4 ms·

Man, I hate hate hate seeing the SSO portal 30 times a day, reaching for my phone to answer the popup every time. Which sometimes gets eaten by "Focus Mode" on

Man, I hate hate hate seeing the SSO portal 30 times a day, reaching for my phone to answer the popup every time. Which sometimes gets eaten by "Focus Mode" on my iPhone, or randomly goes to my watch and I have to look at both. Wasn't the dream to log in once in the morning, and have your SSO token be valid for all systems all day? Is anyone out there successfully putting the "Single" in "Single Sign On"?

bedatadriven 4y ago
I'm not sure about the apps you're using, but our SaaS app sends users to Azure AD for example to authenticate via OpenID Connect and in 90% of the cases they are instantly directed back because they are already logged in.
- mc32 4y ago
  It depends, some apps might be configured to require auth before taking you to the app. It may depend on compliance, or some company policy. Or if there is an SLO app that invalidates login sessions.
Aeolun 4y ago
I’m fairly certain this works great for all systems that allow big bad enterprise to control what you do (Windows and IE, but Chrome is getting there too). Using FF on a Mac apparently makes it really hard to do automatic sign-on.
dexwiz 4y ago
I have used a few SSO providers and never had this. I usually log into the portal once and then everything else resolve via redirects without interaction the rest of the day. Maybe I have to click confirm. This sounds like bad configuration on your ITs side of things.
coldacid 4y ago
Very likely it's your SSO vendor or IT department to blame for this (and in the latter case, probably due to policies they have to enforce but they aren't allowed to control).
jiveturkey 4y ago
Yes, plenty of places do this successfully. You either have some very aggressive cookie blocking or your IT has it setup this way in some misguided strict way.
ironmagma 4y ago
On top of that, it’s called “two” factor authentication, not “phone” factor authentication. Why can I not simply use another computer or YubiKey to sign in, it has to be a phone? So annoying.
- marcosdumay 4y ago
  Shouldn't need another computer either. The extra security is having that one computer you use all the time participating on the login. If it's the one you are using, there is no reason at all to require another.
mooreds 4y ago
It's a configuration option, so it is in control of your IT staff. I'm not sure if there are security risks/compliance requirements specifying such a short SSO session duration (20 min?), but may be worth asking. > Wasn't the dream to log in once in the morning, and have your SSO token be valid for all systems all day? Is anyone out there successfully putting the "Single" in "Single Sign On"? I work for an identity provider that many of our clients use for SSO between applications, and it is absolutely possible to configure our solution to require 1 sign-in per day.
deleted 4y ago
[deleted]
porjo 4y ago
I have the same frustration at current $BIG_CORP employer. It's maddening to think how much productivity must be lost by 100s of engineers being interrupted many times a day by this! Granted, I know nothing about how it is implemented, but I struggle to comprehend why this is necessary - the SSO client knows I authenticated literally minutes go from this device...how is that not sufficient verification!?
FastMonkey 4y ago
It's like that smart home post from a few days ago. The dream is that lights, heating and entertainment automatically turn on and off and adjust throughout the day. The reality is that someone in the house has to become the IT department, troubleshooting issues all the time. The reality is just way more work than the dream.

bedatadriven 4y ago

I'm not sure about the apps you're using, but our SaaS app sends users to Azure AD for example to authenticate via OpenID Connect and in 90% of the cases they are instantly directed back because they are already logged in.

mc32 4y ago
It depends, some apps might be configured to require auth before taking you to the app. It may depend on compliance, or some company policy. Or if there is an SLO app that invalidates login sessions.

Aeolun 4y ago

I’m fairly certain this works great for all systems that allow big bad enterprise to control what you do (Windows and IE, but Chrome is getting there too). Using FF on a Mac apparently makes it really hard to do automatic sign-on.

dexwiz 4y ago

I have used a few SSO providers and never had this. I usually log into the portal once and then everything else resolve via redirects without interaction the rest of the day. Maybe I have to click confirm. This sounds like bad configuration on your ITs side of things.

coldacid 4y ago

Very likely it's your SSO vendor or IT department to blame for this (and in the latter case, probably due to policies they have to enforce but they aren't allowed to control).

jiveturkey 4y ago

Yes, plenty of places do this successfully. You either have some very aggressive cookie blocking or your IT has it setup this way in some misguided strict way.

ironmagma 4y ago

On top of that, it’s called “two” factor authentication, not “phone” factor authentication. Why can I not simply use another computer or YubiKey to sign in, it has to be a phone? So annoying.

marcosdumay 4y ago
Shouldn't need another computer either. The extra security is having that one computer you use all the time participating on the login. If it's the one you are using, there is no reason at all to require another.

mooreds 4y ago

It's a configuration option, so it is in control of your IT staff. I'm not sure if there are security risks/compliance requirements specifying such a short SSO session duration (20 min?), but may be worth asking. > Wasn't the dream to log in once in the morning, and have your SSO token be valid for all systems all day? Is anyone out there successfully putting the "Single" in "Single Sign On"? I work for an identity provider that many of our clients use for SSO between applications, and it is absolutely possible to configure our solution to require 1 sign-in per day.

deleted 4y ago

[deleted]

porjo 4y ago

I have the same frustration at current $BIG_CORP employer. It's maddening to think how much productivity must be lost by 100s of engineers being interrupted many times a day by this! Granted, I know nothing about how it is implemented, but I struggle to comprehend why this is necessary - the SSO client knows I authenticated literally minutes go from this device...how is that not sufficient verification!?

FastMonkey 4y ago

It's like that smart home post from a few days ago. The dream is that lights, heating and entertainment automatically turn on and off and adjust throughout the day. The reality is that someone in the house has to become the IT department, troubleshooting issues all the time. The reality is just way more work than the dream.