Skip to main content

Questions tagged [authorization]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
30 views

Basic auth with socat for plain http traffic

My question is as follows: I need to organize some sort of authorization between http server and client, provided I have no access to their configuration. That needs to be as simple as possible ...
Mirimat's user avatar
0 votes
0 answers
58 views

Google Cloud Run and Identity Aware Proxy

My main goal is to deploy a R Shiny app on GCP and make it subject to authorization so that only certain users can access it. To start simple, I am not trying to deploy my docker container with my ...
dkarlez's user avatar
0 votes
1 answer
33 views

Serve static content using a (Zope, Plone) backend for Cookie-based authentication

I have a Plone site which I'd like to hide from read-only access and instead serve the contents from a static mirror (mainly for performance reasons, of course); most contents rarely change. (How to ...
Tobias's user avatar
  • 165
0 votes
0 answers
136 views

Bypassing CERT_HAS_EXPIRED leads to 401 Unauthorized

In our Next.js app, axios requests work in client components (using useEffect) but fail with a CERT_HAS_EXPIRED error from server components. As a workaround in development, we run ...
wyc's user avatar
  • 115
0 votes
0 answers
27 views

Following Istio TCP Traffic authorization tutorial and getting 'connection rejected' instead of 'connection succeeded'

I'm following the Istio security authorization TCP Traffic tutorial. On step 5, Verify that sleep successfully communicates with tcp-echo on port 9002., I get a connection rejected result rather than ...
crudestudio's user avatar
0 votes
1 answer
137 views

Why dovecot use "postfix_accounts.users" to retrieve mail user information after username/password auth?

I had set up a mail server in my Rocky Linux 9.1 that comes with postfix, dovecot and mysql (refer to https://computingforgeeks.com/how-to-setup-mail-server-on-centos/). Every thing is updated. (...
cidy.long's user avatar
  • 101
0 votes
0 answers
141 views

Apache Ranger vs Keycloak for authorization

Iam new to both Apache Ranger and Keycloak. When I was doing my research I understood that, Apache ranger and Keycloak both has the authoirzation capabilites, added keycloak has authentication ...
pacman's user avatar
  • 101
1 vote
1 answer
72 views

How is the authentication token generated for the IBM Tivoli Netcool/OMNIbus ObjectServer REST API?

We have an application that sends a request to an IBM Tivoli Netcool/OMNIbus 8.1 server's ObjectServer REST API. It sends a GET request to http://1.2.3.4/objectserver/restapi/alerts/status?filter=...
pacoverflow's user avatar
0 votes
1 answer
59 views

Can you limit a role to objects that meet a selector?

How can we limit a service account to only be able to create, list, delete etc. objects that have a specific label within a given namespace? We have engineered an hierarchy of services (which map to ...
badp's user avatar
  • 165
-1 votes
2 answers
89 views

Server authorization based on token with expiration

I'm trying to be able to create video streaming over HTTP which would specific authorization method described below, but I'm not sure how to approach this. Currently I'm using the Motion package which ...
Martin819's user avatar
0 votes
0 answers
31 views

Exchanging AD user groups with an external -not trusted- server for authentication and authorization

I'm not really sure how to short and precisely describe my problem. Thus, I was unable to find a solution or at least a hint via google. We have a Microsoft AD domain and are currently planning to use ...
PJ87's user avatar
  • 1
1 vote
2 answers
744 views

Folders untouchable: owner unknown and cannot be changed

I have a parent folder, let's call it 'P', and in P resides 5 child folders. I am administrator of this non-domain joined server, but I cannot delete these child folder or in any other way alter them. ...
Janus Engstrøm's user avatar
0 votes
1 answer
770 views

DKIM E-Mail verification - prevent receivers from accepting unsigned emails?

I have set up SPF, DKIM and DMARC in my domain (to the best that I can figure out), but I still can send spoofed emails - without a DKIM signature - and they are accepted (at least when I test with ...
Guss's user avatar
  • 2,830
0 votes
1 answer
178 views

Automatic EC2 Role Assignment

Trying to understand AWS IAM resources/concepts a little better. I know there is a way to configure an EC2 (either possibly via its underlying AMI or a launch template) so that when it launches for ...
hotmeatballsoup's user avatar
0 votes
1 answer
390 views

Can I map multiple AD groups to multiple roles on ESXi?

I have an AD joined ESXi server (v7.0) without a vCenter server. I can map an AD group to the "Administrator" role by configuring the advanced setting Config.HostAgent.Plugins.Hostsvc....
stackprotector's user avatar
0 votes
1 answer
977 views

Reverse proxy to direct different users to corresponding locations

I have a server. One of its functions is SyncThing. This app has no per-user authorization, only admin. So I decided to run different Syncthing instances for each user. For authorization process I ...
kyb's user avatar
  • 125
0 votes
1 answer
146 views

How to get Gravitee to do recursive group lookups

I have set up Gravitee APIM 3x (gateway, rest-api, console and portal). This work fine. When trying to replace the memory authentication with LDAP (FreeIPA) authentication, I am able to get the ...
Mogget's user avatar
  • 111
0 votes
0 answers
445 views

Login to SSL VPN via SSO and then use SSO inside VPN for other Service Providers possible?

I have a setup where you authorize via SAML SSO (keycloak as idp) to access a SSL VPN (fortigate as sp). Now inside the VPN there are authorization reverse proxy servers. Is it possible to have the ...
cu 29p's user avatar
  • 1
0 votes
1 answer
57 views

What role does session on the Authorization server play?

I was reading about Sessions in this article https://auth0.com/docs/users/sessions It says when a user logs in, two types of sessions are create Two sessions are created: The local session (storezero....
MrRobot9's user avatar
  • 123
1 vote
1 answer
2k views

Varnish with Basic auth returns 401

I've tried to configure Varnish on server which has Basic Auth authentication by using these solutions: https://stackoverflow.com/a/40424168/7202171 https://blog.tenya.me/blog/2011/12/14/varnish-http-...
Major Kuprich's user avatar
1 vote
1 answer
193 views

Allow only selected address to connect to openssh

I need to restrict connections to an openssh server to only three or four IP addresses. I know I can, on the CentOS 7 and Oracle Linux boxes, use firewalld or TCP wrappers. However, some of the ...
scarville's user avatar
1 vote
1 answer
817 views

NGINX auth_basic exclude GET request to specific php script

I can't seem to figure out how to exclude a specific location from auth_basic. server { server_name example.com; root /var/www/html; index index.php; auth_basic &...
droplet's user avatar
  • 113
1 vote
2 answers
423 views

Hardware token/UUID for authentication of software

Is there a unique hardware token or a UUID on every computer motherboard/BIOS that can be used to create a "strongly coupled" software? I am working on writing a proprietary software for a ...
Cyberpks's user avatar
  • 113
1 vote
0 answers
89 views

Enforce kerberos authentication for each IIS site without individual site developers being able to disable it

We have a IIS server with multiple sites that are managed by different teams. We want to standardize on and enforce Kerberos autentication for all sites with each site having an individual AD group ...
invictus's user avatar
  • 135
1 vote
0 answers
173 views

How to configure the apache authorization chain for Kerberos (mod_auth_kerb) and SSL?

What directives and conditions to configure the Apache configuration as follows: We try to authorize through Kerberos. If successful (What condition to use?), Then we redirect to URL1. Otherwise, we ...
Александр Беляков's user avatar
1 vote
0 answers
26 views

Can you implement token based authentication/authorization without a 3rd party?

fyi I'm a total newbie to server stuff (I'm an app developer, trying to implement a simple but secure api back end) It sounds simple enough, user sends his username/password, if it authenticates, you ...
Sam b's user avatar
  • 11
4 votes
2 answers
7k views

How to whitelist Authorization header in CloudFront custom Origin Request Policy?

I have created the following CloudFront Origin Request Policy: I need Authorization header (without Authorization header the AntiForgeryToken header is not forwarded) but I do not understand why ...
Hooman Bahreini's user avatar
1 vote
2 answers
24k views

Unable to start services in Centos 7 with error "Authorization not available" even as root user

I am not able to start services for the following Centos 7 server [root@myserver home]# uname -r 3.10.0-1160.11.1.el7.x86_64 [root@myserver home]# cat /etc/centos-release CentOS Linux release 7.9.2009 ...
rnoodle's user avatar
  • 111
0 votes
1 answer
65 views

What is the solution for authorizing linux users? [duplicate]

Entire company uses Linux distributions for users and and servers solutions. Company employees, when authenticate themselves to pc and are connected do company internal network, should get ...
Surg30n's user avatar
0 votes
1 answer
417 views

Proxy server capable of injecting authentication parameters/headers into the request

The idea is to have a proxy server(like SOCKS4/5, but for HTTP protocol), the purpose of this proxy server is to authenticate requests on behalf of the users, by manipulating the requests. For example ...
deigeorgiev's user avatar
0 votes
0 answers
360 views

Apache X-Authorization request header

I'm using Basic file type authorization in my Apache httpd configuration. And my http request contains X-Authorization request header instead of Authorization. I'm getting unauthorized error. How can ...
Prasaanth G's user avatar
1 vote
0 answers
46 views

Login Active-Directory account require different username values in loginwindow and switch user

I've just bind my machine (running Mojave) to new AD server and would like to login to an existing AD account from loginwindow startup screen, but all I get is a tilted password record (indicator that ...
Zohar81's user avatar
  • 111
0 votes
1 answer
601 views

Authorize an user to use a permission-required software downloaded in program file(x86)

There are several permission-required software downloaded in program file(x86) in my company. Every time users need to use them, I have to go to their computers and type the password of administrator ...
YYCcvb's user avatar
  • 1
0 votes
2 answers
4k views

Apache authentication fails with require ldap-group

I have been trying to tie apache on a windows server to our active directory server for authentication and authorization. In order to test it, I have been trying the "ldap-status" handler, with the ...
Matteo Tassinari's user avatar
2 votes
2 answers
24k views

How can one allow or deny an ssh login for a specific user(s) or group(s) on an sshd server?

How can one allow or deny an ssh login for a specific user(s) or group(s) on an sshd server? (I realize SE has similar questions, but not I could find any that address this specific point. All others ...
Johnny Utahh's user avatar
0 votes
1 answer
5k views

Error 404 when trying to access Kubernetes dashboard from remote laptop using SSH proxy

I have a remote cluster on a remote private Cloud to which I have only SSH access (no GUI). I started the proxy server with: kubectl proxy --address=0.0.0.0 --accept-hosts=.* And started a local SSH ...
Karim Manaouil's user avatar
2 votes
2 answers
2k views

PAM dynamic LDAP Authorization with groups

At the moment my PAM is integrated through LDAP with a custom authentication stack in the /etc/pam.d/systhem-auth: auth required pam_env.so auth required pam_faildelay.so ...
LucaP's user avatar
  • 71
2 votes
3 answers
10k views

How to keep Authentication header with redirect using NGINX ingress annotations

I have an nginx ingress controller for my kubernetes cluster. I have a need to add a permanent redirect to an ingress which I can successfully do with nginx.ingress.kubernetes.io/permanent-redirect: "...
G. Ball's user avatar
  • 131
1 vote
1 answer
254 views

IP-based Authentication

Is there a way to authenticate an user account (active directory) via ldap only when it is requesting from a specific ip range? In any other cases, the user account should not work. Short: Is it ...
dev_user's user avatar
2 votes
2 answers
10k views

Authorization based on custom Header (Apache)

I have a service running behind a Apache Reverse-Proxy that uses the custom headers "username" and "role" to identify users and their role. I want Apache HTTPD to restrict access to to people whose ...
juo's user avatar
  • 33
-1 votes
1 answer
3k views

dovecot with LDAP can't find userPassword

I'm new to LDAP and I'm trying to use it with Dovecot for authentication. When I test out my setup with Telnet and IMAP, it reports 'userPassword not found'. However a simple search using the same ...
user3017691's user avatar
2 votes
1 answer
223 views

Understanding AWS Cloudfront's origin access identifiers

I do not really understand the security behind AWS Cloudfront's OAI. The only thing it does is switch the bucket's domain. Instead of accessing the bucket with https://s3.amazonaws.com/[Bucket]/* it ...
Zaid Amir's user avatar
  • 179
1 vote
0 answers
554 views

Cannot use integrated security with netcore app on iis installed as a web site

I have a little test project in netcore (2.1.401) that returns the logged in user via CNTLM. I deployed it to an IIS server following [this guide]. I also added the website to the hosts file. If I ...
opensas's user avatar
  • 1,191
1 vote
0 answers
179 views

Reauthorize Google Container Registry GCR to read from Github

When trying to create a new Build Trigger I get the following response, after selecting Github as a source: Google Cloud Platform was not authorized to list repositories. Its access was most likely ...
Tobias Nawa's user avatar
1 vote
0 answers
527 views

How to handle multi-domain user in ldap

I have an LDAP I have to create from scratch. This will handle multiple domains, in which will be multiple apps. With multiple authorization based on each apps. I don't want to duplicate users, and ...
Dolanor's user avatar
  • 173
0 votes
1 answer
71 views

Can any user inside a organization remove a project?

Recently, I have created a project to apply full permissions on a such google account from my organization. I realized that any account could enter and destroy any project. I don't know if this is an ...
Hélson Araújo's user avatar
0 votes
1 answer
746 views

How to restrict/secure access to developer's server hosted on Internet

I am setting up two Ubuntu virtual private servers for my startup company. The "public" server (let's call it www.example.com) shall contain the publicly open company web site and restricted but (...
Rostislav Titov's user avatar
0 votes
3 answers
941 views

Apache Allow Only Authorized Users to Access File

I have an existing web site that needs to link to a pdf file on our web-server. The problem is, ONLY users who have been authenticated by logging into the site should be able to view the file. I have ...
pbuchheit's user avatar
  • 171
0 votes
0 answers
132 views

hHow to authorize Apache's users similar to Microsoft IIS?

I want to enable directory browsing in Apache and ask users to authenticate using openLDAP backend, and I want to set different groups for the folders inside Apache's web server. My goal is not to ...
Vahid Hashemi's user avatar
1 vote
0 answers
45 views

After a domain acct password change, what is the (max) length of time a windows service continue to run if not updated

I know the question is awkwardly phrased, and I also realize there are going to be multiple factors in this that don't lead to a single definitive answer. I seem recall in the past, having services ...
dave_the_dev's user avatar