A Perfect Presentation to Describe Authentication and Authorization and how it is used in Web Application Security. Definitions and implementation and full example of how it works.
ADAPTIVE AUTHENTICATION: A CASE STUDY FOR UNIFIED AUTHENTICATION PLATFORM csandit
Adaptive authentication is a risk-based authentication that identifies high-risk and suspicious
illegitimate login attempts. User past login records which implicitly contains attribute factors
context information are used to establish user behavior profile. Later if the user logins under
different environmental context from that established profile, the identity of the user may be
questioned. The system may challenge the user to present additional authentication method to
get authenticated. We implemented such adaptive authentication system in our production
server and collected user login records for more than six months. In this paper, we presents the
analysis of the user login profile with regards to attribute factors such as geographical location
and time of login. We also developed testbed system that uses the collected real data to evaluate
the system for different ratio threshold values.
Web Component Development Using Servlet & JSP Technologies (EE6) - Chapter 1...WebStackAcademy
Security Implementation Mechanisms
The characteristics of an application should be considered when deciding the layer and type of security to be provided for applications. The following sections discuss the characteristics of the common mechanisms that can be used to secure Java EE applications. Each of these mechanisms can be used individually or with others to provide protection layers based on the specific needs of your implementation.
Java SE Security Implementation Mechanisms
Java SE provides support for a variety of security features and mechanisms, including:
Java Authentication and Authorization Service (JAAS): JAAS is a set of APIs that enable services to authenticate and enforce access controls upon users. JAAS provides a pluggable and extensible framework for programmatic user authentication and authorization. JAAS is a core Java SE API and is an underlying technology for Java EE security mechanisms.
Java Generic Security Services (Java GSS-API): Java GSS-API is a token-based API used to securely exchange messages between communicating applications. The GSS-API offers application programmers uniform access to security services atop a variety of underlying security mechanisms, including Kerberos.
Java Cryptography Extension (JCE): JCE provides a framework and implementations for encryption, key generation and key agreement, and Message Authentication Code (MAC) algorithms. Support for encryption includes symmetric, asymmetric, block, and stream ciphers. Block ciphers operate on groups of bytes while stream ciphers operate on one byte at a time. The software also supports secure streams and sealed objects.
Java Secure Sockets Extension (JSSE): JSSE provides a framework and an implementation for a Java version of the SSL and TLS protocols and includes functionality for data encryption, server authentication, message integrity, and optional client authentication to enable secure Internet communications.
Simple Authentication and Security Layer (SASL): SASL is an Internet standard (RFC 2222) that specifies a protocol for authentication and optional establishment of a security layer between client and server applications. SASL defines how authentication data is to be exchanged but does not itself specify the contents of that data. It is a framework into which specific authentication mechanisms that specify the contents and semantics of the authentication data can fit.
To tell that - IT environment has shifted, and this would be a huge understatement. We just see this happening around us. Yet to say, the transition is not necessarily a bad thing. Like in other technology organizations, Identity governance is in the process of change. We can see that this can be a positive transformation; as the way it allows us to be more flexible and stronger.
Visit : https://techdemocracy.com
Microsoft Graph API Webinar Application PermissionsStefan Weber
Slidedeck presented during a webinar i held on 15th November 2023 about how to consume Microsoft Graph API using application level permissions.
Webinar Recording https://youtu.be/yVK8WQz5qnU
ADAPTIVE AUTHENTICATION: A CASE STUDY FOR UNIFIED AUTHENTICATION PLATFORM csandit
Adaptive authentication is a risk-based authentication that identifies high-risk and suspicious
illegitimate login attempts. User past login records which implicitly contains attribute factors
context information are used to establish user behavior profile. Later if the user logins under
different environmental context from that established profile, the identity of the user may be
questioned. The system may challenge the user to present additional authentication method to
get authenticated. We implemented such adaptive authentication system in our production
server and collected user login records for more than six months. In this paper, we presents the
analysis of the user login profile with regards to attribute factors such as geographical location
and time of login. We also developed testbed system that uses the collected real data to evaluate
the system for different ratio threshold values.
Web Component Development Using Servlet & JSP Technologies (EE6) - Chapter 1...WebStackAcademy
Security Implementation Mechanisms
The characteristics of an application should be considered when deciding the layer and type of security to be provided for applications. The following sections discuss the characteristics of the common mechanisms that can be used to secure Java EE applications. Each of these mechanisms can be used individually or with others to provide protection layers based on the specific needs of your implementation.
Java SE Security Implementation Mechanisms
Java SE provides support for a variety of security features and mechanisms, including:
Java Authentication and Authorization Service (JAAS): JAAS is a set of APIs that enable services to authenticate and enforce access controls upon users. JAAS provides a pluggable and extensible framework for programmatic user authentication and authorization. JAAS is a core Java SE API and is an underlying technology for Java EE security mechanisms.
Java Generic Security Services (Java GSS-API): Java GSS-API is a token-based API used to securely exchange messages between communicating applications. The GSS-API offers application programmers uniform access to security services atop a variety of underlying security mechanisms, including Kerberos.
Java Cryptography Extension (JCE): JCE provides a framework and implementations for encryption, key generation and key agreement, and Message Authentication Code (MAC) algorithms. Support for encryption includes symmetric, asymmetric, block, and stream ciphers. Block ciphers operate on groups of bytes while stream ciphers operate on one byte at a time. The software also supports secure streams and sealed objects.
Java Secure Sockets Extension (JSSE): JSSE provides a framework and an implementation for a Java version of the SSL and TLS protocols and includes functionality for data encryption, server authentication, message integrity, and optional client authentication to enable secure Internet communications.
Simple Authentication and Security Layer (SASL): SASL is an Internet standard (RFC 2222) that specifies a protocol for authentication and optional establishment of a security layer between client and server applications. SASL defines how authentication data is to be exchanged but does not itself specify the contents of that data. It is a framework into which specific authentication mechanisms that specify the contents and semantics of the authentication data can fit.
To tell that - IT environment has shifted, and this would be a huge understatement. We just see this happening around us. Yet to say, the transition is not necessarily a bad thing. Like in other technology organizations, Identity governance is in the process of change. We can see that this can be a positive transformation; as the way it allows us to be more flexible and stronger.
Visit : https://techdemocracy.com
Microsoft Graph API Webinar Application PermissionsStefan Weber
Slidedeck presented during a webinar i held on 15th November 2023 about how to consume Microsoft Graph API using application level permissions.
Webinar Recording https://youtu.be/yVK8WQz5qnU
A Simplified Guide to the Evolution of Authentication!Caroline Johnson
Modern users and customers always demand to improve the security level of their accounts and sensitive information. This applies to both individual users and businesses alike. The trend of highly targeted attacks and the potential to inflict massive damage makes everyone concerned about the safety of their login credentials and business data.
It’s vital that you consider all authentication methods available when prioritizing strong authentication systems. Ultimately, there is no one-size-fits-all solution when it comes to authentication.
Microsoft Entra is a product family name for Microsoft’s identity and access products.
Entra ID is a rebranding of Azure Active Directory (Azure AD). Entra ID is our hero identity solution and is a part of Microsoft Entra.
The name has changed because we’re expanding in several new categories and need name that can convey modern access security across broad range of products.
6.1 Identify correct descriptions or statements about the security issues:
Authentication
authorization
Data integrity
Auditing
Malicious code
Website attacks
6.2 Identify the deployment descriptor element names, and their structure, that declare the following:
A security constraint
A web resource
The login configuration
A security role
6.3 Given authentication type: BASIC, DIGEST, FORM, and CLIENT-CERT, identify the correct definition of its mechanism.
7.1 Identify which attribute scopes are thread-safe:
Local variables
Instance variables
Class variables
Request attributes
Session attributes
Context attributes
7.2 Identify correct statements about differences between the multithreaded and single-threaded servlet models.
7.3 Identify the interface used to declare that a servlet must use the single thread model.
ASTHETIC In computing, identity management (IdM) describes the management of individual principals, their authentication, authorization, and privileges within or across system and enterprise boundaries with the goal of increasing security and productivity while decreasing cost, downtime and repetitive tasks.
The terms "Identity Management" and "Identity and Access Management" are used interchangeably in the area of Identity access management, while identity management its
Salesforce DevOps Online Training Institute- Visualpath is the Leading and Best Software Online Training Institute in Ameerpet. Avail complete Salesforce DevOps Online Training Institute by simply enrolling in our institute in Ameerpet. You will get the best course at an affordable cost. Call on - +91-9989971070.
WhatsApps: https://www.whatsapp.com/catalog/919989971070
Visit : https://www.visualpath.in/salesforce-devops-online-training.html
MasterClass Login Using Biometric Authentication.docxNelSon186520
As biometric technology continues to evolve and gain widespread acceptance, we can expect more online platforms to integrate biometric authentication into their login processes. As users, we should embrace these advancements in security and convenience while staying mindful of our data privacy and making informed choices about the authentication methods we use. Ultimately, biometric authentication paves the way for a safer and more user-centric digital future. Masterclass, a popular online learning platform, is at the forefront of leveraging this technology to enhance the login process for its users. This article explores the concept of biometric authentication, the advantages it offers, and how Masterclass implements biometric login to provide a seamless and secure user experience.
Mobile Authentication with biometric (fingerprint or face) in #AndroidAppDeve...Harikrishna Patel
Biometric identification and authentication depends on unique biological attributes, such as a fingerprint, an iris, a face or even a heartbeat. These attributes are much more difficult for hackers and criminals to exploit because they’re unique to each individual.
Today’s biometric identification and authentication systems cover checks to verify that the biometric elements aren’t coming from video or audio recordings as well. #androidappdevelopment #iotplatform #Softqube
https://www.softqubes.com/blog/mobile-authentication-with-biometric-fingerprint-or-face-in-android/
SSO IN/With Drupal and Identitiy ManagementManish Harsh
This presentation is a result of research and evaluation for SSO and IDM majorly focused to Drupal CMS.
Enterprises, corporations and companies with multiple web properties are struggling to provide a better user experience and offer a single "corporate ID" and "Password" as the key for all.
This single ID should be used across all the properties and corporations should still be able to manage the access level and permission of the respective user based on the grants assigned to this ID in each web property.
Authentication through Claims-Based Authenticationijtsrd
Thinking as far as claims and issuers is an effective reflection that backs better approaches for securing your application. Claims have an understanding with the issuer and allow the claims of the user to be accepted only if the claims are issued by a trusted issuer. Authentication and authorization is explicit in CBAC as compared to other approaches. [1]. Pawan Patil | Ankit Ayyar | Vaishali Gatty"Authentication through Claims-Based Authentication" Published in International Journal of Trend in Scientific Research and Development (ijtsrd), ISSN: 2456-6470, Volume-2 | Issue-4 , June 2018, URL: http://www.ijtsrd.com/papers/ijtsrd15644.pdf http://www.ijtsrd.com/engineering/software-engineering/15644/authentication-through-claims-based-authentication/pawan-patil
A Simplified Guide to the Evolution of Authentication!Caroline Johnson
Modern users and customers always demand to improve the security level of their accounts and sensitive information. This applies to both individual users and businesses alike. The trend of highly targeted attacks and the potential to inflict massive damage makes everyone concerned about the safety of their login credentials and business data.
It’s vital that you consider all authentication methods available when prioritizing strong authentication systems. Ultimately, there is no one-size-fits-all solution when it comes to authentication.
Microsoft Entra is a product family name for Microsoft’s identity and access products.
Entra ID is a rebranding of Azure Active Directory (Azure AD). Entra ID is our hero identity solution and is a part of Microsoft Entra.
The name has changed because we’re expanding in several new categories and need name that can convey modern access security across broad range of products.
6.1 Identify correct descriptions or statements about the security issues:
Authentication
authorization
Data integrity
Auditing
Malicious code
Website attacks
6.2 Identify the deployment descriptor element names, and their structure, that declare the following:
A security constraint
A web resource
The login configuration
A security role
6.3 Given authentication type: BASIC, DIGEST, FORM, and CLIENT-CERT, identify the correct definition of its mechanism.
7.1 Identify which attribute scopes are thread-safe:
Local variables
Instance variables
Class variables
Request attributes
Session attributes
Context attributes
7.2 Identify correct statements about differences between the multithreaded and single-threaded servlet models.
7.3 Identify the interface used to declare that a servlet must use the single thread model.
ASTHETIC In computing, identity management (IdM) describes the management of individual principals, their authentication, authorization, and privileges within or across system and enterprise boundaries with the goal of increasing security and productivity while decreasing cost, downtime and repetitive tasks.
The terms "Identity Management" and "Identity and Access Management" are used interchangeably in the area of Identity access management, while identity management its
Salesforce DevOps Online Training Institute- Visualpath is the Leading and Best Software Online Training Institute in Ameerpet. Avail complete Salesforce DevOps Online Training Institute by simply enrolling in our institute in Ameerpet. You will get the best course at an affordable cost. Call on - +91-9989971070.
WhatsApps: https://www.whatsapp.com/catalog/919989971070
Visit : https://www.visualpath.in/salesforce-devops-online-training.html
MasterClass Login Using Biometric Authentication.docxNelSon186520
As biometric technology continues to evolve and gain widespread acceptance, we can expect more online platforms to integrate biometric authentication into their login processes. As users, we should embrace these advancements in security and convenience while staying mindful of our data privacy and making informed choices about the authentication methods we use. Ultimately, biometric authentication paves the way for a safer and more user-centric digital future. Masterclass, a popular online learning platform, is at the forefront of leveraging this technology to enhance the login process for its users. This article explores the concept of biometric authentication, the advantages it offers, and how Masterclass implements biometric login to provide a seamless and secure user experience.
Mobile Authentication with biometric (fingerprint or face) in #AndroidAppDeve...Harikrishna Patel
Biometric identification and authentication depends on unique biological attributes, such as a fingerprint, an iris, a face or even a heartbeat. These attributes are much more difficult for hackers and criminals to exploit because they’re unique to each individual.
Today’s biometric identification and authentication systems cover checks to verify that the biometric elements aren’t coming from video or audio recordings as well. #androidappdevelopment #iotplatform #Softqube
https://www.softqubes.com/blog/mobile-authentication-with-biometric-fingerprint-or-face-in-android/
SSO IN/With Drupal and Identitiy ManagementManish Harsh
This presentation is a result of research and evaluation for SSO and IDM majorly focused to Drupal CMS.
Enterprises, corporations and companies with multiple web properties are struggling to provide a better user experience and offer a single "corporate ID" and "Password" as the key for all.
This single ID should be used across all the properties and corporations should still be able to manage the access level and permission of the respective user based on the grants assigned to this ID in each web property.
Authentication through Claims-Based Authenticationijtsrd
Thinking as far as claims and issuers is an effective reflection that backs better approaches for securing your application. Claims have an understanding with the issuer and allow the claims of the user to be accepted only if the claims are issued by a trusted issuer. Authentication and authorization is explicit in CBAC as compared to other approaches. [1]. Pawan Patil | Ankit Ayyar | Vaishali Gatty"Authentication through Claims-Based Authentication" Published in International Journal of Trend in Scientific Research and Development (ijtsrd), ISSN: 2456-6470, Volume-2 | Issue-4 , June 2018, URL: http://www.ijtsrd.com/papers/ijtsrd15644.pdf http://www.ijtsrd.com/engineering/software-engineering/15644/authentication-through-claims-based-authentication/pawan-patil
State of ICS and IoT Cyber Threat Landscape Report 2024 previewPrayukth K V
The IoT and OT threat landscape report has been prepared by the Threat Research Team at Sectrio using data from Sectrio, cyber threat intelligence farming facilities spread across over 85 cities around the world. In addition, Sectrio also runs AI-based advanced threat and payload engagement facilities that serve as sinks to attract and engage sophisticated threat actors, and newer malware including new variants and latent threats that are at an earlier stage of development.
The latest edition of the OT/ICS and IoT security Threat Landscape Report 2024 also covers:
State of global ICS asset and network exposure
Sectoral targets and attacks as well as the cost of ransom
Global APT activity, AI usage, actor and tactic profiles, and implications
Rise in volumes of AI-powered cyberattacks
Major cyber events in 2024
Malware and malicious payload trends
Cyberattack types and targets
Vulnerability exploit attempts on CVEs
Attacks on counties – USA
Expansion of bot farms – how, where, and why
In-depth analysis of the cyber threat landscape across North America, South America, Europe, APAC, and the Middle East
Why are attacks on smart factories rising?
Cyber risk predictions
Axis of attacks – Europe
Systemic attacks in the Middle East
Download the full report from here:
https://sectrio.com/resources/ot-threat-landscape-reports/sectrio-releases-ot-ics-and-iot-security-threat-landscape-report-2024/
UiPath Test Automation using UiPath Test Suite series, part 3DianaGray10
Welcome to UiPath Test Automation using UiPath Test Suite series part 3. In this session, we will cover desktop automation along with UI automation.
Topics covered:
UI automation Introduction,
UI automation Sample
Desktop automation flow
Pradeep Chinnala, Senior Consultant Automation Developer @WonderBotz and UiPath MVP
Deepak Rai, Automation Practice Lead, Boundaryless Group and UiPath MVP
The Art of the Pitch: WordPress Relationships and SalesLaura Byrne
Clients don’t know what they don’t know. What web solutions are right for them? How does WordPress come into the picture? How do you make sure you understand scope and timeline? What do you do if sometime changes?
All these questions and more will be explored as we talk about matching clients’ needs with what your agency offers without pulling teeth or pulling your hair out. Practical tips, and strategies for successful relationship building that leads to closing the deal.
Elevating Tactical DDD Patterns Through Object CalisthenicsDorra BARTAGUIZ
After immersing yourself in the blue book and its red counterpart, attending DDD-focused conferences, and applying tactical patterns, you're left with a crucial question: How do I ensure my design is effective? Tactical patterns within Domain-Driven Design (DDD) serve as guiding principles for creating clear and manageable domain models. However, achieving success with these patterns requires additional guidance. Interestingly, we've observed that a set of constraints initially designed for training purposes remarkably aligns with effective pattern implementation, offering a more ‘mechanical’ approach. Let's explore together how Object Calisthenics can elevate the design of your tactical DDD patterns, offering concrete help for those venturing into DDD for the first time!
DevOps and Testing slides at DASA ConnectKari Kakkonen
My and Rik Marselis slides at 30.5.2024 DASA Connect conference. We discuss about what is testing, then what is agile testing and finally what is Testing in DevOps. Finally we had lovely workshop with the participants trying to find out different ways to think about quality and testing in different parts of the DevOps infinity loop.
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...UiPathCommunity
💥 Speed, accuracy, and scaling – discover the superpowers of GenAI in action with UiPath Document Understanding and Communications Mining™:
See how to accelerate model training and optimize model performance with active learning
Learn about the latest enhancements to out-of-the-box document processing – with little to no training required
Get an exclusive demo of the new family of UiPath LLMs – GenAI models specialized for processing different types of documents and messages
This is a hands-on session specifically designed for automation developers and AI enthusiasts seeking to enhance their knowledge in leveraging the latest intelligent document processing capabilities offered by UiPath.
Speakers:
👨🏫 Andras Palfi, Senior Product Manager, UiPath
👩🏫 Lenka Dulovicova, Product Program Manager, UiPath
Generating a custom Ruby SDK for your web service or Rails API using Smithyg2nightmarescribd
Have you ever wanted a Ruby client API to communicate with your web service? Smithy is a protocol-agnostic language for defining services and SDKs. Smithy Ruby is an implementation of Smithy that generates a Ruby SDK using a Smithy model. In this talk, we will explore Smithy and Smithy Ruby to learn how to generate custom feature-rich SDKs that can communicate with any web service, such as a Rails JSON API.
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...James Anderson
Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM
The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management.
The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM).
Speakers:
Bob Boule
Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle.
Gopinath Rebala
Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.
UiPath Test Automation using UiPath Test Suite series, part 4DianaGray10
Welcome to UiPath Test Automation using UiPath Test Suite series part 4. In this session, we will cover Test Manager overview along with SAP heatmap.
The UiPath Test Manager overview with SAP heatmap webinar offers a concise yet comprehensive exploration of the role of a Test Manager within SAP environments, coupled with the utilization of heatmaps for effective testing strategies.
Participants will gain insights into the responsibilities, challenges, and best practices associated with test management in SAP projects. Additionally, the webinar delves into the significance of heatmaps as a visual aid for identifying testing priorities, areas of risk, and resource allocation within SAP landscapes. Through this session, attendees can expect to enhance their understanding of test management principles while learning practical approaches to optimize testing processes in SAP environments using heatmap visualization techniques
What will you get from this session?
1. Insights into SAP testing best practices
2. Heatmap utilization for testing
3. Optimization of testing processes
4. Demo
Topics covered:
Execution from the test manager
Orchestrator execution result
Defect reporting
SAP heatmap example with demo
Speaker:
Deepak Rai, Automation Practice Lead, Boundaryless Group and UiPath MVP
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualityInflectra
In this insightful webinar, Inflectra explores how artificial intelligence (AI) is transforming software development and testing. Discover how AI-powered tools are revolutionizing every stage of the software development lifecycle (SDLC), from design and prototyping to testing, deployment, and monitoring.
Learn about:
• The Future of Testing: How AI is shifting testing towards verification, analysis, and higher-level skills, while reducing repetitive tasks.
• Test Automation: How AI-powered test case generation, optimization, and self-healing tests are making testing more efficient and effective.
• Visual Testing: Explore the emerging capabilities of AI in visual testing and how it's set to revolutionize UI verification.
• Inflectra's AI Solutions: See demonstrations of Inflectra's cutting-edge AI tools like the ChatGPT plugin and Azure Open AI platform, designed to streamline your testing process.
Whether you're a developer, tester, or QA professional, this webinar will give you valuable insights into how AI is shaping the future of software delivery.
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024Tobias Schneck
As AI technology is pushing into IT I was wondering myself, as an “infrastructure container kubernetes guy”, how get this fancy AI technology get managed from an infrastructure operational view? Is it possible to apply our lovely cloud native principals as well? What benefit’s both technologies could bring to each other?
Let me take this questions and provide you a short journey through existing deployment models and use cases for AI software. On practical examples, we discuss what cloud/on-premise strategy we may need for applying it to our own infrastructure to get it to work from an enterprise perspective. I want to give an overview about infrastructure requirements and technologies, what could be beneficial or limiting your AI use cases in an enterprise environment. An interactive Demo will give you some insides, what approaches I got already working for real.
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
AbedElilahElmahmoumP1.pptx
1. AUTHENTICATIO AND
AUTHORIZATION IN
WEB APPLICATIONS
SECURITY
Supervisor: D. Mayada Al Meghari
Abed Elilah Elmahmoum
Course :ITCS6322.20447.31.88-
Web Applications Security
3. INTRODUCTION
It seems that there is no way
to go through a day without
using authentication and
authorization in our real-life
and virtual-life.
4. CONCEPTS
Is the process of identifying
users that request access to
a system, network, or device.
Verify who you are?
Authentication
5. CONCEPTS
Is the process of controlling
user access via assigned
roles & privileges.
What you can do?
Authorization
6. Authentication vs. Authorization
Authentication Authorization
What does it do? Verifies credentials
Grants or denies
permissions
How does it work?
Through passwords,
biometrics,….
Through settings
maintained by
security teams
Is it visible to the
user?
Yes No
It is changeable by
the user?
Partially No
How does data
move?
Through ID tokens
Through access
tokens
7. Applications Exampels
Applications that use authentication and authorization.
Mobile application:
Social media apps (Facebook, Twitter, LinkedIn….).
Google apps (Gmail, Google Play…..).
Ecommerce apps.
Web Applications:
Microsoft office.
Netflix.
Trello.
9. Authentications Methods
Requires two or more
independent ways to identify
a user, for example Captcha
tests, fingerprints.
Multi-factor (MFA)
Most common methods of
authentication using
password to access.
Passwords
Enables login to multiple
applications via a central
identity provider.
Single Sign-on (SSO)
Grants access to a user or
device based on an access
token ID they possess.
Token authentication
Unique biological
characteristics of an
individual like Facial, speaker
recognition and fingerprint,
eye scanners.
Biometric
11. Authorization Methods
Defining which files and memory objects
they can access.
Mandatory Access
Control (MAC)
An entity is authorized if the
authentication system finds that all the
attributes defined in the policy are true.
Attribute-based Access
Control (ABAC)
RBAC builds on predefined roles and
privileges, assigns users to roles, and
configures a system so that only
specific roles can access each object.
Role-Based Access
Control (RBAC)
DAC determines privileges depending
on the specific user and their access
groups.
Discretionary Access
Control (DAC)
12. Implementation and scenario
Monolithic Application Authentication and
Authorization:
In the application, a security module is
generally used to implement user
authentication and authorization.
For example: Software as a service (SaaS)
office tools (such as Microsoft Office 365).
13. Implementation and scenario
Monolithic application user authentication
scenario:
• User enter username and password.
• Security module verify identity of the user.
• Session is created for the user with a unique ID
associated with the session.
• A session stores login user information User name,
Role, and Permission.
• server returns the Session Id to the client.
• The client records the Session Id as a cookie and
sends it to the application in subsequent requests.
• The application can then use the Session Id to
verify the user’s identity, without having to enter
a user name and password for authentication
each time.
14. Implementation and scenario
Monolithic application user authorization
scenario:
• The client accesses the application.
• Session Id is sent to the application along with the
HTTP request.
• The security module generally processes all
received client requests through an authorization
interceptor.
• This interceptor first determines whether the
Session Id exists.
• If the Session Id exists, it knows that the user has
logged in.
• Then, by querying the user rights, it is determined
whether the user can execute the request or not.