Advanced OpenEdge REST/Mobile Security
|
|
|
- Teresa Patterson
- 10 years ago
- Views:
Transcription
1 Advanced OpenEdge REST/Mobile Security Securing your OpenEdge Web applications Michael Jacobs August 2013
2 Legal Disclaimer The contents of these materials are confidential information of Progress Software Corporation or its affiliated entities (collectively Progress Software). These materials may also include information about future features, products, technologies and/or services that are under consideration by Progress Software. Progress Software makes no commitments with respect to such future features, products, technologies and/or services. The information contained in these materials is subject to change. Progress Software does not guarantee any release dates or that there will be a release of any future features, products, technologies and/or services (if any) referenced herein. 2
3 Session Agenda General Web application security overview 3
4 Session Agenda General Web application security overview OpenEdge Web application security specifics REST/Mobile Web applications 3
5 Session Agenda General Web application security overview OpenEdge Web application security specifics REST/Mobile Web applications Advanced security considerations 3
6 Session Agenda General Web application security overview OpenEdge Web application security specifics REST/Mobile Web applications Advanced security considerations Security reference materials 3
7 Web Application Environment Assumptions All internet data is of high value needing strong security 4
8 Web Application Environment Assumptions All internet data is of high value needing strong security Your web server is connected to the internet via a firewall... firewalls leak and no web server or Servlet engine (Tomcat) is ever installed with a secure configuration 4
9 Web Application Environment Assumptions All internet data is of high value needing strong security Your web server is connected to the internet via a firewall... firewalls leak and no web server or Servlet engine (Tomcat) is ever installed with a secure configuration Your web application will be discovered and probed < 1 min after deployment 4
10 Web Application Environment Assumptions All internet data is of high value needing strong security Your web server is connected to the internet via a firewall... firewalls leak and no web server or Servlet engine (Tomcat) is ever installed with a secure configuration Your web application will be discovered and probed < 1 min after deployment Attackers know web servers and applications intimately 4
11 Web Application Environment Assumptions All internet data is of high value needing strong security Your web server is connected to the internet via a firewall... firewalls leak and no web server or Servlet engine (Tomcat) is ever installed with a secure configuration Your web application will be discovered and probed < 1 min after deployment Attackers know web servers and applications intimately Anything placed in them is a target 4
12 Web Application Environment Assumptions All internet data is of high value needing strong security Your web server is connected to the internet via a firewall... firewalls leak and no web server or Servlet engine (Tomcat) is ever installed with a secure configuration Your web application will be discovered and probed < 1 min after deployment Attackers know web servers and applications intimately Anything placed in them is a target Security by obscurity wastes your time and only servers to annoy them 4
13 Web Application Environment Assumptions All internet data is of high value needing strong security Your web server is connected to the internet via a firewall... firewalls leak and no web server or Servlet engine (Tomcat) is ever installed with a secure configuration Your web application will be discovered and probed < 1 min after deployment Attackers know web servers and applications intimately Anything placed in them is a target Security by obscurity wastes your time and only servers to annoy them SSL does not prevent all data leaks, but it does pretty good 4
14 Web Application Environment Assumptions All internet data is of high value needing strong security Your web server is connected to the internet via a firewall... firewalls leak and no web server or Servlet engine (Tomcat) is ever installed with a secure configuration Your web application will be discovered and probed < 1 min after deployment Attackers know web servers and applications intimately Anything placed in them is a target Security by obscurity wastes your time and only servers to annoy them SSL does not prevent all data leaks, but it does pretty good OE admin, name, & app servicer security is not DMZ quality 4
15 Web Application Environment Assumptions All internet data is of high value needing strong security Your web server is connected to the internet via a firewall... firewalls leak and no web server or Servlet engine (Tomcat) is ever installed with a secure configuration Your web application will be discovered and probed < 1 min after deployment Attackers know web servers and applications intimately Anything placed in them is a target Security by obscurity wastes your time and only servers to annoy them SSL does not prevent all data leaks, but it does pretty good OE admin, name, & app servicer security is not DMZ quality Robots, crawlers, and spiders will harm you 4
16 Web Application Security Goals Design and build security into my web application from day 1 5
17 Web Application Security Goals Design and build security into my web application from day 1 Meet OWASP web application security guidelines 5
18 Web Application Security Goals Design and build security into my web application from day 1 Meet OWASP web application security guidelines Force all client access through 1 strong perimeter IdM (Identity Management) security process 5
19 Web Application Security Goals Design and build security into my web application from day 1 Meet OWASP web application security guidelines Force all client access through 1 strong perimeter IdM (Identity Management) security process Authentication 5
20 Web Application Security Goals Design and build security into my web application from day 1 Meet OWASP web application security guidelines Force all client access through 1 strong perimeter IdM (Identity Management) security process Authentication Authorization 5
21 Web Application Security Goals Design and build security into my web application from day 1 Meet OWASP web application security guidelines Force all client access through 1 strong perimeter IdM (Identity Management) security process Authentication Authorization Session management 5
22 Web Application Security Goals Design and build security into my web application from day 1 Meet OWASP web application security guidelines Force all client access through 1 strong perimeter IdM (Identity Management) security process Authentication Authorization Session management Use strong, peer reviewed, industry security technologies 5
23 Web Application Security Goals Design and build security into my web application from day 1 Meet OWASP web application security guidelines Force all client access through 1 strong perimeter IdM (Identity Management) security process Authentication Authorization Session management Use strong, peer reviewed, industry security technologies Push identity to back-end servers for application authorization 5
24 Web Application Security Goals Design and build security into my web application from day 1 Meet OWASP web application security guidelines Force all client access through 1 strong perimeter IdM (Identity Management) security process Authentication Authorization Session management Use strong, peer reviewed, industry security technologies Push identity to back-end servers for application authorization Separate user accounts for local & internet access 5
25 General Web application Security This diagram shows a typical web application authentication and authorization journey It is not specific to OpenEdge it address the industry standards that customers will already being using HTTP Web Server Web Server Authentication Customer s security provider of choice Session Manager 1 HTTP HTTPS Authn Authz Web application Public Static Dynamic Protected Static Dynamic Data Application Server Code 6
26 General Web application Security This diagram shows a typical web application authentication and authorization journey It is not specific to OpenEdge it address the industry standards that customers will already being using HTTP Web Server Web Server Authentication Customer s security provider of choice Session Manager 1 HTTP HTTPS 2 Authn Authz Web application Public Static Dynamic Protected Static Dynamic Data Application Server Code 6
27 General Web application Security This diagram shows a typical web application authentication and authorization journey It is not specific to OpenEdge it address the industry standards that customers will already being using 3 HTTP Web Server Web Server Authentication Customer s security provider of choice Session Manager 1 HTTP HTTPS 2 Authn Authz Web application Public Static Dynamic Protected Static Dynamic Data Application Server Code 6
28 General Web application Security This diagram shows a typical web application authentication and authorization journey It is not specific to OpenEdge it address the industry standards that customers will already being using 3 HTTP Web Server Web Server Authentication Customer s security provider of choice 4 Session Manager 1 HTTP HTTPS 2 Authn Authz Web application Public Static Dynamic Protected Static Dynamic Data Application Server Code 6
29 General Web application Security This diagram shows a typical web application authentication and authorization journey It is not specific to OpenEdge it address the industry standards that customers will already being using HTTP Web Server 3 Web Server Authentication 5 Customer s security provider of choice 4 Session Manager 1 HTTP HTTPS 2 Authn Authz Web application Public Static Dynamic Protected Static Dynamic Data Application Server Code 6
30 General Web application Security This diagram shows a typical web application authentication and authorization journey It is not specific to OpenEdge it address the industry standards that customers will already being using HTTP Web Server 3 Web Server Authentication 5 Customer s security provider of choice 4 Session Manager 1 HTTP HTTPS Authn 2 6 Authz Web application Public Static Dynamic Protected Static Dynamic Data Application Server Code 6
31 General Web application Security This diagram shows a typical web application authentication and authorization journey It is not specific to OpenEdge it address the industry standards that customers will already being using HTTP Web Server 3 Web Server Authentication 5 Customer s security provider of choice 4 Session Manager 1 HTTP HTTPS Authn 2 6 Authz Web application Public Static Dynamic Protected Static Dynamic Data 7 Application Server Code 6
32 General Web application Security This diagram shows a typical web application authentication and authorization journey It is not specific to OpenEdge it address the industry standards that customers will already being using HTTP Web Server 3 Web Server Authentication 5 Customer s security provider of choice 4 Session Manager 1 HTTP HTTPS Authn 2 6 Authz Web application Public Static Dynamic Protected Static Dynamic Data 7 Application Server Code 6
33 Some Assembly Required... OpenEdge (OE) Web applications provide the starting point for you application s security 7
34 Some Assembly Required... OpenEdge (OE) Web applications provide the starting point for you application s security You will contribute to these layers 1. Data-in-transit security provided by the SSL/TLS for web application s client to web server, and from web application to an AppServer 2. Web application session management 3. Java container or Web application authentication 4. Web application authorization to HTTP resources 5. OpenEdge AppServer for application level authorization 7
35 Some Assembly Required... OpenEdge (OE) Web applications provide the starting point for you application s security You will contribute to these layers 1. Data-in-transit security provided by the SSL/TLS for web application s client to web server, and from web application to an AppServer 2. Web application session management 3. Java container or Web application authentication 4. Web application authorization to HTTP resources 5. OpenEdge AppServer for application level authorization Bottom line: OpenEdge s goal is to provide a developer and production administrator with the ability to configure their Web application s security to suit their needs 7
36 Securing an OpenEdge Web Application Design stage Choose web application Authentication & Session model(s) Design web application RBA (Role Based Access) Choose single/multiple web application and service architecture 8
37 Securing an OpenEdge Web Application Design stage Choose web application Authentication & Session model(s) Design web application RBA (Role Based Access) Choose single/multiple web application and service architecture Implementation stage Configure web application Authentication & Session models Code Authentication & Session models into the client Configure additional web application Authorization controls (optional) Code AppServer SSO & authorization (optional) 8
38 Securing an OpenEdge Web Application Design stage Choose web application Authentication & Session model(s) Design web application RBA (Role Based Access) Choose single/multiple web application and service architecture Implementation stage Configure web application Authentication & Session models Code Authentication & Session models into the client Configure additional web application Authorization controls (optional) Code AppServer SSO & authorization (optional) Deployment stage (+ unit testing) Configure web application source of user accounts Reconfigure RBA role names to match user account source Configure web application CORS (for mobile JavaScript clients) 8
39 Securing an OpenEdge Web Application Design stage Choose web application Authentication & Session model(s) Design web application RBA (Role Based Access) Choose single/multiple web application and service architecture Implementation stage Configure web application Authentication & Session models Code Authentication & Session models into the client Configure additional web application Authorization controls (optional) Code AppServer SSO & authorization (optional) Deployment stage (+ unit testing) Configure web application source of user accounts Reconfigure RBA role names to match user account source Configure web application CORS (for mobile JavaScript clients) 8
40 Spring Security Framework version 3.1 OpenEdge supplements the Java container s security with the industry-recognized Spring security framework Spring security is a customizable authentication and accesscontrol framework It is one of the industry standards for securing Spring-based applications For more information on Spring security framework, see the static.springsource.org/spring-security/site/reference.html 9
41 Anatomy of an OpenEdge Web Application Web Server Session manager Spring Security REST/Mobile Application OpenEdge Internal Admin API OpenEdge AppServer Resources*.jsp.html.css.js.json 10
42 Anatomy of an OpenEdge Web Application (1 of 9) <web-app-ctx-root> (aka PDSOE - REST Content) META-INF WEB-INF web.xml appsecurity-xxxxxx.xml standard web application directories (cannot be accessed by clients) rest static lib classes adapters mobile auth error log4j.properties <OE-service.1> <OE-service.n> logs <OE-service>.log 11
43 Anatomy of an OpenEdge Web Application (2 of 9) <web-app-ctx-root> (aka PDSOE - REST Content) META-INF WEB-INF web.xml appsecurity-xxxxxx.xml lib classes log4j.properties web application & security configuration files web.xml - web application appsecurity - Spring rest static adapters mobile auth error <OE-service.1> <OE-service.n> logs <OE-service>.log 12
44 Anatomy of an OpenEdge Web Application (3 of 9) <web-app-ctx-root> (aka PDSOE - REST Content) META-INF WEB-INF web.xml appsecurity-xxxxxx.xml rest static lib classes adapters mobile auth error log4j.properties <OE-service.1> <OE-service.n> logs <OE-service>.log 3rd party logging configuration 13
45 Anatomy of an OpenEdge Web Application (4 of 9) <web-app-ctx-root> (aka PDSOE - REST Content) META-INF WEB-INF web.xml appsecurity-xxxxxx.xml rest static lib classes adapters mobile auth error log4j.properties <OE-service.1> <OE-service.n> logs <OE-service>.log 1 or more PDSOE generated REST/Mobile service mapping files 14
46 Anatomy of an OpenEdge Web Application (5 of 9) <web-app-ctx-root> (aka PDSOE - REST Content) META-INF WEB-INF web.xml appsecurity-xxxxxx.xml lib classes log4j.properties adapters <OE-service.1> <OE-service.n> rest logs <OE-service>.log common 3rd party & OE log file static mobile auth error 15
47 Anatomy of an OpenEdge Web Application (6 of 9) <web-app-ctx-root> (aka PDSOE - REST Content) META-INF WEB-INF web.xml appsecurity-xxxxxx.xml lib classes log4j.properties adapters <OE-service.1> <OE-service.n> logs rest/... static mobile <OE-service>.log dynamic REST/Mobile service root URI auth error 16
48 Anatomy of an OpenEdge Web Application (7 of 9) <web-app-ctx-root> (aka PDSOE - REST Content) META-INF WEB-INF web.xml appsecurity-xxxxxx.xml lib classes log4j.properties adapters <OE-service.1> <OE-service.n> logs rest/... static mobile <OE-service>.log static html, js, & data files supplied by OE & developer auth error 17
49 Anatomy of an OpenEdge Web Application (8 of 9) <web-app-ctx-root> (aka PDSOE - REST Content) META-INF WEB-INF web.xml appsecurity-xxxxxx.xml rest/... static lib classes adapters mobile auth error log4j.properties <OE-service.1> <OE-service.n> logs <OE-service>.log static html & java script for browser UI + catalog for Mobile service 18
50 Anatomy of an OpenEdge Web Application (9 of 9) <web-app-ctx-root> (aka PDSOE - REST Content) META-INF WEB-INF web.xml appsecurity-xxxxxx.xml 19 static lib classes adapters mobile auth error rest/... log4j.properties <OE-service.1> <OE-service.n> logs <OE-service>.log OE supplied login/logout and error pages for testing (need to be replaced and added to by developer)
51 Choose your Authentication Model OpenEdge supplies security template files for various Authentication and user account source combinations Default [anonymous] security configuration is development time only and has no authentication/authorization Web application and client need to share the same model chosen at development time Security template file names are in the format appsecurity-<authn-model>[-<provider>].xml 20
52 Web application authentication models * Anonymous The no user authentication or login session HTTP Basic Authentication Client sends base64 encoded user name/password to web application in each http request HTTP header: Authorization HTTP Form Authentication The client logs into and out of the web application once per session Login: The client obtains user credentials and POSTs them to the web application URI: /static/auth/j_spring_security_check Body: j_username=xxxx&j_password=yyyy&submit=submit+query Cookie: JSESSIONID Logout: The client uses a GET request to log out URI: /static/auth/j_spring_security_logout 21 * Other authentication models available - not certified
53 Common web application authentication providers * Supplies user account information to common Spring authentication process Name; password; roles; state; locked; expired;... Can change provider type at production deployment time Provider choices In-memory user accounts in configuration file Local file user accounts in clear-text file Container user account authenticated by Java container LDAP / AD user accounts in a Directory Service (11.2.1) OERealm OpenEdge AppServer service (11.3) 22 * Other authentication providers available - not certified
54 Choose your user login session model Client and server configurations must agree Sessions controlled by Web Server s session manager (not OE web application or your AppServer) Session ID stored in cookie & sent to client - client returns the cookie with EACH request (JSESSIONID cookie) Session ID cookies cannot be seen by client JavaScript Login sessions timeout - default 30 minutes Login sessions are not automatically shared across multiple web applications PDSOE wants to deploy Mobile UI and its service as TWO different OE web applications 23
55 Plan for Role Based Access (RBA) All of Spring authorization uses ROLES You need to configure at least one role Add additional roles appropriate for your application s security The user s roles are obtained from the same location as the user account information If no user authentication is performed for the request Spring assigns a default user account anonymoususer ROLE_ANONYMOUS 24
56 Choose Your Application Architecture The number of web applications affects your client Single web application One user login - one large set of access controls Cross Site Resource access not a problem Everything enabled/disabled at one time Multiple web applications Multiple user logins - multiple sets of access controls Cross Site Resource access configured everywhere Some applications enabled, others disabled 25
57 Anatomy of an Web Application Configuration Web Server Session manager Spring Security REST/Mobile Application OpenEdge Internal Admin API OpenEdge AppServer Resources*.jsp.html.css.js.json 26
58 Web Application Configuration: web.xml (1 of 4) <context-param /> <listener> <filter> <filter-mapping> <servlet> contextconfiguration parameter for choosing Spring security template <session-config> <security-constraints> <welcome-file-list> <error-page> 27
59 Web Application Configuration: web.xml (2 of 4) <context-param /> <listener> <filter> <filter-mapping> <servlet> OE web application declarations DO NOT EDIT <session-config> <security-constraints> <welcome-file-list> <error-page> 28
60 Web Application Configuration: web.xml (3 of 4) <context-param /> <listener> <filter> <filter-mapping> <servlet> <session-config> <security-constraints> <welcome-file-list> <error-page> Edit web server usersession timeouts, http-only cookies, etc 29
61 Web Application Configuration: web.xml (4 of 4) <context-param /> <listener> <filter> <filter-mapping> <servlet> <session-config> <security-constraints> <welcome-file-list> <error-page> Edit web server level security for container Spring authn model 30
62 Example: Choosing the Spring Security template You edit the web.xml file to set the security configuration Default location C:\Progress\OpenEdge\rest\server\WEB-INF See param-values in the <!--USER EDIT section for contextconfiglocation 1 By default appsecurityanonymous.xml is uncommented
63 Anatomy of an Spring Security Configuration Web Server Session manager Spring Security REST/Mobile Application OpenEdge Internal Admin API OpenEdge AppServer Resources*.jsp.html.css.js.json 32
64 Spring Security Configuration File Tour (1 of 6) <http attributes > <custom-filter> <intercept-url> <basic> <form-login> <logout> <jee> <session-management> </http> contains the authn & authz process controls like session, realm,... for a specific application URI space <b:bean> </b:bean> <authentication-manager> <authentication-provider> </authentication-provider> </authentication-manager> 33
65 Spring Security Configuration File Tour (2 of 6) <http attributes > <custom-filter> <intercept-url> <basic> <form-login> <logout> <jee> <session-management> </http> OpenEdge additions to Spring security process <b:bean> </b:bean> <authentication-manager> <authentication-provider> </authentication-provider> </authentication-manager> 34
66 Spring Security Configuration File Tour (2 of 6) <http attributes > <custom-filter> <intercept-url> <basic> <form-login> <logout> <jee> <session-management> </http> URI access controls: what, how, & who <b:bean> </b:bean> <authentication-manager> <authentication-provider> </authentication-provider> </authentication-manager> 35
67 Spring Security Configuration File Tour (3 of 6) <http attributes > <custom-filter> <intercept-url> <basic> <form-login> <logout> <jee> <session-management> </http> controls the authn model implementations - only one in effect at a time <b:bean> </b:bean> <authentication-manager> <authentication-provider> </authentication-provider> </authentication-manager> 36
68 Spring Security Configuration File Tour (4 of 6) <http attributes > <custom-filter> <intercept-url> <basic> <form-login> <logout> <jee> <session-management> </http> modifies the session management found in <http> <b:bean> </b:bean> <authentication-manager> <authentication-provider> </authentication-provider> </authentication-manager> 37
69 Spring Security Configuration File Tour (5 of 6) <http attributes > <custom-filter> <intercept-url> <basic> <form-login> <logout> <jee> <session-management> </http> <b:bean> </b:bean> <authentication-manager> <authentication-provider> </authentication-provider> </authentication-manager> Spring bean plug-ins for a wide range of authn and process related operations 38
70 Spring Security Configuration File Tour (6 of 6) <http attributes > <custom-filter> <intercept-url> <basic> <form-login> <logout> <jee> <session-management> </http> <b:bean> </b:bean> <authentication-manager> <authentication-provider> </authentication-provider> </authentication-manager> configure how and where user accounts are accessed for Spring s authn process 39
71 Example: <http> and OpenEdge Spring extensions Web application URL space Which Authentication-Manager to use OpenEdge SSO CLIENT-PRINCIPAL 4 OpenEdge Industry Standard CORS 40
72 Example: Choosing the session management model Controls Tomcat session manager {stateless never always ifrequired}
73 Example: controlling URI access <intercept-url pattern= uri access= role-list [ method= method ] [ requires-channel= https ]/> Relative URL access role-list: permitall() denyall() hasanyrole( roles ) roles: role [, role [,...] ] role: ROLE_provider-role provider-role: account provider role name method: {GET PUT POST DELETE} 42
74 Intercept-url Tips Evaluated in the order they appear in the Spring configuration 43
75 Intercept-url Tips Evaluated in the order they appear in the Spring configuration The first pattern match ends the search 43
76 Intercept-url Tips Evaluated in the order they appear in the Spring configuration The first pattern match ends the search The more patterns to match, the slower it runs, use wildcards liberally but with great care 43
77 Intercept-url Tips Evaluated in the order they appear in the Spring configuration The first pattern match ends the search The more patterns to match, the slower it runs, use wildcards liberally but with great care Use a GRANT model - the last intercept url pattern is ALWAYS - deny everybody access to everything 43
78 Intercept-url Tips Evaluated in the order they appear in the Spring configuration The first pattern match ends the search The more patterns to match, the slower it runs, use wildcards liberally but with great care Use a GRANT model - the last intercept url pattern is ALWAYS - deny everybody access to everything Put the most used resource patterns first 43
79 Intercept-url Tips Evaluated in the order they appear in the Spring configuration The first pattern match ends the search The more patterns to match, the slower it runs, use wildcards liberally but with great care Use a GRANT model - the last intercept url pattern is ALWAYS - deny everybody access to everything Put the most used resource patterns first Put explicit resource patterns before wildcard patterns 43
80 Intercept-url Tips Evaluated in the order they appear in the Spring configuration The first pattern match ends the search The more patterns to match, the slower it runs, use wildcards liberally but with great care Use a GRANT model - the last intercept url pattern is ALWAYS - deny everybody access to everything Put the most used resource patterns first Put explicit resource patterns before wildcard patterns If you add extra resources to a web application - add the intercept url pattern immediately 43
81 Intercept-url Tips Evaluated in the order they appear in the Spring configuration The first pattern match ends the search The more patterns to match, the slower it runs, use wildcards liberally but with great care Use a GRANT model - the last intercept url pattern is ALWAYS - deny everybody access to everything Put the most used resource patterns first Put explicit resource patterns before wildcard patterns If you add extra resources to a web application - add the intercept url pattern immediately The default pattern matching is ANT ( * & ** wildcards) (REGEX is configurable if needed) 43
82 Authentication Managers (continued 7 of 7) 2 REST web application authentication manager: controls the common user authentication process REST Manager DO NOT CHANGE THE USER ACCOUNT NAME YOU MAY CHANGE THE USER ACCOUNT PASSWORD IF YOU SYNCHRONIZE THE NEW VALUE WITH THE PASSWORD SENT BY THE REST MANAGER REST Manager Username and encoded password and authorities 44
83 Example: User account authentication control 45
84 Example: User account authentication control Username and encoded password and authorities 45
85 user.properties Using the users.properties file, you can modify the user roles and privileges using the appropriate security configuration file You perform a similar set of edits regardless of which appsecurity-xxx.xml is used 46
86 Example: controlling FORM login Similar to the Basic configuration Model The main difference is that it uses HTTP forms or messages to pass user credentials for authentication Login form Logout URL IMPORTANT: disable session fixation Similar sections you have seen before.. 47
87 Example: controlling which container granted roles Spring will use for authorization This model integrates Spring Security framework with the authentication service of the Java container The Java container authenticates, and the Spring Security framework controls the authorization to REST application resources 48
88 REST Application Manager Security Considerations
89 REST Application Manager Security Configuration Same Spring Security framework Same types of security configuration files DO NOT change the <intercept-url> elements and their patters YOU MAY change the - Authentication provider - ROLE names to be consistent with the authentication provider 50
90 Advanced Security Considerations
91 More Advance General Web Security No Progress based tooling Customer preferences Integrating Microsoft ISS or Apache with Tomcat Tomcat AJP13 SSL <security> AJP13 AJP13 SSL <security> <security> 52
92 CORS - Cross Origin Resource Scripting CORS is a W3C group standard that allows a Mobile App's Java Script to access Web application resources in a DNS domain different from the one the current HTTP page and JavaScript were loaded from It works by adding new HTTP headers that allow servers to control resource access to permitted origin domains. Developer Studio Mobile App Builder <domain 1> Javascript Engine Page href REST <= CORS = > http headers <domain 2> REST Web Application 53
93 What is CORS (Cross Origin Resource Sharing) A CORS enabled server or web application classifies all HTTP requests as: A CORS request that contains the HTTP Origin header A preflight request that contains the Access-Control-Request- Method header in an OPTIONS request A generic request that does not contain any CORS HTTP headers For more information on CORS standard and the advances in the standard, see the documentation at 54
94 Example: OpenEdge CORS support 1. Identify and open the security configuration you applied to your REST application 2. In the security configuration file, appsecurity-xxx.xml, uncomment only the required properties and you must assign a value to those properties <b:bean id="oecorsfilter" class="com.progress.rest.security.oecorsfilter" > <b:property name="allowall" value="false" /> <b:property name="allowdomains" value="*" /> <b:property name="allowsubdomains" value="false" /> <b:property name="allowmethods" value="get,put,post,delete" /> <b:property name="messageheaders" value="accept, Accept-Language, Content-Language, Content-Type, X-CLIENT-CONTEXT-ID, Origin, Pragma, Cache-Control Access-Control-Request-Headers, Access-Control-Request-Method" /> <b:property name="responseheaders" value="cache-control, Content-Language, Content-Type, Expires, X-CLIENT-CONTEXT-ID" /> <b:property name="supportcredentials" value="true" /> <b:property name="maxage" value="-1" /> </b:bean> OECORSFilter allowall* allowdomains* MessageHeaders repsonseheaders 55
95 OECORSFilter properties Property name Description Data types Default Range allowall 1 allowdomains 2 Specifies that CORS filter allow every client request. If this property is set to true, all the other CORS properties values are ignored by the CORS filter. Specifies the domains that can make server requests. Boolean true true or false String * { "*" "domain1 [,domain2...] } allowsubdomains Specifies if subdomains of the permitted domains be allowed to make server requests. Boolean false true or False 56 allowmethods 3 Specifies valid HTTP method names. String GET, PUT, POST, DELETE messageheaders 4 Specifies the message header to be passed as a header to the server. If you are passing multiple messages, you must specify a comma-separated list of messages. String Refer to the footnote. Valid HTTP methods in upper case. Any valid string
96 OECORSFilter properties (continued 2 of 2) Property name Description Data types Default Range responseheaders 5 supportcredentials 6 Specifies the message header to be received by the client as a header from the server. If you are passing multiple messages, you must specify a comma-separated list of messages. Controls whether the CORS filter allows the client to send user credentials in the form of a COOKIE String Refer to the footnote. Any valid string Boolean true true or false 57 maxage Specifies the maximum time (in seconds) for an application resource to be granted on request. After the specified time, the resource grant is revoked and the client must request access again. Integer -1 { -1 +n }
97 AppServer Single Sign-On ClientPrincipal authentication token created from Spring authentication token ClientPrincipal passed with each request to Agent Request context information available via session:current-request-info:getclientprincipal(). session:current-request-info:clientcontextid. session:current-request-info:procedurename. ABL Client-Principal handle can be UNKNOWN Anonymous security model ABL Client-Principal SESSION-ID attribute can be zero (0) Stateless session configuration in REST web application Client-Principal SESSION-ID equals clientcontextid attribute Client-Principal STATE attribute is SSO (represents authentication token generated by another system) 58
98 Example: OpenEdge Client-Principal Single Sign-On AppServer Single Sign-On Security filter that turns a Spring token into an OpenEdge CLIENT-PRINCIPAL 4 59
99 OEClientPrincipalFilter properties Property name Description Data types Default Range enablecp Enables/disables sending CP to AppServer Boolean true true or false domain The OpenEdge domain into which to insert the foreign system s user account ID String web app context name <valid-string> roles Comma separated list of static role names to grant the foreign user account String r1[,r2[,r3...]]] expires accntinfo Optional ClientPrincipal expiration delta time (in seconds) after which it will not be validated for use in OpenEdge Insert the Spring token s account properties into the ClientPrincipal s PROPERTIES attribute integer 0 (none) 0 - max positive int Boolean FALSE true or false 60
100 OEClientPrincipalFilter properties (continued 2 of 2) Property name Description Data types Default Range <prop-name> Adds static ClientPrincipal PROPERTIES attributes String <valid-string> ccid Pass Spring session-id to http client in the X-CLIENT-CONTEXT-ID header Boolean FALSE true or false anonymous Pass anonymous user-id as ClientPrincipal to AppServer Boolean FALSE true or false 61
101 Security Resources Self Study Industry Resources Open Edge Resources OWASP web application security best practices (checklist) See Tomcat See Tutorial/ AJP13 IIS/Apache to Tomcat See config/ajp.html Web application Spring Security See site/reference.html CORS See 62
102 Thank you
103 Thank you
Mobile Security Jump Start. Wayne Henshaw & Mike Jacobs Progress OpenEdge October 8, 2013
Mobile Security Jump Start Wayne Henshaw & Mike Jacobs Progress OpenEdge October 8, 2013 Agenda Architectural basics REST service Mobile client Making required choices Authentication model User sessions
Progress OpenEdge REST
Progress OpenEdge REST Deploying, Managing, and Troubleshooting your REST Web Application Kumar Navneet Principal Software Engineer Progress Software October 8, 2013 David Cleary Principal Software Engineer
Authenticating REST services in OpenEdge
Authenticating REST services in OpenEdge Controlling business logic access via OE Realm & LDAP Peter Judge, Progress Software [email protected] Abstract Slides-only précis of the REST Security Workshop
Debugging Mobile Apps
Debugging Mobile Apps Native and Mobile Web Apps Shelley Chase Senior Architect, Progress OpenEdge November 2013 OpenEdge Mobile Value Proposition: Write Once, Run Anywhere Portability with the Benefits
<Insert Picture Here> Hudson Security Architecture. Winston Prakash. Click to edit Master subtitle style
Hudson Security Architecture Click to edit Master subtitle style Winston Prakash Hudson Security Architecture Hudson provides a security mechanism which allows Hudson Administrators
Web Application Architecture (based J2EE 1.4 Tutorial)
Web Application Architecture (based J2EE 1.4 Tutorial) 1 Disclaimer & Acknowledgments Even though Sang Shin is a full-time employee of Sun Microsystems, the contents here are created as his own personal
Identity Management in Liferay Overview and Best Practices. Liferay Portal 6.0 EE
Identity Management in Liferay Overview and Best Practices Liferay Portal 6.0 EE Table of Contents Introduction... 1 IDENTITY MANAGEMENT HYGIENE... 1 Where Liferay Fits In... 2 How Liferay Authentication
DEPLOYMENT GUIDE Version 1.0. Deploying the BIG-IP Edge Gateway for Layered Security and Acceleration Services
DEPLOYMENT GUIDE Version 1.0 Deploying the BIG-IP Edge Gateway for Layered Security and Acceleration Services Table of Contents Table of Contents Using the BIG-IP Edge Gateway for layered security and
Copyright http://support.oracle.com/
Primavera Portfolio Management 9.0 Security Guide July 2012 Copyright Oracle Primavera Primavera Portfolio Management 9.0 Security Guide Copyright 1997, 2012, Oracle and/or its affiliates. All rights reserved.
Spring Security 3. rpafktl Pen source. intruders with this easy to follow practical guide. Secure your web applications against malicious
Spring Security 3 Secure your web applications against malicious intruders with this easy to follow practical guide Peter Mularien rpafktl Pen source cfb II nv.iv I I community experience distilled
Spring Security 3. http://www.springsource.com/download/community?project=spring%20security
Spring Security 3 1. Introduction http://www.springsource.com/download/community?project=spring%20security 2. Security Namespace Configuration Web.xml configuration: springsecurityfilterchain
CA Performance Center
CA Performance Center Single Sign-On User Guide 2.4 This Documentation, which includes embedded help systems and electronically distributed materials, (hereinafter referred to as the Documentation ) is
Crawl Proxy Installation and Configuration Guide
Crawl Proxy Installation and Configuration Guide Google Enterprise EMEA Google Search Appliance is able to natively crawl secure content coming from multiple sources using for instance the following main
TROUBLESHOOTING RSA ACCESS MANAGER SINGLE SIGN-ON FOR WEB-BASED APPLICATIONS
White Paper TROUBLESHOOTING RSA ACCESS MANAGER SINGLE SIGN-ON FOR WEB-BASED APPLICATIONS Abstract This white paper explains how to diagnose and troubleshoot issues in the RSA Access Manager single sign-on
Table of Contents. Open-Xchange Authentication & Session Handling. 1.Introduction...3
Open-Xchange Authentication & Session Handling Table of Contents 1.Introduction...3 2.System overview/implementation...4 2.1.Overview... 4 2.1.1.Access to IMAP back end services...4 2.1.2.Basic Implementation
SSO Plugin. HP Service Request Catalog. J System Solutions. http://www.javasystemsolutions.com Version 3.6
SSO Plugin HP Service Request Catalog J System Solutions Version 3.6 Page 2 of 7 Introduction... 3 Adobe Flash and NTLM... 3 Enabling the identity federation service... 4 Federation key... 4 Token lifetime...
ADMINISTERING ADOBE LIVECYCLE MOSAIC 9.5
ADMINISTERING ADOBE LIVECYCLE MOSAIC 9.5 Legal notices Copyright 2011 Adobe Systems Incorporated and its licensors. All rights reserved. Administering Adobe LiveCycle Mosaic 9.5 March 31, 2011 This administering
Certified Secure Web Application Secure Development Checklist
www.certifiedsecure.com [email protected] Tel.: +31 (0)70 310 13 40 Loire 128-A 2491 AJ The Hague The Netherlands About Certified Secure Checklist Certified Secure exists to encourage and fulfill
A (re)introduction to Spring Security
A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security Introducing Spring Security View layer security What s coming in Spring Security 3 Before Spring Security There was...
SSO Plugin. Authentication service for HP, Kinetic, Jasper, SAP and CA products. J System Solutions. JSS SSO Plugin Authentication service
SSO Plugin Authentication service for HP, Kinetic, Jasper, SAP and CA products J System Solutions http://www.javasystemsolutions.com Version 3.6 Introduction... 4 Implementing SSO... 5 Copying the SSO
Securing RESTful Web Services Using Spring and OAuth 2.0
Securing RESTful Web Services Using Spring and OAuth 2.0 1.0 EXECUTIVE SUMMARY While the market is hugely 1 accepting REST based architectures due to their light weight nature, there is a strong need to
esoc SSA DC-I Part 1 - Single Sign-On and Access Management ICD
esoc European Space Operations Centre Robert-Bosch-Strasse 5 64293 Darmstadt Germany Tel: (49)615190-0 Fax: (49)615190485 www.esa.int SSA DC-I Part 1 - Single Sign-On and Access Management ICD Prepared
From the Intranet to Mobile. By Divya Mehra and Stian Thorgersen
ENTERPRISE SECURITY WITH KEYCLOAK From the Intranet to Mobile By Divya Mehra and Stian Thorgersen PROJECT TIMELINE AGENDA THE OLD WAY Securing monolithic web app relatively easy Username and password
Configuring Nex-Gen Web Load Balancer
Configuring Nex-Gen Web Load Balancer Table of Contents Load Balancing Scenarios & Concepts Creating Load Balancer Node using Administration Service Creating Load Balancer Node using NodeCreator Connecting
TIBCO Spotfire Platform IT Brief
Platform IT Brief This IT brief outlines features of the system: Communication security, load balancing and failover, authentication options, and recommended practices for licenses and access. It primarily
Copyright 2014 Jaspersoft Corporation. All rights reserved. Printed in the U.S.A. Jaspersoft, the Jaspersoft
5.6 Copyright 2014 Jaspersoft Corporation. All rights reserved. Printed in the U.S.A. Jaspersoft, the Jaspersoft logo, Jaspersoft ireport Designer, JasperReports Library, JasperReports Server, Jaspersoft
SSL CONFIGURATION GUIDE
HYPERION RELEASE 9.3.1 SSL CONFIGURATION GUIDE CONTENTS IN BRIEF About This Document... 2 Assumptions... 2 Information Sources... 2 Identifying SSL Points for Hyperion Products... 4 Common Activities...
Pierce County IT Department GIS Division Xuejin Ruan Dan King
Pierce County IT Department GIS Division Xuejin Ruan Dan King Web Application Work Flow Main Topics Authentication Authorization Session Management * Concurrent Session Management * Session Timeout Single
Setup Guide Access Manager 3.2 SP3
Setup Guide Access Manager 3.2 SP3 August 2014 www.netiq.com/documentation Legal Notice THIS DOCUMENT AND THE SOFTWARE DESCRIBED IN THIS DOCUMENT ARE FURNISHED UNDER AND ARE SUBJECT TO THE TERMS OF A LICENSE
SSO Plugin. Authentication service for HP, Kinetic, Jasper, SAP and CA products. J System Solutions. Page 1 of 23. http://www.javasystemsolutions.
Page 1 of 23 SSO Plugin Authentication service for HP, Kinetic, Jasper, SAP and CA products J System Solutions Version 4.0 Page 2 of 23 Introduction... 4 Implementing SSO... 5 Licensing... 6 Copying the
Check list for web developers
Check list for web developers Requirement Yes No Remarks 1. Input Validation 1.1) Have you done input validation for all the user inputs using white listing and/or sanitization? 1.2) Does the input validation
FileCloud Security FAQ
is currently used by many large organizations including banks, health care organizations, educational institutions and government agencies. Thousands of organizations rely on File- Cloud for their file
3. Broken Account and Session Management. 4. Cross-Site Scripting (XSS) Flaws. Web browsers execute code sent from websites. Account Management
What is an? s Ten Most Critical Web Application Security Vulnerabilities Anthony LAI, CISSP, CISA Chapter Leader (Hong Kong) [email protected] Open Web Application Security Project http://www.owasp.org
EVALUATING COMMERCIAL WEB APPLICATION SECURITY. By Aaron Parke
EVALUATING COMMERCIAL WEB APPLICATION SECURITY By Aaron Parke Outline Project background What and why? Targeted sites Testing process Burp s findings Technical talk My findings and thoughts Questions Project
Single Sign-on (SSO) technologies for the Domino Web Server
Single Sign-on (SSO) technologies for the Domino Web Server Jane Marcus December 7, 2011 2011 IBM Corporation Welcome Participant Passcode: 4297643 2011 IBM Corporation 2 Agenda USA Toll Free (866) 803-2145
Configuration Guide BES12. Version 12.3
Configuration Guide BES12 Version 12.3 Published: 2016-01-19 SWD-20160119132230232 Contents About this guide... 7 Getting started... 8 Configuring BES12 for the first time...8 Configuration tasks for managing
RSA Secured Implementation Guide for VPN Products
RSA Secured Implementation Guide for VN roducts Last Modified August 27, 2004 1. artner Information artner Name Juniper Networks Web Site http://www.juniper.com/ roduct Name Juniper Networks NetScreen-SA
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
External Authentication with Juniper SSL VPN appliance Authenticating Users Using SecurAccess Server by SecurEnvoy
External Authentication with Juniper SSL VPN appliance Authenticating Users Using SecurAccess Server by SecurEnvoy Contact information SecurEnvoy www.securenvoy.com 0845 2600010 1210 Parkview Arlington
Configuration Worksheets for Oracle WebCenter Ensemble 10.3
Configuration Worksheets for Oracle WebCenter Ensemble 10.3 This document contains worksheets for installing and configuring Oracle WebCenter Ensemble 10.3. Print this document and use it to gather the
Lecture 11 Web Application Security (part 1)
Lecture 11 Web Application Security (part 1) Computer and Network Security 4th of January 2016 Computer Science and Engineering Department CSE Dep, ACS, UPB Lecture 11, Web Application Security (part 1)
Application Security
2009 Marty Hall Declarative Web Application Security Originals of Slides and Source Code for Examples: http://courses.coreservlets.com/course-materials/msajsp.html Customized Java EE Training: http://courses.coreservlets.com/
Certified Secure Web Application Security Test Checklist
www.certifiedsecure.com [email protected] Tel.: +31 (0)70 310 13 40 Loire 128-A 2491 AJ The Hague The Netherlands Certified Secure Checklist About Certified Secure exists to encourage and fulfill
Configuration Guide. BlackBerry Enterprise Service 12. Version 12.0
Configuration Guide BlackBerry Enterprise Service 12 Version 12.0 Published: 2014-12-19 SWD-20141219132902639 Contents Introduction... 7 About this guide...7 What is BES12?...7 Key features of BES12...
ipad or iphone with Junos Pulse and Juniper SSL VPN appliance Authenticating Users Using SecurAccess Server by SecurEnvoy
ipad or iphone with Junos Pulse and Juniper SSL VPN appliance Authenticating Users Using SecurAccess Server by SecurEnvoy Contact information SecurEnvoy www.securenvoy.com 0845 2600010 1210 Parkview Arlington
NETASQ ACTIVE DIRECTORY INTEGRATION
NETASQ ACTIVE DIRECTORY INTEGRATION NETASQ ACTIVE DIRECTORY INTEGRATION RUNNING THE DIRECTORY CONFIGURATION WIZARD 2 VALIDATING LDAP CONNECTION 5 AUTHENTICATION SETTINGS 6 User authentication 6 Kerberos
Creating a generic user-password application profile
Chapter 4 Creating a generic user-password application profile Overview If you d like to add applications that aren t in our Samsung KNOX EMM App Catalog, you can create custom application profiles using
StreamServe Persuasion SP5 StreamStudio
StreamServe Persuasion SP5 StreamStudio Administrator s Guide Rev B StreamServe Persuasion SP5 StreamStudio Administrator s Guide Rev B OPEN TEXT CORPORATION ALL RIGHTS RESERVED United States and other
Siteminder Integration Guide
Integrating Siteminder with SA SA - Siteminder Integration Guide Abstract The Junos Pulse Secure Access (SA) platform supports the Netegrity Siteminder authentication and authorization server along with
Configuration Guide BES12. Version 12.2
Configuration Guide BES12 Version 12.2 Published: 2015-07-07 SWD-20150630131852557 Contents About this guide... 8 Getting started... 9 Administrator permissions you need to configure BES12... 9 Obtaining
Configuration Guide BES12. Version 12.1
Configuration Guide BES12 Version 12.1 Published: 2015-04-22 SWD-20150422113638568 Contents Introduction... 7 About this guide...7 What is BES12?...7 Key features of BES12... 8 Product documentation...
Xerox DocuShare Security Features. Security White Paper
Xerox DocuShare Security Features Security White Paper Xerox DocuShare Security Features Businesses are increasingly concerned with protecting the security of their networks. Any application added to a
Configuring Sponsor Authentication
CHAPTER 4 Sponsors are the people who use Cisco NAC Guest Server to create guest accounts. Sponsor authentication authenticates sponsor users to the Sponsor interface of the Guest Server. There are five
Pacific Application Server for OpenEdge: Getting Started. Progress OpenEdge 11.5 Workshop
Pacific Application Server for OpenEdge: Getting Started Progress OpenEdge 11.5 Workshop 2015 Legal Disclaimer The contents of these materials are confidential information of Progress Software Corporation
Configuring Single Sign-on for WebVPN
CHAPTER 8 This chapter presents example procedures for configuring SSO for WebVPN users. It includes the following sections: Using Single Sign-on with WebVPN, page 8-1 Configuring SSO Authentication Using
TIBCO Spotfire Web Player 6.0. Installation and Configuration Manual
TIBCO Spotfire Web Player 6.0 Installation and Configuration Manual Revision date: 12 November 2013 Important Information SOME TIBCO SOFTWARE EMBEDS OR BUNDLES OTHER TIBCO SOFTWARE. USE OF SUCH EMBEDDED
Ricardo Perdigao, Solutions Architect Edsel Garcia, Principal Software Engineer Jean Munro, Senior Systems Engineer Dan Mitchell, Principal Systems
A Sexy UI for Progress OpenEdge using JSDO and Kendo UI Ricardo Perdigao, Solutions Architect Edsel Garcia, Principal Software Engineer Jean Munro, Senior Systems Engineer Dan Mitchell, Principal Systems
Cloud Powered Mobile Apps with Azure
Cloud Powered Mobile Apps with Azure Malte Lantin Technical Evanglist Microsoft Azure Agenda Mobile Services Features and Demos Advanced Features Scaling and Pricing 2 What is Mobile Services? Storage
Reverse Proxy Scenarios for Single Sign-On
Sterling Secure Proxy Reerse Proxy Scenarios for Single Sign-On Version 3.4 Sterling Secure Proxy Reerse Proxy Scenarios for Single Sign-On Version 3.4 Note Before using this information and the product
Web Application Guidelines
Web Application Guidelines Web applications have become one of the most important topics in the security field. This is for several reasons: It can be simple for anyone to create working code without security
Filr 2.0 Administration Guide. April 2016
Filr 2.0 Administration Guide April 2016 Legal Notice For information about legal notices, trademarks, disclaimers, warranties, export and other use restrictions, U.S. Government rights, patent policy,
Configuring Single Sign-On for Documentum Applications with RSA Access Manager Product Suite. Abstract
Configuring Single Sign-On for Documentum Applications with RSA Access Manager Product Suite Abstract This white paper outlines the deployment and configuration of a Single Sign-On solution for EMC Documentum
Recommended readings. Lecture 11 - Securing Web. Applications. Security. Declarative Security
Recommended readings Lecture 11 Securing Web http://www.theserverside.com/tt/articles/content/tomcats ecurity/tomcatsecurity.pdf http://localhost:8080/tomcat-docs/security-managerhowto.html http://courses.coreservlets.com/course-
User Identification (User-ID) Tips and Best Practices
User Identification (User-ID) Tips and Best Practices Nick Piagentini Palo Alto Networks www.paloaltonetworks.com Table of Contents PAN-OS 4.0 User ID Functions... 3 User / Group Enumeration... 3 Using
Copyright 2013 Consona Corporation. All rights reserved www.compiere.com
COMPIERE 3.8.1 SOAP FRAMEWORK Copyright 2013 Consona Corporation. All rights reserved www.compiere.com Table of Contents Compiere SOAP API... 3 Accessing Compiere SOAP... 3 Generate Java Compiere SOAP
Interwise Connect. Working with Reverse Proxy Version 7.x
Working with Reverse Proxy Version 7.x Table of Contents BACKGROUND...3 Single Sign On (SSO)... 3 Interwise Connect... 3 INTERWISE CONNECT WORKING WITH REVERSE PROXY...4 Architecture... 4 Interwise Web
This chapter describes how to use the Junos Pulse Secure Access Service in a SAML single sign-on deployment. It includes the following sections:
CHAPTER 1 SAML Single Sign-On This chapter describes how to use the Junos Pulse Secure Access Service in a SAML single sign-on deployment. It includes the following sections: Junos Pulse Secure Access
Setup Corporate (Microsoft Exchange) Email. This tutorial will walk you through the steps of setting up your corporate email account.
Setup Corporate (Microsoft Exchange) Email This tutorial will walk you through the steps of setting up your corporate email account. Microsoft Exchange Email Support Exchange Server Information You will
Configuration Guide. BES12 Cloud
Configuration Guide BES12 Cloud Published: 2016-04-08 SWD-20160408113328879 Contents About this guide... 6 Getting started... 7 Configuring BES12 for the first time...7 Administrator permissions you need
Criteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-
Web Application Firewall Policy File Specification
Web Application Firewall Policy File Specification Foreword This document provides instructions for configuring the Web Application Firewall (WAF) feature of the Java EE language version of the OWASP Enterprise
Integrating the F5 BigIP with Blackboard
Integrating the F5 BigIP with Blackboard Nick McClure [email protected] Lead Systems Programmer University of Kentucky Created August 1, 2006 Last Updated June 17, 2008 Integrating the F5 BigIP with Blackboard
Novell Access Manager
Access Gateway Guide AUTHORIZED DOCUMENTATION Novell Access Manager 3.1 SP2 November 16, 2010 www.novell.com Novell Access Manager 3.1 SP2 Access Gateway Guide Legal Notices Novell, Inc., makes no representations
Agenda. How to configure
[email protected] Agenda Strongly Recommend: Knowledge of ArcGIS Server and Portal for ArcGIS Security in the context of ArcGIS Server/Portal for ArcGIS Access Authentication Authorization: securing web services
Web application security
Web application security Sebastian Lopienski CERN Computer Security Team openlab and summer lectures 2010 (non-web question) Is this OK? int set_non_root_uid(int uid) { // making sure that uid is not 0
Dell One Identity Cloud Access Manager 8.0.1 - How to Develop OpenID Connect Apps
Dell One Identity Cloud Access Manager 8.0.1 - How to Develop OpenID Connect Apps May 2015 This guide includes: What is OAuth v2.0? What is OpenID Connect? Example: Providing OpenID Connect SSO to a Salesforce.com
A Guide to New Features in Propalms OneGate 4.0
A Guide to New Features in Propalms OneGate 4.0 Propalms Ltd. Published April 2013 Overview This document covers the new features, enhancements and changes introduced in Propalms OneGate 4.0 Server (previously
Shibboleth Identity Provider (IdP) Sebastian Rieger [email protected]
Shibboleth Identity Provider (IdP) Sebastian Rieger [email protected] Gesellschaft für wissenschaftliche Datenverarbeitung mbh Göttingen, Germany CLARIN AAI Hands On Workshop, 25.02.2009, Oxford
CENTRAL AUTHENTICATION SERVICE (CAS) SSO FOR EMC DOCUMENTUM REST SERVICES
White Paper FOR EMC DOCUMENTUM REST SERVICES Abstract This white paper provides a detailed review of Central Authentication Service (CAS) SSO integration with EMC Documentum REST Services by exploring
Web Application Vulnerability Testing with Nessus
The OWASP Foundation http://www.owasp.org Web Application Vulnerability Testing with Nessus Rïk A. Jones, CISSP [email protected] Rïk A. Jones Web developer since 1995 (16+ years) Involved with information
Authentication Methods
Authentication Methods Overview In addition to the OU Campus-managed authentication system, OU Campus supports LDAP, CAS, and Shibboleth authentication methods. LDAP users can be configured through the
JVA-122. Secure Java Web Development
JVA-122. Secure Java Web Development Version 7.0 This comprehensive course shows experienced developers of Java EE applications how to secure those applications and to apply best practices with regard
How to Configure Captive Portal
How to Configure Captive Portal Captive portal is one of the user identification methods available on the Palo Alto Networks firewall. Unknown users sending HTTP or HTTPS 1 traffic will be authenticated,
DEPLOYMENT GUIDE Version 1.2. Deploying F5 with Oracle E-Business Suite 12
DEPLOYMENT GUIDE Version 1.2 Deploying F5 with Oracle E-Business Suite 12 Table of Contents Table of Contents Introducing the BIG-IP LTM Oracle E-Business Suite 12 configuration Prerequisites and configuration
Integrating IBM Cognos 8 BI with 3rd Party Auhtentication Proxies
Guideline Integrating IBM Cognos 8 BI with 3rd Party Auhtentication Proxies Product(s): IBM Cognos 8 BI Area of Interest: Security Integrating IBM Cognos 8 BI with 3rd Party Auhtentication Proxies 2 Copyright
Securing access to Citrix applications using Citrix Secure Gateway and SafeWord. PremierAccess. App Note. December 2001
Securing access to Citrix applications using Citrix Secure Gateway and SafeWord PremierAccess App Note December 2001 DISCLAIMER: This White Paper contains Secure Computing Corporation product performance
Okta/Dropbox Active Directory Integration Guide
Okta/Dropbox Active Directory Integration Guide Okta Inc. 301 Brannan Street, 3rd Floor San Francisco CA, 94107 [email protected] 1-888- 722-7871 1 Table of Contents 1 Okta Directory Integration Edition for
About Me. #ccceu. @shapeblue. Software Architect with ShapeBlue Specialise in. 3 rd party integrations and features in CloudStack
Software Architect with ShapeBlue Specialise in. 3 rd party integrations and features in CloudStack About Me KVM, API, DB, Upgrades, SystemVM, Build system, various subsystems Contributor and Committer
W H IT E P A P E R. Salesforce CRM Security Audit Guide
W HITEPAPER Salesforce CRM Security Audit Guide Contents Introduction...1 Background...1 Security and Compliance Related Settings...1 Password Settings... 2 Audit and Recommendation... 2 Session Settings...
Gateway Apps - Security Summary SECURITY SUMMARY
Gateway Apps - Security Summary SECURITY SUMMARY 27/02/2015 Document Status Title Harmony Security summary Author(s) Yabing Li Version V1.0 Status draft Change Record Date Author Version Change reference
Building Secure Applications. James Tedrick
Building Secure Applications James Tedrick What We re Covering Today: Accessing ArcGIS Resources ArcGIS Web App Topics covered: Using Token endpoints Using OAuth/SAML User login App login Portal ArcGIS
SSC - Web applications and development Introduction and Java Servlet (II)
SSC - Web applications and development Introduction and Java Servlet (II) Shan He School for Computational Science University of Birmingham Module 06-19321: SSC Outline Outline of Topics Servlet Configuration
CA SiteMinder Secure Proxy Server
CA SiteMinder Secure Proxy Server Administration Guide 12.52 SP1 This Documentation, which includes embedded help systems and electronically distributed materials, (hereinafter referred to as the Documentation
User-ID Best Practices
User-ID Best Practices PAN-OS 5.0, 5.1, 6.0 Revision A 2011, Palo Alto Networks, Inc. www.paloaltonetworks.com Table of Contents PAN-OS User-ID Functions... 3 User / Group Enumeration... 3 Using LDAP Servers
SSO Plugin. Release notes. J System Solutions. http://www.javasystemsolutions.com Version 3.6
SSO Plugin Release notes J System Solutions Version 3.6 JSS SSO Plugin v3.6 Release notes What's new... 3 Improved Integrated Windows Authentication... 3 BMC ITSM self service... 3 Improved BMC ITSM Incident
How To Use Netiq Access Manager 4.0.1.1 (Netiq) On A Pc Or Mac Or Macbook Or Macode (For Pc Or Ipad) On Your Computer Or Ipa (For Mac) On An Ip
Setup Guide Access Manager 4.0 SP1 May 2014 www.netiq.com/documentation Legal Notice THIS DOCUMENT AND THE SOFTWARE DESCRIBED IN THIS DOCUMENT ARE FURNISHED UNDER AND ARE SUBJECT TO THE TERMS OF A LICENSE
UPGRADING TO XI 3.1 SP6 AND SINGLE SIGN ON. Chad Watson Sr. Business Intelligence Developer
UPGRADING TO XI 3.1 SP6 AND SINGLE SIGN ON Chad Watson Sr. Business Intelligence Developer UPGRADING TO XI 3.1 SP6 What Business Objects Administrators should consider before installing a Service Pack.
Centrify Mobile Authentication Services
Centrify Mobile Authentication Services SDK Quick Start Guide 7 November 2013 Centrify Corporation Legal notice This document and the software described in this document are furnished under and are subject
Unlocking the Secrets of Alfresco Authentication. Mehdi BELMEKKI,! Consultancy Team! Alfresco!
Unlocking the Secrets of Alfresco Authentication Mehdi BELMEKKI,! Consultancy Team! Alfresco! Agenda Introduction! Talk objectives! Repository Authentication! Share Authentication! External Authentication!