Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Programming > Auth > Flashcards

Auth Flashcards

1
Q

When was the original publication of OAuth 2.0?

A

2012

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

RFC# for Oauth 2.0 original publication

A

6749

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

RFC 8252

A

Oauth 2.0 for Native Apps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

RFC 7636

A

Proof Key for Code Exchange

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

RFC 6750

A

Bearer Tokens

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

RFC 6819

A

Threat Model and Security Considerations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

RFC 7662

A

Token Introspection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

RFC 7009

A

Token Revocation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

RFC 7519

A

JSON Web Token

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

RFC 8414

A

Authorization Server Metadata

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

RFC 7591

A

Dynamic Client Registration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

SCIM

A

System for Cross-domain Identity Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

RFC 7644

A

Defines SCIM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

layman definition of shibboleth

A

any custom or tradition, usually a choice of phrasing or even a single word, that distinguishes one group of people from another.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

LDAP

A

Lightweight Directory Access Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Lightweight Directory Access Protocol

A

an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

RFC 4511

A

LDAP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

IdM

A

Identity Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

IAM

A

Identity and Access Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

When was SCIM 1.0 released?

A

2011

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

When was SCIM 2.0 released?

A

2015

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

SCIM use case example

A

as a company onboards new employees and separates from existing employees, they are added and removed from the company’s electronic employee directory. SCIM could be used to automatically add/delete (or, provision/de-provision) accounts for those users in external systems such as G Suite, Office 365, or Salesforce.com. Then, a new user account would exist in the external systems for each new employee, and the user accounts for former employees might no longer exist in those systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

In addition to simple user-record management (creating & deleting), SCIM can also be used to

A

In addition to simple user-record management (creating & deleting), SCIM can also be used to

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

SCIM’s other RFC

A

7643

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is Shibboleth Single Sign-On and Federating Software

A

a standards based, open source software package for web single sign-on across or within organizational boundaries. It allows sites to make informed authorization decisions for individual access of protected online resources in a privacy-preserving manner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

SAML

A

Security Assertion Markup Language

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Security Assertion Markup Language

A

an open standard for exchanging authentication and authorization data between parties, in particular, between an identity provider and a service provider.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Security Assertion Markup Language ( other definition)

A

an open standard that allows identity providers (IdP) to pass authorization credentials to service providers (SP).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

when was the SAML 1.0 spec created?

A

Nov 2002

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

The three main players in SAML

A

Service Provider, Client, and Identity Provider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is a SAML Service Provider called in Oauth2?

A

Resource Server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is a SAML Identity Provider called in Oauth2?

A

Authorization Server

33
Q

What is the high level structure of a SAML Assertion?

A

just an XML node with certain elements

34
Q

The most common SAML flow

35
Q

principal

A

the user trying to authenticate. You can think of this as the actual human behind the screen

36
Q

Service provider

A

the services that are requesting authentication and identity information about the principal

37
Q

What does SAML use to sign requests?

38
Q

What are the two types of flows SAML supports?

A

those initiated by the service provider and those initiated by the identity provider

39
Q

XMLDSIG

A

XML Digital Signatures

40
Q

SP-initiated flow

A

Service Provider initiated SAML flow

41
Q

Bindings

A

the format in which data is transferred between service providers and identity providers in SAML

42
Q

most popular SAML bindings

A

HTTP Redirect Binding and HTTP POST Binding

43
Q

in SAML, HTTP Redirect Bindings transfer data using what?

A

HTTP redirects and query parameters

45
Q

In SAML, HTTP POST bindings transfer data using what?

A

HTTP POST forms

46
Q

In SAML, HTTP Redirect Bindings are typically used in what?

A

authentication requests

47
Q

In SAML, HTTP Post Bindings are typically used in what?

A

authentication responses

48
Q

Assertions

A

statements made by the identity provider about the principal.

49
Q

What are some examples of SAML assertions?

A

the principal’s email address and/or groups/roles the principal may be associated with

50
Q

Assertions are used by _____ to _____

A

the service provider; to create and configure sessions for a principal.

51
Q

SPML

A

Service Provisioning Markup Language

52
Q

Step A of typical SAML 2.0 flow

53
Q

Typical step B of SAML 2.0 flow

54
Q

How do you make a Grant sort of equivalent to an Authorization Code Flow?

A

use Authorization Code Grant option and scope=”openid profile”

55
Q

AuthN

A

short for Authentication

56
Q

AuthZ

A

short for Authorization

57
Q

OAuth is short for

A

OpenAuthentication

58
Q

A SAML service provider manages an _____________endpoint[OS 2] that receives authentication assertions from identity providers

A

Assertion Consumer Service

59
Q

The entity descriptor for a SAML Service Provider contains an ________ element

A

< md:SPSSODescriptor > md: SPSSODescriptor>

60
Q

the entity descriptor of a SAML Service Provider Metadata document contains at least one _______ endpoint

A

< md:AssertionConsumerService >

61
Q

the root element of a SAML Service Provider metadata document

A

< md:EntityDescriptor >

62
Q

in an RBAC system, an authenticated user usually has what principals?

A

userId and roleId

63
Q

from the perspective of authorization, what is the difference between principles and subjects?

A

principals are the actual entities for which access is allowed or disallowed. Subject is just a user/thread/process that holds some principals.

64
Q

ADFS

A

Active Directory Federation Services (ADFS) is a Single Sign-On (SSO) solution created by Microsoft

65
Q

TIER

A

trust-identity-education-research

66
Q

WSGI

A

Web Server Gateway Interface

67
Q

Web Server Gateway Interface

A

It is a specification that describes how a web server communicates with web applications, and how web applications can be chained together to process one request. WSGI is a Python standard described in detail in PEP 3333.

68
Q

What is the difference between a certificate and a key with respect to SSL?

A

A certificate contains a public key.

The certificate, in addition to containing the public key, contains additional information such as issuer, what the certificate is supposed to be used for, and other types of metadata.

Typically, a certificate is itself signed by a certificate authority (CA) using CA’s private key. This verifies the authenticity of the certificate.

69
Q

CA

A

Certificate Authoriy

70
Q

How many root certificates do browsers come preinstalled with?

A

100-300, as of 2020

71
Q

certificate authority

A

an entity that issues digital certificates

72
Q

What does a digital certificate do?

A

certifies the ownership of a public key by the named subject of the certificate

73
Q

What are the two most common ways CAs authenticate the recipient of a certifcate (e.g. the owner of a domain)?

A

domain validation and extended validation

74
Q

CSR

A

Certificate Signing Request

75
Q

Certificate Signing Request

A

a message sent from an applicant to a certificate authority in order to apply for a digital identity certificate

76
Q

How to generate a private key with openssl

A

openssl genrsa -des3 -out private_key.pem 2048

77
Q

What does the -des3 flag in “openssl genrsa -des3 -out private_key.pem 2048” do?

A

It brings up a prompt for you to encrypt the private key with a password. -des3 means that it will encrypt the private key with the DES3 cipher

78
Q

how to create a certificate signing request using openssl

A

openssl.exe req -new -key yourcertname.key -out yourcertname.csr

79
Q

create openssl cert given key and csr

A

openssl req -x509 -sha256 -days 365 -key frontend.key -in frontend.csr -out frontend.crt

Programming (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions