Posts

SAML Vs JWT

Image
  What is the difference between SAML and JWT ? SAML : SAML  is older format and is based on XML.  Security Assertion Markup Language  is an open standard for exchanging authentication and authorization data between Identity Provider and Security Provider. Identity provider authenticates user and provides to Service Provider if authentication assertion is successful where Service provider relies on the Identity provider to Authenticate users. There are some use-cases where SAML being used like access to application from a portal, Enterprise SSO, Centralized Identity Store etc.   JWT : JWT  is based on json. It is used with the new authorization protocol like OpenId Connect and Oauth 2.0.  Json Web Token  is a ID token Based on JSON to pass user information as a Header, Payload and Signature Structure. There are some use-cases where JWT being used like Permanent or temporary access of resources and Mobile uses cases.

Digital Signature Vs Digital Certificate

Image
  Digital Signature: Digital Signature is used to verify authenticity, integrity, non-repudiation. Digital signature contains signing algorithm and signature verification algorithm.  Signing algorithm follows below steps: Create hash of the electronic data. Encrypts the hash value using the private key.  The encrypted hash along with the hashing algorithm is the digital signature. Signature verification steps: Verifier receives Digital Signature along with the data. It applies Public key (verification algorithm) on digital signature and generate some values.  It applies same hash function on the received data and generate hash. It then compares hash values and output of the verification algorithm.  If both are equals then digital signature is valid. Digital Certificate: Digital Certificate is used to verify the identity of the user, maybe sender or receiver. Digital Certificate contains name of certificate holder, Serial number which is used to uniquely identify a certificate, expirati

AWS Certified Solutions Architect

Basic of the exam: 65 question and 130 Minutes . Question is based on scenario. 1 correct answer of 4 choices and 2 correct answer of 5 choices. There is no indication what is the point of each question. There should be 720 points to pass exam. There is no indication of difficulty level. There are 3 passes, Easy question, Complex questions and unknowns. There is no negative marking of the exam. Exam guide: Hands on experience using compute, networking, storage and database aws services. Hands on experience of AWS deployment and management services. Ability to identify and define technical requirements  An understanding of network technologies as they relate to AWS. Learn the basics of ipv4 and the 7 layer model. Then apply this knowledge to networking services in AWS. An understanding of security features and tools that AWS provides and how they relate to traditional services.  Availability zone, region and edge server knowledge you should have. Well architectu

Initialization Vector

Encryption work by taking a number of text blocks and then applies a key to these to produce cipher .blocks. Cipher blocks could end up being the same for the same input text. Thus an intruder could try and guess the cipher text. This is knows as electronic code book.You will find that every time you encrypt, you will find that every time you encrypt you will get the same value. Apart from using a password to generate an encryption key, which complete decimates the key space, we have the problem of the algorithm used to process the plain text. If this is ECB then we have repeating cipher blocks for the same plain text. If I take "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" and encrypt with 3-DES and a key of "beginner12345" we get: encrypted: DDE22EE186FA0425 DDE22EE186FA0425 DDE22EE186FA0425 DDE22EE186FA0425 DDE22EE186FA0425 DDE22EE186FA0425 DDE22EE186FA0425 B2460B702A2508AE Where we can see that the "a...a" values are always code

Introduction to Docker

Docker provides, Package Once Deploy Anywhere, or PODA. Docker Concepts: Docker simplifies software delivery of distributed applications in three ways: Build: Provides tools to create containerized applications. Developer package the application, its dependencies and infrastructure as read only templates. These are called the Docker image. Ship: Allows to share these applications in a secure and collaborative manner. Docker images are stored, shared and manged in a Docker registry. Docker Hub is a publicly available registry. This is the default registry for all images. Run: The ability to deploy,manage and scale these applications. Docker container is a runtime representation of an image. Container can be run, started, scaled, moved and deleted. What is  Docker Client ? The client is a Docker binary that accepts commands from the user and communicates back and forth with the Docker Engine. What is Docker Host: A machine, either physical or virtual, is id

Spring Session

Spring Session provides an API and implementation for managing a user's session information. It also support clustered sessions without being tied to an application container-specific solution. Spring session support  integration with the HttpSession, WebSocket and WebSession. HttpSession : HttpSession replace HttpSession in application container with support of providing sessionId in header to work with RESTFUL APIS . WebSocket : It keeps alive HttpSession when receiving webSocket message. WebSession : WebSession replace Spring WebFlux's WebSession in an application container neutral way. Above thing can be  achieved using Spring Session Core, Spring Session Data Redis, Spring Session JDBC, Spring Session HazelCast. Spring Session Core provides core Spring Session functionality and API. Spring Session Data Redis provides SessionRepository and ReactiveSesssionRepository implementation backed by Redis and Configuration support. Spring Session JDBC provides Sess

Spring Security Authentication

Image
Spring Security   provides comprehensive support for Authentication. Spring security Authentication has various section like, SecurityContextHolder Object Overview SecurityContextHolder: Spring Security Stores the details of who is authenticated. SecurityContextHolder uses a ThreadLocal to store authenticated user and authenticated principal. SecurityContextHolder uses ThreadLocal. Hence, We can access its details across the method. SecurityContext: It contains the Authentication of the currently authenticated user. Spring Security does not care how the securityContextHolder is populated. If it contains a value, then it is used as the currently authenticated user. The SecurityContext is obtained from the SecurityContextHolder. Authetication: Can be put input to AuthenicationManager to provide the credentials a user has provided to authenticate or the current user from the SecurityContext. The Authentication contains: principal, credentials and authorities.Principal ide