31–40 of 80 posts
I was looking into SAML a while back for a project (preexisting compatibility) and the lack of functional open source IdP's is depressing. I tried Gluu and it's a RAM hog for what it does (IMO). I took a look at the developer docs and it seems all but impossible to override the password hashing method with your own (query passwords from your own database instead of LDAP hashed) was one use case I was looking into) Ev…
This seems to me as just a subset what OpenID Connect is. OIDC is an addition to OAuth2 and supports all mentioned - user identity: core user info endpoint - discovery: https://openid.net/specs/openid-connect-discovery-1_0.html - client registration: https://openid.net/specs/openid-connect-registration-1_0.htm... And also other features which are important for more complex cases than just simple "login using X" butto…
The battle between OAuth 1.0a, 2.0, and OIDC is really long and drawn out and doesn't seem to have a clear winner which I think is hurting everyone (though of course some companies are winning because they can support everything and offer that as value). I sure do wish people would just standardize on OIDC...
I was looking into SAML a while back for a project (preexisting compatibility) and the lack of functional open source IdP's is depressing. I tried Gluu and it's a RAM hog for what it does (IMO). I took a look at the developer docs and it seems all but impossible to override the password hashing method with your own (query passwords from your own database instead of LDAP hashed) was one use case I was looking into) Ev…
Shibboleth, simplesamlphp. Both offer easy ways to add custom login handlers.
For this use case, they'd also need to configure JAAS.
Earlier quoted context omitted.
Unless there's gonna be native browser support, the different websites you visit won't be able to know which accounts you've recently used elsewhere.
If browsers were to support this, there would be some tricky UI/UX questions about how readily the browser provides information to a new website about accounts you have on other sites. Such a feature might best be specified as an extension to this API: https://developer.mozilla.org/en-US/docs/Web/API/Credential_... which although experimental does have some level of browser support.
I don't understand why the need for this new protocol; what's missing from OpenID?
OAuth 1.0a includes authentication and authorization. OAuth 2.0 is designed for authorization only and could be vulnerable to account takeover/impersonation attacks. MasterCard uses OAuth 1.0a instead of 2.0 https://developer.mastercard.com/blog/why-mastercard-doesnt-...
Earlier quoted context omitted.
Shibboleth, simplesamlphp. Both offer easy ways to add custom login handlers.
Shibboleth is _the_ gold standard when it comes to SAML. I'm at the point where I don't recommend anything else, and I'm willing to help people deploy it (contact info in profile). For this use case, they'd also need to configure JAAS.
I've been thinking of writing my own SAML IdP in Python (since I have plenty of experience with the language) and I'm not naive to the various security things that can go wrong, but I'm no expert cryptographer either.
OAuth 1.0a includes authentication and authorization. OAuth 2.0 is designed for authorization only and could be vulnerable to account takeover/impersonation attacks. MasterCard uses OAuth 1.0a instead of 2.0 https://developer.mastercard.com/blog/why-mastercard-doesnt-...
Given that OAuth 2.0 uses TLS, could you please explain how such an attack could actually be executed?
Might seem like a remote chance from a user's point of view, but could be a threat from a payment processor's view, with billions of daily transactions.
Also, easier to prove the integrity of the message when you're handling the authentication piece yourself rather than assuming TLS was correctly enforced end-to-end.
This seems to me as just a subset what OpenID Connect is. OIDC is an addition to OAuth2 and supports all mentioned - user identity: core user info endpoint - discovery: https://openid.net/specs/openid-connect-discovery-1_0.html - client registration: https://openid.net/specs/openid-connect-registration-1_0.htm... And also other features which are important for more complex cases than just simple "login using X" butto…
The battle between OAuth 1.0a, 2.0, and OIDC is really long and drawn out and doesn't seem to have a clear winner which I think is hurting everyone (though of course some companies are winning because they can support everything and offer that as value). I sure do wish people would just standardize on OIDC...
Earlier quoted context omitted.
Shibboleth is _the_ gold standard when it comes to SAML. I'm at the point where I don't recommend anything else, and I'm willing to help people deploy it (contact info in profile). For this use case, they'd also need to configure JAAS.
I'll give just Shibboleth a try later. I've been thinking of writing my own SAML IdP in Python (since I have plenty of experience with the language) and I'm not naive to the various security things that can go wrong, but I'm no expert cryptographer either.
You don't have to be, as you would not implement any cryptographic algorithms (ciphers, hash methods) yourself. Solid experience with software security in general is a requirement of course.