asked on Safety of Third party Single Sign-On (SSO) on your network
Hello All,
I have a question about SSO (Single Sign-On).
There is a website that offers a service and in order to use their service they used to require knowing what our IP address was in order to control access to their services by IP. Now they are changing to SSO instead and even though I'm not familiar w/ SSO I know that they would need to connect to our AD for authentication and as we know a lot of breaches happen with Third party companies having access to internal network infrastructure. I don't feel comfortable using this method and since I'm not all that familiar with it I figured I'd ask your opinion. Yes, I do know that NOTHING is 100% secured and full proof but I want to at least make sure that I'm not potentially opening a can of worms.
My questions are:
- What are some of the risks if I chose to give their SSO access to our AD?
-If I decide to go w/ the SSO what are the questions I should be asking them to make sure that they have their "sh#*" together and will not potentially compromise our Server/network.
-What are some of your opinions on going w/ SSO from a Third party vendor?
-Should I implement SSO in this case or hold my ground and ask for another solution?
-Could I use AWS, Azure AD (or similar) to create just a stand alone AD on it's own to use with this service and is is cost prohibitive?
Thanks in advance for all your help, it's greatly appreciated!!
I have a question about SSO (Single Sign-On).
There is a website that offers a service and in order to use their service they used to require knowing what our IP address was in order to control access to their services by IP. Now they are changing to SSO instead and even though I'm not familiar w/ SSO I know that they would need to connect to our AD for authentication and as we know a lot of breaches happen with Third party companies having access to internal network infrastructure. I don't feel comfortable using this method and since I'm not all that familiar with it I figured I'd ask your opinion. Yes, I do know that NOTHING is 100% secured and full proof but I want to at least make sure that I'm not potentially opening a can of worms.
My questions are:
- What are some of the risks if I chose to give their SSO access to our AD?
-If I decide to go w/ the SSO what are the questions I should be asking them to make sure that they have their "sh#*" together and will not potentially compromise our Server/network.
-What are some of your opinions on going w/ SSO from a Third party vendor?
-Should I implement SSO in this case or hold my ground and ask for another solution?
-Could I use AWS, Azure AD (or similar) to create just a stand alone AD on it's own to use with this service and is is cost prohibitive?
Thanks in advance for all your help, it's greatly appreciated!!
* sso* azure active directory* Single Sign On (SSO)Active DirectoryAWS
Last Comment
Seb
ASKER
Thanks for the great information @Amit but I'm still not clear on this.
can you also answer these questions:
- What are some of the risks if I chose to give their SSO access to our AD?
-If I decide to go w/ the SSO what are the questions I should be asking them to make sure that they have their "sh#*" together and will not potentially compromise our Server/network.
-Could I use AWS, Azure AD (or similar) to create just a stand alone AD on it's own to use with this service and is is cost prohibitive?
YES, I'm with you. They are NOT getting access to our AD. LOL!!!
can you also answer these questions:
- What are some of the risks if I chose to give their SSO access to our AD?
-If I decide to go w/ the SSO what are the questions I should be asking them to make sure that they have their "sh#*" together and will not potentially compromise our Server/network.
-Could I use AWS, Azure AD (or similar) to create just a stand alone AD on it's own to use with this service and is is cost prohibitive?
YES, I'm with you. They are NOT getting access to our AD. LOL!!!
SSO is safe the way you define the roles. you have to create a role and share the role to the vendor.
you can use your existing AD and provide a role with least access they needed
Just ask them the level of access and name of role needed.
you can use your existing AD and provide a role with least access they needed
Just ask them the level of access and name of role needed.
ASKER CERTIFIED SOLUTION
THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ASKER
Great, thanks!! I appreciate the help Gentlemen!.
It is same like you are using your gmail account to login to other sites. From security point, you need to setup ADFS farm. More you can read here:
https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs
There is one more option ADLDS, but i don't recommend that, as it is bit complex to manage and required regular admin work.
Note: Don't give any access to your AD environment directly to any vendor.