3 ms·

I have not seen a course that covers all of the things you are asking for. The best courses on the oidc/oauth and saml I have seen were the paid ones here: ht

I have not seen a course that covers all of the things you are asking for. The best courses on the oidc/oauth and saml I have seen were the paid ones here: https://www.hackmanit.de/en/training/portfolio https://www.hackmanit.de/en/training/portfolio On linkedinlearning this one was quite ok: https://www.linkedin.com/learning/web-security-oauth-and-openid-connect-2 https://www.linkedin.com/learning/web-security-oauth-and-ope... Free ressources check: -https://aaronparecki.com/ https://aaronparecki.com/ -OAuth 2.0 and OpenID Connect (in plain English): https://m.youtube.com/watch?v=996OiexHze0 https://m.youtube.com/watch?v=996OiexHze0 https://speakerdeck.com/nbarbettini/oauth-and-openid-connect-in-plain-english https://speakerdeck.com/nbarbettini/oauth-and-openid-connect... -OAuth/OpenID by Nat Sakimura(chairman openid foundation) https://m.youtube.com/playlist?list=PLRUD_uiAYejRvQWkS2xjgFW20lRLp4snN https://m.youtube.com/playlist?list=PLRUD_uiAYejRvQWkS2xjgFW... For the active directory topic I don't know good ressources

rtrblsm 3y ago
all of that, plus the rfcs for oauth2 and oidc are pretty great as well!
- krantic 3y ago
  Yeah start with https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-09 https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-... Deprecating the unsecure&outdated/it's easy to shoot yourself and summarizing so you don't need to go through the rabbit hole of specs... Also follow the BCP that will remain in a draft state forever(at least for the near future): https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics https://datatracker.ietf.org/doc/html/draft-ietf-oauth-secur...
orlandohill 3y ago
Aaron Parecki has two courses on OAuth: The Nuts and Bolts of OAuth 2.0 https://www.udemy.com/course/oauth-2-simplified/ https://www.udemy.com/course/oauth-2-simplified/ Advanced OAuth Security https://www.udemy.com/course/advanced-oauth-security/ https://www.udemy.com/course/advanced-oauth-security/
shadowbanned4 3y ago
This is practical, but awful advice. Auth (z or n) has been very badly over engineered. You don't need anything more than http basic auth, the rest is just people with too much time on their hands. Oauth particularly is a travesty that their authors should be ashamed of.
- mooreds 3y ago
  It depends! (I work for an auth vendor, so where I stand depends on where I sit, to some extent.) I've seen and built apps that only needed built-in framework or language support. Or, best of all, don't use authentication at all. I've also seen and/or built apps that needed advanced functionality to support business requirements. For example, if you want to: * support slack-like workspace switching functionality for a single user * but allow each organization to control the login methods they want to allow, including magic links, SAML, OIDC, LDAP, etc * and make all APIs securely and scalably available to single page applications and mobile applications * across hundreds of thousands or millions of users You're going to want to use some of the more complicated standards. Basic auth ain't gonna help with that.
  - shadowbanned4 3y ago
    I worked for the largest company in Canada who handled billions of dollars. You can make your decision but they won't do anything.
    - mooreds 3y ago
      They still used basic auth across all their apps?
      - shadowbanned4 3y ago
        No. They used Oauth. I wrote their entire Oauth system. And it was a nightmare reading through Oauth/OIDC specs for something that could be handled trivially with http basic auth.
    - 3y ago
BennyInc 3y ago
I can second Hackmanit from my own experience. We had them come on site some years ago to train our team. This was incredibly helpful as they also focused on what we use in house in a separate chapter.

rtrblsm 3y ago

all of that, plus the rfcs for oauth2 and oidc are pretty great as well!

krantic 3y ago
Yeah start with https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-09 https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-... Deprecating the unsecure&outdated/it's easy to shoot yourself and summarizing so you don't need to go through the rabbit hole of specs... Also follow the BCP that will remain in a draft state forever(at least for the near future): https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics https://datatracker.ietf.org/doc/html/draft-ietf-oauth-secur...

orlandohill 3y ago

Aaron Parecki has two courses on OAuth: The Nuts and Bolts of OAuth 2.0 https://www.udemy.com/course/oauth-2-simplified/ https://www.udemy.com/course/oauth-2-simplified/ Advanced OAuth Security https://www.udemy.com/course/advanced-oauth-security/ https://www.udemy.com/course/advanced-oauth-security/

shadowbanned4 3y ago

This is practical, but awful advice. Auth (z or n) has been very badly over engineered. You don't need anything more than http basic auth, the rest is just people with too much time on their hands. Oauth particularly is a travesty that their authors should be ashamed of.

mooreds 3y ago
It depends! (I work for an auth vendor, so where I stand depends on where I sit, to some extent.) I've seen and built apps that only needed built-in framework or language support. Or, best of all, don't use authentication at all. I've also seen and/or built apps that needed advanced functionality to support business requirements. For example, if you want to: * support slack-like workspace switching functionality for a single user * but allow each organization to control the login methods they want to allow, including magic links, SAML, OIDC, LDAP, etc * and make all APIs securely and scalably available to single page applications and mobile applications * across hundreds of thousands or millions of users You're going to want to use some of the more complicated standards. Basic auth ain't gonna help with that.
- shadowbanned4 3y ago
  I worked for the largest company in Canada who handled billions of dollars. You can make your decision but they won't do anything.
  - mooreds 3y ago
    They still used basic auth across all their apps?
    - shadowbanned4 3y ago
      No. They used Oauth. I wrote their entire Oauth system. And it was a nightmare reading through Oauth/OIDC specs for something that could be handled trivially with http basic auth.
  - 3y ago

BennyInc 3y ago

I can second Hackmanit from my own experience. We had them come on site some years ago to train our team. This was incredibly helpful as they also focused on what we use in house in a separate chapter.