The tag has no wiki summary.

learn more… | top users | synonyms

3
votes
2answers
75 views

Using Prolog to implement authorization rules

I'm working on a user management "pseudoframework" in PHP, and I'm trying to implement fine-grained rule-based authorization. I'm using a combination of SQL and condition-checking functions written ...
1
vote
0answers
53 views

adding new service to authenticated website

So I've created an api that I want to leverage to add some functionality to an existing web app. My current website authenticates users using saml. What I'm looking to do is instead of moving the code ...
1
vote
1answer
92 views

WebAPI authorisation for other apps

I would like to create a WebAPI application that can serve some of my web sites. My goal is to abstract some common task such as email sending, address resolving etc by providing an API to all of my ...
1
vote
3answers
269 views

How do you make sure a .net client application is not being hacked to bypass authorization claims?

We wrote a simple .NET (C#) desktop application in Wpf. We also used WIF (Windows Identity Framework) to get a list of claims for the authenticated user. Some examples are: CanOverrideSalesAmount ...
1
vote
0answers
94 views

How to make sure media are used only on authorised sites?

I have a video library that I need to publish for my clients. The clients need to be able to embed a player to their sites and play the videos. I need to restrict access to my clients only so that ...
1
vote
1answer
39 views

Embedding XACML PDP?

I need to implement a flexible Access Control system for a framework used by a couple of .NET applications. I have looked into Attribute-Based Access Control (ABAC) and XACML and this seems to ...
0
votes
1answer
1k views

Custom Role Provider in ASP.NET MVC and specifically a User having multiple Roles

I have searched around and I can't find any particular answer that addresses what I am asking but no doubt it will have been mentioned already somewhere. I know that when you inherit from an abstract ...
2
votes
1answer
106 views

Providing an agnostic authorization system

I'm trying to design a small web platform that would host several "applications", with a common user pool. My reflection is now focused on the authorization system. I define an application as an ...
1
vote
2answers
278 views

Is double password protection safe for admin authentication?

I was looking at some of my past codes, and I viewed one of my admin boards I've made. I had it setup so that the admin has to define/enter 2 passwords for his account. Is this really double-safe or ...
3
votes
2answers
91 views

How should I specify locations where clients can resolve authorization problems in a REST API?

I'm working through an API design where a user's authentication will be verified by the presence of a valid forms authentication ticket in a session cookie. However, there are additional levels of ...
0
votes
1answer
391 views

Multiple roles in Ruby On Rails

I've been asked to put together an application in RoR which has multiple roles for users. The idea is that a user will have a role, Admin, Moderator, User ect... and they will also have a department ...
5
votes
3answers
549 views

OAuth alternative for a 2 party system

I'm writing a RESTful service (Java EE, Jersey) and a client application that communicates with it, and I wish to secure it and store any usernames & passwords dedicated in my own database. I do ...
0
votes
1answer
149 views

Polymorphism versus authorization

I have something bother me in the understanding of polymorphism (vs role): Note: I am using rails (but it's a general question) I have 4 models: User Pro Customer Company There is a polymorphic ...
4
votes
3answers
278 views

How can I improve this design so that I don't need to dynamically scan classes at runtime?

I'm in the middle of a redesign on the part of my current project that deals with user permissions and authorization. I have an interface named IUserPermissions that encapsulates this information. ...
1
vote
2answers
1k views

Simplest token-system for authenticating and authorizating

I want to make Python script that will accept input from Vim and send it to my web-site. So basically I want to make Vim my text-editor for blog articles. Of course, I need to authenticate and ...
2
votes
2answers
971 views

SVN command line client: checkout refused when LDAP password changed “svn: OPTIONS of” (repo) “authorization failed” (but works in TortoiseSVN)

When using the command line/terminal svn client, a colleague is getting "svn: OPTIONS of " [repo] "...authorization failed" error message when they attempt to checkout the repo to be their local ...
2
votes
0answers
74 views

How can a client authorize us to collect their data from a service provider?

Our clients need to authorize our partners to release data to us. We can collect this data via a push/pull mechanism. Since our partners have never shared data before, they don't have OAuth ...
4
votes
4answers
9k views

REST Service Authentication/Authorization

I have a WCF rest service that will be consumed by multiple clients. The information returned by the client requires me to know who they are, so that I can return information specific to them. Is ...
9
votes
2answers
396 views

Imitating Exchange Server's “RBAC AuthZ” in my own application… (is there something similar?)

Exchange 2010 has a delegation model where groups of winrm cmdlets are essentally grouped into roles, and the roles assigned to a user. (Image source) This is a great & flexible model ...
12
votes
8answers
1k views

Punishing users for insecure passwords [closed]

I'm thinking about limiting the rights of users who choose insecure passwords (insecurity of a password being determined by length, how many types of characters (upper/lower case, numbers, symbols, ...
4
votes
2answers
331 views

What are the different ways for performing authorization in a web application other than role-based authorization?

The most common approach used for authorization which I know is role based authorization. Instead of directly storing the access rights against the user ids you create roles and store the access ...
4
votes
1answer
487 views

How to solve a general authentication problem for multiple applications?

At my current job (we're in a MS environment), we have multiple deployed web applications, both inter/intra net. The internal apps generally use an Active Diretory sign in, the forward facing sites ...
6
votes
2answers
2k views

Examples of permission-based authorization systems in .Net? [closed]

I'm trying to figure out how to do roles/permissions in our application, and I am wondering if anyone knows of a good place to get a list of different permission-based authorization systems ...