What is Authentication?
I’ve talked about authentication many times on ThinkMiddleware.com. It recently occurred to me that I have never devoted a blog post to defining authentication. I’ve had a section on the subject in a couple of different places, but I wanted to have an article to reference from other posts. So, here…
ShrewSoft VPN Client Has Problem After Windows 7 Laptop Sleeps with VPN Active
A few months ago I switched from using Cisco’s QuickVPN software to the ShrewSoft VPN Client for Windows. I’m not going to get into the issues that I had with QuickVPN-it wasn’t very reliable. I’ve had ShrewSoft VPN for Windows v2.1.7 connecting to a Cisco RV082 VPN router. ShrewSoft provides…
Active Directory Return Codes
While working with DataPower and Active Directory (acting as the User Repository) I have often run into situation where AD returns an LDAP error code 49 plus a sub-code in the error string that is unique to AD. The sub-code can be very useful to troubleshooting, if you know what it means.
JBoss/PicketLink WS-Trust Client and Third-Party Security Token Services
Another use-case that I touched on during my JBoss World 2012 presentation was using the PicketLink WS-Trust Client implementation to communicate with third-party Security Token Services. In particular, we discussed how the PicketLink SAML2STSIssuingLoginModule can communicate with the IBM Tivoli…
JBoss and LTPAv2 support
I’ve been at a couple of different client sites where there was a heavy IBM product presence, the use of IBM’s proprietary token format-LTPA2, and the need for a non-IBM technology such as JBoss EAP. Given the nature of the LTPA2 technology (IBM proprietary protocol), there isn’t any direct support…
JBoss World 2012 Session–Trusted Security with JBoss Enterprise Application Platform
It’s been a few weeks since I have posted any updates. I started a new project at the beginning of June; it always takes a few weeks to get up to speed on an extended project. Integrating the IBM Tivoli Security stack and JBoss EAP was the subject of my JBoss World 2012 presentation.
Fine Grained Authorization versus Coarse Grained Authorization
I was recently involved in a conversation where someone asked the question what is FGA (Fine Grained Authorization) versus Coarse Grained Authorization(CGA)? From their perspective, there was just authorization. Further distinction was not needed.
RBM–Administrative Access & Security for DataPower
I generally recommend to clients that DataPower RBM (Role-Based Management) be configured to perform authentication and authorization of DataPower administrators and developers with LDAP. In particular, whatever respository serves as the central repository of user information should be used (of…
DataPower Appliances & HSMs
I’ve been in a couple of shops that have used the HSM module option of DataPower for FIPS 140-2 v2 or v3 compliance. An HSM is a Hardware Security Module. My understanding is that there is a short list of IBM customers that are using this technology. I thought collecting all the information and…
JBoss World 2012 Session…
I will be presenting at JBoss World 2012 in Boston the last week of June. I’ll be presenting with Anil Saldana on JBoss Security, PicketLink, and Identity Management, JBoss Security Architect. A link to the description can be found here. The original abstract:
Who Owns DataPower Within An Organization?
The definition of the word ownership has varying meanings across organizations, but there is always a group that retains control of the technology. It’s typically the group that sponsored the adoption of the technology and owns day-to-day support of it. But, sometimes, the technology initiative…
Symmetric Keys—Addendum
A couple of weeks ago I wrote a brief post about how to generate symmetric keys that can be used with DataPower. It demonstrates how to generate shared keys of various lengths using the Unix dd command. Today, someone asked how a shared key (or symmetric key) can be generated using the openssl…