Questions tagged [authentication]
A process of proving that an entity (commonly a user or organization) is who they claim to be, or who they were previously identified as being. Authentication does not guarantee that particular entity's identity absolutely, it just proves that they are the same agent that has previously successfully asserted their identity. There are three factors (types) of authentication, and a particular authentication process may combine two or more different factors.
2,236
questions
0
votes
0
answers
36
views
How to prevent Apache mod_authnz_ldap to authenticate on non-existent DirectoryIndex entries?
I have been investigating why mod_authnz_ldap/mod_auth_basic are emitting failed authentication messages even when user and password are correct.
I realized that when the URL ends without the file ...
- 1
-2
votes
1
answer
26
views
Why are users' PINs not accepted at Windows' "Your pin is required to log in" prompt?
Windows Hello says "Your PIN is required to sign in.
But when users enter their pin it is not accepted.
0
votes
0
answers
33
views
Spire deployment on kubernetes and certificate retrieval
I am currently trying to deploy spire on my k8s cluster (3 worker nodes). My objective is to successfully deploy spire and use the certificates generated by the spire-server to encrypt the exchanges ...
- 1
0
votes
0
answers
54
views
FreeRADIUS authorization
We currently have FreeRADIUS to either forward or drop requests (to authentication server) based on the AV pairs received during client authentication (shown below). However what I would like to do ...
0
votes
0
answers
27
views
Azure Entra Proxy images load on Edge but not Chrome Authentication Issue
I've noticed an odd issue that occurs only on Chrome, but not on Edge.
We have a web app server (IIS) and an image server. Both are accessed externally by users via an Azure Entra Proxy service.
-if ...
- 291
1
vote
1
answer
71
views
sssd allows switching via su to users blocked from ldap_access_filter for users that can log in
My department is switching to using sssd with ldap for logins on all of our linux hosts. I've got it all working, but there was one issue I was hoping to resolve before continuing testing in our dev ...
- 21
0
votes
0
answers
69
views
Verify a JWT Token issued by Entra AD App Registration in Asp .NET core
I right now have an Entra/Azure AD App registration that is being used by a small Angular SPA to authenticate it to .net core APIs.
when I decode the JWT the iss is
"iss": "https://sts....
- 101
2
votes
0
answers
192
views
Why I can't activate SSL on my Ubuntu Server (20.04) with ldap auth? (ldaps)
I have to activate SSL for secure comunications with ldap, I count with Letsencrypt .pem files (chain, fullchain, cert & privkey).
I followed the steps of some pages but it didn't had any effect ...
- 21
0
votes
2
answers
81
views
GPO Wireless Settings - Trusted Root CA
We pushed SSID configuration by GPO. Computer configuration > Policies > Security Settings > Wireless Network Policies.
In these settings we enabled certificate authentication, however the ...
- 1
0
votes
1
answer
238
views
Windows Server - many event id 4625 authentication failures
In a small network environment, we have one Windows Server with Domain Controller, DHCP and DNS.
When every non-domain Windows client connects to the network, a lot of 4625 logon failure events are ...
- 101
0
votes
0
answers
27
views
How to Reduce Delay in Displaying Incorrect Password message on Domain PC
I've been encountering an issue with domain PCs where it takes a longer time to notify entering of incorrect password. After conducting some research, we identified that the delay is caused due to ...
0
votes
0
answers
13
views
Where is the proper place to save the authentication token in SSO scenarios?
Caddy web server has a forward_auth directive, that as the name suggests, can forward any incoming request to an outside source and that outside source can decide on whether to accept the request and ...
- 513
0
votes
0
answers
51
views
Establishing mutual authentication over SSH using SPIFFE
For this learning purpose I have created a k8s cluster using 4 azure VMs (VM1, VM2, VM3 & VM4).I have followed the spiffe doc to deploy spire-server and spire-agent on a k8s infra. I have kept all ...
0
votes
1
answer
129
views
freeipa server home directory automount
I have installed freeipa-server on centos and enrolled an ubuntu server to it, I have a freebsd server which is our storage server(I am going to enrolled the freebsd (storage server) to this freeipa-...
- 13
0
votes
0
answers
50
views
HashiCorp Nomad OIDC authentication with nested ListClaimMappings
I've setup a HashiCorp Nomad server and I want to add an OIDC authentication method.
I've made all preparations on the OIDC provider, added config to Nomad server but I cannot seem to get in ...
- 126
1
vote
1
answer
148
views
Combining OpenLDAP and Active Directory via OpenLDAP meta backend
We have an application that used to authenticate via our Atlassian Crowd instance, but after a major rewrite that authentication source is not available anymore. Now I need a solution to authenticate ...
- 25k
0
votes
1
answer
211
views
SPF records pass in Gmail sends but show failure in Postmaster
I'm using Sparkpost as the ESP to warm up a secondary domain. We've used this Sparkpost IP for our primary domain for a few months without a problem. I've been tracking the deliverability of the ...
-2
votes
2
answers
271
views
What updates `/var/log/btmp`? How to stop it?
Before providing an answer, please read the question till then end. ESPECIALLY THE SECTION on "Solutions" I am not looking for!
I have a server which runs SSH on a public IP address. ...
- 231
1
vote
1
answer
62
views
How is the authentication token generated for the IBM Tivoli Netcool/OMNIbus ObjectServer REST API?
We have an application that sends a request to an IBM Tivoli Netcool/OMNIbus 8.1 server's ObjectServer REST API. It sends a GET request to http://1.2.3.4/objectserver/restapi/alerts/status?filter=...
- 283
0
votes
0
answers
48
views
Determine which app send requests to Kerberos
We have a guacamole/mstsc in order to get to our windows instances, the problem in additional requests which comes from background application and i cant determine which one is that.
For example.
I ...
- 101
0
votes
0
answers
77
views
I have enabled authentication and still can connect without username and password to MongoDB
I have the following in my /etc/mongod.conf:
# set parameter options
setParameter:
enableLocalhostAuthBypass: false
# security options
security:
authorization: enabled
#keyFile: replace_me
I ...
- 234
1
vote
0
answers
566
views
Entra Id (AAD) certificate based authentication (CBA) client certificate validation failed ("invalid request") error
I'm trying to get CBA to work according to this article:
https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-certificate-based-authentication
I created a self-signed CA for testing ...
- 11
0
votes
1
answer
106
views
su: failed to execute 1 sudo dpkg-reconfigure locales: No such file or directory
I was configuring a linux server and after an apt upgrade this message came up whenever I try to change the user to root.
If I do sudo su -, su -, sudo -i I cannot change user because it says that
su: ...
- 1
0
votes
0
answers
76
views
How to rotate secrets in an untrusted Kubernetes environment
I'm automating the provisioning of Kubernetes environments for developer users. I'd like to regularly rotate the resources of kind 'secret' that are inside these environments. Furthermore, I'd only ...
- 113
2
votes
1
answer
431
views
RHEL 9 use ldap (AD) for authentication only
I want to manage users locally on an RHEL 9 system. I want to create, delete, associate with groups all locally. However I want their password to be validated against LDAP. If they don't exists in ...
- 21
1
vote
1
answer
339
views
AD FS Access Control Policy to permit specific groups and require MFA
We use an on-premise AD FS server (currently on Windows Server 2019), with several "relying party" applications. This is connected to local Active Directory, which in turn syncs to an Azure ...
- 13k
0
votes
0
answers
28
views
User dashboard: how to make sure user cannot access other people's data?
A user can log in to their dashboard. When they log in, the front end pulls data from an S3 bucket corresponding to the user, like (e.g.) bucket/data/user5/data.json. This data is then rendered into a ...
- 111
-2
votes
1
answer
26
views
Computer does not print, accept remote-connections nor open SMB folders until restart
I encountered a Windows 10 which seems to have problems with authentication. The computer does not accept remote connections, does not open smb-folders or print a file (no error shown, when the pc ...
- 101
1
vote
0
answers
351
views
How to set up a persistent access token for service account?
I am trying to connect Google's Vertex AI API to a desktop app written in C++ using their REST APIs. Auth token is part of the process. Being very distant from devops and GCP tech in general I wonder ...
google-cloud-platform
0
votes
0
answers
55
views
Nginx as reverse proxy for Gitblit with client certificate authentication. Peer closed connection in SSL handshake while SSL handshaking to upstream
We used the nginx as reverse proxy for the gitblit with client certificate authentication.
Given the nginx configuration as below.
server {
listen 443 ssl http2 default_server;
server_name _;
...
- 101
0
votes
0
answers
224
views
Is there a way to add SAML-based SSO to an unauthenticated application I am hosting?
I am running an application that doesn't have authentication built-in. I would like to require Google SSO with SAML as a way for users to be allowed to use the application. I am looking for any advice ...
- 101
0
votes
1
answer
282
views
With postfix, how do you setup SASL with dovecot to receive SMTP mail and cyrus to authenticate?
I had a static IP address and setting up my mail relay was as easy as:
mynetworks = ... <static IP address> ...
(and of course authorize all incoming mail from mynetworks).
Now that I do not ...
- 2,276
0
votes
0
answers
56
views
Where does .env (which contains the client secret) go?
I have a React app with a Node.js server.
Here is the directory structure:
.env
app
.env
.gitignore
build/
node_modules/
package copy.json
package-lock.json
package.json
...
- 111
0
votes
1
answer
307
views
AWS Cognito: auth page not showing up, DNS_PROBE_FINISHED_NXDOMAIN from hosted UI URL
Here is the url I am navigating to:
https://auth.[domain].com/oauth2/authorize?client_id=[id here]&response_type=code&scope=email+openid+phone&redirect_uri=https%3A%2F%2F[domain]%2F[...
- 111
0
votes
1
answer
309
views
Pubkey authentication not allowing to enter the server
I'm trying to access my server through SSH using pubkey authentication, but it's not working and I don't understand why. I've been around this same issue for 2 days now.
I'm using Ubuntu 20.04. All I ...
- 101
1
vote
0
answers
308
views
With a locally hosted Traefik proxy, what should my "trustedIPs" be for Authelia
I had a working docker stack with my home media server using a single docker compose file:
version: "3"
secrets:
authelia_jwt_secret:
file: $SECRETS_PATH/authelia/jwt_secret
...
- 274
0
votes
2
answers
595
views
Google Cloud Platform authentication - unable to list projects or set project
I had previously authenticated with Google Cloud Platform and everything was working correctly, however all of a sudden, today I started receiving errors mentioning google-gax in a Node app:
2023-09-...
0
votes
0
answers
85
views
Gitlab Access Tokens, protected by authenticating Apache Reverse Proxy?
We hide a Gitlab instance (among several other applications) behind a single Apache Reverse Proxy, that is doing user authentication (OpenID) before granting further access to the lower services.
This ...
0
votes
0
answers
110
views
Apache 2.4 unixgroup authentication not working
Require unix-group is not working for me when configuring the VirtualHost for my Apache server. Whenever I log in using pwauth, the server still authenticates users who are not members of the group ...
- 1
0
votes
0
answers
92
views
Redis - Unable to Authenticate
I have been trying to set up an Authelia instance for the last week or so and keep running into an issue where it won't authenticate to the Redis instance (both in Docker). I suspected it was because ...
- 101
0
votes
1
answer
1k
views
Is password needed when connecting via Cloud SQL Auth Proxy?
It seems like it's needed, because it asks me for the password. But if so, then what's the point in having 2 credentials (a credentials file + password)?
If not, then what am I missing?
The docs is ...
- 2,298
0
votes
0
answers
63
views
Authenticating to Hashicorp Consul from a VM
I am trying to understand how can I authenticate to Consul from a VM. I have Azure AD as IDP, but it's not clear from the documentation whether it can be used to retrieve JWT token to use it later to ...
- 31
1
vote
0
answers
431
views
AuthorizedKeysCommand setup prompts for password
The issue: Even though I've set up AuthorizedKeysCommand and password authentication is stopped when I attempt to log in from my Mac, I am still being asked to enter the password:
OS: Rocky Linux 9.2
...
- 31
0
votes
0
answers
193
views
Using shadow password from LDAP while using SSSD for identity
I'd like to use SSSD ldap as a provider for shadow entries. It seems to be supported, given the default config with sssd installed adds sss to both passwd and shadow in nsswitch.conf, but I can't get ...
- 1,306
3
votes
1
answer
448
views
Configure postfix to enforce client certificate authentication for one domain
I have a postfix server which processes mails for several domains. The server is using TLS encryption if the client requests ist, but does currently not enforce it for compatibility reasons.
Now there'...
- 185
0
votes
0
answers
127
views
how to set up eat /etc/pam.d/radiusd file to authenticate a user with his username, password and Google Authenticator token. Using Freeradius for 2FA
i have a problem about configuring the “/etc/pam.d/radiusd” file.
I am working on a Linux Debian System.
rn this is my configuration:
auth requisite pam_google_authenticator.so forward_pass
auth ...
1
vote
0
answers
877
views
curl only attempting public key auth for SFTP, not printing SSH authentication methods available
I am trying to use curl to connect to an SFTP server. The server only accepts password authentication. When I try to connect, curl only attempts public-key auth.
$ curl --verbose --insecure 'sftp://...
- 499
1
vote
2
answers
501
views
pam: reducing auth method timeout
I have set up user fingerprint auth on Fedora 37 laptops.
With fingerprint auth as default auth choice, pam is waiting by default for 10 seconds for a valid fingerprint. Now, I would like to reduce ...
- 263
1
vote
2
answers
448
views
How do I query user attributes from a Samba AD DC in Linux with Kerberos auth?
An answer exists for querying AD with password auth, which is working fine locally. What about Kerberos auth? Running ldapsearch with GSSAPI auth yields the following error:
$ ldapsearch -ZZ -Y GSSAPI ...
- 163
0
votes
0
answers
104
views
Using Google Authentication on iPhones on Aruba wireless
We have set up Google Authentication for our Aruba WiFi network. We are using Central (v 8 and 10 - both have the issue) and AP-515s and AP-535s. The solution works as expected on every platform ...
