The Twobo blog
Practical, sourced articles on identity and API security. Each piece keeps the address it had on the old blog and has been rewritten from scratch for how things work today.
Topics: Authorization · Cloud computing · Events & community · General · Identity & access management · Federation · Information security · Mobile security · Social login · News · Technical · Archives
- Information security
POODLE and the End of SSLv3, TLS 1.0 and TLS 1.1
How the 2014 POODLE attack broke SSLv3, why RFC 7568 and RFC 8996 later retired SSLv3, TLS 1.0 and 1.1, and which TLS settings to use for identity and API servers.
- Federation
AD FS Claim Rules for LDAP Attribute Stores, Line by Line
A line-by-line guide to AD FS claim rules that query LDAP attribute stores: conditions, issue versus add, store, types, query format, param and escaping rules.
- Federation
Using an LDAP Attribute Store in AD FS
How to add an LDAP attribute store to AD FS, connect it to AD LDS or another directory, and use it in claim rules for attributes AD does not hold.
- Authorization
The State Parameter in OAuth 2.0: CSRF, PKCE and RFC 9700
Why OAuth 2.0's state parameter exists, the CSRF attack it stops, how to generate and check it, and how state, PKCE and nonce divide the work under RFC 9700.
- Federation
SP-Initiated SSO on .NET: From WIF to Modern Libraries
How service provider initiated sign-in works, why Windows Identity Foundation only covered WS-Federation, and the options for SAML 2.0 and OIDC on ASP.NET Core.
- Events & community
Planning API Security Training for a Distributed Team
A practical curriculum for teaching API security to developers spread across offices and countries: modules, hands-on labs, formats and how to measure if it worked.