Why Single Sign on Sucks
goteleport.com
Why Single Sign on Sucks
1–10 of 124 posts
Re: Why Single Sign on Sucks
#2This is how I login to SSO today at work: Login username is cached in browser. Password is auto-filled-in by my password manager, which is in turn unlocked for a period of time when I am logged into my desktop. I hit "Log In" button. Backend does magic. An app pops up on my phone. I supply my fingerprint. Authentication is approved, and my browser is now logged in.
Same pattern works for logging into AWS from the console. My password manager keeps the username and password. Every time my AWS temporary session token expires, AWS CLI asks saml2aws for a new session token. Saml2aws gets user/password from the password manager, logs in. If session has expired, I get a pop-up on my phone asking me to log in. I supply fingerprint. Authentication is approved, and saml2aws creates a new session, passes it to AWS CLI, and I'm off to the races.
I can control exactly how often I have to enter in a password (to unlock my password manager), and the site administrator determines how long my sessions last. Is it super duper secure? No. But is it better than me typing my password, hitting submit, getting a text message, and typing a code in? Absolutely.
The same pattern can totally work across multiple sites. The standards just need to be changed to allow it to happen. This isn't a technical problem, it's a political one.
Re: Why Single Sign on Sucks
#3I feel like this article misses the point that SSO is intended to benefit organisations, not users. The selling point is that if an IT department can point a new service at Active Directory or something, it's going to be much less of a headache than managing n sets of user credentials.
Re: Why Single Sign on Sucks
#4My experience is completely opposite of the author's. I sign on once a day when I access a service that uses my firm's SSO solution. I'm then automatically signed in to all other services as I use them. It's quite seamless. I have no complaints about the SSO setup in my firm.
Re: Why Single Sign on Sucks
#5downstream SSO consumers sure do like to expire em quickly and idk why. using jumpcloud SSO with several sites is not painful, aside from things like github hiding a tiny line saying "sign on w sso" and making the tables where stuff would be shown empty so it's initially easy to miss you're not fully signed in. like just kick me to full sso button screen instead of showing a bunch of stuff i cant interact with until i click that banner
Re: Why Single Sign on Sucks
#6This is how I login to SSO today at work: Login username is cached in browser. Password is auto-filled-in by my password manager, which is in turn unlocked for a period of time when I am logged into my desktop. I hit "Log In" button. Backend does magic. An app pops up on my phone. I supply my fingerprint. Authentication is approved, and my browser is now logged in. Same pattern works for logging into AWS from the con…
The problem is it's much more complex to manage N users in N applications, having a central location to onboard and offboard your users is a huge boon to IT departments. The convenience isn't for you as the user.
Re: Why Single Sign on Sucks
#7I feel like this article misses the point that SSO is intended to benefit organisations, not users. The selling point is that if an IT department can point a new service at Active Directory or something, it's going to be much less of a headache than managing n sets of user credentials.
That's centralized identity management, not single-sign-on. Single-sign-on is/was supposed to mean you sign on once. I've never seen it actually work.
Re: Why Single Sign on Sucks
#8not a great article. apart from multiple wrong or missing words, the section about browser profiles is just plain weird and ignoring firefox premiered this without any tracking motivation and also with different set of problems in mind. many sections read as if the author did slightly superficial or slightly off research.
Re: Why Single Sign on Sucks
#9This is how I login to SSO today at work: Login username is cached in browser. Password is auto-filled-in by my password manager, which is in turn unlocked for a period of time when I am logged into my desktop. I hit "Log In" button. Backend does magic. An app pops up on my phone. I supply my fingerprint. Authentication is approved, and my browser is now logged in. Same pattern works for logging into AWS from the con…
Sounds ripe for some additional automation involving a synthetic fingerprint mounted on an actuator, and some image recognition to know when to lower it onto the phone.
Re: Why Single Sign on Sucks
#10My experience is completely opposite of the author's. I sign on once a day when I access a service that uses my firm's SSO solution. I'm then automatically signed in to all other services as I use them. It's quite seamless. I have no complaints about the SSO setup in my firm.
So your company doesn't have certain functions where someone has said "this is really critical so we'll force a sign-in even if the SSO token is already there" because that happens to me 10 times a day at my work.