Troubleshooting the error from FIDO conformance tool(UAF), How can I solve this error? - fido

Error image
I'm currently dealing with this error for days. I don't know how I can figure out what is the KeyID and the solution for it.To me it doesn't make sense that since the tool itself creates the KeyID, I have no option to add it in my disallowedKeyIDs.. Any thoughts will be appreciated. Thank you!

The tools are trying to register three different credentials with the server. The server must return a disallow policy with all the registered KeyIDs.
The tools are sending username in the Get/Sign Get/Register, so you can track which username keyID associated with.

Related

how to get oauth client-id for steam?

I find this on official doc for client ID :
During your initial setup you will need to contact Valve with the following information:
What permissions you need the user to obtain. The required permissions are listed below with each API call.
The token lifetime.
The redirect URI to send the user back to after completing authentication/authorization.
In return, Valve will assign a Client ID for your implementation.
But they didn't mention how to contact valve for the same. I found many same questions on different platform but can't find any solution to this.
https://steamcommunity.com/oauth/login?response_type=token&client_id=client_id_here&state=whatever_you_want
I am little confuse in steam-ID and Client-ID. Are they the same? if not then how to retrive client-id from valve.
Sorry If i miss anything here
Answering my own question for someone's reference.
O-auth is not supported in stream any more, But official documentation is still there which is useless right now.
Need to implement it using Open-ID which is the only solution.
There are many PHP and other language's reference on git-hub.
If anyone need any help feel free to ask here i have implemented it successfully.
And also client-id and steam-Id are not same.

MIME type not supported on Azure Data Factory ODATA

I decorated my Controller class with [Produces("application/json")] to enforce JSON output, but did not help.
Did you find a solution to this issue? I get the same error with the same scenario, but intermittently. The user however get the same error consistently.
How to handle not supported MIME type on azure datactory?
According my experience and I searched a lot, we can't find any solutions to solve the problem. I'm afraid we can't answer you.
So I suggest that you can call the Azure Support for help , maybe they could some more effective suggestions or solution.
You could follow these steps On Portal:
New support request:
Fill the details about you problem:
Then create the request, Azure Support will email or call you later.
Hope this helps.
Thanks Leon. I was able to resolve the issue. My ODATA API (Multi-Tenant App) was in a different Tenant and the Data Factory was in a different Tenant. In my API, the ValidateIssuers was set to true and the ValidIssuers was assigned correctly - array of valid tenants. Even then this was breaking it. I set the ValidateIssuers to false and wrote my custom logic to validate the issuers. This pretty much fixed it. There was another error related to the Audience. The AAD resource property in the Data Factory Linked Service (Connection) should match the ODATA Api AD applications Application ID URI – it is case sensitive. In all these scenarios, the error was always the MIME error which was throwing me off – completely misleading. I had to do some logging in my ODATA Api to get to the actual issue.

How to block requests to server with user name / password?

We have realized that this URL http://Keyword:redacted#example.com/ redirects to http://example.com/ when copied and pasted into the browser's address bar.
As far as I understand this might be used in some ftp connections but we have no such use on our website. We are suspecting that we are targeted by an attack and have been warned by Google that we are passing PII (mostly email addresses) in our URL requests to their Google Adsense network. We have not been able to find the source, but we have been warned that the violation is in the form of http://Keyword:redacted#example.com/
How can we stop this from happening?
What URL redirect method we can use to not accept this and return an error message?
FYI I experienced a similar issue for a client website and followed up with Adsense support. The matter was escalated to a specialist team who investigated and determined that flagged violations with the format http://Keyword:redacted#example.com/ will be considered false positives. I'm not sure if this applies to all publishers or was specific to our case, but it might be worth following up with Adsense support.
There is nothing you can do. This is handled entirely by your browser long before it even thinks about "talking" to your server.
That's a strange URL for people to copy/paste into the browser's address bar unless they have been told/trained to do so. Your best bet is to tell them to STOP IT! :-)
I suppose you could look at the HTTP Authorization Headers and report an error if they come in populated... (This would $_SERVER['PHP_AUTH_USER'] in PHP.) I've never looked at these values when the header doesn't request them, so I'm not sure if it would work or not...
The syntax http://abc:def#something.com means you're sending userid='abc', password='def' as basic authentication parameters. Your browser will pull out the userid & password and send them along as authentication information, leaving the url without them.
As Peter Bowers mentioned, you could check the authorization headers and see if they're coming in that way, but you can't stop others from doing it if they want. If it happens a lot then I'd suspect that somewhere there's a web form asking users to enter their user/password and it's getting encoded that way. One way to sleuth it out would be to see if you can identify someone by the userid specified.
Having Keyword:redacted sounds odd. It's possible Google Adsense changed the values to avoid including confidential info.

OAuth in Jira - 'consumer_key_unknown' while requesting token

I am trying to connect to Jira using OAuth. I have followed this manual and I have created app link in Jira instance and configured it with proper consumer key and public key. When I try to request a token using code from the example I am getting 401 with following message (same for python and perl instance):
oauth_problem=consumer_key_unknown
I am out of ideas what can be wrong. I will appreciate any tips.
Well, I believe that I have configured Application link in the wrong place. I have been somehow navigated to the link wiki/admin/listapplicationlinks.action. Then I accidentally found plugins/servlet/applinks/listApplicationLinks which looked pretty much the same as first but content was different. I have added link to the second location and everything works well now. Sorry for confusion.
I also had this similar error. So I then used different "consumer key"(tried to make this unique) other than the given one in the example manual. After searching a lot in internet about this error, I got to know that as most people are using that same consumer key(given in example manual), a database error occurred due to which this error was thrown.

HMAC SSL Certificate Question with OAuth

I'm kinda new to this topic so please be gentle ;) I'm attempting to use a 3rd-party Health API called Dossia (http://dossia.org).
I setup a test account and have received my OAuth Consumer Key and Secret, in the config there's a line which says
define('USER_SIG_METHOD','HMAC-SHA1');
My question is how do I make my server's "Signature Method" HMAC-SHA1?
This is just a non-ssl dev box with Fedora, I do have a production box with SSL on it, but I was hoping to get a sandbox post before moving it to production.
When I curl a post, I get a 404 error and the curl handle's info reads this:
[ssl_verify_result] => -8179
So I'm assuming this is the issue, I have scoured their wiki, which is found here however the only thing it says about the signature method is that they only support HMAC, do I need to include a certificate like the one on my prod box? Or am I going in completely the wrong direction?
Any advice would help me,
Thank you!
The signature Method was not the issue here, it was an issue with the record ID needed to be consistent in order to post to the right patient,

Resources