Evaluation of an OAuth 2.0 protocol implementation for web server applications

Darwish, Marwan; Ouda, Abdelkader

doi:10.1109/iemcon.2015.7344461

Cited by 13 publications

(7 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We have implemented the proposed model as an extension of FIWARE Keyrock Generic Enabler. Keyrock is the Identity Management GEri (Generic Enabler reference implementation) of FIWARE 5 and it brings support to secure and private OAuth 2.0-based authentication of users and devices, user profile management, privacy-preserving disposition of personal data, Single Sign-On (SSO) and Identity Federation across multiple administration domains.…”

Section: B Fiware Implementationmentioning

confidence: 99%

“…Therefore, when asking for the username in the specific step of Figure 7, citizens have to provide their email address to check if their account already exists in the database. To avoid identity theft, they receive a confirmation email that has to be acknowledged 5 https://fiware-idm.readthedocs.io 6 https://www.npmjs.com/package/saml2-js before continuing the process. In case the eIDAS profile of a citizen has to be created or updated in Keyrock, the following actions are performed: As explained above, when an application requests the user information using an OAuth 2.0 access token, the eIDAS profile of the user is included in the response.…”

Section: B Fiware Implementationmentioning

confidence: 99%

“…OAuth 2.0 is the most extended standard for providing third party delegated authentication in the applications and services in the Internet [5]- [7]. Good examples of identity providers that supports this standard are Facebook, Twitter or Google.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

An Identity Framework for Providing Access to FIWARE OAuth 2.0-Based Services According to the eIDAS European Regulation

Alonso¹,

García-Pozo²,

Choque³

et al. 2019

IEEE Access

View full text Add to dashboard Cite

Secure electronic identification (eID) is one of the key enablers of data protection, privacy, and the prevention of online fraud. However, until now, the lack of common legal basis prevented European Member States from recognizing and accepting eIDs issued in the other Member States. The electronic identification and trust services (eIDAS) regulation provides a solution to these issues by ensuring the cross-border mutual recognition of eIDs. FIWARE is a European initiative that provides a rather simple yet powerful set of application programming interfaces (APIs) that ease the development of smart applications in multiple vertical sectors and oriented to the future internet. In this paper, we propose a model that enables the connection of FIWARE OAuth 2.0-based services with the eID authentication provided by eIDAS reference. Thanks to this model, services already connected with an OAuth 2.0 identity provider can be automatically connected with eIDAS nodes for providing eID authentication to European citizens. For validating the proposed model, we have deployed an instance of the FIWARE identity manager connected to the Spanish eIDAS node. Then, we have registered two services, a private videoconferencing system, and a public smart city deployment, and extended their functionalities for enriching the user experience leveraging the eID authentication. We have evaluated the integration of both services in the eIDAS network with real users from seven different countries. We conclude that the proposed model facilitates the integration of generic and FIWARE-based OAuth 2.0 services to the eIDAS infrastructure, making the connection transparent for developers. INDEX TERMS Access Control, eIDAS, electronic identification, identity, FIWARE.

show abstract

Section: B Fiware Implementationmentioning

confidence: 99%

Section: B Fiware Implementationmentioning

confidence: 99%

See 1 more Smart Citation

An Identity Framework for Providing Access to FIWARE OAuth 2.0-Based Services According to the eIDAS European Regulation

Alonso¹,

García-Pozo²,

Choque³

et al. 2019

IEEE Access

View full text Add to dashboard Cite

show abstract

“…OAuth is an Authorization Protocol rather than Authentication Protocol, It is open standard for access delegation, It provides to clients a secure delegated access to server, resources on behalf of a resource owner, OAuth is a framework that enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by arranging an agreement to approve interface in between the resource owner and the HTTP service, or by allowing the third-party application to obtain access on its own behalf [6]. The resource server is the server that hosts the protected resources, which can accept and respond to protected resource that requests using access tokens.…”

Section: B Oauthmentioning

confidence: 99%

Authentication and Authorization Mechanism for Cloud Security

2019

ijeat

View full text Add to dashboard Cite

Cloud Computing is a most widespread and popular form of computing, promising high reliability for customers and providers both at the same point of time for many fields, where cloud storage security is based on Authentication and Authorization in cloud computing. Data is uploaded into a cloud and stored in a datacenter, Authentication and authorization are the major concerns to access the data stored in cloud by users from the data center. Security is a major issue; these are mainly deal with identity and access management, prevention of data loss and malware attack control management. In this paper we majorly concentrated on Authentication and Authorization to cloud access, we focused on identity management mechanism as cloud security solution that provides directory services for application access management. We discussed the protocols that support authorization and allows the communication across applications with the help of tokens instead of credentials. We even concentrated on the different mechanisms which plays a major role in designing a secured cloud computing architecture from malicious intrusions and attacks, it is a step to verify the presence and functioning of the cloud customers and cloud providers through security mechanisms to protect from different risks, threats and attacks. In this paper we discussed different security Algorithms and Authentication architecture along with the proposed algorithm, where analysis is done along with the computational evaluation with output.specific users [23]. VII. RESULT ANALYSISThe traditional model is designed for cloud security using Microsoft Azure Active Directory, OAuth, OpenID connect, Redirect URI. We concentrated on cloud security and build a secured model based on the parameters of Confidentiality,

show abstract

“…Performance of OAuth 2.0 protocol is also presented by Marwah Darwish [10]. It evaluates OAuth 2.0 protocol on web server with limited resource.…”

Section: Related Workmentioning

confidence: 99%

Implementation of Role-Based Access Control on OAuth 2.0 as Authentication and Authorization

Triartono¹,

Negara²,

Sussi³

2019

EECSI

View full text Add to dashboard Cite

As today's technology transition from monolithic towards microservices architecture, the authentication and authorization system also becomes a new concern because of the difference between monolithic and microservices pattern. Monolithic mostly uses role-based access control while microservices uses scope with OAuth 2.0. With this in mind, there is a need for a model that can integrate OAuth 2.0 with role-based access control. With rolebased access control implemented on OAuth 2.0, we expect a simpler authorization process and a more secure authentication and authorization system for microservices backend architecture. This paper proposes a model to implement role-based access control on OAuth 2.0 using Laravel framework, we also test the performance of the system following by response time, data transferred and throughput. From the performance test, this approach has a good performance and can handle certain requests with simulated users even with limited resources.

show abstract

Evaluation of an OAuth 2.0 protocol implementation for web server applications

Cited by 13 publications

References 2 publications

An Identity Framework for Providing Access to FIWARE OAuth 2.0-Based Services According to the eIDAS European Regulation

An Identity Framework for Providing Access to FIWARE OAuth 2.0-Based Services According to the eIDAS European Regulation

Authentication and Authorization Mechanism for Cloud Security

Implementation of Role-Based Access Control on OAuth 2.0 as Authentication and Authorization

Contact Info

Product

Resources

About