The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
2answers
39 views

Uploading pfx certificate to Azure

In order to use SSL with a custom domain in Azure Websites you must upload a pfx file with your certificate and private key to Azure. What are the ramifications of trusting Azure with the private ...
1
vote
1answer
35 views

Securing an OAuth / OpenID Connect identity in a cookie for easy login

I have a website that uses Azure Active Directory or Google+ for logging in. I go through an OAuth2 login flow, and the users email along with their tokens are returned to me by their identity ...
1
vote
1answer
67 views

Secure Azure to Data Centre Web Service Calls via Trusted IP?

Background The company I work for have a system with some data. This system's hosted in our private data centre. This system provides some ReST web services. We're looking to create a website, hosted ...
2
votes
0answers
161 views

Intrusion prevention in windows azure?

When using the Windows Azure IAAS servers how does one setup IPS for all incoming traffic to these servers? How would a regular user who runs his whole environment within Azure make sure that he can ...
1
vote
2answers
618 views

Best way to set up SSL certificates for consuming web service from Azure

I need to purchase and install the correct Verisgin SSL certificate(s) (X.509) on Azure. I have never done this before and would really appreciate some advice on how to go about it and what is ...
1
vote
1answer
304 views

How does the authentication flow with Azure Active Directory differ from Azure ACS?

I understand that Azure ACS acted as a STS that had the ability to redirect users to a given STS (OpenID, LiveID, Facebook) or authenticate using a local user/password account. In a passive situation ...
2
votes
0answers
168 views

Implementing ACS with REST + many Identity Providers - Problems - Azure

I am trying to integrate ACS to use in my application's authentication system. Currently I have a Javascript client and a WCF so I had to use a REST architecture. I am quite puzzled on how to do ...
8
votes
4answers
3k views

How do the STS token formats compare to each other SAML vs SWT vs JWT?

I'm configuring an Azure ACS STS and would like to know if there is any impact on security based on the following token formats or how they are used. The answers to this questions should apply to ...
7
votes
2answers
733 views

What information is exposed by simply opening an RDP connection to the internet?

Microsoft, Rackspace and other hosted providers allows people to RDP into that server. Here are a few examples: Microsoft has something called "Azure Connect" it is very easy to expose a domain ...
1
vote
1answer
279 views

What risk can untrusted WS-Federation metadata pose?

I'm adding support for SAML/ADFS/Azure ACS and read that untrusted metadata poses a risk. Considering that ADFS does background refreshes of the metadata, as do some RPs, can someone explain the ...
7
votes
5answers
2k views

Should one sign and encrypt using the same key? The Azure Training Labs are taking this approach

I'm taking the Azure lab LoadBalancing with WCF and recognise what I have been told is bad from a security perspective, but am not sure if it applies here. Can someone look at this code and tell me ...
5
votes
2answers
687 views

What is more secure: Many subdirectories, or many subdomains?

I have 3 websites that could be configured as a "VirtualApplication" in servicedefinition.csdef: www.mydomain.net/enroll www.mydomain.net/admin www.mydomain.net/ ... or I can configure them as a ...