Tag Archives: oauth2
-
OAuth vs. SAML vs. OpenID Connect
This entry was posted in Gluu and tagged IAM, oauth2, open source, openid connect, saml, sso on .
The Gluu Server is a free open source platform that has both SAML and OAuth2 components. I have been trying to help educate the community for some time on the pro’s and con’s of both infrastructures. Here is a quick overview to help get you oriented! OAuth 2.0 is an authorization framework, not an authentication … Read more >>
-
WebViews are bad — Use AppAuth for Mobile Single Sign-On (SSO)
This entry was posted in Gluu and tagged AppAuth, authentication, Google, Mobile, mobile SSO, OAuth, oauth2, Okta, openid connect, Ping, PKCE, security, sso on .
In a WebView, any malicious code in the page has the same rights as the application. This means you need to make sure to only load trusted content. But there is another risk–a malicious app may also have access to browser content (like cookies) and may snoop passwords or intercept OAuth codes. So if you … Read more >>
-
How to centrally issue OAuth tokens for API access management
This entry was posted in Gluu and tagged api, application security, OAuth, oauth2, openid, saml, xacml on .
So you want to use OAuth2 bearer tokens to protect your API’s to avoid putting credentials in each request. Great idea! But if you have lots of API’s, you may want to build a central service that takes care of registering clients, and issuing tokens. A good way to do this is to use the … Read more >>
-
OAuth2 for IoT?
This entry was posted in Gluu and tagged 2fa, authentication, IOT, oauth2, openid connect, uma on .
Today, consumers have no way to centrally manage access to all their Web stuff and IOT devices are threatening to create a whole new silo of security problems. This is one of the reasons I’ve been participating in the Open InterConnect Consortium Security Task Group. People can’t individually manage every IOT device in their house. … Read more >>
-
Roadmap for Higher Education Institutions: Will New Identity Standards Achieve the Promise of Federated Identity?
This entry was posted in Gluu and tagged Authentrication, Authz, oauth2, openid, saml, sso on .
“Market Strength” as defined by the number of applications that will support the protocol. Will New Identity Standards Achieve the Promise of Federated Identity in Higher Education? OAuth2 based identity standards bridge web and mobile security requirements and have critical developer and industry support. See Also: Gluu Protocol Predictions It is harder than you think … Read more >>
-
OpenID Connect… Call me crazy!
This entry was posted in Gluu and tagged authentication, oauth2, openid connect, Single Sign-On, sso, uma on .
10 Reasons Why OpenID Connect will be ubiquitous for domain authentication “The difficult… I’ll do right now. The impossible may take a little while…” Bob Russell lyrics for Jazz standard “Crazy She Calls Me” OpenID Connect has reached the quorum of votes needed for approval! Check out the launch press release. This under-appreciated event will … Read more >>
-
Juju OAuth2 Application Security Design Proposal
This entry was posted in Gluu and tagged 2fa, Authn, Authz, oauth2, OpenAM, openid connect, saml, siteminder, sso, ubuntu on .
We don’t need SSO, we need trust elevation There is no point in designing a solution that provides just SSO. Today, people are using an array of devices (think IOT). Applications need to understand how (and how long ago) a person has been authenticated, and based on the context of the situation, whether they need … Read more >>
