Auth - atabegruslan/Notes GitHub Wiki

Authentication and Authorization

  • Authentication: Who you are
  • Authorization: What you can do

Ways

Good readings:

Basic Auth

Providing username and password for each and every request you make

'Authorization: Basic '. base64_encode("user:password")

Good:

  • Widely recognized
  • Works through proxies Bad:
  • Not encrypted (though alleviated by HTTPS)
  • Every request is a potential victim to password thieves

Good articles:

Securely in cURL

Securely in PowerShell

Digest Auth

2 rounds:

  1. Client sends a 'probe', without credentials, server returns some info
  2. Client sends a second request, including username, password and the above returned info. They are all MD5 hashed.

Good articles:

SCRAM

Sessions (& cookies)

Tokens

Stateful vs Stateless

OAuth2

Used when your app needs to access data from another platform (eg: your user's google info).

OAuth2 is used for authorization (at least originally)

Grant (or flow) types

Types:

Good tutorials:

SSO

It is an identity layer on top of authorization.
It uses a JWT identity token.

OpenID Connect (OIDC)

OIDC is build on top of OAuth2.
It utilizes an Identity Token (JWT).
Google uses this.
OpenID 2.0 is now obsolete. They achieve the same goal, but are technically different.
Originally OAuth2 was made for Authorization. But when you SignIn with a Social Media platform (eg: SignIn with Google or Facebook), that is actually Authentication. Different platforms uses different scope names (eg: "family_name" vs "surname", "first_name" vs "given_name", etc). This non-standardization isn't good. So OIDC standardizes this by introducing an new scope name called "openId", which can be used whenever identity needs to be obtained while using OAuth2.
What differs from OAuth2 is mainly: The scope includes an extra "openId", and an ID Token (JWT) is returned on top of the Access Token.

Facebook Connect

https://stackoverflow.com/questions/1827997/is-facebook-an-openid-provider/1828333#1828333

Microsoft Account (formerly known as Passport)

https://en.wikipedia.org/wiki/Microsoft_account#Support_for_OpenID

Security Assertion Markup Language (SAML)

Okta, Auth0 and OneLogin uses this.

JWT

Problems of Session:

  • Problematic when there are multiple servers behind the load balancer, because not every server knows the user by session ID.
  • Can't use sticky session. Unscalable and have microservices problems.

The insides of JWT:

Best to put the JWT into an HTTP-only cookie or the Authorization header.

API KEY

For an client app, instead of a user's credentials.

Can be used against DDoS attacks, because with API Keys, you can set a visit-frequency max limit.

SSH

SSH's inner workings: https://github.com/atabegruslan/Notes/wiki/Security#ssh

When SSH-ing into server without password, the server admin need to add your computer's SSH key into the server's /root/.ssh/authorized_keys

One benefit of tokens over SSH keys: while tokens and SSH keys both share the Unique, Revocable, and Random benefits quoted in the blog post below, tokens are also limited in comparison to SSH keys in that they come with their own scoped permissions.

While SSH keys can be read-only or read-write enabled, or scoped to specific repositories, personal access tokens do have an edge in terms of their finer-grained permissions model in comparison. This is likely why GitHub recommends tokens over SSH keys.

https://stackoverflow.com/questions/67077837/in-what-ways-is-an-ssh-key-different-from-tokens-for-git-authentication

Difference between ~/.ssh/id_ed12345, ~/.ssh/id_ed12345.pub & ~/.ssh/known_hosts/ to PEM: https://stackoverflow.com/questions/17670446/what-is-the-difference-between-various-keys-in-public-key-encryption/17674179#17674179

SSH (Secure Shell) is a tool for secure system administration, file transfers, and other communication across the Internet or other untrusted network. It encrypts identities, passwords, and transmitted data so that they cannot be eavesdropped and stolen. OpenSSH is an open-source implementation of the SSH protocol.

SSH is a protocol. OpenSSH is a software tool.
https://www.ssh.com/academy/ssh/openssh

LDAP

https://www.youtube.com/watch?v=QyhNaY5O468

What is the difference between SSO and LDAP? SSO is a convenient authentication method that allows users to access multiple applications and systems using just one login. LDAP is the protocol or communication process that will enable users to access a network resource through a directory service.

https://www.strongdm.com/blog/saml-vs-ldap

SSO is a method of authentication in which a user has access to many systems with a single login, whereas LDAP is a method of authentication in which the protocol is authenticated by utilizing an application that assists in obtaining information from the server.

LDAP a modification of an x500, which is a complicated enterprise directory system.

https://cloudinfrastructureservices.co.uk/ldap-vs-sso/

MS AD uses LDAP

https://cloudinfrastructureservices.co.uk/ldap-vs-active-directory

AD FS

A feature of the Windows Server OS that extends users' SSO to beyond its corporate firewall.

https://www.techtarget.com/searchmobilecomputing/definition/Active-Directory-Federation-Services-AD-Federation-Services

RADIUS

Other related things

Password Reset

Remember Me

Just set the expiry time of the cookie long into the future

MFA

Below is a way

Captcha

Question & Answer challenge

"Not a Robot" challenge

OTP