Collaborate Disseminate
When attackers pull off a privileged access breach, they have a beachhead into your network. Regardless of whether it’s software or users that are ill-protected, threat actors have a consistent playbook: establish a foothold on a vulnerable system, ele… Continue reading How to contain a privileged access breach and make sure it doesn’t happen again
LastPass released the findings of an IDC survey which revealed that “balancing company security requirements and the employee user experience” is the number one identity challenge, followed by “employees struggling with too many passwords.”… Continue reading The importance of balancing security requirements and employee user experience
My SaaS application offers enterprise customers the option to use SAML to authenticate their user population against their own Identity Provider. This normally works fine, however I am looking for advice on an edge case related to shared … Continue reading Authenticate via SAML without establishing SSO session
Setup:
Some service (SAS, HTTP, mongodb) running on a Linux server and using Windows AD/Kerberos for SSO.
On Linux, httpd is running as the http (Unix) account, and mariadb is running as "mariadb" (Unix) account.
Understanding:… Continue reading kerberoasting: Usefulness of hacking a SSO (GSSAPI/SPNEGO) service on Linux
Microsoft has issued an out-of-band emergency update fix to patch an authentication issue that was caused by the November 9th cumulative update for Windows Server. The bug affects Windows Server 2008 SP2 through to Windows Server 2019. The November 9th Patch Tuesday cumulative update (CU) for Windows Server causes a problem that can cause authentication […] Continue reading Microsoft Issues Emergency Update Fix for Windows Server SSO Authentication Bug
Let us say you have an app where the users will be required to deposit cryptocurrency. Is it safe to let users sign in with third-party authentication? For example "sign in with Google" or "sign in with Facebook"?
If it… Continue reading Using SSO for a cryptocurrency app
ref:
https://docs.microsoft.com/en-us/azure/active-directory/develop/reference-breaking-changes#appid-uri-in-single-tenant-applications-will-require-use-of-default-scheme-or-verified-domains
We setup customers to register our application i… Continue reading New rule on verifying domain for azureAD app registration
Companies often claim to be customer-centric, or even customer-obsessed, striving to offer technologies that their users demand. However, the findings of a recent global Auth0 survey suggest that organizations worldwide continue to miss the mark when i… Continue reading Organizations failing to give users the login experience they want
Business investment in SaaS applications continues to climb despite widespread underutilization of app licenses by employees. According to Productiv’s report, on average only 45% of company apps are being used on a regular basis. The data also shows 56… Continue reading SaaS applications investment growing despite underutilization of app licenses by employees
I had configured subdomains on a site to share forms authentication, however decisions were made to change one of websites over to a different domain. So now site A needs to send a user to the site B. Normally I would use something like Co… Continue reading Does hashing really make this home rolled sso process more secure?