I am using jetty basic auth to authenticate my application. The problem is that I have to close the browser to clear the authentication. I am looking for a custom code to do the same.
In other words how to logoff/sign off one you have been authenticated by jetty basic auth.
If I understand correctly, what I do in Firefox is select "Tools > Clear Recent History", check Active Logins, and click Clear Now. Took me a while to figure this out.
Assuming you're asking what I think you're asking, then this is a browser question and not a Jetty question.
It sounds like you simply want a way to get your web-browser to forget your username/password.
How you do that will depend on which browser you are using:
For Chrome read this
For FireFox try the Web-developer addon
Other browsers will probably have similar solutions.
If you want to do it from within the Jetty server, then that's much harder, but you can start reading here, here, here and here
Please read this fantastic post on Basic Authentication.
The answer is in the first paragraph.
How to force Jetty to ask for credentials with BASIC authentication after invalidating the session?
Related
I am a beginner in the world of the OAuth2.0 and OpenID Protocols. I would like to implement a custom server - provider for multiple applications. So, to use it for Single Sign-On (SSO). I would like to work with python. Till now I have found four packages, for an OAuth2.0 and an OpenID Connect server implementation, in Python: pyoidc, django-oidc-provider, Django OAuth Toolkit (DOT) by OAuthlib and Authlib. I tried to read and understand pyoidc, but it was not so helpful and easy, basic things were missing. I have tried django-oidc-provider and I was really satisfied, and the whole implementation was really easy. So, after those trials, I am left with Django OAuth Toolkit (by OAuthlib) and Authlib. Has anyone tried them? Are these packages the same? Is Authlib an updated version of the OAuthlib library? The only information I know till now, is that Flask-OAuthlib is deprecated, and Authlib is was its new version.
*Every answer or advice or personal experience would be really helpful and always appreciated!
Thank you again for your help.
After some research, I concluded to work generally with JWTs. As before, I would like to work with a GraphQL API, so I am searching for solutions about JWT authentication on it. I maybe use Passport.js (passport-jwt) or something else for Python. All the libraries mentioned above possibly will be not used.
I will just redirect the user to my main application, authenticate them with JWT, and then return the JWT back to the application. In the future and after deployment, I might also implement an OAuth2.0 provider for my website. Although those packages did not really help me, I would recommend Django OAuth Toolkit (DOT) and django-oidc-provider to others. But, also I learned that django-oidc-provider only supports the implementation of a small and simple OAuth2.0 provider. Django OAuth Toolkit comes with lots of options for implementing an advanced OAuth2.0 Authentication Server (AS), including Authorization Code flow with PKCE (Proof Key with Code Exchange), which is the most secure flow. It is also scalable and has great documentation with lots of customizations if you want.
*I sent an email to the support of Authlib, and of course no one has answered to me after a week.
I am a very new developer who can write basic HTML (yes I know it's English), and is looking for a solution to a problem that I basically invented.
I recently bought a product called Doorbird, a very cool and well engineered IP Doorbell. The reason I bought it, is because it has an App, and integrates with IP phones and support video, and has a few bells and whistles, if you're not familiar with this product, I highly recommend looking at it.
The "problem" is that it does not integrate with Google Home, or Amazon Echo. However, it does have an API that allows you to go to the URL, login and unlock the door. I was looking into creating my own action that would have the Google Home login to the Doorbell and go to the unlock URL.
My issue is, I have no experience with this, but I pick things up very quickly, and believe in myself!
I already looked at the api.ai site from Google, and have signed up. It looked simple, but upon further investigation looks very complicated.
If anyone would be able to point me in the right direction I would be greatly appreciative.
Thanks in advance,
-Jack G
You need them to publish their REST api so that you can call the 'action' to unlock directly vs. having to go to a login page. You would probably set up oauth to have your server talk to theirs or use web headers. Ask their tech support if they support direct REST api using a security model.
Hello smart people on stackoverflow,
I would be very happy if someone could point me to the right libraries/frameworks to do what I want.
We have the following web architecture set up.
1. We have a tomcat server that offers REST services.
2. We have an apache2 server that serves up php pages to users.
a. Some of these php pages make REST calls to tomcat for data.
b. Other php pages contain javascript that makes REST calls that are routed through apache2 via mod_proxy to tomcat. e.g. All request to http://myapache.com/PASSTOTOMCAT/rest/getSecureData would go to tomcat.
Now, I'm asked to add authentication to everything, both the user pages as well as the REST calls. It would obviously be ideal for the user to sign-in once for access to both.
What library can I use for this? I don't think I can use any php-based solution (ie. one that involves adding a ) because the pass-through url's won't have a chance to add this code and check for authentication. I think I need to use something built into apache2 itself.
One minor requirement is that I would like the user credentials stored in a mysql database as opposed to a file.
Am I over-thinking this?
Thanks in advance
Well it's been 5 days, so I guess I'll answer my own question...
I ended up using the new mod_auth_form for authentication because it lets you use a nice stylized webpage to log users in.
I also used mod_dbd to access user credentials in mysql.
I couldn't find a nice tutorial on this so I struggled through the installation and setup a bit, but if anyone cares, I created a set of instructions on my blog in case anyone else tries to do the same thing.
Installation
Setup
I have installed magento in my local Xampp. After installing I have tried to login in Mozilla (both in front end and admin side). Does any one know how to login magento in fire fox.
Thanks
This is a known issue, and a number of blog posts document some solutions. Try Ash's solution first, failing that you need to alter Magento's code per Richard's post. Make sure that you follow his instructions to move the code into your /app/code/local to prevent future upgrade issues.
The problem occurs because of the way that Firefox handles cookies from localhost, and Magento's code is not very forgiving of that.
HTH,
JD
Safari worked for me without any workarounds.
We currently have an application that runs an embedded jetty 6.1.14 server to which we need to add authentication via Kerberos. I'm new to Kerberos, which makes the task about 100x harder that maybe it should be. I've scoured the internet and have found conflicting reports as to whether or not it is even possible but nothing much to provides guidance as to how to proceed.
I've managed to have the server basically be able to authenticate the users via kerberos but can't find away to have the client automatically send its kerberos ticket: I have to use the from auth-method, though there are hints that this may be using filters, which are very poorly documented.
My question - and I apologize for it being a bit vague, I've not been this exasperated in quite a long time - is to request some guidance for plugging in kerberos authentication without login forms in Jetty 6? Or am I just out of luck? Has anyone added this type of authentication to jetty 6?
If Jetty supports Servlet Filters (JSR-53), then this open source project http://spnego.sourceforge.net might be what you are looking for.
You have to prepare your domain environment first. Make sure that your server if part of your domain (joined it). Then you have to create an machine account and assign an SPN. If you have done that, create a keytab for that account. From now on a client will be able to search for the host in the domain and create a ticket for. Then comes Jetty into play.