Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sso]

Single Sign-On is a technology to allow a single authentication to be used across multiple independent systems.

1
vote
1answer
50 views

Single Sign On Logout Strategy

I have been working on a project that integrates spring-cloud-based microservices and MVC applications with SSO. currently, I use spring-session for the session repository service. My current ...
0
votes
0answers
24 views

SSO with AWS Cognito

I'm trying to work out what the best plan of attack would be to get SSO functionality while continuing to use AWS Cognito. I've come up with a solution that works, but I'm curious if anything has any ...
4
votes
0answers
119 views

Should an SPA use OIDC's Implicit flow or Auth Code flow?

We are developing a new Angular SPA which leverages Keycloak for its SSO abilities using OpenID Connect (OIDC). The app is currently designed to use the Implicit flow to retrieve short-lived access ...
0
votes
1answer
58 views

Single-sign-on login logic and application logic on front-end

Let's say I have multiple Angular/React/Vue applications which I want to enable users to log in once and be able to access all my applications. What I want to solve / ask about is where should I keep ...
2
votes
1answer
346 views

Should an Identity Provider be a separate web application than a Authentication system

I'm currently writing a SAML Identity provider(Idp) to enable SSO and one of the easy ways to go about it is to use Shibboleth Identity Provider which is a ready deployable web application on it's own....
3
votes
6answers
2k views

How does authorization Server work on Single Sign on?

I am trying to implement Single Sign On feature(SSO). I have for now three systems that needs this feature. This SSO is relatively new to me, I have done SSO where the domain is same. There browser is ...
0
votes
2answers
187 views

Multilayer security concept

I'm working on a security concept of a bigger project. It will be done with Spring,but that's actually not relevant right now. The whole system is a hierarchical tree of computer nodes that run a ...
-2
votes
1answer
236 views

Implementing an SSO platform between different server languages and platforms

Our company uses a 3rd party platform to manage a pretty large portion of our business, but the platform is built on top of JSP and MySQL. However, our own products are written in C#/.Net. We're ...
5
votes
1answer
130 views

Is oAuth a good fit here?

We're looking into adding authentication to a range of APIs that we are about to develop. The solution is entirely fluid as it currently stands, but the basic premise is that there is one API layer ...
6
votes
1answer
2k views

Can I prevent CSRF attacks by using localstorage/sessionstorage?

I have a front/back applications that needs to be logged in to be used. When I log in (by means of the front-end app sending a request to the back end), what I do is not sending a cookie, but a JSON ...
1
vote
0answers
80 views

How to detect previous version cookies, and remove them?

We occasionally deploy our SSO system with some major changes. As much as we try to minimize it, on occasion we have require our users to delete all their "old" cookies. This is because their cookies ...
5
votes
1answer
70 views

OAuthv2 authorization grants

I just read this excellent tutorial on OAuthv2 but am still missing some important concepts regarding authorization grants. I'm fundamentally not understanding the necessity for the two request/...
5
votes
1answer
813 views

How can I build a seamless login for multiple sites using OAuth2?

The question is admittedly a bit leading, but what I mean to ask is: If a user logs into into site X, is there a way to automatically log into site Y? Site Y utilises single sign-on via OAuth2 ...
1
vote
0answers
78 views

oAuth Flow Question in a SSO scenario

I have the following simple scenario: Multiple web applications share SSO functionality An Authorization Server is used as the central identity service for the web applications Users are ...
1
vote
0answers
114 views

Implement SSO login with or without Membership

I need to implement SSO for four different domains, say abc.com pqr.com sql.com xyz.com Now, I have already login system for two of my applications using Membership. But now requirement is changed, ...
5
votes
1answer
1k views

How can I integrate local web development environments with a central SSO solution?

We have a single-page web application, and we have a new SSO site (also our own) using OAuth2, and are looking to hook them up. On our production/staging/CI deployments, it's easy to hook everything ...
0
votes
2answers
665 views

Single sign on if you do not have control of one or more of the client/web apps?

I have a customer who has a client app and when they log in to their client app, they will see a link to my website. When they click on the link, it should log in them in automatically to the website ...
3
votes
3answers
2k views

Securing credentials passed to web service

I'm attempting to design a single sign on system for use in a distributed architecture. Specifically, I must provide a way for a client website (that is, a website on a different domain/server/network)...
3
votes
3answers
2k views

Moving between sites using SAML

I'm tasked with developing an SSO system, and was guided towards using the SAML spec. After some research I think understand the interaction between a Service Provider and an ID Provider and how a ...
4
votes
1answer
569 views

SSO between multiple Flex applications [closed]

We have three applications developed in Flex and all these use BlazeDS. These applications have their own authentication implementations (Database). Also they will be deployed in tomcat. Deploying all ...
2
votes
3answers
187 views

A single access point for several applications

I've been asked to create a web page from which users can access several other applications created using oracle forms and jsf, this will include also sso. I cant think of an easy way to do it, what ...
1
vote
2answers
174 views

For ASP.NET Programmers: Does the executable 'dcpromo' have any significance?

Dcpromo.exe is famous among MCSEs for being they only way to create a Windows Domain Controller (in other words an Active Directory Domain) ... which in turn is often used by the ASP.NET Membership ...
2
votes
3answers
5k views

What product is better: ADFSv2, Ping Identity, CS Siteminder? [closed]

I'm comparing different STS's for claims based authentication and am trying when it's appropriate to use each one. It appears that ADFSv2 should be used in all Windows Environments. Ping and ...