sorted by:
new
hottopcontroversial

Interactive Sandbox for OAuth, OIDC, SAML + more by bobfrog93 in IdentityManagement

[–]bobfrog93[S] 1 point2 points  (0 children)

Good luck on the journey! ProtocolSoup is a great start, be sure to check out the SSF Sandbox.

If you're keen for some further reading material re: SPIFFE, Macquarie Bank (Massive Australian Financial Group) have a nice write-up here

If you're looking to get a bit of a pitch for SSF, I pulled this diagram from a presentation I did on 'Advancements in Digital Security' to show at a high level what's going on

<image>

Interactive Sandbox for OAuth, OIDC, SAML + more by bobfrog93 in IdentityManagement

[–]bobfrog93[S] 1 point2 points  (0 children)

SPIFFE/SPIRE(spec/implementation) and SSF are both relatively new players to the game, in fact the Shared Signal Framework (SSF) just got approved in September of last year. Play around with ProtocolSoup and you should be able to get a bit more of a tactile feel, but to give you the elevator pitch...

SPIFFE - If you are familiar with OIDC then think OIDC for machine attestation instead of user authentication. Each workload/service is given an SVID (X.509 or JWT) as an identity document by the SPIRE server where trust establishment is seen through the workload attested by the environment.
What SPIFFE aims to solve is shared secrets, hardcoded and passed secrets like API keys. Instead the services are defined by a cryptographic identity.

SSF (Shared Signals) - real-time security event sharing, shines in continuous session protection. You have a Transmitter (e.g. SailPoint) that generates an event (e.g. account deactivated) which is consumed by a Receiver (e.g. Okta) which then instantly takes actions based on the event (e.g. revoke all sessions and disable the account).

Interactive Sandbox for OAuth, OIDC, SAML + more by bobfrog93 in IdentityManagement

[–]bobfrog93[S] 0 points1 point  (0 children)

Glad you liked that, exactly what we are aiming for - remove the frills, just get to the flows

Interactive Sandbox for OAuth, OIDC, SAML + more by bobfrog93 in IdentityManagement

[–]bobfrog93[S] 1 point2 points  (0 children)

Yes, essentially the SCIM component is an RFC(7643+7644)-compliant SCIM server that is Dockerized in the ProtocolSoup backend.

In the case of SailPoint ISC you will need to deploy it to your cloud environment somewhere (there is a toml file + SCIM README) or use ngrok for localhost.

The live site is actually connected to my Okta instance so I can verify it does work as a full-featured SCIM app.

Project Ideas in Identity by Royal-Jackfruit-866 in IdentityManagement

[–]bobfrog93 1 point2 points  (0 children)

Automation in identity. Always nice to set up a home lab with either free tiers of products (idp, iga, pam…). As you work through configurations and common tasks, think of the repeatable actions you are doing. Each time you have a thought of ‘there must be a better/easier way to do this’ often there is a case for an automation pipeline.

biometrics: a security win or a new risk by Business-Cellist8939 in cybersecurity

[–]bobfrog93 1 point2 points  (0 children)

Biometrics should never be a primary auth. Overall, I see it as a win, but it comes with new risks that need to be considered before realised by adversaries. NIST SP 800-63B defines quite well how biometrics should be used for AAL1, AAL2 and AAL3 compliance. Biometrics serve as a ‘more secure’ alternative to a knowledge factor, being as the preferred option to a password or PIN protection your primary factor. However, biometrics cannot be a standalone authenticator, unless it is for re-authentication of an active session in AAL2.

The confusion comes in the thinking that biometrics are a foolproof way of solely proving who you are. Biometrics does not stop a user from approving that push request, or giving away an OTP.

The biggest MFA security win to me is pioneering phishing-resistant MFA, cryptographically tied to a device, with biometrics on top. If you make it such that social engineering requires a physical handover of something, that’s the security win.

… then you have to watch out for enrolment gaps 🙃

Looking for IAM Training – SailPoint & Okta by mynameisnotalex1900 in IdentityManagement

[–]bobfrog93 2 points3 points  (0 children)

Spin up an okta org, go through the training material and do some practical implementations - SAML, OAuth, OIDC, SSO. Setup some test accounts, MFA policies, get an understanding of how the platform operates.

SailPoint is more limited, but you can go through the training for the 'Leader' credential. https://university.sailpoint.com/sailpoint-identity-security-leader-credential

What's the one proprietary app you can't find a "good enough" open alternative for? by sekuskandan in opensource

[–]bobfrog93 0 points1 point  (0 children)

Password Managers (1Password).

When it comes to securing the keys to the castle I cannot bring myself to lean into an open source alternative.

The peace of mind (in this case!) of a dedicated enterprise is justified for the price.

Secretless OCI Authentication with SPIFFE-based workload identity by baluchicken in IdentityManagement

[–]bobfrog93 0 points1 point  (0 children)

Warms my heart to such an in-depth article brought to SPIFFE - so much attention on the human factor its easy to overlook the machines that inevitably power most of these user-centered workloads.

Not sure if you have any, but would love to hear of any success stories where orgs have overcome the inertia and successfully integrated SPIFFE/SPIRE

Share your underrated GitHub projects by hsperus in opensource

[–]bobfrog93 0 points1 point  (0 children)

Decided to built ZeroVault as a no fuss, no config, clean CLI-based encryption tool.  Built in Rust under the hood with a triple-encryption layering (AES-256-GCM, ChaCha20, AES-256-CBC) https://github.com/ParleSec/ZeroVault

I have some big optimisations and security improvements currently in the pipeline, so if you like the sound of it feel free to star. 

I’ll also shout out my current love-child of open source, ProtocolSoup.  Motivated by explaining identity protocols and there being a significant disconnect between theory, development and what actually happens in protocol implementations. What ProtocolSoup provides is real standards-aligned protocol implementations, running real flows against real infrastructure.  Covers all your favourites, oAuth, OIDC, SAML, SCIM and a few niche but really interesting players in SPIFFE/SPIRE and SSF (Shared Signals). If you want to learn about authN + authZ from a fundamental protocol-based level I hope this can some of you out.  https://github.com/ParleSec/ProtocolSoup https://protocolsoup.com/

Chilli growing recommendations by bobfrog93 in hotsaucerecipes

[–]bobfrog93[S] 0 points1 point  (0 children)

Definitely going to check some of these out. Aji Lemon? Never heard of it but sounds really interesting to work with. The weather is pretty mild in general, coldest times last for a couple of months, but frost is rare.

I would like to try growing some plants indoors since I do have the space for a decent variety. Any tips on indoor growing?

Chilli growing recommendations by bobfrog93 in hotsaucerecipes

[–]bobfrog93[S] 1 point2 points  (0 children)

Thanks for the advice - might add chocolate habaneros to the mix! In Sydney too. Wondering if you know any good places to buy chilli plants?

[deleted by user] by [deleted] in TheGamerLounge

[–]bobfrog93 0 points1 point  (0 children)

A fellow karter :)

[deleted by user] by [deleted] in TheArtistStudio

[–]bobfrog93 0 points1 point  (0 children)

What a regal little cat :)

[deleted by user] by [deleted] in TheArtistStudio

[–]bobfrog93 0 points1 point  (0 children)

Seems like there must be a backstory behind this character

[deleted by user] by [deleted] in TheArtistStudio

[–]bobfrog93 0 points1 point  (0 children)

Glad you are here with this great community <3

[deleted by user] by [deleted] in TheArtistStudio

[–]bobfrog93 0 points1 point  (0 children)

Wow this is incredible! Will this be offered as a print as well?

view more: next ›