background preloader

Security

Facebook Twitter

Enterprise Architecture

Consortium - How Shibboleth Works. At its core Shibboleth works the same as every other web-based Single Sign-on (SSO) system. What distinguishes Shibboleth from other products in this field is its adherence to standards and its ability to provide SSO support to services outside of a user's organization while still protecting their privacy. The main elements of a web-based SSO system are: Web Browser - represents the user within the SSO process Resource - contains restricted access content that the user wants Identity Provider (IdP) - authenticates the user Service Provider (SP) - performs the SSO process for the resource Single Sign-on Steps Step 1: User accesses the Resource The user starts by attempting to access the protected resource.

The resource monitor determines if the user has an active session and, discovering that they do not, directs them to the service provider in order to start the SSO process. Step 2: Service Provider issues Authentication Request Step 3: User Authenticated at Identity Provider. Windows Identity Foundation Now Included in .NET 4.5.

Okta: Secure Identity Management and Single Sign-on.

SAML

CVE security vulnerability database. Security vulnerabilities, exploits, references and more. IT Security Database. OVAL patch, vulnerability, compliance definitions data source. This site collects OVAL(Open Vulnerability and Assessment Language) definitions from several sources like Mitre, Red Hat, Suse, NVD, Apache etc and provides a unified, easy to use web interface to all IT security related items including patches, vulnerabilities and compliance checklists.

You can view full details of oval definitions, which is not possible at any other public web site. Other similar web sites just display comments about the definitions but here you can view exactly what you should look for to verify a vulnerability or a patch. Without itsecdb.com it is almost impossible to view details of an OVAL definition without getting lost in several xml files, definition documentation, xml schemas etc. itsecdb is fully integrated to www.cvedetails.com so you can easily navigate between CVE, product and oval definition details. Most of the definitions, whenever cpe or vulnerability mappings are possible, are mapped to products defined by cvedetails.com to increase usability.