Overview Many web applications do not need a complete SAML or OpenID Connect implementation. If your organization already uses Apereo CAS, Apache HTTP Server can authenticate users directly against CAS using: The architecture is straightforward: Apache handles the CAS login redirect … [Read more...] about Apache mod_auth_cas: Protect Web Applications with Apereo CAS and Docker
Apache mod_auth_mellon: Configure SAML SSO & Docker
Overview Many modern applications support OpenID Connect natively. Plenty of others do not. You may have an application that: In that situation, Apache can act as the authentication layer in front of the application. The architecture looks like: Apache and mod_auth_mellon act … [Read more...] about Apache mod_auth_mellon: Configure SAML SSO & Docker
Configure OpenID Connect (OIDC) in Apereo CAS 7.3 and 8
Overview Apereo CAS is best known as a Central Authentication Service server, but it can also act as a full OpenID Connect Provider, allowing applications to authenticate users with standard OAuth 2.0 and OpenID Connect flows. A typical deployment looks like this: Once configured, CAS can … [Read more...] about Configure OpenID Connect (OIDC) in Apereo CAS 7.3 and 8
Certificate Ownership Is an Operating Model Problem, Not a Tooling Problem
In December 2018, an expired certificate at Ericsson took mobile data offline for roughly 32 million O2 customers in the UK. In February 2020, Microsoft Teams went down for hours because a certificate lapsed. Both companies had money, talent, and tooling. What they did not have was a specific person … [Read more...] about Certificate Ownership Is an Operating Model Problem, Not a Tooling Problem
OpenSSL dgst: Create Checksums and Verify Digital Signatures
Overview A software vendor publishes a new application package: along with a SHA-256 checksum. Before installing that package on a server, you want to answer: Is the file I downloaded exactly the same file the vendor published? Later, your own team distributes an internal … [Read more...] about OpenSSL dgst: Create Checksums and Verify Digital Signatures
OpenSSL crl: Check Certificate Revocation Lists and Revoked Certificates
Overview A TLS certificate can be: and still no longer be trustworthy. If the certificate's private key has been compromised or the certificate was issued incorrectly, the certificate authority can revoke it before its normal expiration date. One common way CAs publish that information … [Read more...] about OpenSSL crl: Check Certificate Revocation Lists and Revoked Certificates
OpenSSL crl2pkcs7: Create PKCS#7 and P7B Certificate Bundles
Overview A certificate authority sends you three PEM files: Your Linux tools are perfectly happy with them. Then the administrator of another system asks: Can you send me the certificate chain as a .p7b file? This is where: becomes useful. The command can take one or more … [Read more...] about OpenSSL crl2pkcs7: Create PKCS#7 and P7B Certificate Bundles
OpenSSL cms: Sign, Verify, Encrypt, and Decrypt Files
Overview TLS protects information while it travels across a network, but sometimes a system administrator needs to protect the file itself. Consider a configuration export that must be transferred from one administrative environment to another. You want the recipient to be able to answer … [Read more...] about OpenSSL cms: Sign, Verify, Encrypt, and Decrypt Files