The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
1answer
30 views

Embedding XACML PDP?

I need to implement a flexible Access Control system for a framework used by a couple of .NET applications. I have looked into Attribute-Based Access Control (ABAC) and XACML and this seems to ...
0
votes
1answer
159 views

Claim based authorization for application framework? [closed]

I am developing a framework that makes common data management tasks easier for a couple of future applications built on top of it, including document management, data versioning, retention, locking ...
0
votes
1answer
1k views

Custom Role Provider in ASP.NET MVC and specifically a User having multiple Roles

I have searched around and I can't find any particular answer that addresses what I am asking but no doubt it will have been mentioned already somewhere. I know that when you inherit from an abstract ...
2
votes
1answer
93 views

Providing an agnostic authorization system

I'm trying to design a small web platform that would host several "applications", with a common user pool. My reflection is now focused on the authorization system. I define an application as an ...
1
vote
2answers
267 views

Is double password protection safe for admin authentication?

I was looking at some of my past codes, and I viewed one of my admin boards I've made. I had it setup so that the admin has to define/enter 2 passwords for his account. Is this really double-safe or ...
3
votes
2answers
85 views

How should I specify locations where clients can resolve authorization problems in a REST API?

I'm working through an API design where a user's authentication will be verified by the presence of a valid forms authentication ticket in a session cookie. However, there are additional levels of ...
0
votes
1answer
301 views

Multiple roles in Ruby On Rails

I've been asked to put together an application in RoR which has multiple roles for users. The idea is that a user will have a role, Admin, Moderator, User ect... and they will also have a department ...
4
votes
3answers
460 views

OAuth alternative for a 2 party system

I'm writing a RESTful service (Java EE, Jersey) and a client application that communicates with it, and I wish to secure it and store any usernames & passwords dedicated in my own database. I do ...
0
votes
1answer
140 views

Polymorphism versus authorization

I have something bother me in the understanding of polymorphism (vs role): Note: I am using rails (but it's a general question) I have 4 models: User Pro Customer Company There is a polymorphic ...
4
votes
3answers
272 views

How can I improve this design so that I don't need to dynamically scan classes at runtime?

I'm in the middle of a redesign on the part of my current project that deals with user permissions and authorization. I have an interface named IUserPermissions that encapsulates this information. ...
1
vote
2answers
792 views

Simplest token-system for authenticating and authorizating

I want to make Python script that will accept input from Vim and send it to my web-site. So basically I want to make Vim my text-editor for blog articles. Of course, I need to authenticate and ...
2
votes
2answers
772 views

SVN command line client: checkout refused when LDAP password changed “svn: OPTIONS of” (repo) “authorization failed” (but works in TortoiseSVN)

When using the command line/terminal svn client, a colleague is getting "svn: OPTIONS of " [repo] "...authorization failed" error message when they attempt to checkout the repo to be their local ...
2
votes
0answers
72 views

How can a client authorize us to collect their data from a service provider?

Our clients need to authorize our partners to release data to us. We can collect this data via a push/pull mechanism. Since our partners have never shared data before, they don't have OAuth ...
3
votes
4answers
8k views

REST Service Authentication/Authorization

I have a WCF rest service that will be consumed by multiple clients. The information returned by the client requires me to know who they are, so that I can return information specific to them. Is ...
9
votes
2answers
364 views

Imitating Exchange Server's “RBAC AuthZ” in my own application… (is there something similar?)

Exchange 2010 has a delegation model where groups of winrm cmdlets are essentally grouped into roles, and the roles assigned to a user. (Image source) This is a great & flexible model ...
12
votes
8answers
1k views

Punishing users for insecure passwords [closed]

I'm thinking about limiting the rights of users who choose insecure passwords (insecurity of a password being determined by length, how many types of characters (upper/lower case, numbers, symbols, ...
4
votes
2answers
307 views

What are the different ways for performing authorization in a web application other than role-based authorization?

The most common approach used for authorization which I know is role based authorization. Instead of directly storing the access rights against the user ids you create roles and store the access ...
4
votes
1answer
472 views

How to solve a general authentication problem for multiple applications?

At my current job (we're in a MS environment), we have multiple deployed web applications, both inter/intra net. The internal apps generally use an Active Diretory sign in, the forward facing sites ...
6
votes
2answers
2k views

Examples of permission-based authorization systems in .Net?

I'm trying to figure out how to do roles/permissions in our application, and I am wondering if anyone knows of a good place to get a list of different permission-based authorization systems ...