Session 2: Open Systems Authentication

Question 1

What are the advantages of using a Federated Identity login structure?

Answer 1

Alows aplications to rely on identity management system rather than storing user credentials themselves. Users can use a single set of credentials across multiple services. Is used as a thirdparty autentication verifyer (Think facebook and Google account account verification)

Question 2

What are the three major platforms and protocols currently being used for Open System Autentication (OSA)?

Answer 2

• SAML
• OAuth
• OpenID

Question 3

Which large web entities use OpenID as their verification service?

Answer 3

Microsoft (Accounts), Google, Paypal, Amazon

Question 4

Which of the 3 OSA protocols are interconnected? (SAML-OpenID, SAML-OAuth, OAuth-OpenID ?)

Answer 4

OpenID has built its foundation upon OAuth 2.0, thus they share a interconected codebase.

Question 4

Which of the 3 OSA protocols are interconnected? (SAML-OpenID, SAML-OAuth, OAuth-OpenID ?)

Answer 4

OpenID has built its foundation upon OAuth 2.0, thus they share a interconected codebase.

Question 5

What is a possible security concern with OAuth API access tokens?

Answer 5

API access tokens do not expire unless access is revoked, this means users workstations are permanently logged in, loss of this device may lead to obtained access privilegies.