http-authentication

WCF WebHttp Mixed Authentication (Basic AND Anonymous)

由 不想你离开。 提交于 2019-12-05 03:51:02
All of this is pertaining to WebHttp binding, hosted in a custom Service Host (IIS is not an option at this time). I've implemented a custom UserNamePasswordValidator, and a custom IAuthorizationPolicy. When I configure the endpoint's binding to use Basic authentication, everything works just as I'd like (custom principal, custom roles, etc..). I'd like to add the ability for anonymous HTTP access as well, and have my custom implementations put the Anonymous user in some default roles, etc.. (if no Authenticate header is sent). What happens now is that anonymous users are given a 401 before

What is base64 clear text username and password?

由 淺唱寂寞╮ 提交于 2019-12-05 02:08:53
问题 Recently I came across this word in a basic authentication article. What it meant by base64 clear text usrname and password on the network? Thanks 回答1: It means encoding the username and password using base 64. The result won't look too much like your username and password but it's pretty easy to reverse the operation to get the plain text. See here for details on base 64 encoding http://en.wikipedia.org/wiki/Base64 For example the string password encoded in base 64 is cGFzc3dvcmQ= This

RTSP Authentication : digest issue

由 折月煮酒 提交于 2019-12-04 17:19:57
I need to authenticate my RTSP stream to a streaming server, here is the challenge : RTSP/1.0 401 Unauthorized WWW-Authenticate: Digest realm="Streaming Server", nonce="76bfe6986d3e766424de9bd6e7d3ccc1" Session: 1845562184;timeout=60 Cseq: 1 ... Wirecast manage to successfully authenticate with those settings : Host name : 192.168.33.9:1935/live/my_stream.sdp location : live/my_stream.sdp username : user password : test its response is : e1dff363b9763df0c7615429af79715c So according to wikipedia I tried to authenticate with the method : //H(data) = MD5(data) //KD(secret, data) = H(secret:data)

How to force Git (2.5+) HTTP transport prefer SPNEGO over Basic authentication?

由 眉间皱痕 提交于 2019-12-04 14:08:17
问题 Summary: I am using Git for Windows 2.5.1 to authenticate with a Kerbesized Git server. When I am using the URL in the form https://el2-gitlab.sa.c/kkm/GrammarTools.git , Git does not even attempt the Negotiate authentication, and asks for the user name and password. A workarouond to force Git to use SPNEGO is to provide empty username and password in the URL itself, as in https://:@el2-gitlab.sa.c/kkm/GrammarTools.git . In this case, Git happily authenticates with the existing Kerberos

Elasticsearch HTTP authentication in Spring

由 不羁的心 提交于 2019-12-04 10:14:30
I want to access a remote elasticsearch which is protected by a username and password. https://[username]:[password]@aws-eu-west-1-portal1.dblayer.com:11109/ In Spring using the XML config I was able to access my localhost elastic as shown below <!-- ElasticSearch --> <elasticsearch:repositories base-package="be.smartsearch.service.repository.elasticsearch" /> <elasticsearch:transport-client id="esClient" cluster-nodes="localhost:9300" /> <bean id="elasticsearchTemplate" class="org.springframework.data.elasticsearch.core.ElasticsearchTemplate"> <constructor-arg name="client" ref="esClient" />

What is the delimiter for WWW-Authenticate for multiple schemes?

由 空扰寡人 提交于 2019-12-04 09:58:10
问题 I've read through RFC 2617 and can't find there or anywhere else what the delimiter is if multiple schemes are supported. For example, suppose both Basic and Digest are supported. I understand that it may appear this way: HTTP/1.1 401 Unauthorized WWW-Authenticate: Basic WWW-Authenticate: Digest But I've also read that both can be listed as one line, but no one ever shows an example or describes what delimiter to use. I've seen cautions that commas can be used within a single scheme: HTTP/1.1

How to use http authentication in devise with an optional omniauth token as the authentication token

由 陌路散爱 提交于 2019-12-04 07:29:11
问题 We have a rails app setup that uses devise & omniauth to allow logging in via facebook authentication. We also have a mobile app that is currently using http authentication to login to the rails app either by passing username & password or by passing in the http authentication token. This all works great so far. The mobile app also has the ability to authenticate with facebook itself and receive the user facebook token directly between itself and facebook. I would like to bridge this gap so

Why is the http auth UI so poor in browsers?

由 感情迁移 提交于 2019-12-04 05:10:26
Why isn't there a logout button? Why no list of "websites you're logged into"? Is it because of some issue with the HTTP specs? Life would be much easier for web developers if they could actually rely on HTTP auth ... No technical reason. I suppose if anything, the auth UI is neglected because fewer and fewer web sites are still using HTTP Basic Authentication, trending more towards various cookie-related login schemes... precisely because the auth UI is so poor! One could probably hack together a Firefox add-on to do it quite easily, which would be the quickest fix. (And the same goes for the

Protect Jenkins with nginx http auth except callback url

由 落爺英雄遲暮 提交于 2019-12-03 13:08:58
I installed jenkins on my server and I want to protected it with nginx http auth so that requests to: http://my_domain.com:8080 http://ci.my_domain.com will be protected except one location: http://ci.my_domain.com/job/my_job/build needed to trigger build. I am kinda new to nginx so I stuck with nginx config for that. upstream jenkins { server 127.0.0.1:8080; } server { listen x.x.x.x:8080; server_name *.*; location '/' { proxy_pass http://jenkins; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; proxy_redirect off; auth_basic "Restricted"; auth

determining web http authentication methods

由 隐身守侯 提交于 2019-12-03 11:28:55
How do you determine if a REST webservice is using Basic, Kerberos, NTLM, or one of the many other authentication methods? When you send an unauthenticated request the service has to respond with a "HTTP/1.1 401 Unauthorized" and the response contains a WWW-Authenticate header that specifies what authentication scheme is expected ( Basic , Digest ), the security realm and any other specific value (like Digets's nonce). So if the server responds with: HTTP/1.0 401 Unauthorized WWW-Authenticate: Digest realm="example.com", qop="auth,auth-int", nonce="...", opaque="..." it wants a Digest
订阅 http-authentication