Security

Article

A Ponemon Institute report showed that 71% of developers believed that security was not adequately addressed during the software development lifecycle. This figure is revealing as it demonstrates that developers view security as a development priority, yet you often feel unequipped to engage. The relationship between security and developers has traditionally been like two teams competing at a tug-of-war. On one end, as developers, you are pulling to produce functional products as fast as possible. You don’t want to be...

(Part 2)Learn about recommended practices for producing secure code with input validation in part one of this four-part video series.

Learn how to start adopting a security-like mentality, also known as the "security mindset" in part four of this four-part video series.

Learn how to start adopting a security-like mentality, also known as the "security mindset" in the first half of part four in this four-part video series.

Learn about authorization such as user privileges, levels of access, and how they're different in part three of this four-part video series.

Learn about numeric errors and the dangers of using incorrect data types in part two of this four-part video series.

(Part 1)Learn about recommended practices for producing secure code with input validation in part one of this four-part video series.

Introduction In this blog post, I will demonstrate how to perform SPKI (Subject Public Key Info) Pinning in an Android Application using TrustKit - a pinning library for Android. Pinning Approaches One of the most common approaches for pinning in a mobile app is to store the certificate in storage. However, when server certificates are rotated, a new update to the application would likely need to be pushed out since the certificate in the application is no longer valid, possibly...

Introduction In this post, I will provide a walk through of how to set up Identity Brokering on an RH-SSO server. Red Hat Single Sign-On (RH-SSO) provides Web single sign-on and identity federation based on SAML 2.0, OpenID Connect and OAuth 2.0 specifications. For this tutorial, you will need: An RH-SSO Instance. A Web/Mobile Application with an OpenID Connect adapter. An OpenID Connect Provider Server (Such as Keycloak) to be used as the 3rd Party Identity Provider. Identity Brokering To...

Article

According to Wikipedia, entropy is the randomness collected by an operating system or application for use in cryptography or other uses that require random data. Entropy is often overlooked, misconfigured or forgotten and it can originate in sporadic errors whether it can be timeouts, refused connections, etc. Such errors are difficult to debug as the errors happen only when there is not enough entropy available. This article tries to explain briefly how to check if this can be a problem...

Article

It has long been recognized that unconstrained growth of memory usage constitutes a potential denial of service vulnerability. Qualys has shown that such unconstrained growth can be combined with other vulnerabilities and exploited in ways that are more serious. Typically, the heap and stack of a process start at opposite ends of the unused address space and grow towards each other. This maximizes the flexibility to grow the regions over the course of execution of the program without apriori knowing...

JBoss Application Server ships with PicketLink module for enabling SAML based SSO. PicketLink is an open source module and it is SAML v2.0 complained, for more information about 'PicketLink' please visit picketlink.org. Now the requirement is to enable SAML based SSO in JBoss Application Server where IDP is OKTA. Before we start enabling this, one should have an OKTA organization, a free developer organization can be created here. If you already have an OKTA organization, you need to set up...

To the average web developer, a hacker may seem simply like a nuisance, easily avoidable with the implementation of security standards and encryption methods. However, to many Americans nationwide, hackers are often defined as “super geniuses” which can “crack” into anything and terrorize our world. The main reason for this somewhat misguided interpretation of the hacking community is the fact that the media typically portrays these individuals as coffee-guzzling, cigarette-smoking rebels dressed in black, hiding in shadows, and wreaking havoc...

Managing the security of your projects applications can be an overwhelming and unmanageable task. In today's world, the number of newly created frameworks and languages is continuing to increase and they each have their own security drawbacks associated with them. The wide variety of security scanners available can help find vulnerabilities in your projects, but some scanners only work with certain languages and they each have different reporting output formats. Creating reports for customers or managers and viewing analytics using...

Related Blog Post : https://developers.redhat.com/blog/2017/05/25/easily-secure-your-spring-boot-applications-with-keycloak/ Support Github repo : https://github.com/sebastienblanc/spring-boot-keycloak-tutoria Although security and identity management is a crucial aspect for any application, its implementation can be difficult. Worse, it is often neglected, poorly implemented and intrusive in the code. But lately, Identity Management servers has appeared which allow to outsource and delegate all authentication and authorization aspects. Of these servers, one of the most promising is Keycloak, open-source, flexible and agnostic of any technology, it is easily deployable / adaptable in its own infrastructure. In this session, I propose you to discover KeyCloak progressively and in an interactive way: 0 slide, 100% live coding."

Although security and identity management is a crucial aspect of any application, its implementation can be difficult. Worse, it is often neglected, poorly implemented and intrusive in the code. But lately, Identity Management servers has appeared which allow to outsource and delegate all authentication and authorization aspects. Of these servers, one of the most promising is Keycloak, open-source, flexible and agnostic of any technology, it is easily deployable / adaptable in its own infrastructure. In this session, I propose you to discover KeyCloak progressively and in an interactive way: 0 slide, 100% live coding."

Learn how to use a centralized authentication service to secure many different microservices.

Corinne takes us through Swift development with AeroGear and how to use the new OAuth2 library to authenticate against Google Services. She also shows how to use Keycloak to secure REST endpoints and access them via AeroGear.

Keycloak is a new open source authentication server for cloud, mobile and html5. With loads of features, including single-sign on, social login, account management console, account workflows, fully featured admin console, OAuth2 and OpenShift cartridge to name a few. The first alpha has recently been released, with loads more features planned for the future. Keycloak also provides support for role based authorization and supports granting access to third party applications. This talk gives a comprehensive introduction to Keycloak and its features, as well as discuss how easily you can add authentication to your applications. There will also be an extensive live demo. Stian Thorgersen is a Senior Software Engineer at Red Hat. He co-leads the Keycloak project together with Bill Burke, and is also the security lead on another new open source project. Stian also has many years of experience in cloud solutions.

What is Keycloak? Although security is a crucial aspect of any application, its implementation can be difficult. Worse, it is often neglected, poorly implemented and intrusive in the code. But lately, security servers have appeared which allow for outsourcing and delegating all the authentication and authorization aspects. Of these servers, one of the most promising is Keycloak, open-source, flexible, and agnostic of any technology, it is easily deployable/adaptable in its own infrastructure. Moreover, Keycloak is more than just an authentication...

Technology is an ever-expanding market full of opportunity and dedicated to making our lives more convenient and advanced in the process. Countless companies across the world have recognized the power in embracing technology to survive and prosper and, with this being said, the world has never been more advanced than it is today — with a future as bright as the people creating it. Furthermore, although many people believe that the modern generation is completely out of their minds and...

... with APIs, OpenID, and Microservices, Daria Mayorova and Mark Cheshire from Red Hat 3Scale shared their presentation on how to construct microservice-based applications with the benefits of API management. Some general characteristics of microservices include: componentization via service organized around business capabilities smart endpoints design for failure decoupling of components Typically, microservices are divided into to two general architectural buckets: Inner Architecture Any service communication with other microservices within a larger service boundary (think intra-application communication). Outer Architecture Border...

Expanding on Tristan's blog, where he spoke of enabling security for JBoss Data Grid caches, in this post we will cover how to add LDAP based security to the JDG caches. The principles and techniques remain defined by Tristan, but there are some minor changes that I will be highlighting in this blog for a successful working configuration of JDG enabled with LDAP security. Before we jump on to configuring the JDG for security, I would like to brush up...

Article

Introduction Dependency management isn’t anything new, however, it has become more of an issue in recent times due to the popularity of frameworks and languages, which have large numbers of 3rd party plugins and modules. With Node.js, keeping dependencies secure is an ongoing and time-consuming task because the majority of Node.js projects rely on publicly available modules or libraries to add functionality. Instead of developers writing code, they end up adding a large number of libraries to their applications. The...

Article

Since I've learned about nftables, I heard numerous times that it would provide better performance than its designated predecessor, iptables. Yet, I have never seen actual figures of performance comparisons between the two and so I decided to do a little side-by-side comparison. Basically, my idea was to find out how much certain firewall setups affect performance. In order to do that, I simply did a TCP stream test between two network namespaces on the same system and then added...

Security

Platforms

Build

Quicklinks

Communicate

RED HAT DEVELOPER

Red Hat legal and privacy links

Red Hat legal and privacy links

Report a website issue