Collaborate Disseminate
We are using Forgerock OpenAM for managing authentication and authorization and I was wondering if it is possible to use this configuration:
Domain 1 -> App 1 -> Use SAML2
Domain 1 -> App 2 -> Use OpenID Connect
Domain 2 ->… Continue reading Can I combine OpenID Connect and SAML2 protocols in OpenAM
I have 2 websites: a.com and b.com
To avoid using SAML for Single-Sign-On and making things complicated, I’ve taken this approach:
a.com is the identity provider. All users will be asked to sign in on a.com
b.com will receive information f… Continue reading Is is safe to pass an API key in a HMAC hash?
Why are we still talking about passwords? We already have single sign-on (SSO), and passwordless is the new buzzword everyone is talking about, but when you put yourself in the shoes of someone who is responsible for the overall security of an organiza… Continue reading Why are many businesses still not using a password manager?
Online accounts getting hijacked and misused is an everyday occurrence, but did you know that account pre-hijacking attacks are also possible? Inspired by previous research on preemptive account hijacking by way of single sign-on (SSO) technology, rese… Continue reading Account pre-hijacking attacks possible on many online services
Torii announced a report revealing that 69% of tech executives believe shadow IT is a top concern related to SaaS – or cloud application – adoption. The majority of respondents have made exceptions to their SaaS security protocols, with 80% doing so be… Continue reading Shadow IT is a top concern related to SaaS adoption
We are trying to set up(I am not part of the setting up process) an SSO based login for an ITSM application. Our organisation has some users working for us although they use their own organisation email address to log in. We use OKTA as ou… Continue reading How does the SAML based SSO differ for Internal (employees) and External users (external resources)?
My company provides a single SaaS product for corporate clients.
For one client we are implementing SSO with them as authentication provider (via Azure AD/SAML for now, but the library we are using is extensible).
The same client has asked… Continue reading Does splitting auth SSO and MFA parts, between client and service companies have any issues?
I am adding Single Sign-On (SSO) via Google and Microsoft identity providers to a web application where many thousands of user accounts already have existing credentials stored by username and password. Each account also has a primary emai… Continue reading Adding SSO to an existing website – should SSO login link to matching email address?
Whilst I was looking for an SAML authentication workflows I stumbled upon this link.
But instead of 301 redirect (or any kind of http redirect), I thought that once the app finds out that SAML authentication is required to contact into iDP… Continue reading Instead of 301 redirecting can I generate unique login endpoint in order to utilize an Http POST request during SAML Auth?
The most known SSO workflows require the Identity provider to provide the login page/form, for example Google’s Authentication for its services.
An example for that is the: Simple SAML SSO Workflow
But in my case, I have a bunch of apps th… Continue reading How can I have SSO with multiple login forms?