Notes on application security, API security, identity, and API management from the field. Articles are also published on Medium. Browse the archive by topic instead — 124 subjects.
I’m taking a brief excursion from my usual identity and API-centric posts to answer a question about performance tuning that someone asked me earlier this year. In a previous incarnation of my career, I was focused on performance tuning and diagnostics — particularly involving Java systems.…
Read article: Performance Tuning MethodologyThere are several identity protocols that are commonly supported by Identity Providers today — OAuth2, OAuth2 Token Exchange, OIDC, SAML2 Browser Profile, WS-Trust, WS-Federation, etc. The OAuth2 and OIDC protocols are relative newcomers. The other protocols have been around longer — and, tend to…
Read article: Understanding WS-Federation — Passive Requestor ProfileA while back I needed a summary of which protocols were supported/recommended in different situations by Azure Active Directory while I was researching the “When To Use Which (OAuth2) Grants and (OIDC) Flows” post. So, I am summarizing it here.
Read article: Summary of Azure Active Directory OAuth2 Authorization Grant and OIDC Authentication Flow UsesAuthentication. Federation. Single Sign On (SSO). I’ve mentioned these concepts many times. I haven’t actually formally defined what each of these terms mean even though I’ve used these many times throughout my writing — these concepts are closely related.
Read article: Authentication vs. Federation vs. SSOThis post was originally published as “How to Submit Tokens to an API Provider, Pt 2” on the Apigee Blog.
Read article: How To Submit Your Security Tokens to an API Provider, Pt. 2This post was originally published as “How to Submit Tokens to an API Provider, Pt 1” on the Apigee Blog.
Read article: How To Submit Your Security Tokens to an API Provider Pt. 1This post concludes our discussion of SAML2 and JWT. Here we look at a comparison of the features and use cases of the two technologies. It’s difficult to make a direct comparison of JWT and SAML2. As we’ve seen through this series, one must take into account the specifications that work in…
Read article: SAML2 vs JWT: A ComparisonThis post explores the equivalent JWT use cases corresponding to the five SAML2 use cases that were explored earlier in this series. We had to build up our tool set to get to this point — including exploring JWT, OAuth2, OpenID Connect, and the supporting specs. To be ready for this moment, we’ve…
Read article: JWT Use CasesThe OpenID Connect (OIDC) family of specs supports logout (from a single application) and global (or single) logout (from all applications that the user has logged into through the OpenID Provider, OP), but these features are optional or in draft status (as of Q2, 2017). So, these spec features may…
Read article: OpenID Connect LogoutThe following blog posts discuss SAML2 use cases that have been explored in this series:
Read article: SAML2 Use CasesLooking for something specific? Browse all 124 topics.
