40 articles tagged Authentication.
In certain US industries, usually legacy businesses with low margins and heavily regulated, it is still quite common to use source IP address as an authentication mechanism on the public internet. Now, never mind that in the age of cloud computing and SaaS applications, it is rare for cloud…
Read article: Don’t Use Source IP Addresses As The Primary Authentication MechanismBut, let’s face it, you’re probably going to do it anyway.
Read article: No, You Shouldn’t Use Production Data For TestingPrivacy (and Digital Privacy) is one of those terms that I’ve thrown around a lot in the last few years. However, I never took the time to define it.
Read article: What Is Digital Privacy?Authentication is described in this post.
Read article: Static Credentials Must Not Be Used In The BrowserIn this next post in the Kerberos and Windows Security Series, we are going to explore a very useful, but abstract feature of the Kerberos Authentication Protocol: Delegation. In particular, we are going to focus on the Windows implementation of this feature. Delegation allows downstream actors to…
Read article: Kerberos and Windows Security: DelegationThere are several approaches to securing APIs. Every API Gateway vendor supports the same core set of API security mechanisms. API Keys and OAuth2 are two examples of these authentication (plus authorization) mechanism. When should one be used over the other? What are the differences between the…
Read article: OAuth2 Access Tokens vs API Keys — Using JWTsThere are many ways to implement user authentication in a modern application (mobile, desktop, tablet, web, etc). I have previously explored Authentication, Federation, and SSO; that post introduces several key concepts that are assumed here. At the intersection of user experience, authentication,…
Read article: Identity Protocols, Hosted Login UIs, and Custom Login UIsWhile researching an upcoming blog post about Kerberos and Mobile, I needed to understand how Identity Providers (like ADFS or Ping Federate) use Kerberos (and possibly Kerberos Delegation) to perform authentication via username and password. This blog post captures what I found for ADFS.
Read article: Active Directory Federation Services (ADFS) and KerberosIt’s 2018. At this point, application developers should not be writing code that directly implements HTTPS calls to OAuth2 or OpenID Connect endpoints, token caching, token refreshes, token validation, or other such activities. An authentication library should be used that implements these…
Read article: OpenID Connect (OIDC) and OAuth2 Authentication Libraries
