Identity and Access Control

[EDN Admin]

Today I woke up thinking that talking about Identity and Access Control and how your strategy around that affects you (web-) apps architecture without going too deeply into the security lingo that usually comes with it. Heres the 40 minute result. I start with HTTPs "native" authentication model RFC 2617 and how thats universally bad, with both Basic and Digest authentication having issues Digest being, ironically worse for the overall security strategy. Then I dive into why models that use tokens (or cookies) are better in terms of security and scalability and explore a range of variations amongst those. <img src="http://m.webtrends.com/dcs1wotjh10000w0irc493s0e_6x1g/njs.gif?dcssip=channel9.msdn.com&dcsuri=http://channel9.msdn.com/Feeds/RSS&WT.dl=0&WT.entryid=Entry:RSSView:27400aab720d4d969d52a12301065093

View the full article