Collaborate Disseminate
We are integrating our application with SSO using Entra ID App Registrations and configuring OIDC.
When our application receives the ID token from Microsoft Entra, the iap and exp values seem invalid. This has been occurring for a few mon… Continue reading Entra ID issuing expired ID Tokens
I have a requirement to extend a quality assurance process in the customers CRM system so that when the user enters some data he or she is prompted to a screen with username and password and the already logged in user is again verified. Yo… Continue reading Verify user credentials via SAML (E-Signature)
I recently started using the Brave browser for a little more privacy.
However, I still don’t understand much about the risks surrounding SSO and cookies.
As an example, I am logged in to YouTube.com with my Google account. As an example, i… Continue reading What are the risks of SSO and logins in general in relation to privacy?
Of the 239 vulnerabilities, 33% (79 out of 239) were associated with authentication, authorization and access control (AAA) — foundational pillars of API security, according to Wallarm. Prioritizing AAA principles Open authentication (OAuth), single-si… Continue reading The new imperative in API security strategy
I have Linux servers which are members of AD domain, running SSSD demon.
SSSD is "Kerberized" and I also do want use Kerberos for Oracle db authentication.
NOTE: this is not purely about Oracle database. This can be applied to an… Continue reading Oracle Kerberos authentication on Linux host with SSSD
The OWASP Foundation’s Top Ten lists have helped defenders focus their efforts with respect to specific technologies and the OWASP API (Application Programming Interface) Security Top 10 2023 is no exception. First drafted five years ago and updated th… Continue reading Is the new OWASP API Top 10 helpful to defenders?
In this Help Net Security interview, Florian Forster, CEO at Zitadel, discusses the challenges CISOs face in managing authentication across increasingly distributed and remote workforces, the negative consequences of ineffective authorization, and how … Continue reading Adapting authentication to a cloud-centric landscape
We have an existing SP called S1 that authenticates to multiple Idps. We have another service called S2, I want S2 to delegate authentication to S1 then to Idp, then back and notify S2 when authentication succeeds. Its important to note th… Continue reading How to delegate SAML2 authentication between Service Providers (SPs)?
I am trying integrate our service with SSO. I have generated the ClientID and ClientSecret.
Is it a good security practice to store the ClientID and ClientSecret as a configmap? If not, what are the alternatives for storing and using them?… Continue reading How to store ClientID and ClientSecret in a K8 Env
Password resets could unnecessarily cost FTSE 100 businesses over $156 million every month, according to MyCena Security Solutions. This raises the question of the necessity of password resets, at a time when organisations must identify cost savings to… Continue reading Password reset woes could cost FTSE 100 companies $156 million each month