The OAuth2 specification says: The interaction between the authorization server and resource server is beyond the scope of this specification. The authorization server may be the same server ...
I'm seeking advice on how we may be able to implement authentication and authorization for multitenancy with slightly different number of scenarios. We are building a set of API's which of some are ...
I have a bunch of applications, where users need to log in. Not everyone can be a user, each user has to be approved of by an admin. The authentication should be a SSO solution, where user accounts ...
On a system that I'm working on a user signs up by means of an OpenID/Social Media account (Twitter, Google, Facebook), and then subsequently signs in using that path. The System comprises of a ...
I have some security concerns about the first step of account authentication in my application. The authentication goes through an OpenID provider. If the response of such provider shows that the ...
I have asked the same question on Server Fault but it possibly fits in better with the IS forum. The system I'm working on will have a mobile application, a web portal and an HTTP-based API. The ...