Posts

Showing posts with the label Authentication

Basic Authentication with Nginx

Basic Authentication with Nginx Basic authentication provides an easy way to password protect an endpoint on our server. Today we will see how we can create a password file and use it to enable basic authentication on Nginx. Create a password Enable basic authentication Reuse configuration If you haven’t seen Nginx before, you can have a look at my previous blog post on Getting started with Nginx 1. Create a password To create a password, we will use the apache2-utils tool called htpasswd . sudo apt-get update sudo apt-get install apache2-utils htpasswd allows use to create passwords encrypted stored in a file sudo htpasswd -c /etc/myapp/.htpasswd user1 -c is used to create the file. If we want to add other users we can omit the parameter. sudo htpasswd /etc/myapp/.htpasswd user2 Now if we navigate to /etc/myapp/ we will be able to find our .htpasswd file containing encrypted passwords together with usernames. 2. Enable basic authentication Enabling basic authenti...

OAuth 2.0, OpenID Connect and Identity Server

OAuth 2.0, OpenID Connect and Identity Server When it comes to authentication and authorization, the most used standard is OAuth 2.0 with OpenID Connect (OIDC). Few weeks ago I discussed Resource owner password and Implicit flows focusing mainly on implementations with Identity Server. There is a lot of confusion revolving around OAuth 2.0 and OIDC, what they are, how they differ and even what Identity Server is and what is it used for. Today I will give more insights on what is OAuth 2.0 and OIDC are and how Identity Server relates to them. 1. What is OAuth 2.0 2. What is OpenID Connect 3. What is Identity Server 4 1. What is OAuth 2.0 OAuth 2.0 is an authorization protocol enabling applications to have a limited access to protected resources. The authorization is handled in the Identity provider (Idp) who is in charge of delivering an access token to the client apppication after having authenticated the resource owner (usually the user). Why do we need it? Let’s take an exa...