SAML2 vs JWT: Understanding OpenID Connect Part 2
This post continues our discussion of OpenID Connect (OIDC). We look at one of the three Authentication Flows defined by the OIDC spec — the Authorization Code Grant Flow.
Design Principles for Seamless User Authentication
This post was originally published as “Design Principles for Seamless User Authentication” on the Apigee Blog.
Protecting Server Resources Hosting Unauthenticated APIs
This post was originally published as “Protecting Server Resources Hosting Unauthenticated APIs” on the Levvel Blog.
XML Digital Signatures
The XML DSig specification is used to provide digital signature functionality to XML Documents. It is is used by numerous other specs such as WS-Security and SAML2. This blog entry will describe how digital signatures work with an X509 private/public key pair.
What is Authentication?
I’ve talked about authentication many times on ThinkMiddleware.com. It recently occurred to me that I have never devoted a blog post to defining authentication. I’ve had a section on the subject in a couple of different places, but I wanted to have an article to reference from other posts. So, here…
RBM–Administrative Access & Security for DataPower
I generally recommend to clients that DataPower RBM (Role-Based Management) be configured to perform authentication and authorization of DataPower administrators and developers with LDAP. In particular, whatever respository serves as the central repository of user information should be used (of…
HTTP Client – Form-Based Authentication
This article continues the discussion started in the Servlet Authentication article. Here we discuss Form-Based authentication; another common form of authentication when Servlet technology is used.
Servlet Container Authentication
There are three required authentication mechanisms supported by a compliant Servlet Container: HTTP Basic Authentication, Form-based Authentication, and CLIENT_CERT authentication. There is a fourth authentication method, DIGEST, that isn’t used very often in my experience. This final…
Dumping the contents of a JAAS Subject
In the last article, JAAS was introduced. An authenticated calling-entity (perhaps a user), has a JAAS Subject. This JAAS Subject contains some combination of Principals, Public Credentials, and Private Credentials. It can be very helpful to dump the contents of this JAAS Subject for debugging…
JAAS Authentication — An Introduction
This article introduces JAAS authentication via a relatively simple example. The example presented here is based upon the Sun tutorial of the same subject. The thinkmiddleware.com example extends the tutorial to use LDAP to authenticate users.
Part 2: Custom Client-Server Java Application That CommunicatesOver A Mutually Authenticated SSL (MASSL) Connection
This is the second of a two-part series discussing Java and Mutually Authenticated SSL. This will gave you a taste of how a J2EE container is communicating (over SSL or MASSL) behind the scenes.