Notes on application security, API security, identity, and API management from the field. Articles are also published on Medium. Browse the archive by topic instead — 124 subjects.
In a previous blog post, I listed a number of SOA Specs and Security Specs that I thought were important to be familiar with when working with DataPower and other SOA technologies. In this post, I made a quick (and dirty) Visio diagram that I tend to draw up on a whiteboard when I’m at a new client…
Read article: SOA Specs VisualizedWhile working with DataPower and Active Directory (acting as the User Repository) I have often run into situation where AD returns an LDAP error code 49 plus a sub-code in the error string that is unique to AD. The sub-code can be very useful to troubleshooting, if you know what it means.
Read article: Active Directory Return CodesIn the last post, we saw how an XML Firewall in loopback mode could be used to return a valid SOAP response to a service message. The stylesheet used simply returned a static SOAP response that was independent of the input parameters. The stylesheet returns a response containing the sum of two…
Read article: Some Simple Updates To A DataPower XSLT stylesheet.It is often the case that a DataPower developer will have work to do, but does not yet have a backend Service Provider to point the DataPower service at. In general, anything beyond trivial examples will need to point at something that returns a valid response. In order to satisfy this requirement,…
Read article: SOAP Web Service Mockup tutorial on DataPowerAnother use-case that I touched on during my JBoss World 2012 presentation was using the PicketLink WS-Trust Client implementation to communicate with third-party Security Token Services. In particular, we discussed how the PicketLink SAML2STSIssuingLoginModule can communicate with the IBM Tivoli…
Read article: JBoss/PicketLink WS-Trust Client and Third-Party Security Token ServicesI’ve been at a couple of different client sites where there was a heavy IBM product presence, the use of IBM’s proprietary token format-LTPA2, and the need for a non-IBM technology such as JBoss EAP. Given the nature of the LTPA2 technology (IBM proprietary protocol), there isn’t any direct support…
Read article: JBoss and LTPAv2 supportEver since I was first started working with IBM WebSphere DataPower I was looking around for someone that was offering access to a IBM WebSphere Datapower, I was looking around for someone that was offering access to an Internet-facing appliance that I could use for experimenting and learning. I…
Read article: DataPower Access Rental—Maybe DataPower in the Cloud?It’s been a few weeks since I have posted any updates. I started a new project at the beginning of June; it always takes a few weeks to get up to speed on an extended project. Integrating the IBM Tivoli Security stack and JBoss EAP was the subject of my JBoss World 2012 presentation.
Read article: JBoss World 2012 Session–Trusted Security with JBoss Enterprise Application PlatformI was recently involved in a conversation where someone asked the question what is FGA (Fine Grained Authorization) versus Coarse Grained Authorization(CGA)? From their perspective, there was just authorization. Further distinction was not needed.
Read article: Fine Grained Authorization versus Coarse Grained AuthorizationI generally recommend to clients that DataPower RBM (Role-Based Management) be configured to perform authentication and authorization of DataPower administrators and developers with LDAP. In particular, whatever respository serves as the central repository of user information should be used (of…
Read article: RBM–Administrative Access & Security for DataPowerLooking for something specific? Browse all 124 topics.
