172 reputation
8
bio website mylifewithjava.blogspot.no
location
age
visits member for 1 year, 8 months
seen Sep 26 at 7:13

I mainly work with Java development but also does a lot of work with SAML, OpenAM and OpenSAML.

Need help with SAML? Ask me a question on the blogg. http://mylifewithjava.blogspot.no If you're new to SAML and OpenSAML have a look at my book on the subject. http://mylifewithjava.blogspot.co.uk/p/gumroad.html


Sep
24
awarded  Autobiographer
Sep
13
awarded  Curious
Sep
12
asked OAuth - Why exchange the authcode for a token
May
5
accepted SAML and OpenID, centralized and decentralized
May
5
comment SAML and OpenID, centralized and decentralized
But how can I not care about the authentication in OpenID? I Im going to use the authenticated user in my system I must be able to trust that the OpenID provider authenticates the user correctly. Dont I?
May
5
awarded  Commentator
May
5
comment SAML and OpenID, centralized and decentralized
You say that you dont have a trust relationship with openid providers. Isn't accepting whatever it tells you a typical trust?
May
5
comment SAML and OpenID, centralized and decentralized
Ok, it seams like typically is the keyword here. Bacause with SAML you can have multiple and with OpenID you can choose to trust only one.
May
5
awarded  Custodian
May
5
reviewed Approve suggested edit on SAML and OpenID, centralized and decentralized
May
5
asked SAML and OpenID, centralized and decentralized
Apr
8
answered Should every SAML identity provider provide a unique public certificate to the service provider?
Apr
3
accepted SAML for transporting authorization information
Apr
3
comment SAML for transporting authorization information
We control both system. We will not have any fin grained access controll for the communication between the systems. What we want is to give the authenticating system the user and its assosiated roles on singing. The authenticating system will handle access managemeng internaly based on this. Sounds like SAML without XACML is a good fit
Apr
3
asked SAML for transporting authorization information
Dec
15
asked Application security architecture framework
Nov
20
comment The need for created timestamp in tokens
It seems lik a non standard way of ensuring uniqueness. Do you think the point of the created date is for uniqueness? One could also just use the exiration timestamp
Nov
18
asked The need for created timestamp in tokens
Sep
19
answered In a SAML2 FSSO Web Browser profile (HTTP POST), should the IdP analyse the AuthnRequest before asking the user to authenticate?
Sep
13
awarded  Teacher