Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Programming > Auth > Flashcards

Auth Flashcards

1
Q

When was the original publication of OAuth 2.0?

A

2012

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

RFC# for Oauth 2.0 original publication

A

6749

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

RFC 8252

A

Oauth 2.0 for Native Apps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

RFC 7636

A

Proof Key for Code Exchange

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

RFC 6750

A

Bearer Tokens

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

RFC 6819

A

Threat Model and Security Considerations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

RFC 7662

A

Token Introspection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

RFC 7009

A

Token Revocation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

RFC 7519

A

JSON Web Token

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

RFC 8414

A

Authorization Server Metadata

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

RFC 7591

A

Dynamic Client Registration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

SCIM

A

System for Cross-domain Identity Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

RFC 7644

A

Defines SCIM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

layman definition of shibboleth

A

any custom or tradition, usually a choice of phrasing or even a single word, that distinguishes one group of people from another.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

LDAP

A

Lightweight Directory Access Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Lightweight Directory Access Protocol

A

an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

RFC 4511

A

LDAP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

IdM

A

Identity Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

IAM

A

Identity and Access Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

When was SCIM 1.0 released?

A

2011

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

When was SCIM 2.0 released?

A

2015

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

SCIM use case example

A

as a company onboards new employees and separates from existing employees, they are added and removed from the company’s electronic employee directory. SCIM could be used to automatically add/delete (or, provision/de-provision) accounts for those users in external systems such as G Suite, Office 365, or Salesforce.com. Then, a new user account would exist in the external systems for each new employee, and the user accounts for former employees might no longer exist in those systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

In addition to simple user-record management (creating & deleting), SCIM can also be used to

A

In addition to simple user-record management (creating & deleting), SCIM can also be used to

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

SCIM’s other RFC

A

7643

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What is Shibboleth Single Sign-On and Federating Software
a standards based, open source software package for web single sign-on across or within organizational boundaries. It allows sites to make informed authorization decisions for individual access of protected online resources in a privacy-preserving manner.
26
SAML
Security Assertion Markup Language
27
Security Assertion Markup Language
an open standard for exchanging authentication and authorization data between parties, in particular, between an identity provider and a service provider.
28
Security Assertion Markup Language ( other definition)
an open standard that allows identity providers (IdP) to pass authorization credentials to service providers (SP).
29
when was the SAML 1.0 spec created?
Nov 2002
30
The three main players in SAML
Service Provider, Client, and Identity Provider
31
What is a SAML Service Provider called in Oauth2?
Resource Server
32
What is a SAML Identity Provider called in Oauth2?
Authorization Server
33
What is the high level structure of a SAML Assertion?
just an XML node with certain elements
34
The most common SAML flow
35
principal
the user trying to authenticate. You can think of this as the actual human behind the screen
36
Service provider
the services that are requesting authentication and identity information about the principal
37
What does SAML use to sign requests?
XMLDSIG
38
What are the two types of flows SAML supports?
those initiated by the service provider and those initiated by the identity provider
39
XMLDSIG
XML Digital Signatures
40
SP-initiated flow
Service Provider initiated SAML flow
41
Bindings
the format in which data is transferred between service providers and identity providers in SAML
42
most popular SAML bindings
HTTP Redirect Binding and HTTP POST Binding
43
in SAML, HTTP Redirect Bindings transfer data using what?
HTTP redirects and query parameters
44
45
In SAML, HTTP POST bindings transfer data using what?
HTTP POST forms
46
In SAML, HTTP Redirect Bindings are typically used in what?
authentication requests
47
In SAML, HTTP Post Bindings are typically used in what?
authentication responses
48
Assertions
statements made by the identity provider about the principal.
49
What are some examples of SAML assertions?
the principal’s email address and/or groups/roles the principal may be associated with
50
Assertions are used by _____ to \_\_\_\_\_
the service provider; to create and configure sessions for a principal.
51
SPML
Service Provisioning Markup Language
52
Step A of typical SAML 2.0 flow
53
Typical step B of SAML 2.0 flow
54
How do you make a Grant sort of equivalent to an Authorization Code Flow?
use Authorization Code Grant option and scope="openid profile"
55
AuthN
short for Authentication
56
AuthZ
short for Authorization
57
OAuth is short for
OpenAuthentication
58
A SAML service provider manages an \_\_\_\_\_\_\_\_\_\_\_\_\_endpoint[OS 2] that receives authentication assertions from identity providers
Assertion Consumer Service
59
The entity descriptor for a SAML Service Provider contains an ________ element
\< md:SPSSODescriptor \> md: SPSSODescriptor\>
60
the entity descriptor of a SAML Service Provider Metadata document contains at least one _______ endpoint
\< md:AssertionConsumerService \>
61
the root element of a SAML Service Provider metadata document
\< md:EntityDescriptor \>
62
in an RBAC system, an authenticated user usually has what principals?
userId and roleId
63
from the perspective of authorization, what is the difference between principles and subjects?
principals are the actual entities for which access is allowed or disallowed. Subject is just a user/thread/process that holds some principals.
64
ADFS
Active Directory Federation Services (ADFS) is a Single Sign-On (SSO) solution created by Microsoft
65
TIER
trust-identity-education-research
66
WSGI
Web Server Gateway Interface
67
Web Server Gateway Interface
It is a specification that describes how a web server communicates with web applications, and how web applications can be chained together to process one request. WSGI is a Python standard described in detail in PEP 3333.
68
What is the difference between a certificate and a key with respect to SSL?
A certificate contains a public key. The certificate, in addition to containing the public key, contains additional information such as issuer, what the certificate is supposed to be used for, and other types of metadata. Typically, a certificate is itself signed by a certificate authority (CA) using CA's private key. This verifies the authenticity of the certificate.
69
CA
Certificate Authoriy
70
How many root certificates do browsers come preinstalled with?
100-300, as of 2020
71
certificate authority
an entity that issues digital certificates
72
What does a digital certificate do?
certifies the ownership of a public key by the named subject of the certificate
73
What are the two most common ways CAs authenticate the recipient of a certifcate (e.g. the owner of a domain)?
domain validation and extended validation
74
CSR
Certificate Signing Request
75
Certificate Signing Request
a message sent from an applicant to a certificate authority in order to apply for a digital identity certificate
76
How to generate a private key with openssl
openssl genrsa -des3 -out private\_key.pem 2048
77
What does the -des3 flag in "openssl genrsa -des3 -out private\_key.pem 2048" do?
It brings up a prompt for you to encrypt the private key with a password. -des3 means that it will encrypt the private key with the DES3 cipher
78
how to create a certificate signing request using openssl
openssl.exe req -new -key yourcertname.key -out yourcertname.csr
79
create openssl cert given key and csr
openssl req -x509 -sha256 -days 365 -key frontend.key -in frontend.csr -out frontend.crt

Programming (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions