IYA Cyber Security

Bearer, Proof of Possession, and Sender Vouches: Three Ways to Trust an Identity

Thu, 20 Aug 2026 17:13:23 GMT

One of the most fundamental questions in any identity or authorization system is how does the system know that the party presenting a credential is actually entitled to use it?

Holder of Key vs. Proof of Possession: Two Sides of Cryptographic Identity

Wed, 19 Aug 2026 19:16:17 GMT

For years, identity protocols have used phrases such as Holder of Key, Proof of Possession, Key Binding, and Bearer almost interchangeably.

Content Security Policy: Putting the Browser on a Security Diet

Wed, 19 Aug 2026 16:50:45 GMT

Web applications have become remarkably powerful.

OAuth2 + OIDC: All of the Specs (2026 Edition)

Tue, 18 Aug 2026 16:36:31 GMT

Current as of August, 2026.

Cryptographic Bill of Materials: The CBOM To The Industry’s SBOM

Tue, 18 Aug 2026 16:36:03 GMT

A Cryptographic Bill of Materials (CBOM) is exactly what it sounds like: an inventory of every cryptographic component used throughout an organization. If a Software Bill of Materials (SBOM) tells you what software you have, a CBOM tells you how that software is protected.

Digital Death: Legal Frameworks

Mon, 17 Aug 2026 16:18:35 GMT

Disclaimer: I’m not a lawyer. I’m just trying to understand how this works.

MCP Governance With Bifrost AI Gateway

Mon, 17 Aug 2026 16:01:29 GMT

The Model Context Protocol (MCP) has changed the relationship between an LLM and the systems around it.

The AI-Enhanced Afterlife: No Thanks

Sun, 16 Aug 2026 16:15:29 GMT

I like this one. It sits right at the intersection of AI, identity, law, and just enough existential dread to make people double-check their password manager.

The Digital Dead: Existence Beyond Death Online

Sun, 16 Aug 2026 15:46:00 GMT

I started thinking about this post a while back when I saw a former colleague’s Medium profile still listed as following mine. He died in the early days of covid. A quick check showed that his LinkedIn profile seems to have disappeared — not sure how that works. It was still there a few years ago.

PKCE: Proof Key for Code Exchange

Sat, 15 Aug 2026 16:00:40 GMT

One of the biggest misconceptions about OAuth2 is that it is a single protocol. In reality, OAuth2 has evolved considerably over the years as new attack vectors have been discovered and new security mechanisms introduced. One of the most significant of these improvements is Proof Key for Code…

DPoP: The Missing Security Layer in OAuth2 and OID4VCI

Sat, 15 Aug 2026 15:19:49 GMT

OAuth2 has long suffered from a fundamental weakness: bearer tokens.

Elliptic Curve Groups: The Mathematical Engine Behind Modern Digital Identity

Fri, 14 Aug 2026 15:56:00 GMT

If you’ve ever read a specification like WebAuthn, DID Core, SD-JWT VC, BBS Signatures, OID4VCI, or OID4VP, you’ve probably encountered references to P-256, secp256k1, Ed25519, or BLS12–381.

Discrete Algorithms: The Mathematics of Decisions, Networks, and Digital Intelligence

Fri, 14 Aug 2026 15:13:19 GMT

When we think about algorithms, we often imagine a computer executing a series of instructions:

WS-Federation Support Comes to the Identity Protocol Debugger

Thu, 13 Aug 2026 15:40:20 GMT

Yes, WS-Federation.

Finite Fields: The Mathematics Behind Cryptography, Error Correction, and Digital Trust

Thu, 13 Aug 2026 14:58:42 GMT

Modern technology runs on mathematics that most people never see.

The Future of Mathematics: AI’s Impact on the Field

Wed, 12 Aug 2026 14:08:30 GMT

Or, how AI Is Changing Mathematics

Model Governance: Congratulations, You’ve Hired the Smartest Intern in History

Wed, 12 Aug 2026 08:34:18 GMT

The first thing people do after deploying a Large Language Model (LLM) is ask it to write a poem.

SD-JWT VC vs. BBS-2023: Why These Aren’t Really the Things You’re Comparing

Tue, 11 Aug 2026 13:47:44 GMT

There is a recurring problem in the Verifiable Credentials world.

Data Minimization: Why Does the Coffee Shop Need to Know My Blood Type?

Tue, 11 Aug 2026 07:41:41 GMT

Modern identity systems have a bit of a hoarding problem.

Decentralized Identifiers: Because Apparently We Needed to Rethink the Name Field

Mon, 10 Aug 2026 04:58:47 GMT

For most of the history of digital identity, we’ve had a remarkably simple solution to the question, “Who are you?”

DPoP Support Comes to the Identity Protocol Debugger

Mon, 10 Aug 2026 02:50:38 GMT

OAuth2 has always had a fundamental problem: a bearer token is a bearer token. After all, it’s a bearer token.

Bilinear Pairings: Modern Privacy-Preserving Cryptography

Fri, 07 Aug 2026 12:46:47 GMT

If you’ve spent any time reading about modern cryptography — especially BBS Signatures, attribute-based credentials, or identity-based encryption — you’ve probably encountered the phrase bilinear pairing.

Post Quantum Cryptography Migration Road Map: Because Waiting Until the Last Minute Has Never Gone…

Thu, 06 Aug 2026 12:08:20 GMT

There are two kinds of organizations in the world.

Elliptic Curve Cryptography: The Tiny Keys That Protect the Internet

Thu, 06 Aug 2026 06:44:38 GMT

If you’ve spent any time reading about modern cryptography, you’ve probably encountered the phrase Elliptic Curve Cryptography (ECC). It sounds less like a security technology and more like an elective mathematics course that everyone regrets taking — I’ve been in several of those.

Selective Disclosure: The Math

Wed, 05 Aug 2026 00:39:01 GMT

Selective Disclosure is fundamentally a mathematical concept. The protocols (SD-JWT VC, BBS-2023, AnonCreds, Idemix, U-Prove, etc.) are really just engineering built on top of several branches of mathematics.

Quantum Mechanics Explained: The Universe’s Passive-Aggressive User Manual

Tue, 04 Aug 2026 14:53:44 GMT

This post seemed like a missing link in my Post-Quantum Cryptography series. Note, this is for non-technical people, non-physicist, or maybe IT community.

Selective Disclosure: Finally, an Identity System That Knows When to Stop Talking

Tue, 04 Aug 2026 00:17:46 GMT

For decades, digital identity has operated on a remarkably inefficient principle, “If someone asks for one piece of information, give them everything.”

Verifiable Credentials: The Next Evolution of Identity & Access Management

Mon, 03 Aug 2026 14:18:23 GMT

Identity & Access Management (IAM) has spent decades answering fairly simple questions: “Who are you?” and “What are you allowed to do?”

WebAuthN: Passwordless Logins

Sun, 02 Aug 2026 14:06:34 GMT

WebAuthn is actually the tip of a much larger iceberg. Like the SD-JWT VC spec, it is built upon several W3C, FIDO Alliance, and IETF specifications. Together, these define a complete passwordless authentication ecosystem.

Unlinkability: Randomness Is Your Friend

Sun, 02 Aug 2026 12:29:46 GMT

Imagine if every time you bought groceries, boarded a plane, logged into a website, rented a car, or proved you were old enough to appreciate terrible coffee, someone quietly scribbled another note into your permanent file.

Identity Protocol Debugger Now Supports SD-JWT VC Issuance and Presentation Flows

Sat, 01 Aug 2026 14:04:39 GMT

Another day, another identity specification to debug.

Privacy-Preserving Identity: Proving What Matters Without Revealing Everything

Sat, 01 Aug 2026 11:45:56 GMT

For decades, digital identity has followed a remarkably simple philosophy, “Tell me everything about yourself, and I’ll decide whether you may proceed.”

AI Governance: Or, Congratulations on Inventing a Robot That Can Make Bad Decisions at Scale

Fri, 31 Jul 2026 05:49:08 GMT

Every new technology eventually discovers governance.

What are AI Gateways: API Gateways Learned a New Language

Fri, 31 Jul 2026 05:09:55 GMT

Or, the name was misspelled.

Risk Management: Or How Corporate IT Learned to Fear Everything Except the Things That Actually…

Thu, 30 Jul 2026 05:41:07 GMT

There is a wonderful phrase that gets tossed around in corporate IT meetings.

OpenID Federation Spec: Because Exchanging Metadata Spreadsheets Was Apparently Not a Great…

Thu, 30 Jul 2026 04:58:27 GMT

Or: How the Identity Industry Invented a Cryptographically Signed Phone Book

The Time I Had To Troubleshoot 6% Packet Loss: Or, How We Accidentally Discovered the Network Had…

Wed, 29 Jul 2026 05:29:33 GMT

Every engineer has that one project.

Data Classification Best Practices: Knowing What Matters Before It Walks Out the Door

Wed, 29 Jul 2026 04:54:11 GMT

Organizations spend millions of dollars protecting data, yet many struggle to answer a surprisingly simple question:

2 + Fish = Moon Rock: When Your Key Performance Indicator Dashboard Has More Charts Than Purpose

Tue, 28 Jul 2026 03:37:28 GMT

When the metrics you hold so dear no longer measure anything meaningful.

Our Identity Protocol Debugger Now Supports WS-Trust

Tue, 28 Jul 2026 03:35:40 GMT

There are moments in software development when you ask yourself an important question:

JWT as Oauth2 Access Tokens & Refresh Tokens— Invalidation: The Awkward Reality

Mon, 27 Jul 2026 03:32:21 GMT

I’ve touched on the topic of using JWT as an Access Token on several previous blog posts:

BBS-2023: The Digital Signature That Knows When To Keep Its Mouth Shut

Mon, 27 Jul 2026 03:30:56 GMT

Most digital signatures have the subtlety of a foghorn.

I Code in vi/vim and Loving It (And No, I’m Not Trying to Impress Anyone)

Sun, 26 Jul 2026 00:57:21 GMT

In 1996, I took my first Computer Science course in college. The professor encouraged us to use vi/vim. Later, at my first job out-of-school, the team was, also, using vi/vim. As the IDE craze took hold at the turn of the century (kind of weird typing that), I never really moved on from there. So,…

How Many IETF RFCs Actually Become Standards?

Sun, 26 Jul 2026 00:49:41 GMT

The Internet Engineering Task Force (IETF) has 10K+ published Request For Comments (RFCs) documents. The industry hears about RFCs all the time. But, as the name implies (“request for comments”) that isn’t the final step in the process. A very small number of RFCs are promoted to Internet…

SD-JWT VC: The Identity Industry’s Latest Attempt to Win a Nobel Prize in Acronyms

Fri, 24 Jul 2026 23:28:44 GMT

If you’ve ever opened the specifications surrounding SD-JWT Verifiable Credentials and thought, “Surely this is a straightforward document that defines a credential format.”

Your Phone vs. The Border: A Traveler’s Privacy Tour of the G20

Fri, 24 Jul 2026 17:48:59 GMT

Travelers Rights. Or, lack thereof.

Input Validation: Because Users Are Creative, and Attackers Are More Creative

Thu, 23 Jul 2026 22:17:15 GMT

There is a special kind of optimism that exists in software development.

Secure Code Reviews: Finding Security Issues Before Attackers Do

Thu, 23 Jul 2026 10:03:02 GMT

For most corporate IT workshops, we are often trying to abstract as many security details away from application code as possible. I understand things may work differently at Big Tech / shops-with-many-competent developer resources. I initially started jotting down notes for this blog post while I…

Post-Quantum Migration Mistakes: How to Accidentally Recreate the Y2K Panic, But With More Math

Wed, 22 Jul 2026 18:51:47 GMT

For decades, organizations have enjoyed a comfortable arrangement with modern cryptography.

The OAuth2/OIDC Debugger Has Learned a New Trick: SAML2 Support Is Here

Wed, 22 Jul 2026 10:01:58 GMT

Identity engineers have a complicated relationship with SAML.

Introducing IDPTools: An Open Source OAuth2 & OpenID Connect Debugger

Sat, 18 Jul 2026 23:01:33 GMT

If you’ve spent any amount of time integrating OAuth 2.0 or OpenID Connect (OIDC), you’ve probably experienced the same cycle:

Identity Protocol Debugger + IDPTools Series

Sat, 18 Jul 2026 21:59:13 GMT

This is a collection of blog posts about my OpenSource Software Project, OAuth2 / OIDC Debugger.

IBM Says It’s Ready to Scale Quantum Computing

Sat, 11 Jul 2026 07:26:34 GMT

This is the next post in my Post-Quantum Cryptography Series.

What Rights Do Tourists and Long-Term Foreign Residents Have?

Sat, 27 Jun 2026 11:07:08 GMT

This is the first of a two part series. In the second post, we will explore the privacy implications of traveler rights at the border across various countries.

The Time We Deleted Eleven Days from Production

Sat, 27 Jun 2026 06:12:25 GMT

Or: How Humanity Performed the Largest Calendar Data Correction in History

The Year 2038 Problem: When Computers Discover Time Is Hard

Fri, 26 Jun 2026 06:15:06 GMT

For most of human history, keeping track of dates was relatively straightforward. The sun came up; the sun went down.

US Government Mandates All Agencies Fast-Track PQC Migration

Fri, 26 Jun 2026 05:23:00 GMT

This post is part of my “Post-Quantum Cryptography Series”.

Understanding Unauthenticated Traffic: How Applications and APIs Represent The Unauthenticated User

Wed, 24 Jun 2026 23:13:08 GMT

Authentication is one of the most fundamental concepts in application security. Most developers spend considerable time designing how authenticated users are represented, authorized, and managed. Surprisingly, much less attention is given to the opposite state of users who have not authenticated at…

Data Loss Prevention (DLP): Keeping Your Organization’s Secrets from Walking Out the Door

Wed, 24 Jun 2026 23:07:05 GMT

For decades, organizations have focused on keeping attackers out. Firewalls, antivirus software, intrusion detection systems, IAM solutions, and the like all serve a common purpose to prevent unauthorized access. However, many security incidents do not begin with an external attacker breaking in.…

Post-Quantum Cryptography Series

Tue, 23 Jun 2026 12:55:04 GMT

There have been many questions about Post-Quantum Cryptography (PQC) recently with clients. So, I figured this would be a good topic to explore.

Sweden’s Cashless Revolution: The Hidden Costs of a Digital Economy

Tue, 23 Jun 2026 12:54:41 GMT

In my “Dangers of a Cashless Society” post, I briefly described my experiences in Sweden. This post expands on that.

AES-256 and the Post-Quantum Panic: The Rare Cryptographic Algorithm That Isn’t Sweating

Mon, 22 Jun 2026 12:07:18 GMT

Quick Summary: AES-256 is the workhorse of enterprise data encryption at rest. It is not considered impacted by quantum computers or Post-Quantum Cryptography. It is considered quantum-resistant, which means it can withstand attacks from quantum computers / algorithms better than other encryption…

Shor’s Algorithm: The Quantum Computer’s Favorite Way to Ruin RSA’s Day

Mon, 22 Jun 2026 12:06:54 GMT

For decades, modern cryptography has rested on a comforting assumption that factoring really large numbers is hard.

Post-Quantum Cryptography (ML-KEM): The Math

Sun, 21 Jun 2026 05:34:55 GMT

ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism), formerly known as CRYSTALS-Kyber, is the post-quantum key exchange algorithm standardized by National Institute of Standards and Technology as FIPS 203. Its security is based on the difficulty of certain problems in lattice cryptography,…

Post-Quantum Cryptography (2026): Preparing for the End of RSA and ECC

Sun, 21 Jun 2026 05:34:40 GMT

For decades, modern cybersecurity has relied on a handful of cryptographic foundations. Technologies such as RSA and Elliptic Curve Cryptography (ECC) protect everything from online banking and VPNs to software updates and digital signatures. These algorithms have withstood years of scrutiny and…

RSA: The Internet’s Favorite Math Trick (Until Quantum Computers Show Up)

Sat, 20 Jun 2026 05:25:56 GMT

Most people use cryptography every day. They log into websites. They check their bank balances. They send messages. They order things they absolutely do not need from online retailers at 2:00 AM.

Introduction To Quantum Computing: Because Regular Computers Apparently Weren’t Complicated Enough

Sat, 20 Jun 2026 05:24:50 GMT

Disclaimer: I’m not a physicist. This is my attempt to understand quantum computing and the underlying physics, yet keeping it light. I do actually want my traditional audience to read this.

AI / LLM Software Security: Part 5

Sat, 13 Jun 2026 04:47:54 GMT

This is the fifth (and final) post in my “AI / LLM Software Security Series”.

AI / LLM Software Security: Part 4

Wed, 10 Jun 2026 21:30:16 GMT

This is the forth post in my “AI / LLM Software Security Series”.

Euler’s Identity: The Single Equation That Connects Five Fundamental Mathematical Constants

Mon, 08 Jun 2026 21:57:40 GMT

When I was writing the Zero Knowledge Proofs: The Math blog post, I had the bright (read stupid) idea of asking ChatGPT to generate an image about math. It didn’t matter which math, didn’t specifically mention ZPTs in the prompt. It initially generated the above image. It’s a good image. It’s the…

Zero-Knowledge Proofs: The Math

Mon, 08 Jun 2026 21:57:20 GMT

This is my second article about Zero-Knowledge Proofs (ZKPs). If you haven’t read it, check out Part 1 as a starting point.

Zero-Knowledge Proofs: Proving Something Without Revealing Anything

Sat, 06 Jun 2026 22:50:36 GMT

Modern computing systems are built around a strange tradeoff in that proving identity or trust usually requires revealing information. Passwords, account numbers, private keys, medical records, financial history — all of these are routinely exposed simply to verify a claim.

The Dawn of De-Dollarization, Digital Sovereignty, and Digital Privacy

Sat, 06 Jun 2026 02:23:25 GMT

“De-dollarization” (moving away from the US Dollar as a reserve currency) is both real and accelerating, but it is gradual, uneven, and multi-dimensional. It is not a sudden collapse of the US dollar’s reserve status, but a persistent shift in the structure of global finance that reflects…

AI / LLM Software Security: Part 3

Fri, 05 Jun 2026 07:56:50 GMT

This is the third post in my “AI / LLM Software Security Series”.

AI / LLM Software Security Series

Thu, 04 Jun 2026 02:01:42 GMT

This series explores the “OWASP Top 10 for LLM Applications 2025” issues.

AI / LLM Software Security: Part 2

Wed, 03 Jun 2026 01:59:22 GMT

This is the second post in my “AI / LLM Software Security Series”.

Surveillance Capitalism: The Data Private Industry Gathers

Wed, 03 Jun 2026 01:59:02 GMT

Surveillance Capitalism is an economic system in which companies collect, analyze, predict, and monetize human behavior through massive-scale data gathering and behavioral tracking — what Americans (the US kind) call Tuesday. The term was popularized by Shoshana Zuboff in her book “The Age of…

Government Data Collection: The Rise of Over-Collection

Mon, 01 Jun 2026 23:28:52 GMT

Before we start, please note, I’m not taking a stand on any particular issue (social, political, etc). I’m just exploring the potential privacy implications in recent headlines.

AWS Outposts Migration Security Considerations: Part 2

Mon, 01 Jun 2026 23:27:04 GMT

The most common reaction to that image has been, “WTF?” I decided to go with it and use the image as originally generated.

AWS Outposts Migration Security Considerations: Part 1

Sun, 31 May 2026 21:52:57 GMT

AWS Outposts moves the AWS cloud services into your onprem data center. It is a hybrid-cloud platform from Amazon Web Services that extends AWS infrastructure and services into your own datacenter, colocation facility, etc. With AWS Outposts, AWS ships you AWS-designed racks with pre-configured…

AI / LLM Application Software Security: Part 1

Sun, 31 May 2026 21:48:21 GMT

This is the first post in my “AI / LLM Software Security Series”.

Network Segmentation: Macro, Micro, and the Building Blocks

Mon, 20 Apr 2026 09:47:29 GMT

I’ve talked about network segmentation in many blog posts, but I’ve never had a blog post dedicated specifically to that topic. So, here we go.

Multi-Factor Authentication (MFA): Don’t Let Your CyberSecurity Insurance Claim Get Denied On…

Thu, 16 Apr 2026 08:15:01 GMT

Multi-Factor Authentication (MFA) is the security control that can make, or break, your business. If there’s one cybersecurity control that consistently separates organizations that get breached from those that don’t, it’s Multi-Factor Authentication (or, to be precise, MFA, done correctly).

Dangers of a Cashless Society

Mon, 13 Apr 2026 06:47:53 GMT

IntroductionWhat Does Cashless Mean?Countries Embracing Going CashlessWhy Cashless Advocates Dislike Cash

Application Security Best Practices

Sun, 12 Apr 2026 13:35:00 GMT

A starting point for application security.

Defense In Depth

Wed, 08 Apr 2026 15:39:19 GMT

“Defense in Depth” is the idea that no single security control is trusted to stop an attack. Instead, you stack multiple, independent layers so that if one fails, others still stand in the way.

Zero Trust Architecture

Wed, 08 Apr 2026 15:15:08 GMT

Zero Trust Architecture (ZT or ZTA) is a security model / framework based on one simple idea: Never trust, always verify. From NIST, we have, the “… ZT approach is primarily focused on data and service protection but can and should be expanded to include all enterprise assets (devices,…

Don’t Use Source IP Addresses As The Primary Authentication Mechanism

Wed, 25 Mar 2026 16:31:32 GMT

In certain US industries, usually legacy businesses with low margins and heavily regulated, it is still quite common to use source IP address as an authentication mechanism on the public internet. Now, never mind that in the age of cloud computing and SaaS applications, it is rare for cloud…

Core Security Precept: Principle of Least Privilege

Wed, 25 Mar 2026 16:22:05 GMT

The word “rule” is overused; so, I went with “precept” — a rule or principle that defines how one should think or act.

A Vendor DMZ Pattern

Sat, 21 Mar 2026 10:26:40 GMT

A long time ago, I was doing integration architecture work in the land of Enterprise Service Buses (ESBs) and API Gateways. Think IBM WebSphere DataPower and Apigee — I like to remember Apigee the way it was before it was integrated into GCP. After we had designed and built the ESB, we moved on to…

Begotten & Forgotten Distributed Service Technologies

Wed, 18 Mar 2026 16:36:48 GMT

Sometime around 2012, I published a similar list (up to the point of APIs). I recently put the same list in another post. I thought having this as its own post would be useful, or, at least, amusing.

Internal Endpoints Must Have The Same Security Capabilities As External Endpoints

Wed, 18 Mar 2026 16:35:38 GMT

In a previous post, we made a point of “Non-Prod Environments Must Have The Same Security Protections As Production”. In this post, we’re going to go one step further and say that your internal and external endpoints, generally, should have the same security capabilities baked into their security…

The Yearly Review Feedback That I Could Never Accept

Tue, 17 Mar 2026 16:06:08 GMT

I have the ability to be a profound jackass. So, most feedback that’s been included in yearly reviews is probably fair. But, fifteen, plus, years ago, I did get one annual review that had one negative remark on it that bothered me then and still does to this day.

API Design: Planned, Unplanned, Security and Utter Chaos

Tue, 17 Mar 2026 16:04:12 GMT

I’ve discussed APIs and API Management in previous blog posts. These are among my older blog posts, but the points being made are, generally, still relevant. I’ve never published a blog post exclusively about API design. I have a blog post about “API Gateways and Multiple Consumer Types” where I…

Any Day Your Socks Don’t Burst Into Flames Is A Good Day

Fri, 13 Mar 2026 07:44:18 GMT

I’ve been wanting to use this as a title for a blog post for a while now. It’s actually one of the quotes I have in my personal email signature. The open question has been what the topic of this blog post should be. There are so many asinine stories from fifteen years of consulting that could be…

Non-Prod Environments Must Have The Same Security Protections As Production

Thu, 12 Mar 2026 16:15:25 GMT

Your non-production environments must have the same security capabilities as your production environment.

Ability To Do Point In Time Restore / Rebuild Of Environments

Wed, 11 Mar 2026 07:58:58 GMT

Over the course of my consulting career, I’ve been brought into organizations to troubleshoot “weird” problems on several occasions — those stories for another time. These engagements are often fun; though, can be very challenging. The organizations where we had the most success in tracking down…

What Is Digital Sovereignty?

Fri, 06 Mar 2026 08:13:37 GMT

Digital sovereignty refers to a nation’s ability to control, regulate, and secure its digital infrastructure, data, platforms, and technological ecosystem in accordance with its own laws, values, and strategic interests.

Achieving Application Environment Isolation

Sun, 01 Mar 2026 14:04:57 GMT

Your production environment should be isolated from your non-production environments. In fact, every application environment should be isolated from every other environment. Sounds simple in practice, but how does one accomplish this? Through a multi-layered isolation strategy:

No, You Shouldn’t Use Production Data For Testing

Fri, 27 Feb 2026 15:49:08 GMT

But, let’s face it, you’re probably going to do it anyway.

Privacy Series

Wed, 25 Feb 2026 16:07:24 GMT

Here is a collection of blog posts I’ve written about Privacy in the digital era.

Data Sovereignty Laws Around The World

Wed, 25 Feb 2026 16:06:03 GMT

Disclosures: AI (ChatGPT) assisted with summarizing this information.

Of Daffy Bastards And Goofy F*cks In The Land Of The Lost: Integration Anti-Patterns From The Dark Side

Mon, 23 Feb 2026 08:32:17 GMT

Some organizations keep following the same legacy, bad practices even though they know better. They keep doing it right up until the unfortunate happens.

What Is Digital Privacy?

Mon, 23 Feb 2026 08:00:17 GMT

Privacy (and Digital Privacy) is one of those terms that I’ve thrown around a lot in the last few years. However, I never took the time to define it.

Data Privacy Laws / Regulations Around The World

Fri, 20 Feb 2026 16:05:34 GMT

Disclosures: AI (ChatGPT) assisted with summarizing this information.

My NAS Appliance Just Turned Ten Years Old

Sat, 20 Dec 2025 05:03:54 GMT

I’ve been waiting a couple of years to write this post. In November, 2015, I bought a Synology RS815 NAS appliance to replace the DIY solution that I had been using for years before that. A month ago, that NAS appliance turned ten years old. It’s been in daily use for the past decade. At the six…

Of Daffy Bastards And Goofy F*cks In The Land Of The Lost: Integration Anti-Patterns From The Dark…

Sat, 22 Nov 2025 14:59:33 GMT

Some organizations keep following the same legacy, bad practices even though they know better. They keep doing it right up until the unfortunate happens.

Using Curl With SPNEGO

Sat, 22 Nov 2025 13:58:00 GMT

Recently, I had to setup a SPNEGO example to demonstrate a Kerberos identity integration. The details aren’t important, but I spent a bit of time figuring out how to use curl’s SPENGO support. So, we have the next blog post topic.

SOFTWARE SUPPLY CHAIN SECURITY: CI/CD/CT PIPELINES AND SECURITY TOOLS — PART 2

Mon, 29 Sep 2025 15:09:34 GMT

This is part two of a two part blog post on Software Supply Chain Security. If you haven’t read Part 1 yet, starting there is recommended.

SOFTWARE SUPPLY CHAIN SECURITY: CI/CD/CT PIPELINES AND SECURITY TOOLS — PART 1

Mon, 29 Sep 2025 15:03:22 GMT

The DevOps movement of the last decade more-or-less led to the DevSecOps movement of this decade. This focus on automation to create efficient, end-to-end software publishing pipelines combined with incidents like the SolarWinds Hack in 2020 and the recent ‘S1ngularity’ attack on the NPM ecosystem…

Prevent XSS and Other Common Attacks on Your App

Fri, 27 Dec 2024 14:08:15 GMT

Regardless of your application architecture or front-end type, there are a variety of common attack types that the application security architecture’s capabilities must protect against. I’ve talked about these topics briefly before here, here, and here.

Authentication Series

Tue, 19 Nov 2024 18:55:40 GMT

Barcode / Christiaan Colen

Practical Business Continuity For The Small Organization

Wed, 04 Sep 2024 21:12:40 GMT

For the small business owner, should the power going out mean you can’t make money? Should the computer system going down for 20 minutes mean a restaurant can’t take or cook orders any longer? Some basic level of preparation for anything other than ideal circumstances and commonsense needs to be…

Practical Business Continuity

Wed, 04 Sep 2024 14:11:00 GMT

Static Credentials Must Not Be Used In The Browser

Sat, 10 Aug 2024 20:38:51 GMT

Authentication is described in this post.

Datastore Security Requirements

Sat, 10 Aug 2024 20:34:56 GMT

This post will introduce a generic set of database / datastore security requirements that be used as a starting point when developing a database security strategy.

Application Front-Ends Must Not Make Authorization Decisions

Tue, 06 Aug 2024 07:34:10 GMT

First, let’s get the usual introductions out of the way. For an in-depth discussion of what Authorization is, check out this post. For a complete introduction to Authorization concepts see my Authorization Series. This post continues my long-running Authorization Series. In this post, we’re going…

API Gateways and Multiple Consumer Types

Fri, 24 May 2024 04:18:09 GMT

Sometimes at client sites, I see a separation of APIs advertised on an API Gateway based upon consumer type. Sometimes, this is unavoidable, but there should be a core set of APIs and a general push to create APIs that are reusable. Reusability of APIs is a foundational building block of API…

RFC 9068: A JWT-Based OAuth2 Access Token Format Standard

Thu, 23 May 2024 12:53:00 GMT

For anyone who has been paying attention, this blog post has been a long-time coming for multiple reasons. First, this is my first blog post in a couple of years — I’ve been heads down on a couple of projects for awhile now. This is literally the first time I’ve “come up for air” since the last…

Making Authorization Decisions

Sat, 06 Feb 2021 07:37:40 GMT

This blog post continues our discussion of Authorization in the API space. It will explore common authorization patterns with API Gateways and the backend API Providers. Generally, the API Gateway will apply a Coarse Grained Authorization (CGA) decision and the API Provider will implement Fine…

Delegation — A General Discussion

Sat, 06 Feb 2021 07:33:03 GMT

This blog post expands on delegation and related concepts introduced in my Kerberos Delegation blog post. It also brings together two blog series I’ve been working on over the years: SAML2 vs. JWT Series and Kerberos and Windows Security Series. Delegation is a critical building block of end-to-end…

Kerberos and Windows Security: Delegation

Sat, 06 Feb 2021 07:32:22 GMT

In this next post in the Kerberos and Windows Security Series, we are going to explore a very useful, but abstract feature of the Kerberos Authentication Protocol: Delegation. In particular, we are going to focus on the Windows implementation of this feature. Delegation allows downstream actors to…

HTTP POST vs GET: Is One More Secure For Use In REST APIs?

Sat, 06 Feb 2021 07:31:12 GMT

The use of HTTP POST vs HTTP GET for read-only (or query) operations in REST APIs recently came up in a conversation. For this particular shop, there had been a long-standing ban on the use of GET requests for use in homegrown applications. This had been the case since before REST APIs were in…

OAuth2 Access Tokens vs API Keys — Using JWTs

Wed, 15 Jul 2020 08:03:23 GMT

There are several approaches to securing APIs. Every API Gateway vendor supports the same core set of API security mechanisms. API Keys and OAuth2 are two examples of these authentication (plus authorization) mechanism. When should one be used over the other? What are the differences between the…

Identity Protocols, Hosted Login UIs, and Custom Login UIs

Mon, 13 Jul 2020 03:01:03 GMT

There are many ways to implement user authentication in a modern application (mobile, desktop, tablet, web, etc). I have previously explored Authentication, Federation, and SSO; that post introduces several key concepts that are assumed here. At the intersection of user experience, authentication,…

More Single Page Application (SPA) and OAuth2 Thoughts

Sun, 01 Sep 2019 00:39:16 GMT

This post continues where “SECURELY USING THE OIDC AUTHORIZATION CODE FLOW AND A PUBLIC CLIENT WITH SINGLE PAGE APPLICATIONS” left off on the topic of securing Single Page Applications (SPAs). That post describes an architecture where the SPA running in the browser (User Agent)is acting as the…

OAuth2 Access Tokens and Multiple Resources Series

Sat, 31 Aug 2019 23:35:44 GMT

This article is a place my other blog posts can point at when referencing this series.

Authorization Series

Sat, 31 Aug 2019 23:21:50 GMT

This post contains links to all the articles about authorization that I have written.

OAUTH2 ACCESS TOKEN USAGE STRATEGIES FOR MULTIPLE RESOURCES (APIS): PART 3

Sat, 31 Aug 2019 23:16:51 GMT

This post was originally published as “OAUTH2 ACCESS TOKEN USAGE STRATEGIES FOR MULTIPLE RESOURCES (APIS): PART 3” on the Ping Identity Blog.

OAuth2 Access Token Usage Strategies for Multiple Resources (APIs) Part 2

Sat, 22 Jun 2019 07:22:16 GMT

This post was originally published as “OAUTH 2 ACCESS TOKEN USAGE STRATEGIES FOR MULTIPLE RESOURCES (APIS): PART 2” on the Ping Identity Blog.

OAUTH 2 ACCESS TOKEN USAGE STRATEGIES FOR MULTIPLE RESOURCES (APIS): PART 1

Mon, 27 May 2019 06:33:13 GMT

This post was originally published as “OAUTH 2 ACCESS TOKEN USAGE STRATEGIES FOR MULTIPLE RESOURCES (APIS): PART 1” on the Ping Identity Blog.

API GOVERNANCE: A VITAL BUILDING BLOCK FOR API SECURITY

Sat, 20 Apr 2019 07:45:05 GMT

This post was originally published as “API GOVERNANCE: A VITAL BUILDING BLOCK FOR API SECURITY” on the Ping Identity blog.

SECURELY USING THE OIDC AUTHORIZATION CODE FLOW AND A PUBLIC CLIENT WITH SINGLE PAGE APPLICATIONS

Wed, 07 Nov 2018 18:02:48 GMT

This blog post was originally published as “SECURELY USING THE OIDC AUTHORIZATION CODE FLOW AND A PUBLIC CLIENT WITH SINGLE PAGE APPLICATIONS” on the Ping Identity blog.

OpenID Connect Authorization Code Flow with AWS Cognito

Sat, 27 Oct 2018 06:06:32 GMT

Earlier this year, I was working on a project that was using AWS Cognito (as the identity stack) and the AWS API Gateway (as the front-door to all of the API calls). AWS Cognito is a relatively new player in the identity space. It doesn’t support the full OAuth2 or OpenID Connect specs, but, does…

Kerberos and Windows Security: Kerberos on Windows

Thu, 25 Oct 2018 02:40:01 GMT

In this next post in my Kerberos and Windows Security Series, we are going to look at the use of Kerberos in Microsoft Windows (Microsoft Kerberos). At the end of the day, Kerberos with Windows is more-or-less the same as Kerberos anywhere else; though, there are several proprietary extensions that…

Authorization Decision Input Parameters

Wed, 24 Oct 2018 03:07:37 GMT

I was working with a developer not so long ago and it was explained to me that a caching layer had been added to a services layer (API Provider) to make the authorization (Fine Grained Authorization, FGA) decision more efficient for subsequent API calls. In particular, the cache contains data…

Active Directory Federation Services (ADFS) and Kerberos

Wed, 24 Oct 2018 02:42:52 GMT

While researching an upcoming blog post about Kerberos and Mobile, I needed to understand how Identity Providers (like ADFS or Ping Federate) use Kerberos (and possibly Kerberos Delegation) to perform authentication via username and password. This blog post captures what I found for ADFS.

The Benefits of JWTs as OAuth2 Access Tokens

Sat, 13 Oct 2018 23:17:51 GMT

Update (01/31/2021) — Since I originally wrote this article, a proposal has been created that officially describes using JSON Web Tokens (JWTs) as OAuth2 Access Tokens. As of this date, it has not yet been adopted as an official RFC.

OpenID Connect (OIDC) and OAuth2 Authentication Libraries

Sat, 13 Oct 2018 06:44:13 GMT

It’s 2018. At this point, application developers should not be writing code that directly implements HTTPS calls to OAuth2 or OpenID Connect endpoints, token caching, token refreshes, token validation, or other such activities. An authentication library should be used that implements these…

IDENTIVERSE REFLECTIONS: NEWS, TRENDS AND A GLIMPSE INTO THE FUTURE

Fri, 05 Oct 2018 03:03:44 GMT

This blog post was originally published as “IDENTIVERSE REFLECTIONS: NEWS, TRENDS AND A GLIMPSE INTO THE FUTURE” on the Ping Identity blog.

Identity + API Management Component Relationships

Thu, 04 Oct 2018 21:33:45 GMT

This diagram captures the relationships between concepts I’ve been writing about for a couple of years now.

The Many Ways of Approaching Identity Architecture

Fri, 01 Jun 2018 22:55:11 GMT

At some point in the finite past, I had the good fortune to become involved in a project that was essentially completely greenfield. An unnamed company, in an unnamed industry decided to try something new. In a page right out of “The Innovator’s dilemma”, they spun up a new, separate organization,…

A Brief Summary of All Things Apigee and API Management that I Have Written

Wed, 16 May 2018 22:56:13 GMT

Not so long ago, someone asked me for a list of all the Apigee and API Management related material I have written. The following was my response. The recipient suggested that I post this; so, here we go.

Kerberos and Windows Security Series

Wed, 16 May 2018 21:44:06 GMT

The following are the Kerberos and Windows Security posts that I have written.

Kerberos Wireshark Captures: A Windows Login Example

Wed, 16 May 2018 21:43:04 GMT

This blog post is the next in my Kerberos and Windows Security series. It describes the Kerberos network traffic captured during the sign on of a domain user to a domain-joined Windows Server 2016 instance. This post will help solidify our understanding of the Kerberos v5 protocol with a real world…

Kerberos v5 Related Specs and RFCs

Wed, 16 May 2018 21:42:30 GMT

This post lists all of the related RFCs and specifications to Kerberos v5 that have been published over the years. It is part of my Kerberos and Windows Security Series. When I was researching this series, finding all of this information together in one place was quite challenging. As noted in my…

The Common Identity Protocols

Wed, 16 May 2018 21:41:30 GMT

I’ve written blog posts on the following identity protocols. I’m creating this post to have a central place to refer to “identity protocols”. I will periodically update this list as I publish new posts with related material.

Kerberos Wireshark Captures: A SPNEGO Example

Wed, 16 May 2018 21:39:55 GMT

This is the second post that presents a real world example of the use of Kerberos. The first post captured the Kerberos protocol details of a Windows domain user login. Both of these posts are part of a series I created about Kerberos and Windows Security. In this post, we will look at the use of…

Kerberos and Windows Security: History

Wed, 16 May 2018 21:37:03 GMT

In previous posts, we explored various identity protocols including OAuth2, OpenID Connect, SAML2 profiles, WS-Trust, and WS-Federation. This post continues our exploration of identity protocols by looking at the Kerberos v5 authentication protocol and its use in Microsoft Windows authentication. I…

Kerberos and Windows Security: Kerberos v5 Protocol

Wed, 16 May 2018 21:34:25 GMT

In our last post, we looked at the history of Kerberos and its use in Windows Security. This post continues our Kerberos and Windows Security discussion. Here we will look at the Kerberos v5 protocol independent of its use in Microsoft Windows.

Demo: Apigee Edge OAuth2 Debugging

Mon, 30 Apr 2018 23:22:40 GMT

This post was originally published as “Demo: Apigee Edge OAuth2 Debugging” on the Apigee Blog.

Apigee Edge and Third-Party Identity Provider Integration — Detailed View

Thu, 29 Mar 2018 04:30:16 GMT

This post provides a detailed view of what happens when my example API Proxy that integrates Apigee Edge and a Third-Party Identity Provider for OAuth2 use cases. The setup instructions are available here.

Identity Broker: An SSO Protocol Transition From OpenID Connect To WS-Federation

Wed, 28 Feb 2018 03:08:56 GMT

I’ve been building up to more complex federation use cases over the past year. In previous posts, we explored the details of OpenID Connect(OIDC) and WS-Federation (WS-Fed). In those posts, we covered basic scenarios of how to use each protocol to integrate one Relying Party (Service Provider,…

The Future of API Security

Thu, 22 Feb 2018 10:10:59 GMT

On February 15, 2018, Bernard Harguindeguy of Elastic Beam and I filmed a webcast on The Future of API Security. The webcast can be viewed here.

The Tale of Thomas, Richard, and Karen — A Software Architecture Parable

Wed, 21 Feb 2018 05:28:14 GMT

It so happened that one day, in a corporate IT department not unlike the one you are familiar with, three IT resources were preparing to design a software system. It doesn’t much matter what the system is or what it is supposed to do, for the results would be more-or-less the same. The assembled…

Apigee Edge OAuth2 and Third-Party Identity Providers

Sun, 04 Feb 2018 20:37:35 GMT

This blog post summarizes the details of how to deploy and configure the the Apigee Edge OAuth2 example that I put together. This example will use the OAuth2 Authorization Code Grant and Refresh Token Grant to demonstrate how OAuth2 can be used with Apigee Edge in a real-world application.

Refresh Token Support in OAuth2 + OIDC Debugger

Sun, 04 Feb 2018 19:43:02 GMT

This post describes the Refresh Token support that was added to the OAuth2 + OIDC Debugger in late 2017. The OAuth2 + OIDC Debugger is a general-purpose testing tool for the OAuth2 and OpenID Connect protocols. It has been tested with many of the leading Identity Providers in the industry.

Differences Between Azure Active Directory and Red Hat SSO v7.1

Sat, 30 Dec 2017 09:50:31 GMT

I recently finished implementing OAuth2 and OIDC support for Azure Active Directory in my OAuth2 + OIDC Debugger. Previously, we implemented support for Red Hat SSO v7.1 and 3Scale. This post compares the two product’s implementations of these protocols (OAuth2 and OIDC). In particular, it looks at…

OAuth2 Resource Owner Password Credential Grant with 3Scale and Red Hat SSO

Fri, 08 Dec 2017 09:09:20 GMT

This blog post continues demonstrating (and documenting) the use of the OAuth2 + OIDC Debugger with 3Scale API Management and Red Hat SSO. Now, we are going to look at the OAuth2 Resource Owner Password Credential Grant with 3Scale and Red Hat SSO.

OAuth2 Implicit Grant with 3Scale and Red Hat SSO

Mon, 27 Nov 2017 21:17:23 GMT

This post demonstrates the OAuth2 Implicit Grant with 3Scale SaaS, APICast Gateway, and Red Hat SSO v7.1. In the last post, we introduced these components and demonstrated a functioning OAuth2 Authorization Code Grant (and OpenID Connect Authorization Code Flow). This is all part of my 3Scale API…

OAuth2 Configuration in 3Scale API Management (and APICast) with Red Hat SSO

Wed, 22 Nov 2017 23:23:56 GMT

This tutorial builds on the capabilities we explored in the “Red Hat SSO + 3Scale API Management” series and in particular in the first tutorial. In this post, we will:

Red Hat SSO v7.1 OAuth2 Client Credentials Grant

Thu, 16 Nov 2017 14:34:02 GMT

This post continues our exploration of OAuth2 Authorization Grants with Red Hat SSO v7.1. In previous posts, we looked at:

Red Hat SSO v7.1 OAuth2 Resource Owner Password Credential Grant Support

Mon, 13 Nov 2017 16:37:40 GMT

In this post, we will look at an example of the OAuth2 Resource Owner Password Credential Grant using Red Hat SSO v7.1. In previous posts, I described the Red Hat SSO setup for OpenID Connect authentication and OAuth2. We have also looked at examples of:

Red Hat SSO and 3Scale API Management Series

Sun, 12 Nov 2017 15:29:55 GMT

This post contains a collection of links to blog posts I’ve written about the use of OAuth2 and OpenID Connect with Red Hat SSO and 3Scale API Management.

OAuth2 Implicit Grant with Red Hat SSO v7.1

Sun, 12 Nov 2017 15:29:15 GMT

In my last post, we looked at how to configure Red Hat SSO v7.1 for OpenID Connect. That post also introduced a web-based OAuth2 + OIDC debugger and the OIDC Authorization Code Authentication Flow. The Red Hat SSO configuration that was created in that post also allows the OAuth2 Implicit Grant to…

Red Hat SSO v7.1 Spec Support

Sun, 12 Nov 2017 15:25:05 GMT

Red Hat SSO v7.1 provides support for OAuth2, OpenID Connect, and SAML2. There are numerous other identity protocols, but these are quite common and can handle a wide variety of use cases.

What is Authorization?

Sun, 12 Nov 2017 15:00:13 GMT

In a previous post, I gave a definition of Authentication. In this post, we’re going to explore authorization, which is typically the next step in the processing pipeline after authentication. The concepts described here can apply equally to traditional web applications, SPA apps, mobile apps,…

OpenID Connect (Authorization Code Flow) with Red Hat SSO

Sat, 11 Nov 2017 03:27:55 GMT

This post was originally published as “White Paper: OpenID Connect (Authorization Code Flow) with Red Hat SSO” on the Levvel Blog.

Application Security Models

Sun, 05 Nov 2017 14:00:35 GMT

I like to start system design (at the application level) with the security model that will be used to protect the system. Application security models have several attributes that need to be addressed at each layer of the application.

Digital Signature Series

Sun, 05 Nov 2017 13:42:13 GMT

The following blog posts are part of a series I wrote on digital signatures.

Performance Tuning Methodology

Sun, 05 Nov 2017 12:06:46 GMT

I’m taking a brief excursion from my usual identity and API-centric posts to answer a question about performance tuning that someone asked me earlier this year. In a previous incarnation of my career, I was focused on performance tuning and diagnostics — particularly involving Java systems.…

Understanding WS-Federation — Passive Requestor Profile

Wed, 18 Oct 2017 16:20:40 GMT

There are several identity protocols that are commonly supported by Identity Providers today — OAuth2, OAuth2 Token Exchange, OIDC, SAML2 Browser Profile, WS-Trust, WS-Federation, etc. The OAuth2 and OIDC protocols are relative newcomers. The other protocols have been around longer — and, tend to…

Summary of Azure Active Directory OAuth2 Authorization Grant and OIDC Authentication Flow Uses

Sun, 24 Sep 2017 12:03:53 GMT

A while back I needed a summary of which protocols were supported/recommended in different situations by Azure Active Directory while I was researching the “When To Use Which (OAuth2) Grants and (OIDC) Flows” post. So, I am summarizing it here.

Authentication vs. Federation vs. SSO

Sun, 24 Sep 2017 10:53:49 GMT

Authentication. Federation. Single Sign On (SSO). I’ve mentioned these concepts many times. I haven’t actually formally defined what each of these terms mean even though I’ve used these many times throughout my writing — these concepts are closely related.

How To Submit Your Security Tokens to an API Provider, Pt. 2

Sun, 17 Sep 2017 05:31:23 GMT

This post was originally published as “How to Submit Tokens to an API Provider, Pt 2” on the Apigee Blog.

How To Submit Your Security Tokens to an API Provider Pt. 1

Sun, 17 Sep 2017 05:19:29 GMT

This post was originally published as “How to Submit Tokens to an API Provider, Pt 1” on the Apigee Blog.

SAML2 vs JWT: A Comparison

Wed, 19 Jul 2017 16:45:07 GMT

This post concludes our discussion of SAML2 and JWT. Here we look at a comparison of the features and use cases of the two technologies. It’s difficult to make a direct comparison of JWT and SAML2. As we’ve seen through this series, one must take into account the specifications that work in…

JWT Use Cases

Thu, 13 Jul 2017 12:34:04 GMT

This post explores the equivalent JWT use cases corresponding to the five SAML2 use cases that were explored earlier in this series. We had to build up our tool set to get to this point — including exploring JWT, OAuth2, OpenID Connect, and the supporting specs. To be ready for this moment, we’ve…

OpenID Connect Logout

Wed, 12 Jul 2017 16:28:12 GMT

The OpenID Connect (OIDC) family of specs supports logout (from a single application) and global (or single) logout (from all applications that the user has logged into through the OpenID Provider, OP), but these features are optional or in draft status (as of Q2, 2017). So, these spec features may…

SAML2 Use Cases

Sun, 09 Jul 2017 06:24:44 GMT

The following blog posts discuss SAML2 use cases that have been explored in this series:

Identity Propagation in an API Gateway Architecture

Sat, 17 Jun 2017 13:54:05 GMT

The power of end-to-end user security context with APIs

When To Use Which (OAuth2) Grants and (OIDC) Flows

Sun, 21 May 2017 10:33:24 GMT

Update(07/01/2019): This is by far my most popular post. I’ve continued to update this article based on feedback and things that I have noticed. I’m trying to keep it relevant.Please leave feedback in the comments section.

An Alternative to Delegated Access in the Enterprise

Mon, 24 Apr 2017 12:31:53 GMT

Extending OAuth2 and OpenID Connect as the enterprise standard for API security

Understanding OpenID Connect Series

Wed, 29 Mar 2017 14:09:19 GMT

The following blog posts make up my series on OpenID Connect. This is part of the SAML2 vs JWT series.

SAML2 vs JWT: Understanding OpenID Connect Part 3

Sat, 25 Mar 2017 08:42:08 GMT

In part 1 and part 2 of Understanding OpenID Connect, core concepts and the first Authentication Flow (Authorization Code Grant Flow) were introduced. In part 3, we look at the remaining Authentication Flows (Implicit Flow and Hybrid Flow) and some other features of the OIDC specification.

SAML2 vs JWT: Understanding OpenID Connect Part 2

Sat, 25 Mar 2017 08:40:09 GMT

This post continues our discussion of OpenID Connect (OIDC). We look at one of the three Authentication Flows defined by the OIDC spec — the Authorization Code Grant Flow.

SAML2 vs JWT: Understanding OpenID Connect Part 1

Sat, 25 Mar 2017 08:38:58 GMT

This post builds upon what we learned about OAuth2 and JWT in previous posts. OpenID Connect will give us the final building block for the JWT-related use cases that this series will explore. The goal of this blog post is to provide a deep understanding of the OpenID Connect spec without having to…

Design Principles for Seamless User Authentication

Tue, 07 Mar 2017 13:31:37 GMT

This post was originally published as “Design Principles for Seamless User Authentication” on the Apigee Blog.

Keeping Your APIs Secure for Multiple User Types

Tue, 14 Feb 2017 23:29:45 GMT

This post was originally published as “Keeping Your APIs Secure for Multiple User Types” on the Apigee Blog.

The Tools of API Management — The Full Stack

Mon, 06 Feb 2017 10:19:38 GMT

In the first three API Management posts I wrote, we discussed “What are APIs?(The Technical Perspective)”, “What is API Management?”, and “The Anatomy of an API Management Solution”. Continuing with this theme, we will explore the API Management Stack. So, what do I mean by API Management Stack?

SAML2 vs JWT: Understanding OAuth2

Mon, 23 Jan 2017 06:31:11 GMT

This blog post continues the SAML2 vs JWT series. In the last post, we discussed JSON Web Tokens. Now, we are going to move on to OAuth2 and OpenID Connect, which provides some structure and protocol around the use of JWT. These protocols are used, along with JWT, to build the JWT use cases this…

Azure Active Directory Setup for API Actors

Mon, 16 Jan 2017 07:37:35 GMT

This post outlines how to setup an Azure Active Directory tenant with a Pay-As-You-Go or Free subscription (which only lasts for 30 days). This post is an ancillary post that gives the AAD configuration details needed for the Apigee and Azure Active Directory Integration — A JWT Story post to…

SAML2 vs JWT: Apigee & Azure Active Directory Integration — A JWT Story

Sun, 15 Jan 2017 04:55:38 GMT

In our next SAML2 vs JWT post, we are going to use a JWT with a very simple API that is proxied through Apigee Edge Public Cloud. The JWT token will be an OAuth2 access token generated by Azure Active Directory. In the last post in this series, we explored what JSON Web Tokens (JWTs) are and the…

SAML2 vs JWT: Understanding JSON Web Token (JWT)

Wed, 11 Jan 2017 03:48:06 GMT

In this post, we begin our exploration of the JSON Web Token (JWT) specification as part of the SAML v2.0 vs JWT Series. To understand JWT use cases, we must also look at OpenID Connect v1.0, OAuth v2.0, and and a few related specifications — the JWT spec by itself is not very interesting or…

SAML v2.0 vs. JWT: SAML2 Single Logout

Sun, 25 Dec 2016 18:07:47 GMT

This post wraps our look at SAML v2.0 Use Cases. The first four use cases are described in “SAML v2.0 vs JWT: SAML2 Web Application SSO Use Cases” and “SAML v2.0 vs. JWT: SAML2 with SOAP Web Services and REST APIs”. The full list of SAML2 vs JWT-related blog posts can be found here.

SAML v2.0 vs. JWT: SAML2 with SOAP Web Services and REST APIs

Sun, 25 Dec 2016 07:10:40 GMT

This post continues our look at SAML v2.0 Use Cases. The first two use cases are described in “SAML v2.0 vs JWT: SAML2 Web Application SSO Use Cases”. The full list of SAML2 vs JWT-related blog posts can be found here.

SAML v2.0 vs. JWT Series

Sat, 24 Dec 2016 23:01:21 GMT

This is a list of all the SAML2 vs JWT related posts I have written. This series explores SAML2 use cases, JWT use cases, the relevant specifications, and explores how the two technologies differ. The reader will see how identity federation technology has evolved over the past fifteen years.

SAML v2.0 vs JWT: SAML2 Web Application SSO Use Cases

Thu, 22 Dec 2016 02:43:54 GMT

This post continues our look at SAML v2.0 and how it compares to JSON Web Tokens (JWT). In the last post, we looked at the history, specs, and basics of SAML v2.0. In this post, we begin exploring SAML v2.0 use cases in detail.

API GOVERNANCE IN THE ENTERPRISE

Fri, 28 Oct 2016 22:58:47 GMT

This post was originally published as “API Governance in the Enterprise” on the Levvel Blog.

SAML 2.0 VS. JWT: UNDERSTANDING FEDERATED IDENTITY AND SAML

Thu, 20 Oct 2016 05:12:16 GMT

This post was originally published as “SAML 2.0 VS. JWT: UNDERSTANDING FEDERATED IDENTITY AND SAML” on the Levvel Blog.

API MANAGEMENT AND PERIMETER SECURITY FOR COTS APPLICATIONS

Wed, 17 Aug 2016 16:34:18 GMT

This post was originally published as “API Management and Perimeter Security for COTS Applications” on the Levvel Blog.

API Security vs. Web Application Security: Part 2

Tue, 17 May 2016 05:12:35 GMT

This post was originally published as “API Security vs. Web Application Security: Part 2” on the Levvel Blog.

API Security vs. Web Application Security Part 1: A Brief History of Web Application Architecture

Tue, 17 May 2016 04:42:35 GMT

This post was originally published as “API Security vs. Web Application Security Part 1: A Brief History of Web Application Architecture” on the Levvel Blog.

DSig Part 3: XML DSig vs. JSON Web Signature

Sun, 10 Apr 2016 06:45:35 GMT

This post was originally published as “DSig Part 3: XML DSig vs. JSON Web Signtaure” on the Levvel Blog.

DSig Part 2: JSON Web Signature (JWS)

Fri, 01 Apr 2016 18:30:03 GMT

This post was originally published as “DSig Part 2: JSON Web Signature (JWS)” on the Levvel Blog.

DSig Part 1: XML Digital Signature and WS-Security Integrity

Thu, 31 Mar 2016 05:34:18 GMT

This post was originally published as “DSig Part 1: XML Digital Signature and WS-Security Integrity” on the Levvel Blog.

Nissan LEAF, API Security, Who Owns API Security, and How Much Security Is Enough?

Mon, 14 Mar 2016 04:26:17 GMT

This post was originally published as “Nissan LEAF, API Security, Who Owns API Security, and How Much Security Is Enough?” on the Levvel Blog.

The Anatomy of an API Management Solution

Tue, 08 Mar 2016 06:45:04 GMT

This post was originally published as “The Anatomy of an API Management Solution” on the Levvel Blog.

What is API Management?

Sat, 27 Feb 2016 01:59:48 GMT

This post was originally published as “What is API Management?” on the Levvel Blog.

What are APIs? (The Technology Perspective)

Tue, 16 Feb 2016 06:24:48 GMT

This post was originally published as “What are APIs? (The Technology Perspective)” on the Levvel Blog.

Modernizing SOA with APIs

Tue, 16 Feb 2016 05:57:42 GMT

This post was originally published as “Modernizing SOA with APIs” on the Levvel Blog.

Protecting Server Resources Hosting Unauthenticated APIs

Tue, 16 Feb 2016 05:30:15 GMT

This post was originally published as “Protecting Server Resources Hosting Unauthenticated APIs” on the Levvel Blog.

Convert an X509v3 Binary Security Token to PEM Format

Sun, 30 Dec 2012 21:58:00 GMT

This tutorial describes how to convert a Binary Security Token extracted from a SOAP message into a valid PEM format that can be read by openssl or similar tool. If you are ever troubleshooting the use of X509v3 certificates used with WS-Security, this can come in very handy.

WS-Security Integrity (XML Digital Signature)

Sun, 11 Nov 2012 22:00:00 GMT

This post continues exploring the use of XML Digital Signature; this time we look at WS-Security Integrity (use of XML Digital Signatures with WS-Security). Our examples show a digital signature and a timestamp in a WS-Security SOAP Header.

XML Digital Signature (an Example)

Mon, 05 Nov 2012 00:04:00 GMT

In the last post, we looked at the steps involved in generating a digital signature using the XML Digital Signature spec. The algorithm to produce a signature and validate it were explored but no examples were given. In this post, we’ll look at an example that is given in the XML Digital Signature…

XML Digital Signatures

Mon, 29 Oct 2012 01:30:00 GMT

The XML DSig specification is used to provide digital signature functionality to XML Documents. It is is used by numerous other specs such as WS-Security and SAML2. This blog entry will describe how digital signatures work with an X509 private/public key pair.

XML Editor…

Sun, 21 Oct 2012 23:35:00 GMT

I was asked recently what XML, XSD and XSLT editor I use. Given that I am an independent/small consulting firm owner, spending $1000s of dollars on development tooling that will come out of my own pocket is not my first choice.

What is Authentication?

Sun, 14 Oct 2012 23:32:00 GMT

I’ve talked about authentication many times on ThinkMiddleware.com. It recently occurred to me that I have never devoted a blog post to defining authentication. I’ve had a section on the subject in a couple of different places, but I wanted to have an article to reference from other posts. So, here…

Datapower SOMA Calls

Wed, 10 Oct 2012 23:51:00 GMT

The primary administration automation mechanism on IBM WebSphere DataPower appliances is the XML Management Interface. The XMI interface allows one to make SOMA (SOAP Configuration Management, assuming SOMA = SOap MAnagement) calls to perform various administration tasks. How to perform these…

ShrewSoft VPN Client Has Problem After Windows 7 Laptop Sleeps with VPN Active

Mon, 01 Oct 2012 23:49:00 GMT

A few months ago I switched from using Cisco’s QuickVPN software to the ShrewSoft VPN Client for Windows. I’m not going to get into the issues that I had with QuickVPN-it wasn’t very reliable. I’ve had ShrewSoft VPN for Windows v2.1.7 connecting to a Cisco RV082 VPN router. ShrewSoft provides…

SOA Specs Visualized

Sun, 23 Sep 2012 18:21:00 GMT

In a previous blog post, I listed a number of SOA Specs and Security Specs that I thought were important to be familiar with when working with DataPower and other SOA technologies. In this post, I made a quick (and dirty) Visio diagram that I tend to draw up on a whiteboard when I’m at a new client…

Active Directory Return Codes

Sun, 02 Sep 2012 21:26:00 GMT

While working with DataPower and Active Directory (acting as the User Repository) I have often run into situation where AD returns an LDAP error code 49 plus a sub-code in the error string that is unique to AD. The sub-code can be very useful to troubleshooting, if you know what it means.

Some Simple Updates To A DataPower XSLT stylesheet.

Fri, 27 Jul 2012 22:20:00 GMT

In the last post, we saw how an XML Firewall in loopback mode could be used to return a valid SOAP response to a service message. The stylesheet used simply returned a static SOAP response that was independent of the input parameters. The stylesheet returns a response containing the sum of two…

SOAP Web Service Mockup tutorial on DataPower

Fri, 27 Jul 2012 18:14:00 GMT

It is often the case that a DataPower developer will have work to do, but does not yet have a backend Service Provider to point the DataPower service at. In general, anything beyond trivial examples will need to point at something that returns a valid response. In order to satisfy this requirement,…

JBoss/PicketLink WS-Trust Client and Third-Party Security Token Services

Wed, 04 Jul 2012 04:39:00 GMT

Another use-case that I touched on during my JBoss World 2012 presentation was using the PicketLink WS-Trust Client implementation to communicate with third-party Security Token Services. In particular, we discussed how the PicketLink SAML2STSIssuingLoginModule can communicate with the IBM Tivoli…

JBoss and LTPAv2 support

Tue, 03 Jul 2012 07:19:00 GMT

I’ve been at a couple of different client sites where there was a heavy IBM product presence, the use of IBM’s proprietary token format-LTPA2, and the need for a non-IBM technology such as JBoss EAP. Given the nature of the LTPA2 technology (IBM proprietary protocol), there isn’t any direct support…

DataPower Access Rental—Maybe DataPower in the Cloud?

Mon, 02 Jul 2012 05:25:00 GMT

Ever since I was first started working with IBM WebSphere DataPower I was looking around for someone that was offering access to a IBM WebSphere Datapower, I was looking around for someone that was offering access to an Internet-facing appliance that I could use for experimenting and learning. I…

JBoss World 2012 Session–Trusted Security with JBoss Enterprise Application Platform

Mon, 02 Jul 2012 05:11:00 GMT

It’s been a few weeks since I have posted any updates. I started a new project at the beginning of June; it always takes a few weeks to get up to speed on an extended project. Integrating the IBM Tivoli Security stack and JBoss EAP was the subject of my JBoss World 2012 presentation.

Fine Grained Authorization versus Coarse Grained Authorization

Wed, 06 Jun 2012 05:48:57 GMT

I was recently involved in a conversation where someone asked the question what is FGA (Fine Grained Authorization) versus Coarse Grained Authorization(CGA)? From their perspective, there was just authorization. Further distinction was not needed.

RBM–Administrative Access & Security for DataPower

Tue, 05 Jun 2012 05:52:00 GMT

I generally recommend to clients that DataPower RBM (Role-Based Management) be configured to perform authentication and authorization of DataPower administrators and developers with LDAP. In particular, whatever respository serves as the central repository of user information should be used (of…

DataPower Appliances & HSMs

Fri, 01 Jun 2012 00:48:09 GMT

I’ve been in a couple of shops that have used the HSM module option of DataPower for FIPS 140-2 v2 or v3 compliance. An HSM is a Hardware Security Module. My understanding is that there is a short list of IBM customers that are using this technology. I thought collecting all the information and…

JBoss World 2012 Session…

Wed, 30 May 2012 00:56:00 GMT

I will be presenting at JBoss World 2012 in Boston the last week of June. I’ll be presenting with Anil Saldana on JBoss Security, PicketLink, and Identity Management, JBoss Security Architect. A link to the description can be found here. The original abstract:

DataPower Exports and XML Files Referenced by Stylesheets

Tue, 29 May 2012 01:58:00 GMT

I was recently presented with an opportunity to be clever while promoting DataPower objects from a development environment to a testing environment. The WS-Proxy object’s policy rules had a Transform Action that ran a custom stylesheet. The stylesheet referenced a configuration file that was kept…

How To Rename a WS-Proxy or Multi-Protocol Gateway Object on a DataPower Appliance

Tue, 22 May 2012 01:37:00 GMT

Anyone who has worked with DataPower for a while has gotten into a situation where they need to rename a service object (XML Firewall, WS-Proxy, Multi-Protocol Gateway, etc). There isn’t a rename button that I have ever found. This tutorial will describe two ways of renaming such objects.

Thomas Erl’s SOA Book Series

Wed, 16 May 2012 01:41:00 GMT

I listed several of Thomas Erl’s books in my SOA Recommended reading list. A full list of Thomas Erl’s series of SOA books can be found here. Anyone working in the SOA space, regardless of vendor or technology stack, should read these books.

Who Owns DataPower Within An Organization?

Tue, 08 May 2012 00:36:00 GMT

The definition of the word ownership has varying meanings across organizations, but there is always a group that retains control of the technology. It’s typically the group that sponsored the adoption of the technology and owns day-to-day support of it. But, sometimes, the technology initiative…

DataPower and Terminal Servers…

Sun, 06 May 2012 00:27:00 GMT

DataPower has a serial port console that is used during initial bootstrap of the appliance, recovering from problems, and certain configuration changes. Having access to the serial console is the only feasible approach to resolving certain issues that arise with any appliance (or piece of network…

WebSphere DataPower Roles and Responsibilities…

Fri, 04 May 2012 03:56:00 GMT

DataPower is a weird (but, wonderful) beast. It has a tendency to break some of the traditional IT silos that develop within infrastructure groups. That can lead to a lot of friction and amusing arguments in which everyone is simply talking past one another. In this post, I want to describe the…

Three Internal Architectures—Designs for DataPower Deployments

Thu, 03 May 2012 03:03:00 GMT

I have been in several different shops that are either deploying DataPower or are a few years after deploying DataPower. I’ve also had opportunities to talk to numerous different DataPower technical resources about how they have utilized DataPower. In the post, I want to describe what I’ve seen as…

OSI 7-Layer Network Model

Tue, 01 May 2012 02:37:00 GMT

I’ve been playing with Cisco switches and routers recently at home to get a handle on VLANs-more about VLANs later. Some people I know who have gotten involved in DataPower started out in system administration or networking and worked their way up the technology stack to SOA Appliances (WebSphere…

Symmetric Keys—Addendum

Tue, 24 Apr 2012 22:50:00 GMT

A couple of weeks ago I wrote a brief post about how to generate symmetric keys that can be used with DataPower. It demonstrates how to generate shared keys of various lengths using the Unix dd command. Today, someone asked how a shared key (or symmetric key) can be generated using the openssl…

SSL Handshake—The Visual

Mon, 23 Apr 2012 23:23:00 GMT

This is an old picture that I made for a 2010 JBoss World security presentation. It came in handy not so long ago when I was explaining the SSL Handshake to someone.

IBM Impact 2012 Client Panel: Experiences with IBM SOA Stack Rollout

Sun, 22 Apr 2012 21:02:00 GMT

I will be leading a discussion panel at IBM Impact 2012 in Las Vegas on Monday, April 30th, 3:45-4pm. More information can be found here. It will be an open ended discussion and Q&A session detailing experiences rolling out IBM technology for an ESB. I’ve done this at a couple of different…

DataPower Extension Functions and Elements

Thu, 19 Apr 2012 02:34:00 GMT

Anyone who has spent time working with DataPower has had to write an XSLT stylesheet at some point. DataPower provides a library of functions and elements that provide access to various DataPower functionality.

XSLT & XPath

Wed, 18 Apr 2012 02:32:00 GMT

XSLT is the only scripting language supported by WebSphere DataPower appliances. It is the only way to customize DataPower functionality and behavior. So, anyone that works with DataPower for a while will sooner be writing XSLT stylesheets.

Sample Stylesheet—Starting Point

Tue, 17 Apr 2012 02:33:00 GMT

I often have to go back and look up these details; so, I decided to post a standard starting point for a new stylesheet.

Protocol Transformations

Fri, 13 Apr 2012 01:44:00 GMT

Previously, I wrote a Wire Protocols post that outlined the common protocols that I’ve encountered when working with ESBs and SOA technology-especially DataPower. A primary function of an ESB is to provide the ability to convert service requests between these different protocols in a mostly…

Privacy Policy

Thu, 12 Apr 2012 01:45:17 GMT

I just added a Privacy Policy to ThinkMiddleware.com.

What is a Web Service? What is a Service?

Wed, 04 Apr 2012 03:33:00 GMT

I have watched this debate unfold at every client site I have visited in the past few years. There are several angles to this question. From a technical stand point, a service is a program that takes some type of input, performs a task, and return some type of output. This is vague. It can describe…

Generating and Uploading a Shared Key (Symmetric Key) to DataPower Appliances

Sun, 18 Mar 2012 01:16:00 GMT

DataPower does not seem to provide a tool to generate a Shared Key that can be used with 3DES or AES algorithms. DataPower does provide a tool for generating X509 private keys, certificate requests, and self-signed certificates-in the Crypto Tools section-but we are concerned with Shared Keys…

Service Mediation vs. Service Orchestration

Sun, 11 Mar 2012 01:24:00 GMT

I’ve wanted to define this term for a while, but, someone beat me to it several years ago. I generally agree with what these guys have to say. These terms are still in use today at client sites where DataPower and the IBM SOA stack is being deployed. Service Mediation logic is the application of…

Data Transformations

Sun, 04 Mar 2012 01:38:00 GMT

In a previous post, I described the different types of Data Formats that are commonly used with ESBs, XML Gateways, and SOA. Converting from one format to another is a common task performed by an ESB or XML Gateway. One can make arguments either way about whether this functionality should exist in…

Data Formats

Sun, 26 Feb 2012 02:10:00 GMT

To follow up on the Wire Protocol post, the next logical step in our SOA exploration is Data Formats. A web service message’s Data Format describes how the data is organized in the message.

Wire Protocols

Sat, 18 Feb 2012 23:15:00 GMT

Like so much of our computer industry, the ecosystem around SOA has many acronyms, buzzwords, and phrases that are supposed to mean something. Likewise, this jargon may be poorly defined or ambiguous. The posts that I have made over the past few months are slowly building up a common vocabulary…

SOA Security Reading Material

Sun, 05 Feb 2012 01:34:00 GMT

At nearly every client site, I’m asked to put together a recommended reading list on a variety of subjects. Web Services security is generally among them. SO, I’m putting together a list of the links that usually make it on that list.

SOA Actors

Sun, 29 Jan 2012 04:18:00 GMT

When I am describing complex SOA or Web Service architectures, environments, and scenarios to clients, I often use the term “SOA Actors” to generically refer to components of such environments in the abstract. I will often do the same on Thinkmiddleware.com posts. Here, I define what I mean by this…

What is a Service Consumer?

Sun, 22 Jan 2012 04:17:00 GMT

A Service Consumer is any tier of an organization’s systems that calls web services. These services could be implemented by SOAP, REST, XML over HTTP, EJBs, JMS or MQ applications, RMI, RPC, invocation of COBOL programs on a mainframe with 3270 screen-scraping, communication over a custom TCP…

What is a Service Provider?

Sun, 15 Jan 2012 04:16:00 GMT

A Service Provider is any tier or system in an organization’s environment that hosts web services (or services of any kind).

What is an ESB?

Sun, 08 Jan 2012 04:16:00 GMT

In the past year, I have stood in a conference room at more than one client fielding a question along the lines of exactly what is an ESB? I’ve found that there is a wide variety of impressions about what exactly makes something an ESB. I’m hardly the first person to post something on the Internet…

What Is A SOAP Web Service?

Thu, 05 Jan 2012 01:32:00 GMT

A SOAP Web Service is any web service that is compliant with the SOAP 1.1 or SOAP 1.2 specs. When referring to a SOAP Web Service we will use the capitalized Web Service. This convention is followed by most publications within the industry.

What is a Web Service? What is a web service?

Thu, 05 Jan 2012 01:32:00 GMT

This one has probably been addressed many times. But, I needed a place to link to whenever it comes up in other posts. For our purposes, a Web Service is SOAP Web Service and a web service is anything acting as a web service in the generic sense.

What Is A REST Web Service?

Thu, 05 Jan 2012 01:31:00 GMT

REST web services are not nearly as formalized as their SOAP equivalent. A REST web service adheres to the principals laid out in Roy Fielding’s PhD Thesis. REST stands for Representational State Transition.

What is an XML Gateway?

Sun, 01 Jan 2012 04:15:00 GMT

An XML Gateway is an externally-facing DMZ tier of a web services platform. Generally, this DMZ tier will be facing the Internet, but it may simply be between business units or facing a leased line connecting one entity to another. It can be implemented using a software solution (such as web…

What is an Appliance? What is a SOA Appliance?

Sun, 25 Dec 2011 02:31:00 GMT

I suppose I’m switching gears a bit here back towards something almost philosophical rather than my usual concrete technical info So be it. In the last six months, I’ve been at several clients sites that are using SOA appliances to build XML Gateway and ESB patterns. I answer quite a few client…

JVM Heap & GC Tuning…

Mon, 10 Oct 2011 02:53:08 GMT

So, obviously, I haven’t posted anything here in a while🙂. Life has been busy. Starting several months ago, I left my job of four years and began independent consulting. Among other things, this means that the variety of topics discussed on thinkmiddleware.com should be more varied. I’m also going…

IBM Announced the New XG45 DataPower appliance

Thu, 06 Oct 2011 03:18:00 GMT

This is the first post on thinkmiddleware.com where we discuss DataPower. Guess what I’ve been doing with my career lately🙂.

JBoss 4.x and DataSource Configuration

Sun, 12 Jun 2011 01:14:40 GMT

On JBoss 4.x, a MySQL datasource looks something like:

Secure Identity Propagation using WS-Trust, WS-Security, and SAML2 — IBM Impact, 2011 Session

Sat, 16 Apr 2011 06:07:05 GMT

On April 13th, 2011, Ryan Triplett and I spoke at IBM Impact in Las Vegas. The topic was “Secure Identity Propagation using WS-Trust, WS-Security, and SAML2“. The PowerPoint presentation can be found here. The original abstract:

Secure Identity Propagation using WS-Trust, WS-Security, and SAML2

Sat, 16 Apr 2011 00:01:00 GMT

I gave the following presentation at IBM Impact in April, 2011.

HTTP Client – Form-Based Authentication

Sat, 11 Sep 2010 23:48:09 GMT

This article continues the discussion started in the Servlet Authentication article. Here we discuss Form-Based authentication; another common form of authentication when Servlet technology is used.

Servlet Container Authentication

Sat, 11 Sep 2010 23:20:40 GMT

There are three required authentication mechanisms supported by a compliant Servlet Container: HTTP Basic Authentication, Form-based Authentication, and CLIENT_CERT authentication. There is a fourth authentication method, DIGEST, that isn’t used very often in my experience. This final…

Summary of J2EE Specs

Sat, 11 Sep 2010 22:58:22 GMT

If you were ever looking for a summary of each version of the J2EE Spec, it can take a few minutes to find it. So, here is a summary. The J2EE Specification is actually collection of numerous different Java-based technology specifications.

JBossWorld 2010 Session — Securing JBoss Services

Thu, 01 Jul 2010 21:18:00 GMT

On June 24, 2010, I gave a presentation at JBoss World in Boston. This was my second time at JBoss World. The presentation covered Securing JBoss Services. It explored the use of JaasSecurityDomain MBeans to configure SSL in JBoss 4.3 (also relevent for newer versions of JBoss) for various…

JAX-WS Example With JBossWS – Server-Side

Tue, 06 Oct 2009 02:40:46 GMT

In previous article, a very simple Web Application was presented. In any complex environment, there will often be multiple tiers within an application or environments hosting code/services for different teams. A common way of communicating within such environments is through SOAP-based Web Services…

Running JBoss on an OpenJDK6 build

Mon, 31 Aug 2009 03:58:07 GMT

Recently, I had some free time and set out to bring up JBoss on OpenJDK6. In particular, I wanted to Run JBoss on an OpenJDK build that I personally compiled.

J2EE Security Series

Wed, 26 Aug 2009 17:27:58 GMT

An Openldap Directory Server JBoss 4.3.x Setup Adding Groups To OpenLdap Using OpenLdap as a User Repository with JBoss 4.3.x

Securing The JBoss JAAS Subject Reader Application with J2EE Security

Tue, 25 Aug 2009 20:03:54 GMT

This article continues the J2EE Security Series from the past few months. Here we expand the Simple J2EE Web Application that was introduced in this article to use J2EE Security.

HTTP(S) URLs & Context Roots

Tue, 25 Aug 2009 18:39:56 GMT

What is a URL? What is a context root? It’s helpful to understand these things when writing or working with web applications.

A Simple Web Application

Tue, 25 Aug 2009 17:08:31 GMT

In order to test J2EE Security with the Security Realm and Openldap User Repository we created in the last article in this series, we need an application to protect. The focus of this article is to create a very simple web application that can be protected by J2EE Security.

J2EE Security

Mon, 15 Jun 2009 02:03:09 GMT

The article continues the series discussing J2EE Security and its related concepts. The following brings together the numerous concepts discussed in the past articles.

Role Mapping & J2EE Security

Mon, 15 Jun 2009 01:47:35 GMT

The discussion of J2EE Security on the JBoss Application Server continues as Role Mapping is introduced.

Using OpenLdap as a User Repository with JBoss 4.3.x

Mon, 15 Jun 2009 01:42:14 GMT

This article continues our discussion of setting up J2EE Security in a JBoss 4.3.x container. In the last article, we completed the setup of an OpenLdap database that can be used as a User Repository.

Adding Groups To OpenLdap

Mon, 15 Jun 2009 00:46:36 GMT

This article describes how to setup an OpenLdap server and add inetperson user objects. However, the article didn’t describe how to add groups to OpenLdap and add users to the groups.

URL & HTML Character Representation

Wed, 13 May 2009 14:08:27 GMT

I’ve had to look up the HTML codes for special characters like space many times. In fact, while writing blog entries for Thinkmiddleware.com, I’ve had to stop and look up the HTML code for less-than sign and greater-than sign one to many times. I just haven’t bothered memorizing them.

JBoss 4.3.X Setup

Sun, 26 Apr 2009 11:37:39 GMT

This article explains how to install and start the JBoss “default” server.

Capturing Network Communication Between Two Processes On the Same Machine…

Tue, 07 Apr 2009 18:14:57 GMT

Have you ever run snoop on Solaris or tcpdump on Linux or AIX and discovered that these tools cannot capture IP-based communication that occurs between two processes on the same machine? Or, Wireshark (formerly, Ethereal) on Windows? Only to discover the same limitation?

Capturing JVM TCP Traffic

Fri, 03 Apr 2009 23:38:19 GMT

Any time you have a distributed application, there is network communication involved. Capturing this network traffic can be instrumental in diagnosing and solving problems. Generally, to capturing network traffic, superuser privledges, timing, and a bit of luck is needed. Often, the appropriate…

Websphere v6.x Classloaders

Sat, 21 Feb 2009 23:47:07 GMT

Building on the ideas introduced in the last article, a J2EE Application servers classloaders are explored in this installment. In particular, Websphere Application Server v.6.x Classloaders are introduced. The J2EE Spec provides some guidance regarding J2EE Application Servers, but as with so many…

JEE 6 Draft Proposal Is Available For Public Review

Sun, 01 Feb 2009 03:36:37 GMT

Check out JSR 316 and this article. There is also a Slashdot.org thread on the subject.

Java Virtual Machine Classloaders

Mon, 19 Jan 2009 04:50:57 GMT

Classloaders are responsible for finding and loading classes that are requested in Java code executed inside a Java Virtual Machine. Classloader-related issues are among the most difficult to troubleshoot in the Java/J2EE technology stack.

Site Maintenance — Clean Up

Sun, 11 Jan 2009 01:40:55 GMT

The older articles predating the use of WordPress are slowly being copied over to the WordPress format. This provides a common look & feel and allows WordPress seach functionality, RSS feeds, and other goodies to work properly with the older content.

Computer Measurement Prefixes and Number Naming Conventions

Sat, 10 Jan 2009 12:02:54 GMT

I always forget the quantity prefixes above “tera”. Even more interestingly, one rarely thinks about the numbers’ names. For example, consider the number

JVM process Virtual Memory Usage (Resident Set Size) On A Linux 2.6.25 Kernel

Thu, 01 Jan 2009 21:41:04 GMT

This article expands on the previous Virtual Memory post by exploring Resident Set Size growth while running a Java program that will consume all available Java Heap memory. Four different JVM implementations are used to compare results of these experiments. These JVMs come from two different…

Google Browser Security Handbook

Thu, 01 Jan 2009 18:38:22 GMT

Google has released a Browser Security Handbook online. It can be found here.

Virtual Memory — Linux

Sun, 28 Dec 2008 19:41:55 GMT

It has been a couple of weeks since the last article was published. Recently, I had to dig into Virtual Memory on AIX to work through some issues. I realized there were several details I needed to explore further to understand Virtual Memory implementations. In particular, the implementation…

Dumping the contents of a JAAS Subject

Sun, 07 Dec 2008 08:07:26 GMT

In the last article, JAAS was introduced. An authenticated calling-entity (perhaps a user), has a JAAS Subject. This JAAS Subject contains some combination of Principals, Public Credentials, and Private Credentials. It can be very helpful to dump the contents of this JAAS Subject for debugging…

JAAS Authentication — An Introduction

Sun, 30 Nov 2008 08:31:19 GMT

This article introduces JAAS authentication via a relatively simple example. The example presented here is based upon the Sun tutorial of the same subject. The thinkmiddleware.com example extends the tutorial to use LDAP to authenticate users.

An Openldap Directory Server

Sat, 29 Nov 2008 10:02:33 GMT

The recent JNDI article and an upcoming JAAS article require an LDAP server. This tutorial will walk through the basic details of reproducing the Openldap Server used in these two articles.

JNDI — Java Naming & Directory Interface

Wed, 26 Nov 2008 23:34:15 GMT

While researching an upcoming JAAS article, the decision was made to use JNDI to interact with the Openldap server that was stored user information. JNDI is used extensively in the J2EE landscape; so, exploring JNDI separately from JAAS seemed in order.

Ant — Build Control

Sat, 22 Nov 2008 19:57:26 GMT

I’ve mentioned that for larger projects/examples on thinkmiddleware.com, Ant would be used. The Java Security Manager article was the first time it was used. Although, the full details of the source code were not included, Ant was used.

The Java Security Manager

Sat, 15 Nov 2008 13:16:06 GMT

In the last post, the Java Standard Edition and Java Enterprise Edition security features were introduced. This is the second in a series of articles that introduces each Java security feature in depth. This article introduces the Java Security Manager and the sandbox it creates for a Java…

Java Security — The Low-Level details To J2EE Security–And, Beyond

Sat, 08 Nov 2008 23:12:26 GMT

While researching details for a Java Security Manager article, it became obvious that I didn’t understand the mappings of all the different Java, security-related specifications to the technologies and acronyms I knew. Thus, was the beginning of this article. Below each security-related feature in…

Java Networking API vs. The C library networking API

Sun, 02 Nov 2008 11:15:12 GMT

The original article is located here. In this article, I described what was involved in writing a server program in the C language. The details are not important, but I wanted to compare the details that are exposed in this relatively simple C network programming example with the equivalent Java…

Concurrency And Server-Side Networking APIs — Part 4

Sat, 01 Nov 2008 00:14:09 GMT

The original article can be found here. Introduction

Concurrency And Server-Side Networking APIs — Part 3

Thu, 30 Oct 2008 18:10:24 GMT

This is part three of an exploration of how concurrency in networking APIs works in Unix-like operating systems and Java technology. This article now looks at the Java equivalents of several C-based server implementations that have been presented. If you haven’t read this series from the beginning,…

Concurrency And Server-Side Networking APIs — Part 2

Tue, 28 Oct 2008 01:00:45 GMT

In the second part of this series we continue to explore how Unix-like operating systems implement the networking API and threading API. In particular, we are supremely interested in how the kernel allows server programs accept incoming connections. Part two explores implementing concurrency in…

Concurrency And Server-Side Networking APIs — Part 1

Sun, 26 Oct 2008 23:22:13 GMT

This article explores how a Sun Hotspot JVM behaves when accepting incoming TCP/IP socket connections. The behavior of native server programs–written in C–are also explored to better understand how concurrency can be achieved. Then, a comparison of how these runtime environments implement…

Threads, Threads Everywhere. And, Not a Needle In Sight

Sun, 19 Oct 2008 23:18:46 GMT

Several terms have been used liberally throughout articles on thinkmiddleware.com. A moment should be taken to formally define them. I am going to attempt to present these concepts in as generic a sense as possible, but the truth of the matter is, every OS has its own threading model and…

Mapping An LWP Using Excessive CPU Time To a Java Thread

Sun, 19 Oct 2008 21:16:50 GMT

It happens. End users are complaining about a slow system or a request that never returned. You log into a production middleware server and notice that a java process is consuming an entire CPU or worst every available CPU on the box. It has happened again–a thread(s) has gone into an infinite loop…

Configure Your JVM For Use With a Remote Debugger

Sat, 18 Oct 2008 21:06:11 GMT

As I’ve pointed out in several previous articles, I like the jdb command line debugger that is available with the Sun JDK. This debugger can actually be used with any spec-compliant JVM. The JPDA specification defines the interfaces and services that are used by remote debuggers and profiles. The…

Generating Thread Dumps

Sat, 18 Oct 2008 20:57:13 GMT

Thread dumps are the basic diagnostic tool for JVMs. Thread dumps present a partial state of each Java thread in a running JVM. I say partial because it doesn’t present all information that captures the state of a Java thread. The state of a running Java thread is stored in a series of data…

My JVM ran out of memory! What objects are consuming all of the memory?

Thu, 16 Oct 2008 20:48:56 GMT

This article isn't a comprehensive JVM Java heap sizing and garbage collection tuning document; its goal is simply to outline options for identifying which type of Object(s) are consuming the majority of memory in a running JVM--troubleshooting memory leaks in the Java heap. As usual, I focus on…

Troubleshooting Deadlock Conditions With Monitor Locks In Java Virtual Machines

Tue, 14 Oct 2008 20:48:29 GMT

In this article, I wanted to present a brief tutorial regarding troubleshooting deadlock conditions in JVMs. Before one can troubleshoot a deadlock condition, one needs to understand what it is; to this end, I have written a simple Java program called DeadLock.java, which is guaranteed to very…

The Definition of Reverse Engineering, JVMs, and the Java programming language

Sun, 12 Oct 2008 20:11:20 GMT

I recently had a conversation with a colleague that reminded me of a another discussion with my Masters Project advisor a couple of years ago when I was exploring research topics. The topic under discussion was Reverse Engineering --in particular, Software Reverse Engineering. It sounds really…

EJB vs. Web Services

Mon, 06 Oct 2008 20:07:51 GMT

This article is by no means an exhaustive discussion on the subject of Web Services and EJBs. But, I have often found many of the points I bring up here missing from meaningful debate. Researching this article also gave me an opportunity to go over material I've been wanting to read for a while now.

The Java Instruction Set, Assemblers, and Disassemblers

Sun, 05 Oct 2008 20:03:19 GMT

Note: this is another article that I wrote a while ago using a Java Disassembler that no longer seems to be available--d-Java. There are numerous Java Disassemblers on the Internet. Two more that could be used are mentioned in the reference section: Jasper & Kimera. They can produce the Jasmin…

Generating Thread Dumps from a Sun or IBM JVM Running As A Windows Service

Mon, 29 Sep 2008 19:28:10 GMT

I was recently asked if there was a way to generate a Thread Dump from a JVM running as a Windows Service. It occured to me that I had a similar issue during my Masters Project when I was trying to generate a thread dump from a Cygwin xterm; Googling at the time turned up no good way of accomplishing the task. But, I knew that you could use the Java Debugger that ships with the Sun JDK, jdb, to generate a thread dump of all non-System Threads in a JVM. I posed this as a solution to generating Thread Dumps from a JVM running as a Windows Service.

Performance Tuning In Industry

Mon, 29 Sep 2008 19:16:15 GMT

IT Professionals face an up hill battle in the realm of performance tuning. First, management must be convinced that time needs to be set aside for it. Next, the skill sets to successfully move through the performance tuning life cycle must be present. Then, the tools to effectively identify issues…

Part 2: Custom Client-Server Java Application That CommunicatesOver A Mutually Authenticated SSL (MASSL) Connection

Thu, 11 Sep 2008 19:02:01 GMT

This is the second of a two-part series discussing Java and Mutually Authenticated SSL. This will gave you a taste of how a J2EE container is communicating (over SSL or MASSL) behind the scenes.

Part 1: Creating your own SSL certificates for a custom Java client-server application

Wed, 27 Aug 2008 18:09:41 GMT

If you replace the steps for creating your own CA private key & certificate and signing your own certificate (with the CA) with having certificates signed by a legitimate Certificate Authority, you've got the basic idea behind creating/ordering certs for most situations.

Achieving highly available HTTP database session persistence spanning multiple cells with Websphere v6.1

Sun, 24 Aug 2008 18:03:48 GMT

Websphere can provide HTTP Session data replication across multiple clusters and cells by using database session persistence.

References I Cited in My Masters Project

Fri, 21 Mar 2008 03:13:00 GMT

This week (er, quarter), I wanted to share the references I used while researching my Masters Project. It’s a collection of about fifty web links and books that I found helpful. Reading this stuff and staring at long sequences of numbers represents about eighteen months of my life. More information…

These are the references I cited in my Masters Project Defense

Thu, 20 Mar 2008 06:05:16 GMT

So, obviously, I haven’t been adding to this site nearly as often as I had hoped. This week (er, quarter), I wanted to share the references I used while researching my Masters Project. It’s a collection of about fifty web links and books that I found helpful. Reading this stuff and staring at long…

Masters Project Defense

Sun, 02 Dec 2007 03:11:00 GMT

On November 29, 2007, I gave my Masters Project Defense before Dr. Chris Gill, Dr. Cindy Grimm, and Dr. Roger Chamberlain. This is the presentation. I’m posting it here because it involved analyzing low-level details of a Sun JVM running JBoss 3.x.

Masters Project

Sat, 01 Dec 2007 06:03:27 GMT

On November 29, 2007, I gave my Masters Project Defense before Dr. Chris Gill, Dr. Cindy Grimm, and Dr. Roger Chamberlain. This is the presentation.

Presentation I gave to the CS450 Video Game Programming Class at Wash U on October 12, 2007

Mon, 15 Oct 2007 06:02:22 GMT

Here is the presentation.

Flying Over Mars

Fri, 09 Feb 2007 06:01:36 GMT

I’ve had this one sitting on the shelf for a while. The last semester of my undergraduate program at Wash U., I created a flight simulator program that could be used to view Martian terrtain data. We created this by grabbing a series of still shots while the flight simulator was running.

The First 1500 Hamming Numbers

Tue, 30 Jan 2007 05:59:51 GMT

I haven’t had a chance to post anything here since the beginning of last semester. I’m in a class at the moment where all of the programming assignments involves annoying little math algorithms. The most recent required us to generate the first N hamming numbers using an efficient algorithm that…

JCup & JFlex With Ant

Sat, 18 Nov 2006 03:31:00 GMT

I’ve been bogged down in work and school lately. So, it has been a while since I’ve written anything. This semester I’m taking an Instruction Set Architecture course at Wash U–basically, the final project is to design a processor with VHDL in ModelSim. I think I’m going to stick to software.…

Using JCup & JFlex with Ant

Fri, 17 Nov 2006 05:56:33 GMT

Linux Kernel Modules

Sun, 17 Sep 2006 05:58:39 GMT

I’m reading the book Linux Device Drivers to get up to speed on writing Linux modules; I’ll be using this for an upcoming project, if all goes according to plan. This isn’t much, but if you need to get the most basic of kernel modules built, this is what you need to do.

Examining the Call Stack with GDB

Sun, 03 Sep 2006 05:54:35 GMT

This will be the second Blog entry I’ve made. I need to come up with a fancier welcome and introduction to each of these things. I started the forth semester of CS Masters program at Wash U. last week. I’ve got a lot of reading to do.

Flex & Bison Example using Microsoft Visual C++ 7.0

Mon, 28 Aug 2006 05:51:57 GMT

Well, I guess this is my first Blog entry. I’m at the tail end of the four weeks I’ve had between the end of summer school and the beginning of the Fall semester. I’m working on a CS Masters degree at Washington University in St. Louis.

Universal Exterminator

Mon, 21 Aug 2006 05:48:09 GMT

I took CS450–Game Programming– at Wash U in Fall, 2005. This was the result. This was the end result. My group called themselves “Die Sphere, Die!”–you may notice our logo pop up occasionally.