http://checkout.google.com/support/sell/bin/answer.py?hl=en&answer=70647
Only accept messages that are
authenticated by HTTP Basic
Authentication, using your Merchant ID
and Merchant Key as the username and
password.
Any idea on how to set this up ? (HTTP Basic Authentication)
In apache you set this up using a .htaccess & .htpass files. This website will generate the files for you: http://www.htaccesstools.com/htpasswd-generator/
In IIS there is some setting under 'Directory Security' (I think) but I can't remember exactly how it works.
As for your specific google checkout problem... I'm not sure exactly what you mean, you havent provided much information...
Related
I am using Aacotroneo/Laravel-Saml2 and have successfully setup a login system using ADFS. In another system I am using simpleSAMLphp elsewhere on the same domain successfully with WIA so I know ADFS is setup for that and that everything is setup correctly except the laravel application.
I have installed a browser addon to check the SAML logs for responses and requests. The only thing I can think of is that there is no client request ID sent through from laravel.
&client-request-id=d1ccbbdd-d55e-4828-eb24-0080000000b4
Any suggestions are appreciated. If I have missed a saml2 setting I am more than happy to try them, a lot of them don't seem to work or make any difference whether set to true or false.
Is it possible I need to setup encryption certificates and certain true/false combinations?
Thanks
Check this article
ADFS has non-standard SAML2 Authentication Context Class urn:federation:authentication:windows
By default this class has lower priority than urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
I would suggest making the following changes to AuthNRequest:
<samlp:RequestedAuthnContext Comparison=”minimum”
<samlp:AuthnContextClassRef xmlns:samlp="urn:oasis:names:tc:SAML:2.0:assertion">
urn:federation:authentication:windows
</samlp:AuthnContextClassRef>
<samlp:AuthnContextClassRef xmlns:samlp="urn:oasis:names:tc:SAML:2.0:assertion">
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
</samlp:AuthnContextClassRef>
</samlp:RequestedAuthnContext>
The general answer you can find everywhere is to use the Signal authenticationRequired(QNetworkReply*, QAuthenticator*), then fill the login credentials into the given QAuthenticator object.
However, this does not work in my case as that signal is never emitted. Reason: The server does not return an authorization failure but redirects me to a login page instead. So my program will just download that page.
I have found out how to catch this by checking the attribute QNetworkRequest::RedirectionTargetAttribute of the QNetworkReply.
So I can detect the redirection and ask the user for auth info.
But... where do I go from there? How do I set the authentication data? Can I manually set a QAuthenticator to my QNetworkRequest or my QNetworkAccessManager? I didn't find a way to do that anywhere, just via the above-mentioned signal/slot mechanism which does not work because it does not trigger.
Any help would be greatly appreciated!
From documentation,
http://qt-project.org/doc/qt-5/qauthenticator.html
QAuthenticator supports the following authentication methods:
Basic
NTLM version 2
Digest-MD5
Since you are getting redirected to a login page, and you haven't indicated if any of the above authentication methods even works, I will assume that it does not because things like Basic authentication is sent on every request to the server. Login pages generally authenticate the client and use some sort of a cookie for future authentication. To do this,
Detect login page
Pass proper credentials to the server (based on what the form wants)
In the QNetworkReply to the login page, look for cookies (Set-Cookie headers).
Pass the relevant cookies back with your requests.
If it works, you are no longer redirected to login page.
For information on cookies, you can get overview via Wikipedia, but for implementation, you need to look at the RFC 6265,
If this is incorrect, and you can use basic authentication, then that information is passed in the URL itself. Set username and password in your QUrl and if it works, you will not be redirected. http://qt-project.org/doc/qt-5/qurl.html#setPassword
I'm currently working on building a WCF web Service, I was asked to use Basic Authentication over HTTPS and also to validate whether the user is present in an LDAP group for Authorization.
I searched in Internet and it is said that Active Directory Authentication is not available in IIS and we should use our own Custom Basic Authentication Module or UserNamePasswordValidator.
Link I used for coding Custom Authentication Module
I have hosted the WCF in local IIS with SSL and now it is running under https.
The question is, If I implement this one, I need to add the Authorization header manually it seems. Is there any other way I can get the User Name or Password entered in the Basic Authentication dialog which is showed when we open the service in a browser ?.
OR
could you please provide an advice on what are the things I need to do to implement the above said Security ?
I'm helpless and requesting your help on this !!!!. Thanks in Advance.
Background:
I also tried UserNamePasswordValidator, but it was doing at the Application level, I was able to view the wsdl file (Meta data of the web service without even providing credentials) so I did went with the Custom Basic Authentication Module.
With Custom Basic Authentication Module , it is asking for credentials before the svc is opened in browser. So I think this would best suite. Please provide your valuable suggestions.
Basic authentication works by the web server returning a 401.0 status code AND a WWW-Authenticate response header with the value 'Basic real="xxx"' where the realm is simply information shown to the user so that they understand what is asking for the authentication. When the browser receives this type of response, it displays a dialogue box to the user asking for a username/password. The browser then re-submits the originally requested URL, but also includes an 'Authorization' header whose value is a base64 encoded string which includes the username and password.
A custom authentication module for IIS basically has to handle this interaction. For each request that comes in, it needs to see if there is an 'Authorization' header, and if so, it extracts the username/password, authenticates them in whatever fashion it likes, and if successful sets up the Context.User. If there is no 'Authorization' header, or the username/password are not valid, then the module must set the response code to 401.0, and ensure that there is a WWW-Authenticate header (as described above).
In order to use the module, all other authentication modules in IIS must be disabled (although there seem to be some circumstances in which the anonymous authentication module should be enabled). Due to caching in IIS, don't be surprised if not all requests are passed to your authentication module.
What are best practices when it comes to sending user credentials to stateless services (Let's say ASP.NET Web Api's).
What should be done when SSL is not an option?
And is it safe to send user credentials in URL parameters (with or without SSL)?
Thanks in advance
Check this post about securing your API, it is easily readable and explains most of what you need.
About SSL not being an option, as stated in the post:
When do I use HTTPS?
Answer: whenever you don’t want information stolen from the HTTP request.
Use a standard authentication (BasicAuthentication, OpenID or Oauth)
Use HTTPS. Creating of self-signed certificate and enabling a server with is a very simple operation
Do not pass any confidential information (also a user password) in URL parameters even with SSL. They can be logged on the way to your server
I am using Paros proxy for checking and monitoring my site. The site doesn't have any HTTP based authentication but while running through paros proxy it is saying "A username and password are being requested by http://XYZ.com. The site says: "XDB" " I've tried several different paros settings and sites but it is showing me the same thing. It seems paros has some default HTTP auth credentials. I've also tried entering login creds in the config.xml but it didn't worked out. Any help please...
Paros hasnt been updated for many years.
Try using OWASP ZAP: https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
Its a fork of Paros but has much more functionality and is being very actively maintained.
Simon (ZAP Project lead)