Questions tagged [sso]

Single Sign-On is when a user can use the same set of authentication credentials to access multiple different services.

29 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3
votes
0answers
41 views

SAML - when creating new users, how do I get essential fields?

My company runs a saas product; as we move into enterprise customers, we're getting more and more requests for SSO. I understand the SAML workflow for authentication, and roughly how we'd implement ...
2
votes
0answers
67 views

'Fake SSO & self registration' access to a web api

I was asked to design and implement a solution that I have some security concerns about. The customer has a web application into which users log in using their credentials. The customer wants to add ...
2
votes
0answers
2k views

Token-based SSO for multiple domains for backend API requests

I’m in the process of setting up SSO for a service I’m creating. After looking at solutions, I’ve found nothing to fit exactly what we need. I’m looking to make sure from a security standpoint what we ...
2
votes
0answers
156 views

How does Adobe Pass Auto-Authentication work?

At time marker 2:05 of this video, he describes that Adobe Pass can automatically identify you based on your broadband provider, and sign you in/authorize you for media content. Can anyone describe ...
1
vote
0answers
31 views

Why doesn't Keycloak allow user sign-up and sign-in through a client?

I'm in need of an authentication & authorization service that can manage our app's pool of users. I stumbled upon Keycloak and have been checking it for the past few days, but I'm wondering why ...
1
vote
1answer
102 views

How do enterprises deal with SSO and Google backing up WiFi credentials?

Single Sign On in a company means that you have one set of credentials for all the services the company uses / provides to their employees. Logically, these credentials might also be usable for Wifi. ...
1
vote
1answer
85 views

SSO SP Initiated Single Sign Out - User Experience

I work on a software product that allows customers to use SAML or OAuth provisioning to their users. e.g to Azure AD. Now non technical savvy users understandably presume that logging off from our ...
1
vote
0answers
30 views

SSO and browser vs. server

We've got implementations in a browser-based system right now that does both SAML and OpenID-connect login support, but does them differently and was looking for advice on the risks. Our SAML ...
1
vote
0answers
161 views

Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?

I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
1
vote
0answers
31 views

Passing token/session values from one application to its sub application

My client currently has an existing ASP.NET web portal, which runs fine. It's hosted on their on-premise IIS Server. I will call this one the "parent application". Now I'm working on another web ...
1
vote
0answers
3k views

Exception: krb_error 0 Do not have keys of types listed in default_tkt_enctypes

I am looking for your help with one Exception we are getting while setting up our Kerberos SSO. I will briefly give an overview of our setup and things we tried till now and exception we are getting: ...
1
vote
0answers
566 views

SSO - Client Certificate vs SAML

For me SSO is sign on where one need not type the password explicitly. I see one of the possible way to achieve it is by using Certificates loaded in browser. SAML/OAuth delegates the job of ...
1
vote
0answers
419 views

Different timezone in WebSSO using ADFS as IDP

Is there a best practise when it comes to handling timezones in an international single-sign-on solution? I've been asked to include the clients timezone in our saml-ticket as an attribute. This will ...
1
vote
0answers
135 views

SSO Implementaion/Suggestions Needed

We have a partner who has integrated our services into their application. All API method call's from partner app to our services using standard API key/pwd credentials. But to make any changes on ...
0
votes
1answer
45 views

OAuth2, SAML, OpenID connect - Which one to use for my scenario?

I work for a company where we give customer (hundreds/thousands of users) access to 2 sites. One owned by a 3rd party SaaS and one owned by us. Customers spend alot of time registering for both sites ...
0
votes
1answer
92 views

App-to-app or service-to-service authentication using federated login

I have an application Foo that exposes a web-based portal as well as a REST API service via HTTPS. When a human user connects to the app Foo to use its web-based portal, the human user is first ...
0
votes
0answers
37 views

Auth0 privacy and confidentiality

I'm studying Auth0 and I would like to know if using a third party application like this for authentication and authorization can be a problem for privacy and data confidentiality.
0
votes
0answers
39 views

How to verify the genuine user identity using Google signin API?

I'm developing a mobile app. I have a question, and here is the scenario. If a person is logging into the App with google sign in API in a public network. The website will verify the user with his ...
0
votes
0answers
25 views

Should I put HR system and various business related systems under SSO?

We are building several systems for businesses, like employees schedule management and sharing, customer management and recently we are building HR System. We have put Schedule management and customer/...
0
votes
0answers
39 views

Passing JWT Token in SSO

I'm in the midst of exploring the concept of Single Sign On with JWT. I'm planning to build sso.test.com using Laravel Referring to chart above, may I know: Is it safe to POST JWT token (that ...
0
votes
0answers
24 views

SSO-logged in Web Application does not log the user out. R&D says session is active at IDP, hence this is an expected behaviour

Like the title says, one of our application uses SAML based authentication and uses Okta as the IDP. After logging in, I noticed that the session remains active for many hours even after I log out of ...
0
votes
0answers
78 views

SSO - How Auth Code flow with PKCE is secure?

I've run into this docs when I was studying some SSO concepts; This grant adds the concept of a code_verifier to the Authorization Code Grant. When the Client asks for an Authorization Code it ...
0
votes
0answers
59 views

Can I leverage Shibboleth to avoid recurring metadata exchanges with our customer?

we provide various web services for our customers, leveraging their IdP to have the customers' employees sign in with their company-issued accounts. Sometimes we operate web services for one customer ...
0
votes
0answers
49 views

Is this a flawed custom SSO design?

My company is working with a CRM that has a custom SSO implementation that we use. So they serve as our IdP. The basic workflow: 1: User attempts to access secure app. 2: App routes user to IdP ...
0
votes
0answers
36 views

Azure AD - Guest user SSO to RDP

We have two Azure subscription, (1) of the parent company where all the users live in Azure AD (synchronised from on premises AD), and (2) that holds the 365 apps which are dedicated to our company. ...
0
votes
0answers
162 views

Understanding JWT and SSO

I'm having trouble understanding how to set up SSO between my app and another app we have deployed. I'm new to trying to set this kind of thing up, so I was hoping someone could explain whether I'm on ...
0
votes
2answers
141 views

SSO Log Users Out Based on IP Address

We would like to implement SAML based SSO for our organization. We do not want employees to be able to access specific accounts outsides of specific hours and IP ranges. (We do not want to setup a VPN ...
0
votes
1answer
101 views

SSO authentication & authorization architecture/implemenation

We got a bunch of different services (SPAs + API GW, legacy JavaEE apps, etc.). Each of those is usually ran in multiple instances (customer specific instances). The plan is to federate them under a ...
0
votes
0answers
897 views

In what ways may a SAML2 service provider interoperate with an agency using Common Access Cards (CAC)

I'm at a service provider organization that supports shibboleth-style and CAS third party authentication. I'm looking at the requirements to meet the low baseline of FedRamp (see FedRAMP Security ...