Questions tagged [single-sign-on]
Single Sign On is a technology that allows a single login to be transparently used with multiple applications and environments.
351
questions
1
vote
1
answer
47
views
AD FS Access Control Policy to permit specific groups and require MFA
We use an on-premise AD FS server (currently on Windows Server 2019), with several "relying party" applications. This is connected to local Active Directory, which in turn syncs to an Azure ...
- 13k
0
votes
1
answer
48
views
Is there a solution to manage users in some systems or at least in linux?
I work somewhere with a lot of Linux and VPS servers. When someone joins the company, other staff members need to add his SSH key to each server; conversely, if someone leaves, all of his SSH keys ...
0
votes
0
answers
133
views
SSO not working between a browser and a Keycloak using an user federation with kerberos integration to a windows AD
I am trying to get SSO working using a browser(Chrome or firefox) and keycloak configured with an user federation AD Domain(kerberos is configured).
First I present the overview of what I have and ...
0
votes
0
answers
40
views
Is there a way to add SAML-based SSO to an unauthenticated application I am hosting?
I am running an application that doesn't have authentication built-in. I would like to require Google SSO with SAML as a way for users to be allowed to use the application. I am looking for any advice ...
- 101
1
vote
0
answers
73
views
Configuring cyrus to use oauth2 via keycloak with ldap backend?
We are using cyrus (and exim) as a long-running mail server. The requirement to store passwords in email programs seems to be a security risk to me. I would like to move auth behind something like ...
- 121
1
vote
0
answers
87
views
Looking for a good beginners guide for SSO and HAProxy (keyloak, authelia..)
Im using haproxy now for several years and im very happy... (After i experienced with traefik...) Now i want to put some of my docker-microservices (hedgedoc etc) in the internet. But i want to have ...
- 41
0
votes
0
answers
49
views
applying Nginx SSO with authorization to selected subdomains
I need an open source SSO tool integrated with Nginx like authelia. It must be able to manage users' access to different sites. For example, the "s.com" domain is protected by SSO. This ...
- 1
0
votes
1
answer
92
views
Unable to setup SAML with internal IdP (SP is checking for valid URL)
I've been reading through the various ways to configure an IdP/SP relationship and going back forth with a vendor I'm setting up our IdP to authenticate with. We've exchanged metadata and the ...
- 761
-1
votes
1
answer
74
views
Why does AWS Cognito require a client secret when configuring an external IdP (Azure AD)?
I don't understand why AWS Cognito require a client secret when configuring an external IdP (e.g. Azure AD).
AFAIK, AWS Cognito merely forwards federated identities to the external IdP for (OIDC) ...
- 429
0
votes
0
answers
32
views
Do I need an ADFS and Proxy?
The client has an ADFS server and they use our APP hosted on IIS developed on Dot Net.
How Do I set UP ADFS - do I need ADFS Proxy server as well, Can I use an existing AD server and install ADFS, we ...
- 262
1
vote
0
answers
188
views
AD FS 3.0 SSO issue in Outlook Desktop Application with Modern Auth for MS365
I have installed and configured AD FS services on a Microsoft Windows Server 2016 Standard.
Through Azure AD Connect we were able to configure our domain as a federated domain on our Microsoft 365 ...
- 1,539
0
votes
0
answers
58
views
How can I debug a 'KidNotFound' error when implimenting GitLab SSO with Azure AD as IdP?
I am trying to integrate our self-managed GitLab 15.9.3-ee instance with our Azure AD. Using Azure AD as the IdP for SSO in to GitLab, I have been using the documentation here:
https://docs.gitlab.com/...
- 11
1
vote
1
answer
296
views
Setup SSO : openldap, kerberos, nfs(truenas) :
Currently I am able to setup a SSO NFS setup with openldap ldap server and Truenas NFS server (with LDAP access configured). The ubuntu clients are able to use pam-mount to mount the nfs home shares. ...
- 13
0
votes
1
answer
169
views
Azure AD B2C on backend or front end?
I have a service oriented application where the fornt end is a NextJs application and the backend is a .net core API project.
I want to use Azure AD B2C to provide Authentication.
Should I configure ...
- 1
0
votes
1
answer
1k
views
ADFS Client Certificate Authentication
I have ADFS on my environment and it's currently authenticating via active directory perfectly fine. I'm trying to enable certificate authentication so they can authenticate with their smart cards. ...
- 1
-1
votes
1
answer
419
views
Azure AD B2C use case - SSO between 2 applications
I have 2 applications .
Application 1 : A .NET backend / Angular frontend app with AD B2C for authentication. (This application is already developed and working.)
Application 2 : A similar stack ...
1
vote
0
answers
170
views
Implement SSO between a custom app and Microsoft 365 with custom identity provider
I’m trying to implement SSO between a custom app and Microsoft 365 so that when the users hit any link to Teams o SharePoint Online in the Liferay app, ADFS doesn't ask for credentials. Context:
ADFS ...
1
vote
0
answers
569
views
Microsoft-Account authentication issues after Office365 organization join
Years ago I registered my domain for Windows Live Domains (domains.live.com) and created 5 accounts for me and my family (@mydomain.tld). These email-adresses are our primary addresses and also ...
- 21
0
votes
0
answers
435
views
Authentication Uses NTLM instead of Kerberos
We have transfered our site (httpd+nginx+php) from simple host with 3 containers to kuber cluster. And after that for some reason SSO has stopped working. Kerberos and samba configs are the same, AD ...
0
votes
0
answers
663
views
Apache with SSO and group-based authentification
I would like to configure SSO in Apache incl. group-based authentication. It means that users, who are a member of a particular group, should be able to log in to the website without entering the ...
- 1
1
vote
2
answers
63
views
Possible ways of enabling SSO in Active Directory / Azure Active Directory
I saw in some videos that the recommendation today is to avoid using ADFS for SSO. I would like to confirm that statement and to know what are all the possible ways to enable SSO without using ADFS in ...
- 27
2
votes
0
answers
985
views
Single Sign on (SSO) not working on Firefox
Could it be that Firefox doesn’t support all windows NTLM SSO scenarios on a Sharepoint Site via adfs? Login attempts into Sharepoint site just gets stuck on the login page and nothing happens ...
- 51
0
votes
0
answers
279
views
Azure AD app registration - possible to modify or transform email claim provided by OIDC SSO?
We have two instances of a SaaS app from a vendor that have SSO capabilities using OIDC. Our app users are differentiated based on the provided email address when logging in using the login page ...
- 121
0
votes
0
answers
518
views
Apache2 SSO mod_auth_kerb An unsupported mechanism was requested
I am using a Windows 2022 Server running the active directory (server.local) and a Debian 10 Server running Apache.
When accessing the Site with Chrome or Internet Explorer it returns a 401 Status ...
- 1
0
votes
1
answer
957
views
Issues configuring SAML authentication in Apache Guacamole behind a HAProxy
I've deployed an Apache Guacamole server and trying to configure SSO using SAML with a Cloud IdaaS. HAproxy is in front of the Guacamole server, providing SSL offloading. Apache Guacamole was ...
- 219
0
votes
1
answer
477
views
Single Signon best practice for phpMyAdmin across multiple servers
I run a small web development company and we run multiple production servers, each with their own MySQL database server. I'm trying to figure out the best way of giving access to these separate MySQL ...
- 101
1
vote
1
answer
1k
views
Azure AD Kerberos decryption key rollover; new-azureADSSOAuthenticationContext; using token instead of pscredential
We do the 30 days kerberos decryption key rollover process automated by using an "encrypted" password stored within a text file to create the neccessary PSCredential object for the ...
- 133
0
votes
0
answers
40
views
Is it possible to add Google single sign on to specific 365 users, NOT the whole tenant?
We've got a client with a satellite office outside of the US, and it's not connected to their AD server. As such, changes to their 365 passwords are not synced like the home office does, and it gets ...
- 1
0
votes
1
answer
199
views
basic understandig about kerberos sso in apache
I'm trying to configure kerberos sso in apache at the moment.
On the test server the website sub.internal.local workes quite well in reference to the kerb sso.
When I try to adopt the config to ...
- 1
0
votes
1
answer
163
views
OpenCms: Kerberos SSO authentication with httpd+Tomcat
I have a standalone httpd+Tomcat 8.5.65 installation on OpenJDK 11 with OpenCms 11.0.2 for my client's internal website.
They have a LDAP network and they're requesting the automated logon using ...
- 101
1
vote
0
answers
1k
views
Apache reverse proxy with Kerberos authenticate and LDAP authorization
Server version: Apache/2.4.37 (Red Hat Enterprise Linux)
Apache is launched as a container in the Openshift cluster.
I am using Apache as a forward and reverse proxy for Kibana.
Mandatory requirement ...
- 11
0
votes
0
answers
374
views
Login to SSL VPN via SSO and then use SSO inside VPN for other Service Providers possible?
I have a setup where you authorize via SAML SSO (keycloak as idp) to access a SSL VPN (fortigate as sp). Now inside the VPN there are authorization reverse proxy servers.
Is it possible to have the ...
- 1
1
vote
1
answer
229
views
Does Windows SSO work with ADFS 2016 for OIDC Web Application?
Our web application uses OpenID-Connect (OIDC) Implicit Flow for user login with ADFS 2016. Login generally works, however users get login screen for user name and password.
Does Windows-Login / SSO (...
0
votes
2
answers
311
views
ADFS as proxy to some IDP
As far as I know, Exchange does support WS-Federation, but it does not support SAML. At the same time I have IDP that does support SAML, but does not support WS-Federation.
Is it possible to configure ...
- 145
0
votes
1
answer
3k
views
SAML 2.0 NameIDPolicy that was not satisfied by the issued token
I am working on a SAML integration with some monitoring software, but I keep receiving the MSIS7070 error below. I have tried numerous transform combinations with no luck. I am certain this is ...
- 111
1
vote
0
answers
864
views
AWS SSO: Should I use Permission Sets or IAM Roles, or Both?
We have AWS accounts for dev, staging, and prod. We use AWS SSO via Okta, and define groups like "Developers" and "Support" in Okta.
Developer group should have broad access to ...
- 575
1
vote
0
answers
703
views
Office 365 with SSO, but needs email to be accessed via POP and send mails via SMTP
We are moving from Godaddy to Office 365. Many of our staff use Thunderbird and a few use Gmail to read office emails (collection emails via POP).
Office 365 uses SSO by OneLogin to authenticate users....
- 11
1
vote
0
answers
864
views
Linking authentication FreeIPA and SSO
Long story short, my goal is to have all user permissions managed in one place and then deployed everywhere. My thoughts are that Active Directory/FreeIPA is perfect for this sort of thing. It also ...
0
votes
1
answer
1k
views
What is the proper way to use IIS to forward the REMOTE_USER header to Tomcat?
I am trying to set up SSO with IIS 10 and Tomcat 9. I want to use Windows Authentication in IIS and pass the authenticated username to Tomcat. I had this working with Tomcat 8.5, however after ...
- 111
1
vote
0
answers
152
views
How to configure the apache authorization chain for Kerberos (mod_auth_kerb) and SSL?
What directives and conditions to configure the Apache configuration as follows:
We try to authorize through Kerberos.
If successful (What condition to use?), Then we redirect to URL1.
Otherwise, we ...
-1
votes
1
answer
195
views
With Microsoft 365 SSO. Delete user in third-party App when such user gets deleted in Active Directory
I have an application connected to Microsoft Active Directory using SSO. So basically users in the third-party App authenticate with Microsoft 365 using SSO however we would like to delete a user in ...
- 119
1
vote
0
answers
616
views
Why isn't Kerberos used for SSO to cloud apps?
When comparing Kerberos to SAML, a common argument on StackOverflow sites and the rest of Internet is that SAML is for Internet / cloud applications while Kerberos is for enterprise LAN. There are ...
- 187
1
vote
0
answers
66
views
Integrating GitHub Org with SAML shibboleth & post actions
I am at the beginner level of GitHub cloud administration and looking for answers to the below-listed questions after I enable SAML integration (Shibboleth) for my Github cloud Organisation.
Before ...
github
0
votes
0
answers
320
views
IIS: Kerberos authentication only works from local machine
I'm setting up an IIS application on a server within my domain. I configured SPN's and settings to allow windows authentication to work with kerberos and Single Sign On, and everything works fine on ...
-1
votes
1
answer
48
views
how we can generate the single sign on and reply url for new application in azure active directory
I am going to register a new application in the Azure active directory for SAML login.
How can I generate my reply URL and single sign on url and entity ID ?
1
vote
1
answer
196
views
graviteeio - management-rest-api oauth role mappings
Gravitee manager can be configured with keycloak authentication as described here.
They state in their documentation, that role mapping could be addressed on their gravitee.yml configuration:
security:...
- 11
1
vote
0
answers
40
views
Created a new account in my Google Admin tenant, login always redirects to Microsoft's SSO page
I have a very old Google Admin tenant from when this service was still available for free. I don't use it for email anymore; my email is hosted on outlook.com now (another now-defunct free option). I ...
- 213
1
vote
0
answers
158
views
How can I pass login_hint/authuser to Google IdP when using AWS SSO
I have configured AWS SSO to use Google as an IdP. It's working fine.
However, since I have multiple google accounts I often have to go through the multiple login 'chooser'.
When accessing Google ...
- 161
1
vote
0
answers
39
views
Windows ADFS User Certificate URL
I have setup a window lab server based on windows server 2012 r2. I have an AD, ADFS and CS.
I have setup User certificate enrollment. Everything work fine but I have a litle issue.
I have setup ADFS ...
1
vote
0
answers
3k
views
curl not sending credentials during negotiation
We have a Jenkins server that uses Kerberos-SSO, with a fallback to Basic if SSO is not configured on the browser or using curl.
When I use curl with the --negotiate argument, however, it doesn't send ...
- 534