Questions tagged [sso]
Single Sign-On is a technology to allow a single authentication to be used across multiple independent systems.
30 questions
0
votes
0
answers
59
views
SSO Application Storing a Custom Secret in the User Profile
I have an application that employs "zero knowledge" data security, where even with full backend access to our application, customer data cannot be read without knowing their individual ...
- 119
0
votes
1
answer
963
views
Session Handover via OpenID Connect between a Mobile Application and a Website?
I am trying to assess secure ways to implement a session handover between an app and a website in the same company ecosystem.
The Setup
Mobile Application A and Website B use the same company OpenID ...
- 103
1
vote
1
answer
4k
views
Implementing SSO on a REST API
I have a REST API server with its own authentication methods. I need to provide to some third party apps an authentication solution which should be processed on my server, I don't want them to handle ...
1
vote
0
answers
33
views
How to integrate multiple services via API's into a single dashboard on a per-user basis with SSO?
so my project is that I'd like to pull data from a bunch of different services/API's and show them in a single dashboard. SSO is a requirement so I want to make sure the user doesn't have to put in ...
- 111
0
votes
1
answer
2k
views
Best way to store Session token on mobile App
Background
Building a mobile App for product X which is currently hosted as a SaaS solution. The product X does not support OAuth currently, implements basic authentication and generates Session token ...
- 109
4
votes
2
answers
929
views
Integration with multiple SSO's
Currently, we had a web app that integrated with SSO through Open-Id protocol
Then we got another client that had it's own SSO and need us to integrate with their SSO through SAML protocol so their ...
- 49
3
votes
1
answer
633
views
Silent login in external application
We have a web application and our partners asked us to log in silently from their web applications, which would allow their users to make a single login on l to access our application instead of two.
...
- 149
1
vote
1
answer
1k
views
User registration across multiple services [closed]
I have multiple web services that need to be integrated into one solution. One frontend would provide access to features from all services.
Each of the services has its own native authentication, and ...
- 119
1
vote
0
answers
93
views
Single Sign On implementation for CMS
This is a general question seeking guidance for the best practice(s) on implementing a Single Sign On (SSO) across many various installations of the same application.
The hypothetical example I would ...
- 19
1
vote
1
answer
403
views
Single Sign On Logout Strategy
I have been working on a project that integrates spring-cloud-based microservices and MVC applications with SSO. currently, I use spring-session for the session repository service. My current ...
- 111
11
votes
2
answers
1k
views
Should an SPA use OIDC's Implicit flow or Auth Code flow?
We are developing a new Angular SPA which leverages Keycloak for its SSO abilities using OpenID Connect (OIDC). The app is currently designed to use the Implicit flow to retrieve short-lived access ...
- 1,249
0
votes
1
answer
436
views
Single-sign-on login logic and application logic on front-end
Let's say I have multiple Angular/React/Vue applications which I want to enable users to log in once and be able to access all my applications.
What I want to solve / ask about is where should I keep ...
- 117
2
votes
1
answer
676
views
Should an Identity Provider be a separate web application than a Authentication system
I'm currently writing a SAML Identity provider(Idp) to enable SSO and one of the easy ways to go about it is to use Shibboleth Identity Provider which is a ready deployable web application on it's own....
- 123
3
votes
6
answers
4k
views
How does authentication Server work on Single Sign on?
I am trying to implement Single Sign On feature(SSO).
I have for now three systems that needs this feature. This SSO is relatively new to me, I have done SSO where the domain is same. There browser is ...
- 111
0
votes
2
answers
217
views
Multilayer security concept
I'm working on a security concept of a bigger project. It will be done with Spring,but that's actually not relevant right now.
The whole system is a hierarchical tree of computer nodes that run a ...
- 439
-2
votes
1
answer
558
views
Implementing an SSO platform between different server languages and platforms
Our company uses a 3rd party platform to manage a pretty large portion of our business, but the platform is built on top of JSP and MySQL. However, our own products are written in C#/.Net. We're ...
- 1,377
5
votes
1
answer
168
views
Is oAuth a good fit here?
We're looking into adding authentication to a range of APIs that we are about to develop. The solution is entirely fluid as it currently stands, but the basic premise is that there is one API layer ...
- 153
14
votes
1
answer
8k
views
Can I prevent CSRF attacks by using localstorage/sessionstorage?
I have a front/back applications that needs to be logged in to be used. When I log in (by means of the front-end app sending a request to the back end), what I do is not sending a cookie, but a JSON ...
- 407
1
vote
0
answers
135
views
How to detect previous version cookies, and remove them?
We occasionally deploy our SSO system with some major changes. As much as we try to minimize it, on occasion we have require our users to delete all their "old" cookies. This is because their cookies ...
- 795
5
votes
1
answer
106
views
OAuthv2 authorization grants
I just read this excellent tutorial on OAuthv2 but am still missing some important concepts regarding authorization grants.
I'm fundamentally not understanding the necessity for the two request/...
- 4,920
5
votes
1
answer
2k
views
How can I build a seamless login for multiple sites using OAuth2?
The question is admittedly a bit leading, but what I mean to ask is:
If a user logs into into site X, is there a way to automatically log into site Y? Site Y utilises single sign-on via OAuth2 ...
- 501
1
vote
0
answers
141
views
Implement SSO login with or without Membership
I need to implement SSO for four different domains, say
abc.com
pqr.com
sql.com
xyz.com
Now, I have already login system for two of my applications using Membership. But now requirement is changed, ...
- 171
7
votes
1
answer
2k
views
How can I integrate local web development environments with a central SSO solution?
We have a single-page web application, and we have a new SSO site (also our own) using OAuth2, and are looking to hook them up.
On our production/staging/CI deployments, it's easy to hook everything ...
- 356
0
votes
2
answers
675
views
Single sign on if you do not have control of one or more of the client/web apps?
I have a customer who has a client app and when they log in to their client app, they will see a link to my website. When they click on the link, it should log in them in automatically to the website ...
- 147
3
votes
3
answers
4k
views
Securing credentials passed to web service
I'm attempting to design a single sign on system for use in a distributed architecture. Specifically, I must provide a way for a client website (that is, a website on a different domain/server/network)...
- 183
3
votes
3
answers
4k
views
Moving between sites using SAML
I'm tasked with developing an SSO system, and was guided towards using the SAML spec. After some research I think understand the interaction between a Service Provider and an ID Provider and how a ...
- 4,763
4
votes
1
answer
589
views
SSO between multiple Flex applications [closed]
We have three applications developed in Flex and all these use BlazeDS. These applications have their own authentication implementations (Database). Also they will be deployed in tomcat. Deploying all ...
- 49
2
votes
3
answers
206
views
A single access point for several applications
I've been asked to create a web page from which users can access several other applications created using oracle forms and jsf, this will include also sso.
I cant think of an easy way to do it, what ...
- 745
3
votes
2
answers
179
views
For ASP.NET Programmers: Does the executable 'dcpromo' have any significance?
Dcpromo.exe is famous among MCSEs for being they only way to create a Windows Domain Controller (in other words an Active Directory Domain) ... which in turn is often used by the ASP.NET Membership ...
- 6,060
2
votes
3
answers
6k
views
What product is better: ADFSv2, Ping Identity, CS Siteminder? [closed]
I'm comparing different STS's for claims based authentication and am trying when it's appropriate to use each one.
It appears that ADFSv2 should be used in all Windows Environments. Ping and ...
- 6,060