The tag has no wiki summary.

learn more… | top users | synonyms

5
votes
3answers
167 views

Multi platform password storage with retrieval for applications with authorization?

I'm working on a development tool that requires knowing one or more api passwords for a user to operate. Currently it works on Mac, and uses keychain to store the credentials for later re-use. Are ...
1
vote
1answer
97 views

Should I store my user claims in the JWT token?

I am using JWT tokens in HTTP headers to authenticate requests to a resource server. The resource server and auth server are two separate worker roles on Azure. I cannot makeup my mind as to whether ...
1
vote
2answers
121 views

Is it a good idea to require passwords in offline applications?

I am developing an application which can install extension modules (plugins, if you will) from APT-style repositories hosted elsewhere. The plugins need not be signed (although the downloads are ...
2
votes
0answers
68 views

Oauth 2 store access token vs verifying on each call

Let's say my Server is both Authorization Server and Resource server My Client (for example mobile app) can authenticate in 2 matters: via Resource Owner Password Credentials Grant via ...
0
votes
0answers
38 views

Authorizing view content

Let's say I have a view which should change it's content based on the user resp. on the users permission. After some research I basically found 2 types of authorization. Role-Based and Activity-Based ...
3
votes
2answers
125 views

Using Prolog to implement authorization rules

I'm working on a user management "pseudoframework" in PHP, and I'm trying to implement fine-grained rule-based authorization. I'm using a combination of SQL and condition-checking functions written ...
2
votes
0answers
69 views

Adding new service to authenticated website

So I've created an API that I want to leverage to add some functionality to an existing web app. My current website authenticates users using SAML. What I'm looking to do is instead of moving the code ...
1
vote
2answers
141 views

WebAPI authorisation for other apps

I would like to create a WebAPI application that can serve some of my web sites. My goal is to abstract some common task such as email sending, address resolving etc by providing an API to all of my ...
1
vote
3answers
386 views

How do you make sure a .net client application is not being hacked to bypass authorization claims?

We wrote a simple .NET (C#) desktop application in Wpf. We also used WIF (Windows Identity Framework) to get a list of claims for the authenticated user. Some examples are: CanOverrideSalesAmount ...
2
votes
0answers
100 views

How to make sure media are used only on authorised sites?

I have a video library that I need to publish for my clients. The clients need to be able to embed a player to their sites and play the videos. I need to restrict access to my clients only so that ...
1
vote
1answer
59 views

Embedding XACML PDP?

I need to implement a flexible Access Control system for a framework used by a couple of .NET applications. I have looked into Attribute-Based Access Control (ABAC) and XACML and this seems to ...
0
votes
1answer
2k views

Custom Role Provider in ASP.NET MVC and specifically a User having multiple Roles

I have searched around and I can't find any particular answer that addresses what I am asking but no doubt it will have been mentioned already somewhere. I know that when you inherit from an abstract ...
2
votes
1answer
113 views

Providing an agnostic authorization system

I'm trying to design a small web platform that would host several "applications", with a common user pool. My reflection is now focused on the authorization system. I define an application as an ...
1
vote
2answers
284 views

Is double password protection safe for admin authentication?

I was looking at some of my past codes, and I viewed one of my admin boards I've made. I had it setup so that the admin has to define/enter 2 passwords for his account. Is this really double-safe or ...
3
votes
2answers
92 views

How should I specify locations where clients can resolve authorization problems in a REST API?

I'm working through an API design where a user's authentication will be verified by the presence of a valid forms authentication ticket in a session cookie. However, there are additional levels of ...
0
votes
1answer
455 views

Multiple roles in Ruby On Rails

I've been asked to put together an application in RoR which has multiple roles for users. The idea is that a user will have a role, Admin, Moderator, User ect... and they will also have a department ...
6
votes
3answers
649 views

OAuth alternative for a 2 party system

I'm writing a RESTful service (Java EE, Jersey) and a client application that communicates with it, and I wish to secure it and store any usernames & passwords dedicated in my own database. I do ...
0
votes
1answer
157 views

Polymorphism versus authorization

I have something bother me in the understanding of polymorphism (vs role): Note: I am using rails (but it's a general question) I have 4 models: User Pro Customer Company There is a polymorphic ...
4
votes
3answers
280 views

How can I improve this design so that I don't need to dynamically scan classes at runtime?

I'm in the middle of a redesign on the part of my current project that deals with user permissions and authorization. I have an interface named IUserPermissions that encapsulates this information. ...
1
vote
2answers
1k views

Simplest token-system for authenticating and authorizating

I want to make Python script that will accept input from Vim and send it to my web-site. So basically I want to make Vim my text-editor for blog articles. Of course, I need to authenticate and ...
2
votes
2answers
1k views

SVN command line client: checkout refused when LDAP password changed “svn: OPTIONS of” (repo) “authorization failed” (but works in TortoiseSVN)

When using the command line/terminal svn client, a colleague is getting "svn: OPTIONS of " [repo] "...authorization failed" error message when they attempt to checkout the repo to be their local ...
2
votes
0answers
74 views

How can a client authorize us to collect their data from a service provider?

Our clients need to authorize our partners to release data to us. We can collect this data via a push/pull mechanism. Since our partners have never shared data before, they don't have OAuth ...
4
votes
4answers
10k views

REST Service Authentication/Authorization

I have a WCF rest service that will be consumed by multiple clients. The information returned by the client requires me to know who they are, so that I can return information specific to them. Is ...
9
votes
2answers
414 views

Imitating Exchange Server's “RBAC AuthZ” in my own application… (is there something similar?)

Exchange 2010 has a delegation model where groups of winrm cmdlets are essentally grouped into roles, and the roles assigned to a user. (Image source) This is a great & flexible model ...
12
votes
8answers
1k views

Punishing users for insecure passwords [closed]

I'm thinking about limiting the rights of users who choose insecure passwords (insecurity of a password being determined by length, how many types of characters (upper/lower case, numbers, symbols, ...
4
votes
2answers
347 views

What are the different ways for performing authorization in a web application other than role-based authorization?

The most common approach used for authorization which I know is role based authorization. Instead of directly storing the access rights against the user ids you create roles and store the access ...
4
votes
1answer
500 views

How to solve a general authentication problem for multiple applications?

At my current job (we're in a MS environment), we have multiple deployed web applications, both inter/intra net. The internal apps generally use an Active Diretory sign in, the forward facing sites ...
6
votes
2answers
3k views

Examples of permission-based authorization systems in .Net? [closed]

I'm trying to figure out how to do roles/permissions in our application, and I am wondering if anyone knows of a good place to get a list of different permission-based authorization systems ...