Databases
StackOverflow2013
Postsdbo
POIs this SSO implementation secure?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POIs this SSO implementation secure?
    primarykey
    data
    text
    <p>A client has asked us to devise a simple Single sign-on solution for their vendors. In this situation, the client has many vendors with the capabilities to implement a simple solution which allows the vendors' users to sign in to our client's site. I came up with this:</p> <p><strong>Shared data</strong></p> <p>The following data will be shared between us and a given vendor.</p> <ul> <li>user_id - <em>Provided by vendor</em></li> <li>vendor_id - <em>Provided by us</em></li> <li>vendor_secret - <em>Provided by us. "Random" SHA512 hash</em></li> </ul> <p><strong>Shared hashing function</strong></p> <p>Our specification will define the following practice for producing a key that is suitable for transmission via URL parameters:</p> <pre><code>// Pseudo-code. Assume sha512() is a function in their native language that accepts a string and returns a SHA-512 hash vendor_id = 341; vendor_secret = "areallylonghash..."; user_id = "12345abcdef;&amp;"; hash = sha512(vendor_id + ":" + vendor_secret + ":" + user_id); </code></pre> <p><strong>SSO Process</strong></p> <ol> <li>User clicks "log in" on a vendor's site and a GET request is issued to the vendor's SSO entry point.</li> <li>Vendor recieves request on entry point (Say www.avendor.com/sign_in).</li> <li>Vendor uses hashing function above to generate hash for user.</li> <li>Vendor redirects to our client's endpoint with the parameters <code>vendor_id</code>, <code>user_id</code>, and <code>hash</code>.</li> <li>We receive a request at our endpoint. We look up the vendor_secret from the vendor_id passed and attempt to recreate the <code>hash</code> that was sent to us.</li> <li>If the generated hash matches, create a session on the client's site.</li> </ol> <p><strong>Potential problems</strong></p> <p>If we're using a GET request for the redirection step 4 is it possible that the generated hash could end up in a user's browser history? Not very secure if someone can just click on a link in the history. Could we use HTTP headers to transmit the hash when redirecting?</p> <p>If you've gotten this far, thank you. All feedback is welcome! We're like to make sure we're deploying a secure solution.</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. This table or related slice is empty.
    1. USbloudermilk
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POIs this SSO implementation secure?
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POIs this SSO implementation secure?
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POIs this SSO implementation secure?
      1. USbob
      1. VTFavorite
    1. COCan you use one of the many OpenId libraries http://openid.net/developers/libraries/ for your solution?
      singulars
      1. POIs this SSO implementation secure?
      1. USAndrew Savinykh
    2. COUnfortunately the vendor we've spoken with is not open to adopting an open SSO standard... I know that sounds ridiculous, but they're not willing to invest the time in implementing something like OpenID or OAuth.
      singulars
      1. POIs this SSO implementation secure?
      1. USbloudermilk
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload