Avatar of Seb
Seb
Flag for United States of America asked on

Safety of Third party Single Sign-On (SSO) on your network

Hello All,
I have a question about SSO (Single Sign-On).
There is a website that offers a service and in order to use their service they used to require knowing what our IP address was in order to control access to their services by IP. Now they are changing to SSO instead and even though I'm not familiar w/ SSO I know that they would need to connect to our AD for authentication and as we know a lot of breaches happen with Third party companies having access to internal network infrastructure. I don't feel comfortable using this method and since I'm not all that familiar with it I figured I'd ask your opinion. Yes, I do know that NOTHING is 100% secured and full proof but I want to at least make sure that I'm not potentially opening a can of worms.

My questions are:

- What are some of the risks if I chose to give their SSO access to our AD?
-If I decide to go w/ the SSO what are the questions I should be asking them to make sure that they have their "sh#*" together and will not potentially compromise our Server/network.
-What are some of your opinions on going w/ SSO from a Third party vendor?
-Should I implement SSO in this case or hold my ground and ask for another solution?
-Could I use AWS, Azure AD (or similar) to create just a stand alone AD on it's own to use with this service and is is cost prohibitive?

Thanks in advance for all your help, it's greatly appreciated!!
* sso* azure active directory* Single Sign On (SSO)Active DirectoryAWS

Avatar of undefined
Last Comment
Seb

8/22/2022 - Mon
Amit

SSO is completely safe. In your case you need to use app like ADFS from Microsoft. Setup ADFS environment, where you will be acting as IDP or identity provider and your application vendor will with using it. With ADFS you just relay claim or user attributes to your app vendor. Say, your user want to login to X app. Your app vendor will ask you to relay claims like email address, name and Group info. Once you relay those claims to your vendor, vendor will be using them to configure it's app and provide the access.

It is same like you are using your gmail account to login to other sites. From security point, you need to setup ADFS farm. More you can read here:
https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs

There is one more option ADLDS, but i don't recommend that, as it is bit complex to manage and required regular admin work.

Note: Don't give any access to your AD environment directly to any vendor.
Seb

ASKER
Thanks for the great information @Amit but I'm still not clear on this.

can you also answer these questions:
- What are some of the risks if I chose to give their SSO access to our AD?
-If I decide to go w/ the SSO what are the questions I should be asking them to make sure that they have their "sh#*" together and will not potentially compromise our Server/network.
-Could I use AWS, Azure AD (or similar) to create just a stand alone AD on it's own to use with this service and is is cost prohibitive?

YES, I'm with you. They are NOT getting access to our AD. LOL!!!
Ramasamy P

SSO is safe the way you define the roles. you have to create a role and share the role to the vendor.

you can use your existing AD and provide a role  with least access they needed

Just ask them the level of access and name of role needed.
I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst
William Peck
ASKER CERTIFIED SOLUTION
Amit

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
Seb

ASKER
Great, thanks!! I appreciate the help Gentlemen!.