SSL OAuth JWT OpenID Odata GraphQL gRPC GoogleWorkspace - sgml/signature GitHub Wiki

XML Security

Vendor Non-OAuth Specifications Supported Key Focus Documentation Reference
SiteMinder SAML 2.0, WS-Federation, Proprietary policy overlays Legacy enterprise-grade SSO & policy enforcement SiteMinder Implementation (Broadcom)
Ping Identity SAML 2.0, WS-Federation (via PingFederate) Cloud-ready federated SSO PingFederate Documentation
WSO2 SAML 2.0, WS-Federation, WS-Security, WS-Policy Open source, comprehensive identity management WSO2 Identity Server Documentation
CyberSafe Kerberos (MIT Kerberos-based, KDC integration, Active Directory support) Enterprise authentication solutions based on Kerberos CyberSafe Kerberos
Axiomatics XACML, Policy-based Access Control Fine-grained authorization and enterprise policy management using XACML Axiomatics XACML Reference

Oauth Flows

OAuth Type Spec Section / Grant Type Expected Redirect Count Maximum Redirects (Poor Implementation)
Two-legged OAuth Client Credentials Grant (RFC 6749, Section 4.4) 0 0
Three-legged OAuth Authorization Code Grant (RFC 6749, Section 4.1) 2* ∞ (if a redirect loop is not properly terminated)
Four-legged OAuth Extended delegation flow (non-standard, legacy term) 3* ∞ (if chained redirects are abused)
Token Exchange (RFC 8693) OAuth 2.0 Token Exchange (RFC 8693) 0 ∞ (if misconfigured redirects lead to loops)

Objections

Lack of granularity

Authorization Code

"While the Authorization Code Grant Flow is designed to improve upon less secure methods by keeping tokens off the front channel, its reliance on multiple redirections and the client-supplied 'state' parameter introduces real implementation challenges. In practice, weak enforcement of redirect URI validation and the absence of PKCE in older implementations have allowed attackers to exploit this complexity."

— OAuth 2.0 Security Best Current Practice (IETF OAuth Working Group)
OAuth 2.0 Security Best Current Practice Draft

"The theoretical strengths of the Authorization Code Grant Flow come at the cost of increased complexity; if the redirection endpoints and state parameters are not rigorously validated, the flow becomes susceptible to redirect manipulation and CSRF attacks. This has led many in the security community to caution that proper implementation is not optional, but absolutely critical."

— OAuth.com Editorial, discussing common pitfalls in OAuth implementations
OAuth 2.0 Authorization Code Grant – OAuth.com

Client Credentials

"One of the primary challenges with the Client Credentials Grant flow is its singular reliance on the client's own credentials, making it highly vulnerable if these credentials are leaked. Without any end-user context, a leaked client secret can enable an attacker to impersonate the application indefinitely, leading to unauthorized access that may persist until the credentials are explicitly rotated."

— Microsoft Identity Platform
OAuth 2.0 Client Credentials Grant Flow

"The Client Credentials Grant flow, while ideal for machine-to-machine communication, suffers from a lack of fine-grained access control because it never involves an end-user. This absence of user consent means that once an application is authorized, it gains broad access rights, which can be problematic if permissions are not tightly enforced."

— OAuth.com Editorial
OAuth 2.0 Client Credentials Grant Overview

Oauth 1.0a/b

Provider OAuth Version Supported Reference URL
Etsy OAuth 1.0 (implemented as OAuth 1.0a/1.0b) Etsy Developer Documentation
Flickr OAuth 1.0 (typically known as OAuth 1.0a, incorporating 1.0b fixes) Flickr API Documentation
Twitter OAuth 1.0a (which reflects the OAuth 1.0b revisions) Twitter OAuth 1.0a Documentation
Tumblr OAuth 1.0 (commonly referred to as OAuth 1.0a/1.0b) Tumblr API Documentation
MySpace OAuth 1.0 (historically supported via OAuth 1.0a/1.0b) MySpace API Archive (historical reference)
Netflix OAuth 1.0 (historically implemented as OAuth 1.0a, reflecting 1.0b fixes) Netflix API Archives (historical reference)
OpenStreetMap OAuth 1.0 (using OAuth 1.0a mechanisms, reflective of OAuth 1.0b improvements) OpenStreetMap API Wiki

Notes:

  • Two-legged OAuth (Client Credentials Grant) involves direct client-to-server communication without user redirection.
  • Three-legged OAuth (Authorization Code Grant) employs a redirection cycle to obtain user consent, typically resulting in two redirects.
  • Four-legged OAuth is a legacy or extended term implying one extra redirection beyond the standard three-legged flow.
  • Token Exchange (RFC 8693) is designed for direct, server-to-server token exchanges without redirection. However, if a poor implementation erroneously introduces redirection loops, it could theoretically allow an infinite number of redirects.

The asterisks next to the expected redirect counts for three- and four-legged OAuth indicate that these values represent typical scenarios rather than strict limits set by the specification.

openssl

Chrome SSL Flags

chrome://flags/#allow-insecure-localhost

Chrome Secure Cookie Implementation

Architecture

Auth Headers

Porting

JWT Best Practices

Keycloak

Polyglot

Request Flows

Oauth 1.0A

OAuth 2.0

Pairing

Reverse Proxy

Traefik: https://www.codementor.io/@slavko/traefik-as-an-alternative-reverse-proxy-to-nginx-for-self-hosted-dockerized-applications-bm5tpcsmj

References

Google WorkSpace Marketplace

Google APIs

Billing

PowerBI

  1. https://www.cloudfronts.com/salesforce-object-connecting-inside-powerbi/
  2. http://blog.pragmaticworks.com/tales-from-sales-hurdles-with-salesforce-connectors-in-power-bi
  3. http://community.powerbi.com/t5/Integrations-with-Files-and/Power-Bi-Integration-with-Custom-Salesforce-Objects-Not-Reports/m-p/289454#M13653
  4. https://docs.microsoft.com/en-us/power-bi/service-connect-to-salesforce
  5. https://powerbi.microsoft.com/en-us/blog/embedding-a-power-bi-report-into-salesforce/
  6. http://angryanalyticsblog.azurewebsites.net/index.php/2016/05/16/api-strategies-with-power-bi/
  7. https://chris.koester.io/index.php/2015/07/16/get-data-from-twitter-api-with-power-query/
  8. http://www.excelandpowerbi.com/?p=86
  9. https://jessedotnet.com/2016/06/24/power-bi-connect-to-your-secure-api/
  10. https://blogs.msdn.microsoft.com/iwilliams/2016/08/31/partner-center-api-and-power-bi/
  11. https://blog.kloud.com.au/2015/06/24/use-excel-powerquery-and-yahoo-finance-to-manage-your-portfolio/
  12. https://whitepages.unlimitedviz.com/2017/01/analyzing-wordpress-site-power-bi-google-analytics/
  13. https://www.kasperonbi.com/getting-data-into-power-query-with-the-twitter-search-api-how-to-hack-pq-to-use-oauth/
  14. https://community.powerbi.com/t5/Desktop/Issue-with-getting-data-via-API-with-bearer-token/td-p/126232
  15. https://github.com/Microsoft/DataConnectors/blob/master/samples/Github/README.md
  16. https://docs.opendatasoft.com/api/explore/odata.html#converting-an-authorization-grant-to-a-bearer-token
  17. https://www.thebiccountant.com/2017/09/24/custom-connector-import-google-sheets-oauth2-powerbi/
  18. https://digitalborn.org/post-requests-excel-power-bi/
  19. https://prathy.com/2017/09/calling-power-bi-api-using-power-bi-desktop-to-document-power-bi-service/
  20. https://stackapps.com/apps/oauth/view/12623
  21. https://planningcenter.github.io/api-docs/#personal-access-token
  22. https://blog.crossjoin.co.uk/2017/10/15/exploring-the-new-ssrs-2017-api-in-power-bi/
  23. https://stackoverflow.com/questions/33225590/
  24. https://docs.microsoft.com/en-us/power-bi/desktop-connect-odata

Office 365

  1. https://docs.microsoft.com/en-us/previous-versions/office/office-365-api/api/version-2.0/extensions-rest-operations
  2. https://support.office.com/en-us/article/access-odata-feeds-from-power-query-82bd48b9-6a2f-4f2a-83c9-6868ba1d30e2
  3. https://www.microsoft.com/en-us/microsoft-365/blog/2015/05/08/11-updates-to-power-query/
  4. https://support.office.com/en-us/article/import-data-from-external-data-sources-power-query-be4330b3-5356-486c-a168-b68e9e616f5a

Flows

OIDC

Browser Tooling

Comparisons