Single Sign-On (SSO) is an authentication process that allows users to access multiple services with a single set of login credentials. Although SSO improves the user experience, it poses challenges to developers to implement complex authentication protocols securely. External services, called brokers, simplify the integration of SSO. In this paper, we shed light on the emerging brokered SSO ecosystem, focusing on the security of the newly introduced actor, the broker. We systematically evaluate the landscape of brokered SSO, uncovering significant blind spots in previous research. Our study reveals that 25% of the websites with SSO integrate brokers for authentication, an area that has not been covered by any previous research. Through our comprehensive security evaluation, we identify three categories of threats associated with brokered SSO: (1) insufficient validation of redirect chains enabling injection attacks, (2) unauthorized data access enabling account takeovers, and (3) violations of security best current practices. We expose vulnerabilities in over 50 brokers, compromising the security of more than 2k websites. These findings represent only a lower bound of a critical situation, underscoring the urgent need for improved security measures and protocols to safeguard the integrity of brokered SSO systems.

Description

Title

• Identity Broker Analysis

Creator or Contributor

• Name

  Louis Jannett

  Role

  Researcher

  ORCID

  https://orcid.org/0000-0001-5448-5929

  Affiliation

  Ruhr University Bochum

  Name

  Tommaso Innocenti

  Role

  Researcher

  ORCID

  https://orcid.org/0000-0003-0247-806X

  Affiliation

  Northeastern University

  Name

  Christian Mainka

  Role

  Researcher

  ORCID

  https://orcid.org/0000-0002-4273-645X

  Affiliation

  Ruhr University Bochum

  Name

  Vladislav Mladenov

  Role

  Researcher

  ORCID

  https://orcid.org/0000-0001-9208-9281

  Affiliation

  Ruhr University Bochum

  Name

  Engin Kirda

  Role

  Researcher

  ORCID

  https://orcid.org/0000-0001-9988-6873

  Affiliation

  Northeastern University

Resource type

• Dataset

Keyword

• Single Sign-On
• Identity Broker

License

• http://opensource.org/licenses/MIT

Description

• Single Sign-On (SSO) is an authentication process that allows users to access multiple services with a single set of login credentials. Although SSO improves the user experience, it poses challenges to developers to implement complex authentication protocols securely. External services, called brokers, simplify the integration of SSO. In this paper, we shed light on the emerging brokered SSO ecosystem, focusing on the security of the newly introduced actor, the broker. We systematically evaluate the landscape of brokered SSO, uncovering significant blind spots in previous research. Our study reveals that 25% of the websites with SSO integrate brokers for authentication, an area that has not been covered by any previous research. Through our comprehensive security evaluation, we identify three categories of threats associated with brokered SSO: (1) insufficient validation of redirect chains enabling injection attacks, (2) unauthorized data access enabling account takeovers, and (3) violations of security best current practices. We expose vulnerabilities in over 50 brokers, compromising the security of more than 2k websites. These findings represent only a lower bound of a critical situation, underscoring the urgent need for improved security measures and protocols to safeguard the integrity of brokered SSO systems.

Date

• Published

  2024-10-14

Subject

• IT Security
• Single Sign-On
• Authorization and Authentication
• Identity Brokers

Language

• English

Identifier

• DOI

  10.60517/xd07gs75z

Publisher

Last modified

• 2024-10-08