Subscribe!

Identity and Access Control

Play Identity and Access Control
Sign in to queue

Description

Today I woke up thinking that talking about Identity and Access Control and how your strategy around that affects you (web-) app's architecture without going too deeply into the security lingo that usually comes with it. Here's the 40 minute result.

I start with HTTP's "native" authentication model RFC 2617 and how that's universally bad, with both Basic and Digest authentication having issues Digest being, ironically worse for the overall security strategy. Then I dive into why models that use tokens (or cookies) are better in terms of security and scalability and explore a range of variations amongst those.

Tags:

Azure, Identity, Windows Azure

Embed

Download

Download this episode

More episodes in this series

Related episodes

The Discussion

  • User profile image
    codingoutlo​ud

    Clemens mentions a Firefox plug-in that helps steal session cookies over wifi, but he could not recall the name. I believe he was thinking of Firesheep: http://codebutler.com/firesheep/

  • User profile image
    kentweare

    A great primer for those new to ACS and federated security.  Thanks for publishing this.

     

    Kent

  • User profile image
    ilija injac

    This is really a great introduction into ACS and its feature-set on a conceptual base. What I miss the most, are some samples, or better some video demonstration, about WCF and best practices regarding service throttling on Azure. A video only about WCF being hosted in Worker Roles on Azure using ACS would also be great Smiley

    Thank you.

     

    Ilija

     

Add Your 2 Cents