Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Authorization is a key theme in computer security practices.

learn more… | top users | synonyms

0
votes
1answer
20 views

Limiting account access based upon NIC used to connect on Linux

I have a server which has multiple NICs (ignoring redundant pairs): 'inward' facing production (connects to other servers); 'outward' external facing production (connects out to the internet via a ...
2
votes
1answer
46 views

API request modification

I am building an API that returns data about companies Multiple applications will access the API, some of these applications will have access to one company, some to multiple companies. When a request ...
-1
votes
0answers
20 views

Page Access Authorization [on hold]

I'm trying to figure out how to give users access to a certain web pages based on the user having ownership of a certain file and file type. For instance, The user can't have access to the page unless ...
2
votes
3answers
60 views

Claims based vs Permission based authorization

So I understand roles vs permissions. I also understand roles vs claims. In both cases claims and permissions are granular, usually per feature or business operation such as AddPerson permission. ...
1
vote
0answers
10 views

IdM on apps we host for a client

We're looking at hosting some of a client's existing applications in our environment. My current thinking is we will have an encrypted channel back to the client's network over which authentication ...
2
votes
0answers
22 views

Is there a way to restrict hls key file served by cloudfront (over https) to only authorized users

I have a video file which is distributed after hls packaging and encrypted using aes 128. Since HLS key url is part of the m3u8 file I have to restrict the delivery of key file only to authorized ...
0
votes
1answer
69 views

Is my understanding about how SSL works correct?

I've been reading about 2-way SSL or mutual auth recently, and here's what I've figured so far: Mutual auth is a way for the client to authenticate itself to the server, just like the server does to ...
1
vote
3answers
235 views

Order of authentication and authorization

This is my first question here in Information Security SE. Is there a recommendation to help telling the scenarios where authentication should precede authorization from the ones where authorization ...
1
vote
2answers
53 views

Requesting administrative access in a company

I have been given the task of defining a process for assigning administrative access. One of the requirements for this processs is that if a subject wishes to gain adminstrative access, only the ...
0
votes
1answer
21 views

ACL managed with roles

I have resources in an application. Further I have a table holding all resources and for every resource what role is allowed to access it. I also have defined a Table holding all uses that are ...
1
vote
0answers
16 views

Tacacs won't match cmd rules included in both user and group area at the same time

I'm struggling to set up TACACS+ commands authorization. I have users defined in tacs_plus.conf. All of the users are members of group ADMIN. Group ADMIN has command authorization definitions. Now ...
2
votes
1answer
55 views

Reducing asymmetric authorization token size

I would like to use an asymmetric rather than symmetric signature for authorization, since I don't want a compromised service being able to forge authorization tokens (obviously). An authorization ...
0
votes
2answers
38 views

How to handle data-dependent Claims?

This question is about Claims-Based Authorization and Windows Identity Foundation (unfortunately I lack the priviledge to create a tag for this). Consider the following simple use case: I have a ...
-1
votes
2answers
100 views

Is there a difference between Broken Access Control and Insecure Direct Object reference? [closed]

According to me,if this difference is correct,it is that for exploiting a broken access control you don't necessarily need to be logged into the application,but for exploiting insecure direct object ...
4
votes
2answers
294 views

Claim Based Authorization vs Attribute Based Access Control

Is there a difference between Attribute Based Access Control which is usually associated with XACML and Claim Based Authorization which seems to be a term coined by Microsoft? Is the latter simply ...
2
votes
2answers
123 views

How to build a secure affiliate network

I'm going to build a demo affiliate network, which needs to be secured. Let say I have a web application called Affiliate Network Manager that manages all affiliates associated with my online book ...
1
vote
1answer
43 views

Issues of using HOTP w/ iteration window

I am using HOTP to generate OTP to validate a request, in order to prevent replay attacks. I'm thinking about using a window of 10 (or so) iterations to accommodate a possible mismatch in the counter ...
0
votes
1answer
102 views

HTTP Status Codes - security considerations [duplicate]

I am designing an authorization framework and now I am thinking about the error codes which I should return when someone is trying to access a resource and he doesn't have the required permissions. ...
1
vote
0answers
102 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
2
votes
1answer
83 views

SAML for transporting authorization information

I'm thinking of using SAML for sending authentication and authorization information to system. I plan to send roles and other information as authentication attributes in the assertion. Does this ...
1
vote
0answers
211 views

I authenticate my users through Facebook's Oauth client and want to secure my own called APIs

My application is divised into two parts: Javascript application as client Server side API's (RESTFUL through Play!2.2 framework) I expect users to be authenticated through Facebook's Oauth 2.0 ...
1
vote
0answers
170 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
2
votes
1answer
406 views

Looking for approach to implement attribute based access control (ABAC)

We are looking to implement Attribute-Based Access Control. While we are sold on the philosophy, there are two topics that seem to crop up: Will it lead to significant performance issues? Especially ...
3
votes
1answer
423 views

Securing mobile app rest requests

I am using Facebook login in a mobile native app, and I'm trying to figure out if my approach is secure enough. This is the flow (all communication is made over SSL): User logins to Facebook ...
5
votes
1answer
165 views

Cascaded Sudo for privilege elevation

I intend to use the least privileged user to do a given task. The issue is that it involve a kind of responsibility chain and translate as a sudo chain in my scripts, spreading the overall task in ...
2
votes
1answer
66 views

What is the purpose of derivation of encryption and authorization keys from master key?

We're using AES-CBC and HMAC to encrypt and authenticate our messages (using encrypt-then-authenticate method). Sometimes I see solutions (like this one) which are deriving encryption and ...
1
vote
3answers
116 views

Authorization with MD5 imlemented in Javascript

I want to use MD5 function (JavaScript library) to hash password before send it to server during logging in to website and during registration proces. I want to ask is it a secure method? I can't ...
1
vote
1answer
553 views

What is the difference between claims, attributes, and roles?

Many questions have already been asked about Claims-based authentication and the differences with other approaches: Role-based vs Claims-based Explain claims-based authentication Now, my favorite ...
1
vote
1answer
81 views

What makes it difficult for Facebook to implement restriction/ACL for accessing uploaded photo? [closed]

Facebook claims to allow restrict sharing to friends, certain network, or even custom when I upload photos. But it appears that this security is only in effect for the page where the photo is ...
0
votes
2answers
106 views

Is sending authorizing links through e-mail a vulnerability?

I am not sure if my wording is right, but if I attach a unique token inside email links which will authorize the user if clicked, would you consider this a vulnerability? Password-reset partly ...
2
votes
2answers
99 views

RBAC and assertions, which authorization flow is better?

I'd like to ask which authorization flow is considered better or standard. First approach (has role AND assertion is valid): if (!isGranted(roles, permission) { return false; } if ...
0
votes
2answers
51 views

Should a user be able to change another user's role to match their own?

Lets say a web application has four user roles. Standard, Supervisor, Manager and Administrator. Should a manager be able to promote someone else to a Manager, or only to a supervisor? I realize in ...
1
vote
0answers
384 views

Simple Session Management Across Multiple Application Servers

How should I handle authentication for a simple iPhone chat app? Backend I'm building the backend using two application servers: Sinatra REST Server It lists users & old messages. Node.js ...
2
votes
1answer
227 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
1
vote
1answer
87 views

Protecting data on an embedded device

I am to release a system-on-chip device that, during its lifetime, will come to store sensitive data. I want to make that data hard to extract or duplicate. Encrypting is good for dealing with MiTM, ...
6
votes
1answer
311 views

What datastructure would/have you used to store ACLs within a hybrid ACL/RBAC system?

In our system, every resource has an access control list (ACLs), which list entries (ACEs) that have a specific kind of access to that resource. The ACE can be for end-entities (eg: users like "Mr Q") ...
0
votes
2answers
767 views

Look over my Web API Authentication Scheme

I want some advice on my Authorization/Authentication scheme that I will be using for my Web API that I am writing. Firstly the Authentication : 1) When a user first logs in and they are authorized, ...
0
votes
1answer
86 views

Service TO Service Authentication & authorization [duplicate]

I have two web services A and B the requests between those services is http. I want so establish a secure connection between service A and service B to ensure the authorized and authenticate request ...
11
votes
4answers
2k views

How secure is NOPASSWD in passwordless sudo mode?

On all our boxes we have ssh access via keys. All keys are password protected. At this moment the sudo mode is not passwordless. Because the number of VMs are growing in our setup, we investigate the ...
2
votes
0answers
60 views

Creating New Acc in Mac Mail 1st Connect to Server not SSL is uname & pw tx secure?

It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries ...
8
votes
2answers
2k views

Role Based Authorization vs. Claim Based Authorization

What is the difference between "role based authorization" and "claim based authorization"? Under which circumstances would it be appropriate to implement each of these authorization models?
3
votes
2answers
978 views

When do you use OpenID vs. OpenID Connect

Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context? The reason I ask is because I'm trying to implement the following: User ...
2
votes
1answer
116 views

Helping developers find logic and authorisation flaws

Professional penetration testers are usually good at finding all sorts of vulnerabilities, including logic flaws, that are highly-specific to the site being tested. However, being a manual activity, ...
8
votes
2answers
4k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
3
votes
1answer
797 views

What are the risks posed by “pass-through authentication” and how are they mitigated?

Related: Local Admin has Domain Admin rights "Pass-through authentication" on Windows systems allows for the possibility for user accounts with the same name and password to impersonate one ...
0
votes
1answer
104 views

Where to perform authorisation in a web app?

Most web apps perform authorisation checks at the controller layer. This is basically ok, but complex apps tend to have repetitive checks. For example, there might be ten or so controller actions that ...
1
vote
1answer
196 views

How to write an authentication module for my website?

This will sound naive for sure, and it is. Being a recent college graduate, I have been wondering on how do average websites implement their authentication modules. I have been using a table storing ...
1
vote
2answers
239 views

Authorization in offline application

I'm working on a machine which needs to store usernames and passwords for the various operators, technicians, and engineers that may be using and configuring it. It is important that some functions be ...
5
votes
2answers
2k views

Best way to allow sudo access when using ssh keys

Probably a simple question, but I can't seem to find any actual best practices out there. I manage a handful of servers and I am really getting sick of tracking my passwords in pwsafe. I've been ...
-1
votes
1answer
95 views

Is my invitation based file access authorization scheme worthwhile?

I need to allow users to upload files with sensitive data to a server, then invite other authenticated users to access specific files. This is my proposed solution: Each user will have his own ...