Collaborate Disseminate
I am looking for some recommendation / advice, with the following scenario:
Using apache 2.4 and Shib 2.
The setup is SP initiated.
Only one Apache web server
I am protecting two resources.
example.com/siteA
example.com/… Continue reading Shibboleth SP two resources and two IDPs
I have a scenario in mind and I am wondering if this is, in general, a drawback to SSO using SAML 2.0/OIDC or if there are any known ways to mitigate such a scenario:
Background:
1. A user is able to SSO into some remote app… Continue reading SSO using SAML 2.0/OIDC
I’m wondering how much I should trust our clients and their SSO implementations. We have an identity provider set up for @our-domain.com and most users of that domain have a lot of rights in our software and can access privat… Continue reading SSO level of trust external identity providers
I was asked to design and implement a solution that I have some security concerns about.
The customer has a web application into which users log in using their credentials.
The customer wants to add a button in that applic… Continue reading ‘Fake SSO & self registration’ access to a web api
I have a system where I am running apps written a mix of Java and another language, and I am looking for there to be a single login session of the application.
By single login session I mean
Single Sign on
If session is a… Continue reading Solutions for sharing a single web session among services in different languages
We got a bunch of different services (SPAs + API GW, legacy JavaEE apps, etc.). Each of those is usually ran in multiple instances (customer specific instances). The plan is to federate them under a single-sign on.
We also need to be able… Continue reading SSO authentication & authorization architecture/implemenation
I am working with a company that has product that supports SAML based authentication.
We do not facilitate for just in time federation and only accept the user identifier in assertion responses (the user must already exist i… Continue reading SAML assertion encryption and using same key for encryption as signing
I’m currently looking at the security of a KeyCloak implementation, which again uses SAML 2.0 identity provider.
I’m not too familiar with SAML, but during the authentication, the sent SAMLRequest states SigAlg=http%3A%2F%2F… Continue reading SHA1 signature in a SAML request
Our web application uses Google’s G Suite Single Sign-on for authentication into our application. As part of writing documentation around compensating controls, the PCI DSS requires “Validation of Compensating Controls” (Note… Continue reading Do you need to validate compensating controls of a certified organization?
I have two services that run on different encryption and logins. I have a requirement to combine or integrate these two services and give a single username and password. This single username and password should be able to log… Continue reading Integrating two services with different encryption and login standards