My blog posting has taken a turn for the worse. Mainly coz I have been out of country and since returning I am busy reading up on Azure monitoring.<\/p>\n
Anyways, some quick links to tabs I want to close now but which will be useful for me later –<\/p>\n
Now for some non-Azure stuff which I am too lazy to put in a separate blog post:<\/p>\n
Set-ADFSProperties -IgnoreTokenBinding $True<\/code>) did the trick for us. So what is this token binding thing?\n\n- Token Binding seems to be like cookies for HTTPS. I found this presentation<\/a> to be a good explanation of it. Basically token binding binds your security token (like cookies or ADFS tokens) to the TLS session you have with a server, such that if anyone were to get hold of your cookie and try to use it in another session it will fail. Your tokens are bound to that TLS session only. I also found this medium post<\/a> to be a good techie explanation of it (but I didn’t read it properly*).\u00a0<\/li>\n
- It seems to be enabled on the client side<\/a> from Windows 10 1511 and upwards.<\/li>\n
- I saw the same recommendation in these Microsoft Docs on setting up Azure stack<\/a>.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
Some excerpts from the medium post (but please go and read the full one to get a proper understanding). The excerpt is mostly for my reference:<\/p>\n
\nMost of the OAuth 2.0 deployments do rely upon bearer tokens. A bearer token is like \u2018cash\u2019. If I steal 10 bucks from you, I can use it at a Starbucks to buy a cup of coffee\u200a\u2014\u200ano questions asked. I do not want to prove that I own the ten dollar note.<\/p>\n
OAuth 2.0 recommends using TLS (Transport Layer Security) for all the interactions between the client, authorization server and resource server. This makes the OAuth 2.0 model quite simple with no complex cryptography involved\u200a\u2014\u200abut at the same time it carries all the risks associated with a bearer token. There is no second level of defense.<\/p>\n
OAuth 2.0 token binding proposal cryptographically binds security tokens to the TLS layer, preventing token export and replay attacks. It relies on TLS\u200a\u2014\u200abut since it binds the tokens to the TLS connection itself, anyone who steals a token cannot use it over a different channel.<\/p>\n<\/blockquote>\n
Lastly, I came across this awesome blog post (which too I didn’t read properly* – sorry to myself!) but I liked a lot so here’s a link to my future self – principles of token validation<\/a>.<\/p>\n <\/p>\n
* I didn’t read these posts properly coz I was in a “troubleshooting mode” trying to find out why ADFS broke with token binding. If I took more time to read them I know I’d get side tracked. I still don’t know why ADFS broke, but I have an idea.<\/p>\n","protected":false},"excerpt":{"rendered":"
My blog posting has taken a turn for the worse. Mainly coz I have been out of country and since returning I am busy reading up on Azure monitoring. Anyways, some quick links to tabs I want to close now but which will be useful for me later – A funny thing with Azure monitoring … Continue reading [Aside] Various Azure links<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[258,333],"tags":[746,383,612,407,406,823],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/4030"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=4030"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/4030\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=4030"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=4030"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=4030"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}