Did You Remember to Test Your Tokens?
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Spring Roo - Reference Documentation
Spring Roo - Reference Documentation DISID CORPORATION S.L. Table of Contents Getting started . 1 1. Overview . 2 2. What’s new in Spring Roo 2.0 . 3 Improved extensibility . 3 No backward compatibility . 3 Usability improvements . 3 Centered in Spring technologies . 3 Application architecture . 4 Domain model . 4 View layer . 4 3. Requirements . 6 4. Install Spring Roo . 7 Using Spring Roo . 9 5. The Roo shell . 10 6. Impatient beginners . 12 7. Create your Spring Boot application . 13 8. Configure the project settings . 14 9. Setup the persistence engine . 15 10. The domain model . 16 JPA entities . 16 DTOs . 20 11. The data access layer . 21 Spring Data repositories . 21 Default queries . 21 12. The service layer . 22 Service API and Impl . 22 13. The view layer . 23 Thymeleaf view engine . 23 Spring MVC Controllers . 23 Spring Webflow . 25 14. The integration layer . 26 REST API . 26 WS API . 26 Email . .. -
Release 0.0.2 Hypothes.Is Project and Contributors
The h Documentation Release 0.0.2 Hypothes.is Project and contributors Sep 27, 2021 Contents 1 Contents 3 Index 25 i ii The h Documentation, Release 0.0.2 h is the web app that serves most of the https://hypothes.is/ website, including the web annotations API at https: //hypothes.is/api/. The Hypothesis client is a browser-based annotator that is a client for h’s API, see the client’s own documentation site for docs about the client. This documentation is for: • Developers working with data stored in h • Contributors to h Contents 1 The h Documentation, Release 0.0.2 2 Contents CHAPTER 1 Contents 1.1 The Hypothesis community Please be courteous and respectful in your communication on Slack (request an invite or log in once you’ve created an account), IRC (#hypothes.is on freenode.net), the mailing list (subscribe, archive), and GitHub. Humor is appreciated, but remember that some nuance may be lost in the medium and plan accordingly. If you plan to be an active contributor please join our mailing list to coordinate development effort. This coordination helps us avoid duplicating efforts and raises the level of collaboration. For small fixes, feel free to open a pull request without any prior discussion. 1.2 Advice for publishers If you publish content on the web and want to allow people to annotate your content, the following documents will help you get started. 1.2.1 Generating authorization grant tokens Warning: This document describes an integration mechanism that is undergoing early-stage testing. -
Course Title
"Charting the Course ... ... to Your Success!" Spring 3x Advanced Topics Course Summary Description This course is the next step in using the many features Spring 3.x has to offer. Web topics covering Web Flow and MVC address the powerful features for building popular workflow structures in applications today. Spring Batch addresses the Web counterpart to business processing. The final two topics address all areas in Spring. Security touches all layers of a business application. The newly rewritten Spring Security structure covers all areas addressed down to the Method level. Spring Roo is the last topic that can be used to build entire applications, including Spring MVC. Due to the size of Spring Roo, the depth will depend on available remaining time. The various Spring Integration features of messages will be demonstrated based on student requirements. Objectives At the end of this course, students will be able to: Design, create and debug Spring MVC applications. Understand Web Flow and where it can be used. Create, monitor, and test Spring Batch applications. Apply Security to all levels of Spring applications, including methods. Use Spring Roo to create Spring applications. Configure Spring using Java Classes. Apply Spring Integration options. Topics Working with Spring Web Flow Introducing Spring Security The Web Module and Spring MFC Web Security Controllers and Commands Securing the Service Layer Binding and Validation Customizing and Extending Spring Security Introducing Spring Batch Working with Remote Services -
Adding Red Hat Decision Manager Users 44
Red Hat Decision Manager 7.11 Integrating Red Hat Decision Manager with other products and components Last Updated: 2021-07-06 Red Hat Decision Manager 7.11 Integrating Red Hat Decision Manager with other products and components Legal Notice Copyright © 2021 Red Hat, Inc. The text of and illustrations in this document are licensed by Red Hat under a Creative Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available at http://creativecommons.org/licenses/by-sa/3.0/ . In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must provide the URL for the original version. Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law. Red Hat, Red Hat Enterprise Linux, the Shadowman logo, the Red Hat logo, JBoss, OpenShift, Fedora, the Infinity logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries. Linux ® is the registered trademark of Linus Torvalds in the United States and other countries. Java ® is a registered trademark of Oracle and/or its affiliates. XFS ® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries. MySQL ® is a registered trademark of MySQL AB in the United States, the European Union and other countries. Node.js ® is an official trademark of Joyent. Red Hat is not formally related to or endorsed by the official Joyent Node.js open source or commercial project. -
Spring Framework II Course Summary
"Charting the Course ... ... to Your Success!" Spring Framework II Course Summary Description This course is the next step in using the many features the Spring Framework has to offer. In depth Web topics covering Web Flow and MVC address the powerful features for building popular workflow structures in applications. Spring Security will be applied to all areas including the Method level. Spring ROO will be used to build entire applications, including Spring MVC. Web Services for SOAP and RESTful are included to complete the Web Tier. Objectives At the end of this course, students will be able to: Design, create and debug complex Spring MVC applications. Understand Web Flow and where it can be used. Create, monitor, and test Spring Web Services. Apply Security to all levels of Spring Framework applications, including methods. Use Spring Roo to create Spring Framework applications. Configure Spring Framework using Java Classes and eliminate Web.XML configuration. Incorporate JQuery and JavaServer Faces. Topics Web Development Spring Roo Web Services What’s Next in Spring III Security Audience This course is designed for Developers who have attended the “Spring Framework I” class or equivalent experience in developing or maintaining Spring Framework Web applications. Prerequisites Spring programming experience, a basic knowledge of configuration, familiarity with the Spring Framework dependency injection, and Aspect oriented programming. Duration Five Days Due to the nature of this material, this document refers to numerous hardware and software products by their trade names. References to other companies and their products are for informational purposes only, and all trademarks are the properties of their respective companies. -
Spring Security Reference
Spring Security Reference 4.2.8.RELEASE Ben Alex , Luke Taylor , Rob Winch , Gunnar Hillert Copyright © 2004-2015 Copies of this document may be made for your own use and for distribution to others, provided that you do not charge any fee for such copies and further provided that each copy contains this Copyright Notice, whether distributed in print or electronically. Spring Security Reference Table of Contents .............................................................................................................................................. xvii I. Preface ................................................................................................................................... 1 1. Getting Started ............................................................................................................... 3 2. Introduction .................................................................................................................... 4 2.1. What is Spring Security? ..................................................................................... 4 2.2. History ................................................................................................................ 6 2.3. Release Numbering ............................................................................................. 6 2.4. Getting Spring Security ........................................................................................ 7 Usage with Maven ............................................................................................ -
Spring Security
Spring Security Reference Documentation Ben Alex Luke Taylor Spring Security: Reference Documentation by Ben Alex and Luke Taylor 3.0.8.RELEASE Spring Security Table of Contents Preface ...................................................................................................................................... x I. Getting Started ....................................................................................................................... 1 1. Introduction ................................................................................................................... 2 1.1. What is Spring Security? ..................................................................................... 2 1.2. History ................................................................................................................ 4 1.3. Release Numbering ............................................................................................. 4 1.4. Getting Spring Security ....................................................................................... 5 Project Modules ................................................................................................. 5 Core - spring-security-core.jar .................................................. 5 Web - spring-security-web.jar ..................................................... 5 Config - spring-security-config.jar ........................................... 5 LDAP - spring-security-ldap.jar ................................................ 5 ACL - spring-security-acl.jar -
Hacking JSON Web Token (JWT) - 101-Writeups
Hacking JSON Web Token (JWT) - 101-writeups ... https://medium.com/101-writeups/hacking-json... Hacking JSON Web Token (JWT) Rudra Pratap Follow May 3, 2018 · 5 min read Hey, Well this is my first writeup and there might be ton of mistakes as i go along writing it out so please give me feedback so that i can work over it. So lets start! JWT ... 0x01 JWT work�low Starting with JWT, it is a very lightweight specification 1 of 13 8/21/19, 10:35 AM Hacking JSON Web Token (JWT) - 101-writeups ... https://medium.com/101-writeups/hacking-json... This specification allows us to use JWT to pass secure and reliable information between users and servers. JWT is often used for front-end and back-end separation and can be used with the Restful API and is often used to build identity authentication mechanisms. Take an example of vimeo.com , which is one of the biggest video hosting companies as per my knowledge. ... Figure 1 2 of 13 8/21/19, 10:35 AM Hacking JSON Web Token (JWT) - 101-writeups ... https://medium.com/101-writeups/hacking-json... Figure 2 When a user enters his/her credentials, a post request is sent (check Figure 1) after which the credentials are validated. If they are a correct combo then the user is presented with response having a JWT token as seen in Figure 2. ... Example JWT : eyJraWQiOiJrZXlzLzNjM2MyZWExYzNmMTEzZjY0OWRjOTM4OW RkNzFiODUxIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOi JkdWJoZTEyMyJ9.XicP4pq_WIF2bAVtPmAlWIvAUad_eeBhDOQe2 MXwHrE8a7930LlfQq1lFqBs0wLMhht6Z9BQXBRos9jvQ7eumEUF WFYKRZfu9POTOEE79wxNwTxGdHc5VidvrwiytkRMtGKIyhbv68du FPI68Qnzh0z0M7t5LkEDvNivfOrxdxwb7IQsAuenKzF67Z6UArbZE8 odNZAA9IYaWHeh1b4OUG0OPM3saXYSG- Q1R5X_5nlWogHHYwy2kD9v4nk1BaQ5kHJIl8B3Nc77gVIIVvzI9N_ klPcX5xsuw9SsUfr9d99kaKyMUSXxeiZVM-7os_dw3ttz2f- TJSNI0DYprHHLFw Now whenever a user accesses something, the request which are made are slightly different having a new header authorization: jwt 3 of 13 8/21/19, 10:35 AM Hacking JSON Web Token (JWT) - 101-writeups .. -
SAP Process Mining by Celonis
TABLE OF CONTENTS REVISION HISTORY 4 INTRODUCTION 5 ABOUT THIS GUIDE 5 TARGET AUDIENCE 5 TECHNICAL CONFIGURATION – SYSTEM LANDSCAPE 8 SINGLE-SERVER DEPLOYMENT 8 MULTI-SERVER DEPLOYMENT (SCALE-OUT) 9 TECHNICAL CONFIGURATION – FILE SYSTEM LAYOUT 9 WINDOWS SYSTEMS 10 LINUX SYSTEMS 12 TECHNICAL CONFIGURATION – MULTI-SERVER 13 TECHNICAL CONFIGURATION – SECURITY 15 GENERAL SECURITY 15 SECURE COMMUNICATION BETWEEN CENTRAL APPLICATION AND COMPUTE SERVICE 17 PYTHON SECURITY 18 TECHNICAL CONFIGURATION – HIGH AVAILABILITY (HA) 19 TECHNICAL CONFIGURATION – LOGGING 21 LOGGING FOR SAP PROCESS MINING BY CELONIS 21 APPLICATION SERVER ADMINISTRATION 24 REQUIRED TOOLS 24 SAP PROCESS MINING BY CELONIS CONFIGURATION 24 SAP PROCESS MINING BY CELONIS AS OPERATING SYSTEM SERVICE 25 PERIODICAL TASKS – ARCHIVING FILES 26 SAP PROCESS MINING BY CELONIS LOG FILES 26 MIGRATION FROM SAP PROCESS MINING BY CELONIS FROM A VERSION BELOW 4.5 TO A VERSION INCLUDING AND ABOVE 4.5 30 SAP PROCESS MINING BY CELONIS CONFIGURATION STORE BACKUPS 32 © 2020 Celonis SE OPERATION GUIDE 2 RECOVERING FROM A BACKUP FOR INTEGRATED CELONIS CONFIGURATION STORE 33 BACKUP AND RECOVERY – BACKUP ANALYTICS DATABASE (SAP HANA) 34 INCLUDED MONITORING FUNCTIONALITY 35 SOFTWARE CHANGE MANAGEMENT 38 SOFTWARE UPDATE PROCEDURE 39 SUPPORT DESK MANAGEMENT 40 SLD REGISTRATION 40 CONFIGURABLE HELP PAGES 40 © 2020 Celonis SE OPERATION GUIDE 3 REVISION HISTORY VERSION NUMBER VERSION DATE SUMMARY OF REVISIONS MADE 1.4 MAR 22, 2017 Application Version 4.2 1.6 FEB 23, 2018 Updated version for application version 4.3 1.9 FEB 03, 2019 Updated version for application version 4.5 1.10 MAY 17, 2020 Updated version for application version 4.5 SP3 1.11 JUN 20, 2020 Updated version for application version 4.6 © 2020 Celonis SE OPERATION GUIDE 4 INTRODUCTION ABOUT THIS GUIDE SAP Process Mining by Celonis is a powerful software for retrieving, visualizing and analyzing real as-is business processes from transactional data stored by the SAP ERP systems. -
Openair XML API Reference Guide
XML API Reference Guide April 10, 2021 Copyright © 2013, 2021, Oracle and/or its affiliates. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error- free. If you find any errors, please report them to us in writing. If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable: U.S. GOVERNMENT END USERS: Oracle programs (including any operating system, integrated software, any programs embedded, installed or activated on delivered hardware, and modifications of such programs) and Oracle computer documentation or other Oracle data delivered to or accessed by U.S. Government end users are "commercial computer software" or "commercial computer software documentation" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, reproduction, duplication, release, display, disclosure, modification, preparation of derivative works, and/or adaptation of i) Oracle programs (including any operating system, integrated software, any programs embedded, installed or activated on delivered hardware, and modifications of such programs), ii) Oracle computer documentation and/or iii) other Oracle data, is subject to the rights and limitations specified in the license contained in the applicable contract. -
Precompiler Session 01 - Tuesday 8:00 Machine Learning: Taking Your ML Models to Android and Ios Wes Eklund
PreCompiler Session 01 - Tuesday 8:00 Machine Learning: Taking your ML Models to Android and iOS Wes Eklund Once you've developed a kickass Machine Learning model, you need a way to get that model to your computing devices (phones) to start doing your predictions! Most Machine Learning projects in production will 'train' the model on cloud servers, then 'deploy' the model to an API server or mobile device. This session will introduce the attendee on using TensorFlow Serving and Apple CoreML to deploy Machine Learning models to a mobile app. Prerequisites: Download Here Build a Natural Language Slack Bot for your Dev Team Michael Perry Many project teams use Slack as a means of communication with one another. Why not also use it to communicate with your infrastructure? Invite a helper into your conversation that can perform routine tasks tirelessly, conversationally, and interactively. In this 4 hour workshop, you will build a Slack bot that understands natural language and integrates with your DevOps pipeline. You will use the Slack Events API to receive messages, and the Slack Web API to send them. You will use LUIS to interpret language and extract intent. You will execute actions against the Visual Studio Team Services Web API in response to user requests, and subscribe to Webhooks to notify your team of important events. In the end, you will have a new member of your team who can help you with your build and release pipeline. Workshop outline: Slack API Authorization - OAuth and API key verification Events API - respond to posts Web -
On the Security of Single Sign-On
On the Security of Single Sign-On Vladislav Mladenov (Place of birth: Pleven/Bulgaria) [email protected] 30th June 2017 Ruhr-University Bochum Horst G¨ortz Institute for IT-Security Chair for Network and Data Security Dissertation zur Erlangung des Grades eines Doktor-Ingenieurs der Fakult¨atf¨urElektrotechnik und Informationstechnik an der Ruhr-Universit¨atBochum First Supervisor: Prof. Dr. rer. nat. J¨org Schwenk Second Supervisor: Prof. Dr.-Ing. Felix Freiling www.nds.rub.de Abstract Single Sign-On (SSO) is a concept of delegated authentication, where an End- User authenticates only once at a central entity called Identity Provider (IdP) and afterwards logs in at multiple Service Providers (SPs) without reauthenti- cation. For this purpose, the IdP issues an authentication token, which is sent to the SP and must be verified. There exist different SSO protocols, which are implemented as open source libraries or integrated in commercial products. Google, Facebook, Microsoft and PayPal belong to the most popular SSO IdPs. This thesis provides a comprehensive security evaluation of the most popular and widely deployed SSO protocols: OpenID Connect, OpenID, and SAML. A starting point for this research is the development of a new concept called malicious IdP, where a maliciously acting IdP is used to attack SSO. Generic attack classes are developed and categorized according to the requirements, goals, and impact. These attack classes are adapted to different SSO proto- cols, which lead to the discovery of security critical vulnerabilities in Software- as-a-Service Cloud Providers, eCommerce products, web-based news portals, Content-Management systems, and open source implementations.