Authentication How to use LDAP credentials offline?

I would like to use an LDAP server (probably Apache directory) to manage logins and credentials for an application. From time to time the application needs to work offline (on a laptop) without a connection to the LDAP server. What is the best way to replicate the credentials localy? I have already thought about: Using Mitosis to replicate the LDAP server on the laptop. But it would be a quite "heavy" and complicated solution. Moreover Mitosis seems not be be finished yet. Exporting

Authentication How do I implement ‘sign in with google’ on my site?

On my site I would like to allow users to sign in with a google account. I plan to use openid but I would like to allow signing in with google because it has more benefits. I've noticed in the past a few sites that have the ability to sign in with a google (gmail) account and IIRC though they did NOT support openID (but I could be wrong). How do I implement 'sign in with google'?

Online Authentication Techniques

What online authentication services are available. I know about Live ID OpenID Are there any other major players. I am particularity interested in authentication federation so that we can log in once and use on multiple sites (if this is even possible).

Authentication cURL local path

I'm trying to use cURL to get past a login page, but in the process, it makes calls behind the scenes to local paths (i.e. it wants to get some file in /Private/....asp instead of, but of course these local paths don't exist on my server. Is this a limitation of cURL or is there a way for me to get around this?

Authentication Node.js can't set headers after they are sent

I'm working on a simple node.js project that requires authentication. I decided to use connect-redis for sessions and a redis-backed database to store user login data. Here is what I have setup so far: // Module Dependencies var express = require('express'); var redis = require('redis'); var client = redis.createClient(); var RedisStore = require('connect-redis')(express); var crypto = require('crypto'); var app = module.exports = express.createServer(); // Configuration app.configure(f

Spring Security 3.1 Active Directory Authentication

I'm connecting to my AD with the next configuration: class=""> <beans:constructor-arg value="mydomain" /> <beans:constructor-arg value="ldap://my URL :389" /> <beans:property name="convertSubErrorCodesToExceptions" value="true"/> </beans:bean> The connection is working fine, because if I write a wrong login/password, I get "bad credentials" (User was not fo

Authentication Symfony2 FosUser : CSRF token issue

I use the authentification system provided by FOSUser bundle Everything was doing fine but recently when clicking on : <form action="{{ path('fos_user_registration_register') }}" method="post"> <button class="btn btn-small btn-success" type="submit">S'inscrire</button> </form> that generated the error: The CSRF token is invalid. Please try to resubmit the form. none of the view nor

Authentication Authenticating user using persistent cookie. Hash & salt necessary?

I'm building a login script and I want users to be able to tick a "remember me" button. I've read this page on the matter: They recommend creating an auth_key by concatenating a random string with the username and then hashing it with a salt. $cookie_auth= rand_string(10) . $username; $auth_key = md5($salt . $cookie_auth); $auth_query = mysql_query("UPDATE users SET auth_key = '" . $auth_key . "' WHERE us

Authentication Kohana 3.3 expanding the Auth module

I'm building an application using the Auth module for which I need at least 3 account types : Employer, Employee and Client. Since these accounts have different properties, functions and relationships (ex: employers has_many employees) I guess I need to have them on 3 separate ORM models. The method I thought was to tweak the Auth module to replace the 'User' model with the appropriate sub-model (employer, employee, client), corresponding the the user type in the database. Can this be done, or

Authentication SSL Certificate and identity verification

I've been looking for information about SSL certificates and encryption protocols. I got very good answers, especially on this website. There's only one thing I don't get. If I got this right, the verification of the identity (I mean the verification of the server identity, not the certificate identity) is made using asymmetric cryptography. That means the steps would be (stop me if I'm wrong): Client uses verified public key to encrypt a random challenge string and send it to server. Server

DirectoryEntry authentication throws COMException instead of DirectoryServicesCOMException

I'm using .NET and creating a DirectoryEntry and the access the NativeObject member to validate a user's credentials against AD. There are some situations, where the login will fail, because the "User must change password on next logon" flag is set or the user is currently not allowed to logon because the logon times do not match. I want to distinguish if one of these situations occured or if the user just entered a wrong password. If I create the DirectoryEntry object with parameter Authenti

Authentication Creating SAS BI Dashboard accounts for people outside our organization?

our organization has been using SAS BI Dashboard for several months now for internal use within our own organization. Now, we are working on a project where roughly 100 people in other, outside organizations will need to log on to our BI Dashboard site to view an individualized dashboard for their organization. We plan to use row-level permissions in an Information Map to control who is allowed to see what in terms of the data behind the dashboard indicators. How would you recommend creatin

SSL/TLS Mutual authentication in Firefox-OS

I’m currently working on a project ( An application based on “Firefox OS”) and I would like to know if there is any existing API or library in Firefox OS that I can use in my application which ensures the SSL/TLS Mutual authentication? If not, how can I configure SSL/TLS Mutual authentication in my application using Apache server, so that it can require a client Certificate and extract from this certificate the public key ?

Authentication paypal advanced configuration woocommerce

I bought woocommerce paypal advanced but I don't know how to configure it here is the things I had done: created paypal sandbox account created seller account and marked it as pro created buyer account then I added merchant login in admin (sellers email) mark sandbox on. than when I try to buy product from front end I get error Error: "There was an error processing your order - User authentication failed" I don't know what further steps requires? is there any regi

ASP .NET WebAPI default OWIN authentication - help clear things up

I have some general/how-does-it-work-inside questions about WebAPI and OWIN (specifically, the default configuration which is set up when you create new WebAPI project in VS2013 and select Individual user account authentication). I did that, then I registered (using jQuery post) and even logged in (received token which I included in Authorization header, receiving access to protected resource. I just have some more questions about it: Are my data stored inside authentication token? I know my p

How to disable ProgrammaticLogin authentication Netbeans/Glassfish

I'm trying to run a Netbeans/Glassfish application locally on Windows which is currently running in production on a Unix server. I've succeeded in getting the app up and running, but can't get past the login display due to an authorization exception. I have my name (email) and password set up in the app's database, and have been able to log in to the app running on the Unix server using my credentials. I have connected the Glassfish server to the database via a putty tunnel, and successfully pin

Authentication Claims-based auth and circles of users

Let's think of a simple REST-based web service to store and retrieve JSON objects. Without any authentication, every user can access any data. Now let's add usage of JWTs to authenticate users. Of course, since we are not doing authorization, still every user can access anything, but at least now we know who accesses what. Next step: When storing an object, save the user's sub claim with the object, and verify that the user's sub claim matches the one of the requested object, and if so, delive

Authentication Azure MFA with OATH Tokens

I haven't found anything obvious that answers this question so I'm going to ask it here, if i find the answer I'm looking for I will share it with the community. I am in the process of implementing Azure On-Premise Multi Factor Authentication. All is going well. The two way SMS works just dandy. The Authenticator app works on my iPhone pretty good. I've even managed to get our FortiGate devices to talk to it for Two Factor for our VPN connections. I am now trying to figure out how to imple

Enabling Spring OAuth2 ResourceServer disables UsernamePasswordAuthenticationFilter

I have the following in my WebSecurityConfigurerAdaptor: protected void configure(HttpSecurity http) throws Exception { http .authorizeRequests() .antMatchers("/login.jsp").permitAll() .anyRequest().authenticated() .and() .exceptionHandling() .accessDeniedPage("/login.jsp?authorization_error=true") .and() .csrf() .disable() .formLogin() .loginProcessingUrl("/login")

Authentication JSON Web Token (JWT) - one account multiple users

If I'm using JWT to authenticate users to get access to my API, would it be possible to create one "generic" account for many users to use? That way, users who don't have a "real" account, would be given this generic account credentials in order to access the API. Would that be possible? Because, I'm wondering, with JWT, if one users log in, would I invalidate the other user token? If that approach would not work, what would you recommend? The reason: I want my app to communicate with my serve

Authentication Google api revoke token issue

I've created an application using google drive API to list and manage all my drive files. Everything goes fine, except the log out part. I've searched for two days for a solution without a result. The following is code related to login and works fine: function checkAuth() { gapi.auth.authorize( { 'client_id': CLIENT_ID, 'scope': SCOPES.join(' '), 'immediate': true, 'authuser': '-1' }, handleAuthResult); } function handleAuthResult(authResu

Authentication Service-based security with Java EE

All Java EE authorisation techniques I've seen so far are for the view layer only - mostly based on JSF. You basically restrict access to certain URL patterns or JSF components. However, I'd prefer to have my security layer on the services. My layers are looking something like this: View (XHTML + JSF Backing Beans / RESTful web services) Services Entities and Business Logic DAOs Since the services are a proxy to my business logic and contain no logic by themselves, I'd like to use them for

Custom Authentication AngularFire2 Ionic2

I update my application from Ionic 1 to Ionic 2. For the first App (Ionic 1) I use AngularFire and custom authentication (with Slim Framework). With Ionic 2 I try to do the same thing with AngularFire2 (and firebase 2.4.2) but I have this error when I auth to firebase. Code (App.ts): @App({ templateUrl: './build/app.html', providers: [ FIREBASE_PROVIDERS, defaultFirebase('https://<APP>'), firebaseAuthConfig({ provider: AuthProviders.Custom, met

Authentication Request Client Certificate

I've seen a lot of unsolved questions about this. Apparently many developers have gotten past this issue, but I haven't seen any solutions posted. I'm trying to read a smart card (X.509 CAC) for my ASP.NET MVC 5 web app. When I try to pull the certificate information like this: var request = HttpContext.Request; var cert = request.ClientCertificate; The cert has empty values. The problem appears to be I am not presenting the dialog to request user certificate info like I see on other websit

Authentication "No provider for AuthGuard!" using CanActivate in Angular 2

EDIT : Obviously this is outdated, now you provide your guard at the providers array in an NgModule. Watch other answers or official documentation for more information. bootstrapping on a component is outdated provideRouter() is outdated as well I'm trying to setup Authentication in my project, using a login and AuthGuard from the Angular2 guide : I'm using the release : "@angular/router": "3.0.0-beta.1". I'll try to explain as much

Authentication Zap Vaadin setup issues

Being absolutely new to security testing, I am trying to run basic steps and then trying to run a spider and active scan. I have seen couple of videos from owasp & youtube and tried to make sense of the included ZAP documentation. However, I don't think ZAP is logged in while making the spider crawl or active scans. Mine is a Java + Vaadin & Spring based application and the POST URL's don't change on making any kind of request. Just the request parameters change. POST URL's are always h

Authentication Best practice of access restriction in staging on GKE

I want to allow only my team to access(https) our staging environments(Web application) through ingress in GKE cluster. I found the article below. but GKE doesn't support basic authentication and setting nginx is only way . GKE Ingress Basic Authentication ( I want to avoid setting nginx if possible. Because I want to make staging and production as close as possible. Thanks.

Service Stack - Custom authentication on one route

In my current application, I am using Service Stack with JWT's for security. Security has been implemented and works perfectly. Trouble is, I would like to secure one route differently from the others. There is a document the logged in user retrieves, I want to make sure the document they are retrieving is theirs and not someone else's. It is very sensitive data. I would like to secure it differently because something like PostMan could be used with a valid token to retrieve any document,

Access Spring Security's FormLoginBeanDefinitionParser's attributes inside AuthenticationSuccessHandler implementation

I would like to gain access to form-login tag's configuration properties inside an AuthenticationSuccessHandler implementation. An example situation would look like the following: @Autowired private FormLoginBeanDefinitionConfigurationProperties properties; public class CustomAuthenticationSuccessHandler extends SimpleUrlAuthenticationFailureHandler { String usernameParameterName = properties.getUsernameParameter(); String passwordParameterName = properties.getPasswordParameter(); } W MVC Core and IdentityServer 4: Setting defaultScheme in AddAuthentication

I am looking at the code below. The AddAuthentication added defaultScheme with "Cookies". Does this mean the current mvc application only accept Cookie authentication but not Access Token by default. services.AddOptions(); //services.Configure(Configuration); services.AddDistributedMemoryCache(); // Adds a default in-memory implementation of IDistributedCache services.AddSession(); JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear(); services.AddAuthentication(options => { optio

Authentication Shopify app developement redirection URL callback

I am working on the Shopify app development. Right now I am working on my local system and try to connect this with the localhost. Shopify auth is working fine but I have faced problems in redirection URL callback function. It always returns with an https request. I have mentioned redirect URL with http://localhost/appname/callback. Does Shopify app only work on https? Please let me know if anyone has knowledge of the Shopify app.

Authentication Expected behaviour of sign in with slack

Expected Behavior: Click Sign in with Slack Redirect you url https://(slackteam) and asks to sign in Click 'Continue' At Dashboard. Current Behavior: Click Sign in with Slack Redirect you url https://(slackteam4) ERROR: OAuth Error: invalid_team_for_non_distributed_app Currently, I have a setup page in my project which I am using as my redirect url. My add to slack button works fine like getting the code when redirected to this setup page and exchange it for a

Remember password with Azure AD authentication

I have a .NET Core 2.1 web application which uses .NET Identity. I use Azure AD to authenticate users. Client needs ability to remember password, so that they do not have to enter it every time. Is there a way to persist user's login with Azure AD in my web app? Workflow: User clicks the login button, redirected to Microsoft login page where they enter their Azure AD credentials to authenticate, if login successful, redirected back to web application. Right now, user has to enter username and

Authentication Resource 'GUID value here' does not exist or one of its queried reference-property objects are not present

I'm trying to change an Azure AD user password. The user is already authenticated in a SPA application using the implicit flow and the adal library. While calling: return await graphClient.Me.Request().UpdateAsync(new User { PasswordProfile = new PasswordProfile { Password = userPasswordModel.NewPassword, ForceChangePasswordNextSignIn = false }, }); I'm

Authentication IIS CORS, how to add route exception

I do have two servers, server A and server B. server A runs on IIS with windows authentication. I also do have a Slim/Twig/PHP construct on server B. I calling a route on server B by using ajax on server A ajax on server A function triggerBalloonNotification(){ $.ajax({ method: "GET", url: "http://serverB/route/on/serverB" }) .done(function( json ) { console.log('done'); }); } this triggers an 'Access-Control-Allow-Origin' - error which i countered by

Authentication OAuth2 Server to Server Expiring Token

We are using OAuth2 to validate our server to server interactions. The Grant Type is Client Credentials. If I have Service1 running on ServerA all is well - when the token is about to expire it just gets another one. But if I scale up Service1 to run on 2 servers using the same CLIENT_ID: ServerA requests a token, then ServerB requests a token. The second request for a token invalidates the 1st token. A loop begins... If the AuthServer is setup to always return the SAME token to each Ser

formsauthenticationticket is decrypted with previous login data

I have an MVC application that uses Active Directory membership for user authentication. After the user logs in, a FormsAuthenticatedTicket is created and encrypted. Then, in Application_PostAuthenticateRequest the ticket is decrypted and the deserialized user data is stored in a custom principal object. i have changed the expiration date of ticket from AddMinute(30) to AddMenute(10) My problem is that when a user logs in after their cookie has expired, the ticket is encrypted with the curren

Authentication Google Analytics Setup User ID

So I've set up Google Analytics and everything is well and working. Now I want to track user ID. We have a system where when users are logged in they are assigned a unique identifier number. For example, we'll call this unique identifier number "identifierNumber" however when I add a new view and enable UserID in Google Analytics my user's number goes to zero. This is how I have it set up in my code between the head. I want to mention that if I go to my original view without user Id it still sho

Authentication Update Kerberos Cache

I have to connect to different devices simultaneously using kerberos authenication. At present using default cache(File) to store kerberos ticket which stores only one ticket at a time. But for my requirement I have to store multiple tickets. Please suggest how to update cache which stores multiple tickets and how to access them. At present kerberos tickets are accessed using kinit. Please share the detailed steps to update the cache to handle above requirement. I am new to this space your help

Authentication Infinispan Server CLI authentification

I tries to start Infinispan 10.1.3 in server mode. But after security configuration I have following error in CLI: [disconnected]> connect Username: admin Password: ******** The user is not allowed to access the server resource: ISPN000287: Unauthorized access: subject 'null' lacks 'ADMIN' permission In result I can't connect to my Infinspan server via CLI :( I created all Infinispan configuration exactly according documentation: in file infinispan.xml I added: <security> <

Authentication Best practice for authenticating a website user on multiple domains

I've looked through and failed to find a question that answers this: apologies if I've missed something. A user registers on my website at - and can then log into, of course. I also have which my user can log into as well. It uses's credentials. But if she wants to log into then she currently has to fill in a login form on to get authenticated. And I'm just about to write which will work the same way - usi

Authentication How to get Authorization Code from Made 2 Manage (M2M) web API

I am looking for an expert in Made2Manage (M2M) Web API. I want to perform CRUD operations via this API. Do you know how we can generate the Authorization code using the API endpoint? Right now, I'm trying to get the auth code with this endpoint: https://localserver/M2MIDSERVER/identity/connect/token, but I'm confused with the server name, don't know what server name can we use. Is there any way to get the server name that is being used here from the API standard interface or any alternative met

Authentication Can I use AWS Cognito authenticate for Rstudio Server Pro?

I have been searching documentation about how can I use AWS Cognito authentication for my Rstudio Server pro ? but I couldn`t Find any of related documentation on internet . IS there any process that we could authenticate rstudio server pro without using PAM , Google , and proxied authentication . IF i could call json File from my S3 bucket using Centos than I think i can Do . Can any one help me to call my json file from s3 buckets.

Authentication How to authenticate Microsoft Graph to pull groups?

I just need pull all groups inside Azure, no need to access any particular application. However, I cannot find a proper IAuthenticationProvider to user, all of them require ClientID, which is particular to an application. Also, I have a hard time to find any reference for that. So, my questions are How to login Azure to pull groups without specify an application for IAuthenticationProvider? Where are all reference documentations? Thanks a lot!

Authentication Is there a way to specify a .pem key within bitbucket-pipelines.xml?

I am trying to deploy a build from bitbucket via bitbucket pipelines. Basically what I need is to copy the static build files into a remote server. This server requires a .pem file for authentication. I have tried specifying this key in the following ways: As a repository variable As a file within the repository itself and pointing to it within the build XML. As a parameter for scp-deploy. But in all cases the same issue occurs: Host key verification failed. lost connection error Command fail

MSI Authentication in Visual studio

I have tried to trigger azure function using service principal, and i didnt have permission to get the secret key. how to do MSI Authentication in Visual studio for connecting to azure function?

LTE modem and PPP authentication

Does an LTE-modem needs to use PPP, and PPP-authentication to get a PDN connection with an external PDN? There are so many 3GPP specifications and they are not always so clear in the explanation. I have been looking into TS29061, TS23060 and TS23401, and I get the impression that PPP is in most cases not used! So, is PPP (and PPP authentication) something pre LTE? Much thanks in advance for your answers!

  1    2   3   4   5   6  ... 下一页 最后一页 共 34 页