I with to setup a openid server which will support complex attributes that are not defined (http://www.axschema.org/types/) list or in experimental list. Attributes could be detailed information about his work like his reporting boss id, etc. My openid server and client both are within my control and are not supposed to be exposed to the internet.
Is it possible to create this environment within OpenId protocol? If yes, please suggest which servers support complex attributes if any.
The attribute exchange protocol is pretty straightforward:
http://openid.net/specs/openid-attribute-exchange-1_0.html
You'll undoubtedly need to modify it to support these non-standard fields (doubly so because you're probably pulling the data from LDAP or some other database), but it shouldn't be hard.
(As for attribute exchange itself, almost all of the open-source implementations support this.)
Related
I'm looking to write a unified email and messaging program. Supporting IMAP, POP, and SMTP are all pretty easy - the protocols are well documented and easy to come by.
Exchange has a SOAP API documented here, whereby you can write an Exchange client which talks with Exchange servers.
I'm looking to find out what protocol IBM (Lotus) Notes uses and how I can go about writing a standalone application which can send and receive mail. (Standalone is a key part of this - I've seen various things about automating the existing client, but I'm looking to write a new client, so I need to know what protocols it uses.)
Language is unimportant to me at this time. I'm leaning towards Python for the project, but I'm still at an exploratory stage where I'm trying to determine what frameworks exist in any language to help me write this.
That's a pretty interesting topic! There are two ways I can think of that provide mail-oriented abstractions, and two that allow you to access mail files as databases directly.
To start out with, and this is very likely the expedient route to take, Domino supports IMAP. It's far from perfect and it's not likely to improve, but it does more or less work for mail access. Not every server has it enabled by default, but it's not terribly difficult or unusual for an administrator to do so.
Recently, the Extension Library has added a JSON-based mail service that purports to provide a pretty friendly API for many operations, but is not complete - for example, it doesn't seem to cover a user's custom views or folders.
Depending on the depth of the project, then there are the routes for accessing the server using Domino's database API, which would be the most flexible but would involve far more hurdles.
The core protocol is NRPC, which, to my knowledge, is only implemented in the core Notes library. As Stan said, it's heavily tied to the presence of an ID file (server or user) and uses that for its encryption. With some setup, you could have that library and ID present and then use the C functions and structs on a platform it supports. This route would give you the most functionality (there are a number of C-level functions to assist with converting between Notes's document representation and MIME).
Alternatively, there is a remote-access protocol called DIIOP that can be used to access a remote Domino server using UN/password credentials via Java objects. This is not enabled for every server, but it's not terribly uncommon, and isn't that hard to enable. You wouldn't have access to all of the C API's functionality for edge cases, but this would cover a lot of ground.
If you want to work in Python, and you are willing to limit yourself to just the most recent versions of the Lotus Domino server, then I think that you should consider using the REST API that is known as the Donmino Data Service. Here's some on-line documentation.
We have implemented a custom STS. Currently, we limit allowed RPs based on realms & hosts that we can configure. This is proving to be slightly unpractical though. I would like to be able to allow people (e.g. our developers) to have access to our auth service, but not allow competitors to use it.
What would be a good approach to implementing some sort of a security mechanism to do this properly? Should I implement some sort of challenge/response mechanism? Or is there something already established as a security practice?
Note, we're using .NET, but I'm sure the solution is agnostic of the technology.
I am researching security frameworks for an ASP.NET MVC3 application that would have some pretty complex authorization rules in terms who can see data, who can create and edit it. Rules such as
- I can only see clients that are part of my company or branch.
- If I am out 15 or less days from the day the record was created and my role is of super user then only I can edit all but two fields on that record. After 16 days or more I can only edit two fields.
My initial thought was to use the Enterprise Security Block and just add customized authorizers, but after reading more about the native support for membership based security in ASP.NET, I am not so sure if Enterprise Security Block is necessary. I have not use neither of the frameworks in a real-world application so looking for some collective wisdom on the topic.
This is the problem with complex field level security. There is no real framework to help you with it, because everything is so custom. The best you can do is extract this into some kind of lookup table, and assign each field a custom identifier in the table, then have a set of columns that indicate each security level. Then, you build your business logic so that you pass in a field and conditions, and it simply responds back whether or not to allow it.
THen you have to figure out what "allow" means in your interface. Disable it? Hide it? ignore it?
I don't envy you.
You might find this semi-interesting.
http://bartreyserhove.blogspot.com/2008/12/field-level-security-using-aspnet-mvc.html
You can use Azman - Microsoft Authorization Manager and its related APIs.
It provides you with roles, actions, permissions and many more configurable options.
Azman uses AD to store most of this. It also provides options to store using local XML and/or configuration files.
You are crossing into more than just direct security concerns here but actually authorization rules AND edit rules. Your auth rules sound quite custom and I feel that you may need to process these rules in your own custom code and then include these Attributes in your own view models.
Im not aware of any frameworks that will give you this by default as these are very custom editing rules. You could call these claims and when you login go against a claims based framework such as windows identity foundations (WIF) but you will still need custom IF stmts to allow editing in your view based on properties you set in your ViewModel such as CustomerViewModel.AllowAddressEdit. Your view needs to then check this property to display DisplayFor or EditorFor. However you should also check these values on postback to ensure a user hasn't just injected values to hack your app.
You can use asp.net security for basic authentication to the site, and you can use it for basic role membership. But since these are site-wide permissions, you will need your own logic to segment users into organizational permissions.
What I've done in the past is use the asp.net membership logic to handle the basic auth stuff, but then keep another structure in your database that maps the user id's to other parameters - like the mentioned organizational level membership, or especially access rights for data-driven structures.
I'm actually surprised there aren't better solutions already built out there for handling more complext membership/permissions situations that many apps need.
Over here in symfony's tutorial, it says:
Hide all ids
Another good practice in symfony
actions is to avoid as much as
possible to pass primary keys as
request parameters. This is because
our primary keys are mainly
auto-incremental, and this gives
hackers too much information about the
records of the database.
Why is that so? And does it apply to all web apps?
Exposing keys is a potential internal direct object reference risk. In essence, it's saying that if keys conform to a predictable pattern, they may be used against you in an attack. Of course other layers of security should prevent his (proper authorisation, in particular), but it's one more little layer of security. The concept is relevant to all apps which expose internal keys.
See OWASP Top 10 for .NET developers part 4: Insecure direct object reference for more info.
Even though there are many good CMS tools out there, I've decided to roll my own tools for my website to get some hands on experience. The only thing that is currently eluding me is how to add authentication to secure the administrative tools.
I'm the only one who will be using the administrative tools, so I don't need something as complex as a full-blown log-in and registration system. However, I also don't want to rely on security-through-obscurity and use random page names and such to hide the tools.
What are my options?
OpenID is probably your best bet.
To utilize it for one person as you suggest, just check the username that is authenticated. Yeah, that would amount to hardcoding, but if we're creating a system with only one valid login name, there's no need for anything more complicated.
But creating the alternative shouldn't be that bad. You could also just create a table of roles, and do a query against that table to see if the currently logged in user is an admin. If you want to be fancier later, you can later add different users and roles.
How the users and roles get into the table is up to you.
1) Simply use "WWW-Authenticate: Basic" see Wikipedia for an idea and the related RFC for details.
2) Enable SSL to ensure your cleartext password is encrypted.
SSL is quite standard on web servers. You can even self-sign your certificate.
This will depend in part on what platform will be used by you and your web host. A given platform will likely offer one set of choices that will be easier to access than others.
For instance, ASP.NET running inside of IIS offers Forms, Basic and Windows (NTLM) authentication, as well as certificate-based authentication with the ability to map client certificates to Windows users.
You could certainly implement another authorization schema in an ASP.NET application, and many do. But there happen to be this set of out of the box authentication schemes that you would not have to implement if this were your platform. I expect this is true of any other platform, including the Linux-based platforms.
Be sure to find out what's available out of the box, and what can easily be added, before writing your own.