Category Archives: IdentityServer

Annual Identity Update on DotNetRocks

Posted on April 16, 2013 by Dominick Baier

It’s this time of the year again! http://www.dotnetrocks.com/default.aspx?ShowNum=863 “Dominick Baier returns to talk to Carl and Richard about the current state of security in .NET 4.5. Dom starts out talking about how WebAPI has impacted the development of web services … Continue reading →

Posted in .NET Security, ASP.NET, Azure, IdentityModel, IdentityServer, OAuth, WCF, WebAPI | 1 Comment

Authentication vs Authorization

Posted on April 16, 2013 by Dominick Baier

…in the context of token-based security systems. There are many practical and philosophical ways to discuss the difference between the two terms. But since there is quite some confusion, I want to look at it from the perspective of the … Continue reading →

Posted in .NET Security, IdentityModel, IdentityServer, OAuth, WebAPI | 2 Comments

Getting JSON web tokens (JWTs) from ADFS via Thinktecture IdentityServer’s ADFS Integration

Posted on April 15, 2013 by Dominick Baier

Originally posted on brockallen:
Dominick and I recently added three features to IdentityServer that collectively we call “ADFS Integration”. This “ADFS Integration” is a new protocol (which can be enabled, disabled and configured like any other protocol IdentityServer supports). In…

Posted in IdentityModel, IdentityServer, OAuth, Uncategorized, WebAPI | Leave a comment

Going to NDC? Get two extra Days of Identity and Access Control!

Posted on April 10, 2013 by Dominick Baier

Claims, WS-Federation, WS-Trust, WS-Security, ASP.NET, Federation, Single Sign-On, Home Realm Discovery, WCF, SAML, JWT, Web API, OAuth2, Thinktecture IdentityServer & IdentityModel, ADFS, Windows Azure Active Directory & Access Control… Do the above terms sound interesting? Then join me for a … Continue reading →

Posted in Azure, IdentityModel, IdentityServer, OAuth, WCF, WebAPI | 2 Comments

IdentityServer and the Microsoft JWT Token Handler

Posted on April 8, 2013 by Dominick Baier

Just a heads up – in the next drop of IdentityServer we will be switching to Microsoft’s JWT token handler. This adds support for X.509 based signatures and JWT over WS*. On github there’s a branch called “Microsoft-JWT”, if you … Continue reading →

Posted in IdentityServer, OAuth, WebAPI | Leave a comment

Common OAuth2 Vulnerabilities and Mitigation Techniques

Posted on March 15, 2013 by Dominick Baier

In the last post I described some of the general problems with OAuth2 and its implementations. In this post I want to go into more detail and show some necessary hardening steps. We did our best (well as much as … Continue reading →

Posted in IdentityModel, IdentityServer, OAuth, WebAPI | 4 Comments

OAuth2 Security

Posted on March 15, 2013 by Dominick Baier

Right now there are many good “discussions” on OAuth2 security happening. Some are constructive, some rather destructive – and some simply hack one or the other website to prove the point. In my opinion there are a number of reason … Continue reading →

Posted in IdentityModel, IdentityServer, OAuth, WebAPI | 11 Comments

Introducing OAuth2 Code Flow and Refresh Token Support in Thinktecture IdentityServer

Posted on March 15, 2013 by Dominick Baier

We recently merged OAuth2 code flow and refresh token support into the main branch on Github. Please give it a try and tell us if it is working for you or not. After that feedback phase I will release v2.2 … Continue reading →

Posted in ASP.NET, IdentityModel, IdentityServer, OAuth, WebAPI | 17 Comments

Federating IdentityServer with Windows Azure Active Directory

Posted on February 24, 2013 by Dominick Baier

Vittorio describes here in great detail how to provision a WAAD tenant as an identity provider in an ACS namespace. Since we are all using the same technology under the bonnet, this should also work with IdentityServer – and it … Continue reading →

Posted in Azure, IdentityServer | 12 Comments

Claims-based Identity & Access Control Pre-Conference Workshop at NDC 2013

Posted on February 13, 2013 by Dominick Baier

This is great news! If you are going to NDC, you can take my identity & access control training as a pre-conference workshop. I have divided the content in a “web apps” day and a “services & the cloud” day. This … Continue reading →

Posted in .NET Security, ASP.NET, Azure, Conferences & Training, IdentityModel, IdentityServer, OAuth, WCF, WebAPI | Leave a comment