Collaborate Disseminate
Of the 239 vulnerabilities, 33% (79 out of 239) were associated with authentication, authorization and access control (AAA) — foundational pillars of API security, according to Wallarm. Prioritizing AAA principles Open authentication (OAuth), single-si… Continue reading The new imperative in API security strategy
I have Linux servers which are members of AD domain, running SSSD demon.
SSSD is "Kerberized" and I also do want use Kerberos for Oracle db authentication.
NOTE: this is not purely about Oracle database. This can be applied to an… Continue reading Oracle Kerberos authentication on Linux host with SSSD
The OWASP Foundation’s Top Ten lists have helped defenders focus their efforts with respect to specific technologies and the OWASP API (Application Programming Interface) Security Top 10 2023 is no exception. First drafted five years ago and updated th… Continue reading Is the new OWASP API Top 10 helpful to defenders?
In this Help Net Security interview, Florian Forster, CEO at Zitadel, discusses the challenges CISOs face in managing authentication across increasingly distributed and remote workforces, the negative consequences of ineffective authorization, and how … Continue reading Adapting authentication to a cloud-centric landscape
We have an existing SP called S1 that authenticates to multiple Idps. We have another service called S2, I want S2 to delegate authentication to S1 then to Idp, then back and notify S2 when authentication succeeds. Its important to note th… Continue reading How to delegate SAML2 authentication between Service Providers (SPs)?
I am trying integrate our service with SSO. I have generated the ClientID and ClientSecret.
Is it a good security practice to store the ClientID and ClientSecret as a configmap? If not, what are the alternatives for storing and using them?… Continue reading How to store ClientID and ClientSecret in a K8 Env
Password resets could unnecessarily cost FTSE 100 businesses over $156 million every month, according to MyCena Security Solutions. This raises the question of the necessity of password resets, at a time when organisations must identify cost savings to… Continue reading Password reset woes could cost FTSE 100 companies $156 million each month
We have 3 different applications which have the same top level domain.
a.example.com
b.example.com
example.com
We have a login mechanism where the user provides a username + password and logs in. Each of these websites wants to have cont… Continue reading SSO Using API based login (not through UI redirection)
We have 3 different applications which have the same top level domain.
a.example.com
b.example.com
example.com
We have a login mechanism where the user provides a username + password and logs in. Each of these websites wants to have cont… Continue reading SSO Using API based login (not through UI redirection)
I am a student learning Android Application development
I am a newbee to SSO oAuth2 etc and Im interested to learn.
I am comfortable with signing in a user using their username/password and obtaining Access and refresh tokens.
I have also … Continue reading how do you support sign in on android mobile applications for users who can only access the application via their institutions account