1
vote
3answers
276 views

Should WS-Fed, Mozilla's Persona or OpenID ever be used with a Banking application?

Most banking sites I've seen use a sign in process that is proprietary, or otherwise won't integrate with an external IDP. Should banks offer integration with services like OpenID, WS-Fed, or ...
7
votes
2answers
451 views

How does external authentication work?

For example, I can log in to stackexchange websites by logging in to external websites such as OpenID, Yahoo, etc. How does this work? How do the websites (SE and Yahoo!, for example) communicate? How ...
5
votes
2answers
676 views

Storing third-party auth info securely

Suppose there's a multi-user web application that requires access to user's mailbox (on third-party service, like gmail, etc.). This access needs to be persistent. Which means we'd have to store user ...
2
votes
2answers
199 views

How does LiveID work? Is there any documentation on the LiveID provisioning site msm.live.com?

I'm trying to learn details on how LiveID works, when compared to other federation technologies. To be honest, I'm a bit overwhelmed by all the options at https://msm.live.com/ and want to understand ...
3
votes
3answers
2k views

What is the exact difference between SAMLp and WS-Trust?

They seem to be similar on the surface, but I'm not sure how deep the differences are. Can someone explain to me the difference between SAMLp and WS-Trust? ADFSv2 gives me a choice between these ...
0
votes
1answer
618 views

How can I decrypt ADFS-based SAML/p or WS-Trust claims?

I'd like to audit the claims that are sent to a client from a SAML/p or WS-Trust authentication. What private keys do I need and how would I decrypt this information? If it makes any difference, I'm ...
22
votes
4answers
567 views

How does using OpenID affect webapp security?

Using OpenID for authenticating users grows in popularity and, in fact, makes a webapp easier to use. But what are the security considerations one should bear in mind when deciding whether to ...