Security

Subscribe to Security content with RSS Syndicate content or email

Delegated Authentication using the Windows Certificate Store.

Has anyone created Delegated Authentication using the Windows Certificate Store? Thank you for any feedback.

views

rating

Authentication with REST

We are building a bunch of rest based services using Ens 2016.2 to serve our browser based application (Angular 4).

Two questions:

views

rating

How to set up SSL/TLS for web application?

I have built an Ensemble SOAP service (EnsLib.SoapService.Service) as a business service which accepts soap requests from another application.

views

rating

Can you keep a secret?

If you are developing applications that use CSP or Zen, or potentially any of the other InterSystems web-related stuff that's built on top of CSP, then it's important to know how to keep one particular secret.

views

rating

Caché Open Authorization Framework (OAuth 2.0) implementation - part 1

This article, and following two articles of the series, is intended as a user guide for developers or system administrators, who need to work with OAuth 2.0 framework (further referred to as OAUTH for simplicity) in their InterSystems product based applications.

Note that at this time, OAUTH is still under development and is an unsupported feature

views

rating

CSP skeleton key

In this recent post I highlighted the importance of a CSP session's Key property in enforcing the level of security your web application may be relying on, and in particular the need to keep the property value secret.

views

rating

Password change on inbound web-services

We are planning to use Caché users on a SOAP web-service, so the WS-security tokens will be used.
It will be username and password only for now.

views

rating

Programatic User Authentication against windows AD

Hi,

Does calling the BIND method of %SYS.LDAP, with the username, domain and password of the user that  needs to be authenticated- the right way to authenticate him/her ?

views

rating

views

rating

User authentication using Arduino with RFID

    In the previous article, I had just started working with Arduino, and got a meteorological station to show as a result. In this article, let's go further: we will set  up authentication via RFID cards and Arduino against the InterSystems Caché  application.

views

rating

How to create new user for ODBC connection

We are using Cache in our application. We are using default username/password for connecting to the Cache Database through Cache Manege Provider.

views

rating

Making encrypted datafields SQL-searchable

Overview

Encryption of sensitive data becomes more and more important for applications. For example patient names, SSN, address-data or credit card-numbers etc..

Cache supports different flavors of encryption. Block-level database encryption and data-element encryption. The block-level database encryption protects an entire database.  The decryption/encryption is done when a block is written/read to or from the database and has very little impact on the performance.

With data-element encryption only certain data-fields are encrypted.  Fields that contain sensitive data like patient data or credit-card numbers. Data-element encryption is also useful if a re-encryption is required periodically. With data-element encryption it is the responsibility of the application to encrypt/decrypt the data.

Both encryption methods leverage the managed key encryption infrastructure of Caché.

The following article describes a sample use-case where data-element encryption is used to encrypt person data.  

But what if you have hundreds of thousands of records with an encrypted datafield and you have the need to search that field? Decryption of the field-values prior to the search is not an option. What about indices?

This article describes a possible solution and develops step-by-step a small example how you can use SQL and indices to search encrypted fields. 

views

rating

NTLM authorization via Ensemble

I am looking for a solution with Ensemble to talk to a old NTLM based SOAP Service. Does anyone has done this before?

views

rating

How to Change Redirect Url in OAuth2 implementation?

I tried to implement the Oauth2 in google,

I got authentication, But I unable to read response class.

I got an error as:

views

rating

Difference between CLIENT and AUTHSERVER instance?

I use Cache Instance. I'm trying to implement OAuth 2.0 in Cache instance.
Is it possible to use Cache instance as Client and Server?

views

rating