID Connect: How to maintain a single sign-on experience between multiple web clients of the same umbrella application?
I'm considering how to take a fairly complex tiered application with multiple web apps that delegate back to the same application server, and migrate it to use OIDC authentication with auth code flow. ...
2
votes
3answers
1k views
Best practice for connecting publicly available server to internal LDAP/Active Directory?
We have a public website. The site also contains the intranet (although none of the data on the intranet pages are terribly secret). Users have to login to the website using their Active Directory ...
7
votes
1answer
3k views
How to implement cross-domain, auto-login SSO without browser redirects for unlogged users?
I need to implement an SSO solution with the following requirements:
Cross-domain: Let's assume I have a.com, b.com and sso.com. If I become logged in through a.com, I shouldn't need to login when I ...
1
vote
2answers
1k views
Where are passwords stored in SAML? On the IdP or on the SP side?
I understand the basic flow of SAML but is still unclear to me where the passwords are stored.
This image shows "APP VERIFIES SAML RESPONSE & LOGS USER IN" from onelogin looks like the password ...
3
votes
1answer
96 views
Is there a way to tell if an Android app really uses SSO(Single Sign On)?
In the last few years, SSO protocols like OAuth and SAML are becoming increasingly used to enable 3rd parties access some user's resources from some service without the need for user to provide ...
2
votes
1answer
306 views
Do we need to maintain Authentication and Authorization Logic separately? [closed]
We are using Keycloak Identity server which will take care of Authentication and Authorization for our new Multi Level Marketing Website.
There was a discussion going on within our team to maintain ...
0
votes
2answers
347 views
Would it be possible to store Kerberos tickets on a YubiKey?
Kerberos supports different ways (ccache types) of storing tickets, such as:
FILE
MEMORY
KEYRING
I was wondering whether it would technically be possible to also store the Ticket-granting-ticket and ...
1
vote
0answers
2k views
Exception: krb_error 0 Do not have keys of types listed in default_tkt_enctypes
I am looking for your help with one Exception we are getting while setting up our Kerberos SSO. I will briefly give an overview of our setup and things we tried till now and exception we are getting:
...
-1
votes
1answer
141 views
Reasons to limit password length [duplicate]
We are currently using a third party software for SSO Login in a hybrid landscape with SAP, ADFS, etc.
The users have to change their password in the client software, which is then sent to a central ...
1
vote
0answers
538 views
SSO - Client Certificate vs SAML
For me SSO is sign on where one need not type the password explicitly.
I see one of the possible way to achieve it is by using Certificates loaded in browser.
SAML/OAuth delegates the job of ...
1
vote
1answer
194 views
Any practical Single Sign-On (SSO) protocol/traffic analysis tool/method/analyzer? [closed]
I want to analyze the SSO protocol/traffic that is deployed in real environment, such as commercial website. The challenge is that most of them are black-box.
Scenario 1. I read several papers about ...
0
votes
1answer
253 views
Storing SAML Idp certificates in APP_Data folder
We provided a SAML2 Service Provider to our client, so they can use that to configure their Identity Provider to our Service Provider.
My questions is about our client certificate, I'm worried that ...
0
votes
1answer
112 views
Is it possible to analyze real Single Sign-On (SSO) messages via network sniffing?
I am thinking how to gain and analyze the information in the real SSO (request/response) messages, for some commercial SSO solutions.
The challenge is that most commercial SSO solutions are black-box ...
1
vote
1answer
155 views
SSO: Who is the idp (identity provider) for Google Apps?
If I am a user for different Google Apps. Google Apps (gmail, google calender, games logging in using Google email account, etc.) are different service providers. Who will be the identity provider (...
1
vote
1answer
139 views
Is JSON web token further secured in OpenID, and how?
I have read the details of pure JSON web token (JWT), and found that it is signed (e.g. by SHA256) but not encrypted. Hence, attack can read the sensitive information by decoding the header and ...
0
votes
1answer
41 views
Claims based authentication to log on to a device
Are there operating systems that allow logging on to the device (laptop, tablet etc.) using claims based authentication?
3
votes
1answer
652 views
Encrypting data and SSO
I provide a service in which users can store data, files, etc in an encrypted form.
The service that I have built has two applications for the user's password with which they login to my service: 1) ...
1
vote
0answers
44 views
Objectively speaking, what is the expected standard to prepare for an interview as network admin? [closed]
I have an interview middle of next month for a position as network admin.
As I understand things, clients are running Windows but some servers may be running Linux.
What is the expected standard in ...
1
vote
1answer
157 views
Is SSO/OAuth inherently broken?
The way I understand it, the whole concept of OAuth/SSO involves allowing a user the ability to have a central password they can use on a multitude of sites without compromising it because really they'...
1
vote
1answer
79 views
SSO Understainding Credentials and Authentication [closed]
I would like to create a SSO where my users can login to machines and wordpress (php) websites.
So far I have LDAP with Kerberos working. I can login with the same credentials to every service, ...
5
votes
1answer
6k views
Self-signed certificate for a IdP-initiated SAML SSO
We act as a Service Provider in a SAML SSO integration with our customers. During the dev and stage testing, we usually exchange metadata files and SSO endpoints.
When forming our metadata we use the ...
2
votes
1answer
232 views
Why do we need IdP when directory services already authenticate and authorize users?
Why do we need Identity Providers when enabling SSO? Why can't directory services do it itself when they already have users identity and can verify it (I'm thinking here about MS AD and the need of AD ...
3
votes
1answer
329 views
Can password based SSO be trivially compromised?
Many cloud SSO providers now offer "password based SSO" (e.g. https://docs.microsoft.com/en-us/azure/active-directory/active-directory-appssoaccess-whatis ), where, even if the SaaS you want to log in ...
0
votes
1answer
39 views
SSO DNS SRV lookup
I'm pen testing the page (IdpInitiatedSignOn.aspx) of a web app which uses an SSO mechanism (Active Directoy Federated Services). The username field requires a domain (e.g. company) to preface the ...
