The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
1answer
31 views

Embedding XACML PDP?

I need to implement a flexible Access Control system for a framework used by a couple of .NET applications. I have looked into Attribute-Based Access Control (ABAC) and XACML and this seems to ...
0
votes
1answer
163 views

Claim based authorization for application framework? [closed]

I am developing a framework that makes common data management tasks easier for a couple of future applications built on top of it, including document management, data versioning, retention, locking ...
0
votes
1answer
1k views

Custom Role Provider in ASP.NET MVC and specifically a User having multiple Roles

I have searched around and I can't find any particular answer that addresses what I am asking but no doubt it will have been mentioned already somewhere. I know that when you inherit from an abstract ...
4
votes
3answers
461 views

OAuth alternative for a 2 party system

I'm writing a RESTful service (Java EE, Jersey) and a client application that communicates with it, and I wish to secure it and store any usernames & passwords dedicated in my own database. I do ...
2
votes
1answer
94 views

Providing an agnostic authorization system

I'm trying to design a small web platform that would host several "applications", with a common user pool. My reflection is now focused on the authorization system. I define an application as an ...
0
votes
1answer
302 views

Multiple roles in Ruby On Rails

I've been asked to put together an application in RoR which has multiple roles for users. The idea is that a user will have a role, Admin, Moderator, User ect... and they will also have a department ...
1
vote
2answers
269 views

Is double password protection safe for admin authentication?

I was looking at some of my past codes, and I viewed one of my admin boards I've made. I had it setup so that the admin has to define/enter 2 passwords for his account. Is this really double-safe or ...
3
votes
2answers
85 views

How should I specify locations where clients can resolve authorization problems in a REST API?

I'm working through an API design where a user's authentication will be verified by the presence of a valid forms authentication ticket in a session cookie. However, there are additional levels of ...
0
votes
1answer
140 views

Polymorphism versus authorization

I have something bother me in the understanding of polymorphism (vs role): Note: I am using rails (but it's a general question) I have 4 models: User Pro Customer Company There is a polymorphic ...
4
votes
3answers
272 views

How can I improve this design so that I don't need to dynamically scan classes at runtime?

I'm in the middle of a redesign on the part of my current project that deals with user permissions and authorization. I have an interface named IUserPermissions that encapsulates this information. ...
1
vote
2answers
793 views

Simplest token-system for authenticating and authorizating

I want to make Python script that will accept input from Vim and send it to my web-site. So basically I want to make Vim my text-editor for blog articles. Of course, I need to authenticate and ...
2
votes
2answers
776 views

SVN command line client: checkout refused when LDAP password changed “svn: OPTIONS of” (repo) “authorization failed” (but works in TortoiseSVN)

When using the command line/terminal svn client, a colleague is getting "svn: OPTIONS of " [repo] "...authorization failed" error message when they attempt to checkout the repo to be their local ...
2
votes
0answers
72 views

How can a client authorize us to collect their data from a service provider?

Our clients need to authorize our partners to release data to us. We can collect this data via a push/pull mechanism. Since our partners have never shared data before, they don't have OAuth ...
3
votes
4answers
8k views

REST Service Authentication/Authorization

I have a WCF rest service that will be consumed by multiple clients. The information returned by the client requires me to know who they are, so that I can return information specific to them. Is ...
9
votes
2answers
365 views

Imitating Exchange Server's “RBAC AuthZ” in my own application… (is there something similar?)

Exchange 2010 has a delegation model where groups of winrm cmdlets are essentally grouped into roles, and the roles assigned to a user. (Image source) This is a great & flexible model ...
6
votes
2answers
2k views

Examples of permission-based authorization systems in .Net?

I'm trying to figure out how to do roles/permissions in our application, and I am wondering if anyone knows of a good place to get a list of different permission-based authorization systems ...
4
votes
2answers
308 views

What are the different ways for performing authorization in a web application other than role-based authorization?

The most common approach used for authorization which I know is role based authorization. Instead of directly storing the access rights against the user ids you create roles and store the access ...
12
votes
8answers
1k views

Punishing users for insecure passwords [closed]

I'm thinking about limiting the rights of users who choose insecure passwords (insecurity of a password being determined by length, how many types of characters (upper/lower case, numbers, symbols, ...
4
votes
1answer
472 views

How to solve a general authentication problem for multiple applications?

At my current job (we're in a MS environment), we have multiple deployed web applications, both inter/intra net. The internal apps generally use an Active Diretory sign in, the forward facing sites ...