Category Archives: IdentityServer

Customizing IdentityServer

Posted on May 17, 2013 by

IdentityServer was designed with extensibility in mind. And since the question how to do that comes up quite frequently, here’s a overview to get you started. Certain parts of IdSrv that we thought might need to be extended or customized … Continue reading →

Posted in IdentityServer | Leave a comment

Web API Security: JSON Web Token/OAuth2 with Thinktecture.IdentityModel AuthenticationHandler

Posted on April 29, 2013 by

(OK – I only included OAuth2 in the title to get your attention – this applies to whatever framework or technology you use to work with JSON web tokens aka JWTs) Following the pattern from my two previous posts, you … Continue reading →

Posted in .NET Security, IdentityModel, IdentityServer, OAuth, WebAPI | 1 Comment

Annual Identity Update on DotNetRocks

Posted on April 16, 2013 by

It’s this time of the year again! http://www.dotnetrocks.com/default.aspx?ShowNum=863 “Dominick Baier returns to talk to Carl and Richard about the current state of security in .NET 4.5. Dom starts out talking about how WebAPI has impacted the development of web services … Continue reading →

Posted in .NET Security, ASP.NET, Azure, IdentityModel, IdentityServer, OAuth, WCF, WebAPI | 1 Comment

Authentication vs Authorization

Posted on April 16, 2013 by

…in the context of token-based security systems. There are many practical and philosophical ways to discuss the difference between the two terms. But since there is quite some confusion, I want to look at it from the perspective of the … Continue reading →

Posted in .NET Security, IdentityModel, IdentityServer, OAuth, WebAPI | 2 Comments

Getting JSON web tokens (JWTs) from ADFS via Thinktecture IdentityServer's ADFS Integration

Posted on April 15, 2013 by

Reblogged from brockallen: Dominick and I recently added three features to IdentityServer that collectively we call “ADFS Integration”. This “ADFS Integration” is a new protocol (which can be enabled, disabled and configured like any other protocol IdentityServer supports). In short … Continue reading →

Posted in IdentityModel, IdentityServer, OAuth, Uncategorized, WebAPI | Leave a comment

Going to NDC? Get two extra Days of Identity and Access Control!

Posted on April 10, 2013 by

Claims, WS-Federation, WS-Trust, WS-Security, ASP.NET, Federation, Single Sign-On, Home Realm Discovery, WCF, SAML, JWT, Web API, OAuth2, Thinktecture IdentityServer & IdentityModel, ADFS, Windows Azure Active Directory & Access Control… Do the above terms sound interesting? Then join me for a … Continue reading →

Posted in Azure, IdentityModel, IdentityServer, OAuth, WCF, WebAPI | 2 Comments

IdentityServer and the Microsoft JWT Token Handler

Posted on April 8, 2013 by

Just a heads up – in the next drop of IdentityServer we will be switching to Microsoft’s JWT token handler. This adds support for X.509 based signatures and JWT over WS*. On github there’s a branch called “Microsoft-JWT”, if you … Continue reading →

Posted in IdentityServer, OAuth, WebAPI | Leave a comment

Common OAuth2 Vulnerabilities and Mitigation Techniques

Posted on March 15, 2013 by

In the last post I described some of the general problems with OAuth2 and its implementations. In this post I want to go into more detail and show some necessary hardening steps. We did our best (well as much as … Continue reading →

Posted in IdentityModel, IdentityServer, OAuth, WebAPI | Leave a comment

OAuth2 Security

Posted on March 15, 2013 by

Right now there are many good “discussions” on OAuth2 security happening. Some are constructive, some rather destructive – and some simply hack one or the other website to prove the point. In my opinion there are a number of reason … Continue reading →

Posted in IdentityModel, IdentityServer, OAuth, WebAPI | 4 Comments

Introducing OAuth2 Code Flow and Refresh Token Support in Thinktecture IdentityServer

Posted on March 15, 2013 by

We recently merged OAuth2 code flow and refresh token support into the main branch on Github. Please give it a try and tell us if it is working for you or not. After that feedback phase I will release v2.2 … Continue reading →

Posted in ASP.NET, IdentityModel, IdentityServer, OAuth, WebAPI | 12 Comments