Questions tagged [authentication]

Authentication is the process of providing a proof of identity or verifying identity.

Authentication is the process of providing a proof of identity or verifying identity. This might involve confirming the identity of a person or software program, tracing the origins of an artifact, or ensuring that a product is what its packaging and labeling claims to be. Authentication is different than Authorization, which is the step of allowing access to a resource. Authentication and authorization usually happen together to verify identity and then allow access.

The first type of authentication is accepting proof of identity given by a credible person who has evidence on the said identity, or on the originator and the object under assessment as the originator's artifact respectively.

The second type of authentication is comparing the attributes of the object itself to what is known about objects of that origin. For example, an art expert might look for similarities in the style of painting, check the location and form of a signature, or compare the object to an old photograph.

The third type of authentication relies on documentation or other external affirmations.

Factors and identity

The ways in which someone may be authenticated fall into three categories, based on what is known as the factors of authentication: something the user knows, something the user has, and something the user is. Each authentication factor covers a range of elements used to authenticate or verify a person's identity prior to being granted access, approving a transaction request, signing a document or other work product, granting authority to others, and establishing a chain of authority.

74922 questions
15
votes
2 answers

Is it possible to salt and or hash HOTP/TOTP secret on the server?

I am building a two-factor authentication system based on the TOTP/HOTP. In order to verify the otp both server and the otp device must know the shared secret. Since HOTP secret is quite similar to the user's password, I assumed that similar best…
Boycott Russia
  • 11,818
  • 5
  • 28
  • 29
15
votes
2 answers

Proper android Oauth2 library / framework

I've been searching day and night now for a proper OAuth2 library to use for my android app. I came across many, including apache amber (formally leeloo) and the android developer specified one…
Gooey
  • 4,740
  • 10
  • 42
  • 76
15
votes
3 answers

How to find the object that called a method in Java

can I find the object who called a method in Java? I have a social network with groups and persons. If a person wants to leave a group, only that can remove itself from the group, nobody else can remove that person, somehow the person who called the…
John Smith
  • 1,276
  • 4
  • 17
  • 35
15
votes
1 answer

HTTP Basic Auth for some (not all) controllers

Using Rails 3.2. I have half a dozen controllers, and want to protect some (but not all) of them with http_basic_authenticate_with. I don't want to manually add http_basic_authenticate_with to each controller (I could add another controller in the…
shacker
  • 14,712
  • 8
  • 89
  • 89
15
votes
4 answers

Verify Facebook Access Token for specific App

I need to verify that users on my iPhone app are actually logged in to my Facebook app. I'm able to verify their user id by retrieving it with their Access token: https://graph.facebook.com/me?fields=id&access_token=XXXXXXXXXXXXXXX The security…
Eric Di Bari
  • 3,767
  • 7
  • 40
  • 49
15
votes
2 answers

What is the point of Authentication tokens on REST services

What is the value of using a authentication token when using a REST webservice instead of sending a username, password over HTTPS/Encryption each time you make a request? I understand that for instance OAUTH has some benefits cause you don't need…
Spring
  • 11,333
  • 29
  • 116
  • 185
15
votes
5 answers

Use HTTP Auth only if accessing a specific domain

I've got several sites: example.com, example1.com, and example2.com. All of them point to my server's /public_html folder, which is my Apache root folder. What do I need to add to my .htaccess file to use http authentication only if the user is…
Dave DeLong
  • 242,470
  • 58
  • 448
  • 498
15
votes
2 answers

How to restfully login, Symfony2 Security, FOSUserBundle, FOSRestBundle?

I'd like to be able to login via a ws. I've tried to simulate this with curl pointing to /login but it only handles HTML, etc. By the way, it requires a CSRF which I don't want. So I'd like to either disable the CRSF (from the login_check) or find a…
Trent
  • 5,785
  • 6
  • 32
  • 43
15
votes
9 answers

Why I can not login to magento backend using google chrome

I am using magento community edition 1.7.0.2.I am not able to login to back end of magento.I know this problem can be because of chrome not accepting cookies. But how to fix that please help. Thanks
Mukesh
  • 7,630
  • 21
  • 105
  • 159
15
votes
5 answers

How to access Cookie set with Passport.js

I'm using Passport.js to achieve login to my Node-App. But in my app, I need to get access to the user's ID and currently, I don't have an idea how to achieve this thing! How can I access the user-id or should I send it in a cookie myself?
Lukas Olsen
  • 5,294
  • 7
  • 22
  • 28
15
votes
2 answers

Migrating legacy users to symfony2

I'm moving from expressionengine to symfony2 and I'm looking for the best way to migrate the user passwords. The goal is to let legacy users log in with their existing credentials, while passwords for new users are created the default way. I have…
Thomas K
  • 6,076
  • 5
  • 39
  • 56
15
votes
7 answers

New Facebook SDK FBSession sessionOpenWithPermissions

I've been trying to develop iOS app using Facebook and I'm new. So I've been trying to make a login with Facebook, followed a tutorial on Facebook and try to implement it. But I've encountered, [FBSession sessionOpenWithPermissions] not found. When…
user1383655
  • 195
  • 1
  • 10
15
votes
4 answers

Claim auth from ADFS

I try to connect to a SharePoint Online instance via a WPF application. I have found this article that discribes a possible solution but the problem is that the specific instance has a Active Directory Federation Services (ADFS) in front and I don't…
jwillmer
  • 3,570
  • 5
  • 37
  • 73
15
votes
3 answers

What's the login for phpMyAdmin?

I downloaded the most recent version of XAMPP (v.1.7.7) and decided start a database. When I opened phpMyAdmin, it alerts me there is a new version of phpMyAdmin available. I downloaded it from online, and I deleted the old version of phpMyAdmin and…
slippery
  • 447
  • 3
  • 5
  • 15
15
votes
3 answers

SSL authentication by comparing certificate fingerprint?

Question for all the SSL experts out there: We have an embedded device with a little web server on it, and we can install our own SSL self-signed certificates on it. The client is written in .NET (but that doesn't matter so much). How can I…
chris166
  • 4,769
  • 4
  • 24
  • 25