OMG WTF SSO: A Humorous Look at Single Sign-On Misconfigurations
0:00:31 Introduction: Adena, a liaison between technical teams and IT, shares her experiences with single sign-on (SSO) misconfigurations in a business-focused, yet broadly applicable, talk.
0:01:19 What is SSO?: SSO allows users to log in once and access multiple related but independent software systems, ideally streamlining access and improving security.
0:03:06 The Dream of SSO: Centralized user management, easier user experience, and consistent security standards enforcement across all connected services.
0:06:27 SSO Protocols: A way for an identity provider to tell a service, "Yeah, that's Bob," but this alone doesn't guarantee secure or correct implementation.
0:07:32 The Reality of SSO Implementation: Misconfigurations can lead to serious security vulnerabilities, making it crucial to understand both your and your vendor's needs and perspectives.
0:08:33 Figuring Out Your Needs: Example needs: users must sign in through the company, and users can only access their own stuff.
0:09:42 Understanding Vendor Perspectives: Vendors may prioritize user convenience or have different assumptions about access control, leading to potential mismatches with your security requirements.
0:16:09 Weird Question 1: Can users from other identity providers access your organization's accounts? This might be necessary for consultants or partners, but it needs careful management and monitoring.
0:17:37 Failure Case 1: Turning on SSO might not disable other authentication methods, potentially allowing unauthorized access through compromised credentials or other SSO setups.
0:19:01 Weird Question 2: Will the vendor ever fail away from your sign-in method? Break-glass accounts might be necessary for emergencies, but the conditions and security of failover mechanisms must be understood.
0:20:11 Weird Question 3: How is API access enforced? API access might bypass SSO, requiring separate security considerations.
0:20:24 Failure Case 2: The vendor's own phone app might use basic authentication, bypassing SSO enforcement.
0:21:44 Weird Question 4: Can Bob access Alice's account with her username and password? If attribute mapping relies on user-editable fields, attackers might exploit this to gain unauthorized access.
0:23:18 Attribute Mapping: The process of matching user accounts between your identity provider and the vendor's system.
0:24:04 Failure Case 3: If attribute mapping is based on a lookup table and usernames are editable, attackers might manipulate usernames to gain access to other accounts.
0:26:42 Weird Question 5: Are shared accounts allowed? Shared accounts can be useful but pose security risks if not properly managed and monitored.
0:27:12 Failure Case 4: Shared accounts, if allowed, might enable users to gain unauthorized access by linking their account to another user's compromised credentials.
0:27:59 Squarespace/Google Domains Issue: A real-world example of SSO misconfiguration where Squarespace's assumptions about user behavior and authentication methods led to compromised domain admin accounts.
0:30:32 Conclusion: Ask questions, don't make assumptions, and test things out to ensure your SSO implementation is secure and meets your needs.
0:31:54 Q&A: Discussion about just-in-time provisioning, role management, threat modeling, and the importance of asking questions to ensure a secure SSO implementation.