Hot answers tagged

14

It sounds like there are two goals: Easy for end-users to authenticate with their existing social accounts Easy for developers using your webservice Authorizing people to use resources on your site makes OAuth2 a preferred mechanism due to the popularity and availability of client libraries. 1. Easy for end-users to authenticate with their existing ...


5

How to make it extensible First you should notice all these api's use the same mechanism for logging in. They all use OAuth for their authentication. This you need to leverage by starting with a general OAuth library. Don't use their own libraries for authentication, these will be unusable for other providers. If you get the hang of OAuth2 it is quite easy ...


5

The primary benefit to using ACS is that you can integrate login systems which are not compatible with DotNetOpenAuth; namely, that you could combine external logins with an Active Directory (including both on-premises AD as well as AD in the cloud like Office 365). Your customers could use their accustomed identities from 3rd parties, and your ...


2

What do requirements tell? This is the only authoritative source in this case, so refer to the requirements. If you are asking the question because you're actually drafting the requirements themselves, then take in account that: Persons change e-mail addresses occasionally. Either because they change the provider, or because their old address receives too ...


2

From a threat modeling perspective, it is not clear really what security benefit will you achieve by having each widget have its own token. So unless it can be demonstrated that there is a clear security advantage (even if defense in depth), my suggestion would be to avoid adding complexity in your application, and keep it simple. Many security issues are ...


2

There are two options: Some SSO providers allow you to go through them to integrate with other SSO providers. Your application would only deal with one provider and one data format. Through configuration, you would allow for exchanging information and translating with other formats. Based on rules, the SSO provider would either use authentication ...


2

The auth process needs some way of telling which provider to use. But you don't need three sites. Just three urls. Deploy the site with multiple domain name bindings and read the url the client is connecting to. Then map that to the required auth provider.


1

I did this myself recently and it's a bit of a pain, largely due to the limitations on the extension method setup methods which restrict your control over the component, forcing you to use CookieAuth when you don't really want to. What I setup was Cookie, JWT and OpenIdConnect authentication. in the cookie auth we forward events to the JWT or OpenId auth ....


1

Nowadays the recommended approach is to use Authorization Code with PKCE (Proof Key for Code Exchange). The threat to be concerned about is leaking the access token from the URL - the URL is not a good place to put sensitive information and there are a number of ways that the URL could be leaked. When a confidential client uses code flow a leak of the ...


1

Nice research effort from the OP! Upvoted. So you have already got an answer from your cross-posted question in SO. On top of that, here I'm just trying to clarify on the one statement in your question, based on the original OAuth2 RFC 6749. I understand the security concerns with having an AT show up anywhere in a log file. I do not, however, understand ...


1

With current times, it's often the case that applications accept many different forms of authentication/identity be it social, OpenID, or internally created accounts. I think the solution most take (including myself) is to store identity data within the application in a database. When the user first registers, you can query the identity service (OpenID) to ...


1

My two cents: I've never done anything like this before nor do I know how the FB, Twitter or Google login mechanisms work, but a few issues popped up in my head as soon as I read your question: Multiple logins: What happens if I log in with my Facebook account one day and my Google account the next? Or simultaneously? Do you treat these two accounts as ...


1

I would definitely go with the solution it sounds like you've already figured out: implementing the 3rd party authentication on your client-facing website and then associating those 3rd party auth tokens with your website user accounts, and then finally trigger your setSessionID call on login. Depending on your website architecture, you may find using a ...


1

In the big picture, what is the current best practice for registering users and requiring them to login to use your single page app? I would look at OAuth option to free users from registration process. It is a new era where users do not want spent time to deal with creating a new account for each sites that they visit. Instead, they look forward to get ...


Only top voted, non community-wiki answers of a minimum length are eligible