Farasath blogs

The first thing I did after joining the WSO2 Identity Server team was to test the WSO2 Identity Server 5.2.0-beta pack. I had some experience playing around with OAuth so I started testing OAuth scenarios. I was able to test most grant types with ease. Then came the authorization code grant type. The usual way to test it was to setup the playground2 app and test. I wanted to look for an alternate way to test the Authorization grant type without setting up the app (partly because I was lazy to download tomcat etc. :P ) So with the help of my team member Pushpalanka, I found an alternate way to get an access token by simply using a browser redirect and a curl command. So I wanted to make a note in case someone wanted to do the same :) 1. First, log in to the Identity Server management console.        the defaults are,                   username = admin                 ...

It's been almost a week since I joined WSO2. I am now part of the WSO2 Identity Server team :) So my adventures from now on will revolve around the Identity Management area and security stuff. We are currently on our way to release Identity Server 5.2.0 beta. During alpha testing, I learnt several basics that I thought worth making a note of. Hence, this post as both a note to myself and anyone starts off with WSO2 Identity Server. A user store is basically where WSO2 IS stores all information about users such as username, password, roles etc.WSO2 Identity Server comes with a built-in LDAP-based primary user store out of the box. This is true for other WSO2 products as well. However, you also have the option of configuring any JDBC database,external LDAP or an Active Directory as the secondary user store in WSO2 IS and other products. I will focus on setting up a MySQL database as the secondary user store in WSO2 IS in this post. I will divide the process into to thre...

I am using a Xiaomi Redmi Note phone, the MIUI which is the custom ROM that comes with Mi phones gives this cool option to display network speed in the system tray. I find that useful specially when downloads are in process etc. So wanted the same for my lap top as well. I saw my friend using a similar applet in his Ubuntu machine. So with a bit of googling around I found   Netspeed Indicator Applet which  displays the total current network traffic on system tray area on panel. Y ou can check out the current download & upload speed from its drop-down menu.  Pretty simple steps to get it, Open up the terminal and, sudo add-apt-repository ppa:nilarimogard/webupd8 sudo apt-get update sudo apt-get install indicator-netspeed The applet will show up on the system tray in the next login, you have the option either monitoring network speeds for each interface (wlan , eth) separately or all at once. Here's how it would look after you get it working, ...

I have always been excited on mobile development although I had only few opportunities to get my hands dirty. I came across this series of blog posts by Rashmika Nawarathne  which tell the story of hybrid mobile development from 'why' to 'how'. I have been the following the blog posts and thought it is certainly worth sharing with others as well. You can find the introductory blog post of the series  at, http://blog.nawaratne.com/2015/10/mobile-enablement-intro.html.  You can follow the rest of the series from his blog.

GSoC 2015 - In a nutshell I got the opportunity this summer(well it summer all year in Sri Lanka) to take part in Google Summer of Code. My project was to implement the User Managed Access 1.0 specification for WSO2 Identity Server . Though I wanted to blog about the project as the project went along, I did really make it a reality. They say it's never too late to share some experience. First of all I need to thank my mentors Johann Nallathamby and Prabath Siriwardena for their absolute support to make this project a reality. Johann in particular has been helpful all the way bearing my late night calls and chats to clarify and provide feedback. The overall experience of participating in GSoC was simply "awesome". Its my first considerable contribution to an open source project. And the experience gathered during the past three months have been priceless. There were sleepless nights where i could not get things to work missing out on trivial things, other days whe...

Previously I wrote a post on my first step towards understanding OAuth. This post continues builds on that. OAuth has different types of flows targeting various scenarios or use cases. The main feature that differentiates each of these flows is the grant type. What exactly is an OAuth grant type? An OAuth grant is something that a client application could exchange for an access token from an Authorization Server. An access token typically represents a user's permission for the client application to access the resources on their behalf OAuth Grant Types The OAuth 2.0 core specification  defines four types of grants, Authorization code grant Implicit grant Resource owner credentials grant Client credentials grant In addition to these the core specification also defines a refresh grant type. There are few new additions to these as well, Message authentication code (MAC) tokens SAML 2.0 Bearer Assertion Profiles JSON Web Token grant I would like to focus on ...

A must read article explaining the vulnerabilities in some JWT libraries and the solutions to mitigate them by Tim McLean https://www.timmclean.net/2015/03/31/jwt-algorithm-confusion.html