Collaborate Disseminate
We have 3 different applications which have the same top level domain.
a.example.com
b.example.com
example.com
We have a login mechanism where the user provides a username + password and logs in. Each of these websites wants to have cont… Continue reading SSO Using API based login (not through UI redirection)
We have 3 different applications which have the same top level domain.
a.example.com
b.example.com
example.com
We have a login mechanism where the user provides a username + password and logs in. Each of these websites wants to have cont… Continue reading SSO Using API based login (not through UI redirection)
I am a student learning Android Application development
I am a newbee to SSO oAuth2 etc and Im interested to learn.
I am comfortable with signing in a user using their username/password and obtaining Access and refresh tokens.
I have also … Continue reading how do you support sign in on android mobile applications for users who can only access the application via their institutions account
I am a student learning Android Application development
I am a newbee to SSO oAuth2 etc and Im interested to learn.
I am comfortable with signing in a user using their username/password and obtaining Access and refresh tokens.
I have also … Continue reading how do you support sign in on android mobile applications for users who can only access the application via their institutions account
In an SSO scenario (it’s Azure Active Directory specifically, but conceptually I’m not sure it matters), I obtain a token that then allows my application to impersonate the user to access resources – for example an Azure storage account wi… Continue reading Sending Client-Acquired SSO Token to My API Server to Access Firewalled Resources Under User Identity
Assume a multitenant cloud-based application with a zero-knowledge security scheme where the hashed user password acts as a key which protects an actual 256-bit AES user encryption key, and that user key is used to encrypt and decrypt all … Continue reading How to protect user/application-level encryption keys in an SSO scenario?
I am in the process of building an integration between 2 service providers (SP). I have setup my own Identity Provider, KeyCloak.
What I am trying to achieve is as follows: A user signs into SP1 using SSO, they get redirected to our IDP to… Continue reading SAML Authentication Across multiple Service providers
Assume my solution offers 5 identity providers that users can choose from
Apple
Facebook
Github
Google
Microsoft
These providers all take user identity very seriously. Is there any legitimate liability concern that an unauthorized person … Continue reading Security/Liability Concerns with Sign-In-Provider Account Merging
The attackers who pulled off the recent breach of continuous integration and continuous delivery (CI/CD) platform maker CircleCI got in by compromising an engineer’s laptop with malware, stealing their 2FA-backed SSO session cookie, and using it … Continue reading CircleCI breach post-mortem: Attackers got in by stealing engineer’s session cookie
Let’s say I’m building a web application (let’s focus on the backend side) that is B2C. Users should be able to register with my application, using a SSO provider like Google or Facebook. Once they’re registered, they can access other endp… Continue reading SSO and/or JWT: make sure web app’s endpoints are protected