Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sso]

Single Sign-On is a technology to allow a single authentication to be used across multiple independent systems.

3
votes
2answers
59 views

Integration with multiple SSO's

Currently, we had a web app that integrated with SSO through Open-Id protocol Then we got another client that had it's own SSO and need us to integrate with their SSO through SAML protocol so their ...
1
vote
1answer
32 views

Silent login in external application

We have a web application and our partners ask us to login silently from their web applications allow their users to make a single login on their sites without login twice to access our application. ...
1
vote
1answer
64 views

User registration across multiple services [closed]

I have multiple web services that need to be integrated into one solution. One frontend would provide access to features from all services. Each of the services has its own native authentication, and ...
1
vote
0answers
41 views

Single Sign On implementation for CMS

This is a general question seeking guidance for the best practice(s) on implementing a Single Sign On (SSO) across many various installations of the same application. The hypothetical example I would ...
1
vote
1answer
63 views

Single Sign On Logout Strategy

I have been working on a project that integrates spring-cloud-based microservices and MVC applications with SSO. currently, I use spring-session for the session repository service. My current ...
4
votes
0answers
273 views

Should an SPA use OIDC's Implicit flow or Auth Code flow?

We are developing a new Angular SPA which leverages Keycloak for its SSO abilities using OpenID Connect (OIDC). The app is currently designed to use the Implicit flow to retrieve short-lived access ...
0
votes
1answer
100 views

Single-sign-on login logic and application logic on front-end

Let's say I have multiple Angular/React/Vue applications which I want to enable users to log in once and be able to access all my applications. What I want to solve / ask about is where should I keep ...
2
votes
1answer
434 views

Should an Identity Provider be a separate web application than a Authentication system

I'm currently writing a SAML Identity provider(Idp) to enable SSO and one of the easy ways to go about it is to use Shibboleth Identity Provider which is a ready deployable web application on it's own....
3
votes
6answers
3k views

How does authorization Server work on Single Sign on?

I am trying to implement Single Sign On feature(SSO). I have for now three systems that needs this feature. This SSO is relatively new to me, I have done SSO where the domain is same. There browser is ...
0
votes
2answers
194 views

Multilayer security concept

I'm working on a security concept of a bigger project. It will be done with Spring,but that's actually not relevant right now. The whole system is a hierarchical tree of computer nodes that run a ...
-2
votes
1answer
327 views

Implementing an SSO platform between different server languages and platforms

Our company uses a 3rd party platform to manage a pretty large portion of our business, but the platform is built on top of JSP and MySQL. However, our own products are written in C#/.Net. We're ...
5
votes
1answer
134 views

Is oAuth a good fit here?

We're looking into adding authentication to a range of APIs that we are about to develop. The solution is entirely fluid as it currently stands, but the basic premise is that there is one API layer ...
6
votes
1answer
2k views

Can I prevent CSRF attacks by using localstorage/sessionstorage?

I have a front/back applications that needs to be logged in to be used. When I log in (by means of the front-end app sending a request to the back end), what I do is not sending a cookie, but a JSON ...
1
vote
0answers
81 views

How to detect previous version cookies, and remove them?

We occasionally deploy our SSO system with some major changes. As much as we try to minimize it, on occasion we have require our users to delete all their "old" cookies. This is because their cookies ...
5
votes
1answer
75 views

OAuthv2 authorization grants

I just read this excellent tutorial on OAuthv2 but am still missing some important concepts regarding authorization grants. I'm fundamentally not understanding the necessity for the two request/...
5
votes
1answer
919 views

How can I build a seamless login for multiple sites using OAuth2?

The question is admittedly a bit leading, but what I mean to ask is: If a user logs into into site X, is there a way to automatically log into site Y? Site Y utilises single sign-on via OAuth2 ...
1
vote
0answers
83 views

oAuth Flow Question in a SSO scenario

I have the following simple scenario: Multiple web applications share SSO functionality An Authorization Server is used as the central identity service for the web applications Users are ...
1
vote
0answers
114 views

Implement SSO login with or without Membership

I need to implement SSO for four different domains, say abc.com pqr.com sql.com xyz.com Now, I have already login system for two of my applications using Membership. But now requirement is changed, ...
5
votes
1answer
1k views

How can I integrate local web development environments with a central SSO solution?

We have a single-page web application, and we have a new SSO site (also our own) using OAuth2, and are looking to hook them up. On our production/staging/CI deployments, it's easy to hook everything ...
0
votes
2answers
670 views

Single sign on if you do not have control of one or more of the client/web apps?

I have a customer who has a client app and when they log in to their client app, they will see a link to my website. When they click on the link, it should log in them in automatically to the website ...
3
votes
3answers
3k views

Securing credentials passed to web service

I'm attempting to design a single sign on system for use in a distributed architecture. Specifically, I must provide a way for a client website (that is, a website on a different domain/server/network)...
3
votes
3answers
3k views

Moving between sites using SAML

I'm tasked with developing an SSO system, and was guided towards using the SAML spec. After some research I think understand the interaction between a Service Provider and an ID Provider and how a ...
4
votes
1answer
575 views

SSO between multiple Flex applications [closed]

We have three applications developed in Flex and all these use BlazeDS. These applications have their own authentication implementations (Database). Also they will be deployed in tomcat. Deploying all ...
2
votes
3answers
191 views

A single access point for several applications

I've been asked to create a web page from which users can access several other applications created using oracle forms and jsf, this will include also sso. I cant think of an easy way to do it, what ...
1
vote
2answers
174 views

For ASP.NET Programmers: Does the executable 'dcpromo' have any significance?

Dcpromo.exe is famous among MCSEs for being they only way to create a Windows Domain Controller (in other words an Active Directory Domain) ... which in turn is often used by the ASP.NET Membership ...
2
votes
3answers
5k views

What product is better: ADFSv2, Ping Identity, CS Siteminder? [closed]

I'm comparing different STS's for claims based authentication and am trying when it's appropriate to use each one. It appears that ADFSv2 should be used in all Windows Environments. Ping and ...