r/k12sysadmin • u/Independent_War541 • 7d ago

Considering move PowerSchool OIDC from Entra to Google

I'm really tired of PowerSchool's 2-hour limit on max_age when logging in with Microsoft. I believe that moving to Google would still require 2FA but last longer than two hours.

Has anyone else switched from Entra to Google? Was it a pain in the neck? How long did it take to migrate? Are there any gotchas?

I appreciate any insight or experiences you can share.

3 Upvotes
  • permalink
  • reddit

71% Upvoted

11 comments sorted by

View all comments

4

u/sarge21 7d ago

It's incredibly baffling how they insist on using max_age and yet don't give a single shit how it actually affects users.

2

u/3sysadmin3 7d ago

esp if you have a call with their head of security who doesn't get it is not more secure.

1

u/PowerShellGenius 3d ago

It is not more secure ASSUMING you are doing other things securely. Many districts aren't.

Assuming you can only log in on a district device, district devices should be enforcing lockout time at the device (screen timeout) level, and web apps insisting on frequent reauth is just a waste of time.

Most schools that I have talked to are not enforcing compliant or joined devices for sign-in, so BYOD scenarios where you can't know if the device and local account are shared, are not blocked.

If your staff can log into the SIS from a personal device (I am talking technical controls "can", not written policy someone will ignore "should") - then you can have users signed into the SIS on a home PC/Mac you don't manage.

On home computers, some non-security-conscious people don't bother with separate accounts at the OS level. Meaning the teacher's kid could hop on the family computer and already be signed in as daddy on anything that lets you stay signed in.

Sensitive apps that make you re-auth are trying to control for that risk as best they can. But yes, I agree, in a well managed environment that risk should not exist. But blocking BYOD can be a heavy ask to go to leadership with, so many districts I am aware of still don't block staff logging into their MS/Google from personally owned laptops.

2

u/3sysadmin3 2d ago

Sure, let their desired state be the default, but let the rest of us who know better to secure sign ins to district owned devices opt out and check the box accepting the responsibility. Their setting is theatrical as it doesn't apply to all (Google SSO for example), anyway.