How does the Token-Based Authentication work?

Digital transformation brings security concerns for users to protect their identity from bogus eyes. According to US Norton, on average 8 lakh accounts are being hacked every year. There is a demand for high-security systems and cybersecurity regulations for authentication.  

 

Traditional methods rely on single-level authentication with a username and password to grant access to web resources. Users tend to keep easy passwords or reuse the same password on multiple platforms for their convenience. The fact is, there is always a wrong eye on your web activities to take unfair advantage in the future. 

Due to the rising security load, two-factor authentication (2FA) come into the picture and introduced Token-based authentication. This process reduces the reliance on password systems and added a second layer to security. Let’s straight jump on to the mechanism.

But first of all, let’s meet the main driver of the process: a T-O-K-E-N !!!

 

What is an Authentication Token?

A Token is a computer-generated code that acts as a digitally encoded signature of a user. They are used to authenticate the identity of a user to access any website or application network.

A token is classified into two types: A Physical token and a Web token. Let’s understand them and how they play an important role in security.

·       Physical token: A Physical token use a tangible device to store the information of a user. Here, the secret key is a physical device that can be used to prove the user’s identity. Two elements of physical tokens are hard tokens and soft tokens. Hard tokens use smart cards and USB to grant access to the restricted network like the one used in corporate offices to access the employees. Soft tokens use mobile or computer to send the encrypted code (like OTP) via an authorized app or SMS.

·       Web token: Authentication via web token is a fully digital process. Here, the server and the client interface interact upon the user’s request. The client sends the user credentials to the server and the server verifies them, generates the digital signature, and sends it back to the client. Web tokens are popularly known as JASON Web Token (JWT), a standard for creating digitally signed tokens.

A token is a popular word used in today’s digital climate. It is based on decentralized cryptography. Some other token-associated terms are Defi tokens, governance tokens, Non-Fungible tokens, and security tokens. Tokens are purely based on encryption which is difficult to hack.  

What is a Token-based Authentication?

Token-based authentication is a two-step authentication strategy to enhance the security mechanism for users to access a network. The users once register their credentials, receive a unique encrypted token that is valid for a specified session time. During this session, users can directly access the website or application without login requirements. It enhances the user experience by saving time and security by adding a layer to the password system.

A token is stateless as it does not save information about the user in the database. This system is based on cryptography where once the session is complete the token gets destroyed. So, it gets the advantage against hackers accessing resources using passwords.  

The most friendly example of the token is OTP (One Time Password) which is used to verify the identity of the right user to get network entry and is valid for 30-60 seconds. During the session time, the token gets stored in the organization’s database and vanishes when the session expired.  

Let’s understand some important drivers of token-based authentication-

·       User: A person who intends to access the network carrying his/her username & password.

·       Client-server: A client is a front-end login interface where the user first interacts to enroll for the restricted resource.

·       Authorization server: A backend unit handling the task of verifying the credentials, generating tokens, and send to the user.

·       Resource server: It is the entry point where the user enters the access token. If verified, the network greets users with a welcome note.

How does Token-based Authentication work?

Token-based authentication has become a widely used security mechanism used by internet service providers to offer a quick experience to users while not compromising the security of their data. Let’s understand how this mechanism works with 4 steps that are easy to grasp.

How Token-based Authentication works?

1. Request: The user intends to enter the service with login credentials on the application or the website interface. The credentials involve a username, password, smartcard, or biometrics

2. Verification: The login information from the client server is sent to the authentication server for verification of valid users trying to enter the restricted resource. If the credentials pass the verification the server generates a secret digital key to the user via HTTP in the form of a code. The token is sent in a JWT open standard format which includes-

·       Header: It specifies the type of token and the signing algorithm.

·       Payload: It contains information about the user and other data

·       Signature: It verifies the authenticity of the user and the messages transmitted.

3. Token validation: The user receives the token code and enters it into the resource server to grant access to the network. The access token has a validity of 30-60 seconds and if the user fails to apply it can request the Refresh token from the authentication server. There’s a limit on the number of attempts a user can make to get access. This prevents brute force attacks that are based on trial and error methods.  

4. Storage: Once the resource server validated the token and grants access to the user, it stores the token in a database for the session time you define. The session time is different for every website or app. For example, Bank applications have the shortest session time of about a few minutes only.

So, here are the steps that clearly explain how token-based authentication works and the main drivers driving the whole security process.

 

Note: Today, with growing innovations the security regulations are going to be strict to ensure that only the right people have access to their resources. So, tokens are occupying more space in the security process due to their ability to tackle the stored information in the encrypted form and work on both websites and applications to maintain and scale the user experience.  Hope the document gave you all the know-how of token-based authentication and how it helps in ensure the crucial data is being misused. 

 

Setting TLS Version For Azure App Services

If we are looking to set the minimum TLS version via the portal, we first have to open up our App Service and look down the left-hand menu for TLS/SSL settings.

On this screen, we can edit the TLS minimum version, which should really be 1.2 at all times.

And we are done! A very easy setting to change that adds a tonne of security benefits.

Thank you! Happy Learning.

Data Binding in Angular

 Data binding is the core concept of Angular 8 and used to define the communication between a component and the DOM. It is a technique to link your data to your view layer. In simple words, you can say that data binding is a communication between the typescript code of your component and your template which the user sees. It  makes easy to define interactive applications without worrying about pushing and pulling data.

Data binding can be either one-way data binding or two-way data binding.

One-way databinding

One-way databinding is a simple one-way communication where the HTML template is changed when we make changes in TypeScript code.

Or 

In one-way databinding, the value of the Model is used in the View (HTML page) but you can't update Model from the View. Angular Interpolation / String Interpolation, Property Binding, and Event Binding are the example of one-way databinding.

Angular provides four types of data binding and they are different on the way of data flowing.

•  String Interpolation 

String interpolation

String Interpolation is a one-way databinding technique which is used to output the data from a TypeScript code to HTML template (view). It uses the template expression in double curly braces to display the data from the component to the view.

For example:

{{ data }}

String interpolation adds the value of a property from the component:

Syntax:

1. <li>Name: {{ user.name }}</li>  
2. <li>Email: {{ user.email }}</li>  

• Property Binding

Property Binding

Property Binding is also a one-way data binding technique. In property binding, we bind a property of a DOM element to a field which is a defined property in our component TypeScript code.

For example:

<img [src]="imgUrl"/>

Syntax:

1. <input type="email" [value]="user.email">  

• Event Binding

Event Binding

In Angular 8, event binding is used to handle the events raised from the DOM like button click, mouse move etc. When the DOM event happens (eg. click, change, keyup), it calls the specified method in the component. In the following example, the cookBacon() method from the component is called when the button is clicked:

For example:

1. <button (click)="cookBacon()"></button>

Two-way databinding

In two-way databinding, automatic synchronization of data happens between the Model and the View. Here, change is reflected in both components. Whenever you make changes in the Model, it will be reflected in the View and when you make changes in View, it will be reflected in Model.

This happens immediately and automatically, ensures that the HTML template and the TypeScript code are updated at all times.

Two-way Data Binding

We have seen that in one-way data binding any change in the template (view) were not be reflected in the component TypeScript code. To resolve this problem, Angular provides two-way data binding. The two-way binding has a feature to update data from component to view and vice-versa.

In two way data binding, property binding and event binding are combined together.

Syntax:

1. [(ngModel)] = "[property of your component]" 

Thank you! Happy Learning !!!!!!!!!!

What's the difference among app.use, app.run, app.map in Owin? When to use what?

 When dealing with a request we use IApplicationBuilder. And we have four methods available to interact with a request:

• Use
• Run
• Map
• MapWhen

These are called Request Delegates.

Use:

Adds a middleware to the application pipeline and it can either pass the request to next delegate or it can end the request (short- circuit request pipeline). It is the most commonly used method to interact with middleware. 

More simple (app.use inserts a middleware into the pipeline which requires you to call the next middleware by calling next.Invoke()).

 Run:

app.run inserts a middleware without a next, so it just runs.

Map: 

With app.map you can map paths, which get evaluated at runtime, per request, to run certain middleware only if the request path matches the pattern you mapped.

MapWhen:

Behaves almost the same as Map except that we can specify the detailed condition by using a HttpContext object. We could check for URL, headers, query strings, cookies, etc).

Thank you 

AZ-305 Exam question and answer

 Azure Monitor includes several different tools. Three of the options below are tools that are included in Azure Monitor. Which ones are they?

Ans:- VM Insights

Smart Alerts

Resource Mapper

Container Insights

Log Analytics

 

___________ is a part of Azure Monitor that monitors the availability, performance, and usage of web applications in the cloud and on-prem.

Ans :- Application Insights

Container Insights

VM Insights

Log Analytics

In Azure Monitor, ____________ allow you to perform data analysis and to create visual reports right in the Azure portal.

Dashboards

Power BI

Ans:- Workbooks

Playbooks

_________________ is a set of tools that provides support when issues with Azure services crop up and affect your environment. It consists of three different services, including Azure Status, Service Health, and Resource Health.

Azure Monitor

Azure Service Monitor

Ans:- Azure Service Health

Application Insights

 

____________________ is used to collect and view security analytics data and threat intelligence data in your environment. It uses Microsoft’s analytics and threat intelligence to detect previously undetected threats, and can be used to investigate incidents, using artificial intelligence.

Azure Security Center

Ans:- Azure Sentinel

Azure Monitor

Azure Attack Simulator

 

Which tool would you use to allow Steve to manage only the resources in the Finance resource group, while allowing Jen to manage only the resources in the Marketing resource group?

Resource Locks

Resource Tags

Ans:- Azure RBAC

Azure AD RBAC

 

RBAC roles can be assigned to ______________, __________________, _________________, and _______________.

Users, Resources, Groups, Managed Identities

Users, Resource Groups, Management Groups, Service Principals

Users, Groups, Distribution Lists, Managed Accounts

Ans:- Users, Groups, Service Principals, Managed Identities

 

A _____________ is a collection of permissions that defines the actions that can be performed by the entity to which it is assigned.

Ans:-Role Definition

Security Principal

Role Group

Managed Identity

 

Steve is a member of the Marketing group. The Marketing group is a member of the Sales group, which has been granted the Contributor role at the subscription scope. Steve will inherit the permissions defined in the Contributor role that is assigned to the Sales group.

Ans:- True

False

 

The Blue Widget Corp is deploying Azure AD. They will require dynamic groups, self-service group management, and self-service password reset for on-prem users. Which edition of Azure AD should they deploy in order to get these features, while minimizing costs?

Azure AD Free

Azure AD Basic

Ans:-Azure AD Premium P1

Azure AD Premium P2

 

You've been asked to check on how many users have administrative access in your Azure AD environment. Which identity governance tool should you use to accomplish this?

Entitlement Management

Ans :- Azure AD Access Reviews

Privileged Identity Management

Activity and Auditing

 

The Blue Widget Corp is a brand-new startup in the planning stages. They want to deploy a cloud-based version of Active Directory that supports group policy, Kerberos, and NTLM. Which Active Directory solution should you recommend?

Azure Active Directory Free

Azure Active Directory Premium P1

Azure Active Directory Premium P2

Ans:- Azure Active Directory Domain Services

 

Azure AD Identity Protection default policies that administrators can choose to enable. Select the default policies below.

There are multiple correct answers.

Ans:- MFA Registration Policy

User Lockout Policy

Ans:- User Risk Remediation Policy

User Expiry Remediation Policy

Ans:- Sign-In Risk Remediation Policy

 

___________________ is an Azure AD service that allows you to manage, control, and monitor access to resources in Azure AD, Azure, and other Microsoft Online Services such as Microsoft 365 or Microsoft Intune.

Azure AD Access Reviews

Ans :- Privileged Identity Management

Azure Identity Protection

Azure Security Center

 

You've been asked to enable just-in-time privileged access to Azure AD and Azure resources within the Blue Widget Corp subscription. Which tool or service would you use to accomplish this?

Azure Security Center

Resource Locks

Ans:- Privileged Identity Management

Identity and Access Management

 

To use Privileged Identity Management, you must first have an ________________ license.

Azure AD Free

Azure AD Premium P1

Ans:- Azure AD Premium P2

All Answers Are Correct

 

The four levels of management, in order of precedence, that are available in Azure include _____________, ______________, __________________, and _________________.

Ans:- management groups, subscriptions, resource groups, resources

subscriptions, tenants, resource groups, resources

management groups, tenants, subscriptions, resource groups

tenants, management groups, subscriptions, resource groups

 

______________ can be used to manage access, policy, and compliance for multiple subscriptions.

Tenants

Subscription Groups

Ans:- Management Groups

None of the Above

 

The organization that you work for is an MSP that supports several dozen customers. You've been asked to streamline the management of your customers' resources via Azure delegated resource management. Which solution should you recommend to make this happen?

Azure Sentinel

Ans:- Azure Lighthouse

Azure Monitor

Azure Management Group

 

When you create an Azure policy, you start with the _________________, which defines the conditions under which the policy will be enforced. Several policy definitions can be grouped together to form ______________. Once a policy definition or initiative has been created, __________________ is used to assign the policy definition or initiative to a scope of resources that Azure supports.

policy initiative, a policy definition, an assignment

policy definition, a policy initiative, a scope policy

Ans:- policy definition, a policy initiative, an assignment

policy, a policy assignment, a scope

_______________ focus on resource properties during deployment and for already existing resources to ensure those resources adhere to requirements and standards that you define; whereas _________________ are used to build entire environments that adhere to requirements and standards.

ARM Templates, Azure Policies

Ans:-Azure Policies, Azure Blueprints

Azure Blueprints, ARM Templates

Azure Blueprints. Azure Policies

 

There are two service tiers available in Azure Key Vault. The ____________ tier encrypts with a software key, while the _____________ tier includes HSM-protected keys.

Ans:- Standard, Premium

Basic, Premium

Free, Standard

Free, Premium

 

When using key vault to store keys and secrets, you can monitor their access and use by enabling logging for the vault. When doing so, you can configure Azure Key Vault to archive to a storage account, or to stream to an event hub. You cannot send the logs to Azure Monitor logs.

True

Ans:-False

 

The vCore-based purchasing model is available for both the Azure SQL Database offering and the Azure SQL Managed Instance offering.

Ans:- True

False

 

The Database transaction unit (DTU)-based purchasing model is available for both the Azure SQL Database offering and the Azure SQL Managed Instance offering.

True

Ans:- False

 

The Database transaction unit (DTU)-based purchasing model is available for both the Azure SQL Database offering and the Azure SQL Managed Instance offering.

True

Ans:- False

 

You've been asked by the Blue Widget Corp to deploy an Azure SQL Managed Instance. This instance will support a customer-facing app that can get quite busy. Availability is of utmost importance. Which purchasing model and service tier should you deploy?

DTU-Based Purchasing Model and Business Critical Tier

DTU-Based Purchasing Model and Hyperscale

Ans:- vCore Purchasing Model and Business Critical Tier

vCore Purchasing Model and Hyperscale

 

Azure disk encryption is used to protect both Windows and Linux virtual machines. It uses _______________ technology on Windows VMs, and _____________ on Linux VMs to protect ________________ with full volume encryption.

Microsoft InTune, Let's Encrypt, the OS disk only

Ans:- Windows BitLocker, Linux DM-Crypt, both the OS disk and data disks

Windows BitLocker, Linux DM-Crypt, the OS disk only

Windows BitLocker, Linux DM-Crypt, data disks only

 

Transparent Data Encryption, or TDE, can be used to encrypt __________________ data files in real time.

SQL Server

Azure SQL Database

Azure Synapse Analytics

Ans:- All

None

The Blue Widget Corp employs 50 people who are geographically dispersed. These users all work from home. You've been asked to deploy a solution that allows them to connect to the corporate network in New York. Which solution should you deploy to ensure these users can connect, and that their connections are encrypted?

Ans:- Point-to-Site VPNs

Site-to-Site VPNs

ExpressRoute Connections

Local Network Gateways

 

The Single Server deployment option of Azure Database for MySQL comes in three pricing tiers: _________________, ___________________, and _________________.

Ans:- Basic, General Purpose, and Memory Optimized

Free, Basic, General Purpose

General Purpose, Advanced, Memory Optimized

Free, Basic, Standard

 

Azure Database for PostgreSQL is a _______________ database service available in the Microsoft cloud. It’s available in three deployment modes, including ___________________, ______________, and ___________________.

relational, single server, flexible server, multi-server

non-relational, free, basic, premium

non-relational, single server, flexible server, hyperscale

Ans:- relational, single server, flexible server, hyperscale

 

Inventory management systems, order management systems, reporting databases, and accounting packages are common examples of solutions that leverage relational databases.

Ans:- True

False

The Blue Widget Corp has asked you to deploy a storage solution that will serve as the backend for an IoT system that's being deployed. This IoT system will consist of environmental sensors that collect data. Your storage solution will need to hold this sensor data. There needs to be a separate partition for each device, and the data that is collected and stored needs to be ordered by the date and time that each measurement was captured. Which storage solution would be a viable solution?

Azure File Storage

Ans:- Azure Table Storage

Azure Queue Storage

Azure Blob Storage

 

The Blue Widget Corp is deploying a new, static website to host assembly diagrams of its products. These diagrams are in image format (JPG, PNG, etc). Users will access these diagrams via their web browsers. Which storage solution should you deploy to allow the organization to serve up these images?

Azure File Storage

Azure Table Storage

Azure Queue Storage

Ans:- Azure Blob Storage

Thank you! All the best