Hacker News Reader

Comment by nsxwolf | Hacker News Reader

Man, I hate hate hate seeing the SSO portal 30 times a day, reaching for my phone to answer the popup every time. Which sometimes gets eaten by "Focus Mode" on my iPhone, or randomly goes to my watch and I have to look at both.

Wasn't the dream to log in once in the morning, and have your SSO token be valid for all systems all day? Is anyone out there successfully putting the "Single" in "Single Sign On"?

View on HN

It's a configuration option, so it is in control of your IT staff. I'm not sure if there are security risks/compliance requirements specifying such a short SSO session duration (20 min?), but may be worth asking.

> Wasn't the dream to log in once in the morning, and have your SSO token be valid for all systems all day? Is anyone out there successfully putting the "Single" in "Single Sign On"?

I work for an identity provider that many of our clients use for SSO between applications, and it is absolutely possible to configure our solution to require 1 sign-in per day.

I have used a few SSO providers and never had this. I usually log into the portal once and then everything else resolve via redirects without interaction the rest of the day. Maybe I have to click confirm. This sounds like bad configuration on your ITs side of things.

Very likely it's your SSO vendor or IT department to blame for this (and in the latter case, probably due to policies they have to enforce but they aren't allowed to control).

On top of that, it’s called “two” factor authentication, not “phone” factor authentication. Why can I not simply use another computer or YubiKey to sign in, it has to be a phone? So annoying.

Shouldn't need another computer either. The extra security is having that one computer you use all the time participating on the login. If it's the one you are using, there is no reason at all to require another.

It's like that smart home post from a few days ago. The dream is that lights, heating and entertainment automatically turn on and off and adjust throughout the day. The reality is that someone in the house has to become the IT department, troubleshooting issues all the time. The reality is just way more work than the dream.

Yes, plenty of places do this successfully. You either have some very aggressive cookie blocking or your IT has it setup this way in some misguided strict way.

I have the same frustration at current $BIG_CORP employer. It's maddening to think how much productivity must be lost by 100s of engineers being interrupted many times a day by this! Granted, I know nothing about how it is implemented, but I struggle to comprehend why this is necessary - the SSO client knows I authenticated literally minutes go from this device...how is that not sufficient verification!?

I'm not sure about the apps you're using, but our SaaS app sends users to Azure AD for example to authenticate via OpenID Connect and in 90% of the cases they are instantly directed back because they are already logged in.

It depends, some apps might be configured to require auth before taking you to the app. It may depend on compliance, or some company policy. Or if there is an SLO app that invalidates login sessions.

I’m fairly certain this works great for all systems that allow big bad enterprise to control what you do (Windows and IE, but Chrome is getting there too). Using FF on a Mac apparently makes it really hard to do automatic sign-on.

Reply on news.ycombinator.com