26 articles tagged Authorization.
This post continues where “SECURELY USING THE OIDC AUTHORIZATION CODE FLOW AND A PUBLIC CLIENT WITH SINGLE PAGE APPLICATIONS” left off on the topic of securing Single Page Applications (SPAs). That post describes an architecture where the SPA running in the browser (User Agent)is acting as the…
Read article: More Single Page Application (SPA) and OAuth2 ThoughtsThis post contains links to all the articles about authorization that I have written.
Read article: Authorization SeriesThis blog post was originally published as “SECURELY USING THE OIDC AUTHORIZATION CODE FLOW AND A PUBLIC CLIENT WITH SINGLE PAGE APPLICATIONS” on the Ping Identity blog.
Read article: SECURELY USING THE OIDC AUTHORIZATION CODE FLOW AND A PUBLIC CLIENT WITH SINGLE PAGE APPLICATIONSEarlier this year, I was working on a project that was using AWS Cognito (as the identity stack) and the AWS API Gateway (as the front-door to all of the API calls). AWS Cognito is a relatively new player in the identity space. It doesn’t support the full OAuth2 or OpenID Connect specs, but, does…
Read article: OpenID Connect Authorization Code Flow with AWS CognitoI was working with a developer not so long ago and it was explained to me that a caching layer had been added to a services layer (API Provider) to make the authorization (Fine Grained Authorization, FGA) decision more efficient for subsequent API calls. In particular, the cache contains data…
Read article: Authorization Decision Input ParametersAt some point in the finite past, I had the good fortune to become involved in a project that was essentially completely greenfield. An unnamed company, in an unnamed industry decided to try something new. In a page right out of “The Innovator’s dilemma”, they spun up a new, separate organization,…
Read article: The Many Ways of Approaching Identity ArchitectureThis post demonstrates the OAuth2 Implicit Grant with 3Scale SaaS, APICast Gateway, and Red Hat SSO v7.1. In the last post, we introduced these components and demonstrated a functioning OAuth2 Authorization Code Grant (and OpenID Connect Authorization Code Flow). This is all part of my 3Scale API…
Read article: OAuth2 Implicit Grant with 3Scale and Red Hat SSOThis post continues our exploration of OAuth2 Authorization Grants with Red Hat SSO v7.1. In previous posts, we looked at:
Read article: Red Hat SSO v7.1 OAuth2 Client Credentials GrantIn my last post, we looked at how to configure Red Hat SSO v7.1 for OpenID Connect. That post also introduced a web-based OAuth2 + OIDC debugger and the OIDC Authorization Code Authentication Flow. The Red Hat SSO configuration that was created in that post also allows the OAuth2 Implicit Grant to…
Read article: OAuth2 Implicit Grant with Red Hat SSO v7.1In a previous post, I gave a definition of Authentication. In this post, we’re going to explore authorization, which is typically the next step in the processing pipeline after authentication. The concepts described here can apply equally to traditional web applications, SPA apps, mobile apps,…
Read article: What is Authorization?
