{"componentChunkName":"component---src-templates-blog-list-template-js","path":"/141","result":{"data":{"allMarkdownRemark":{"edges":[{"node":{"excerpt":"OAuth2 is an authorization delegation protocol that allows one party’s accessing of an end user’s resources stored with another party…","fields":{"slug":"/engineering/what-is-the-difference-between-oauth1-and-oauth2/"},"html":"

OAuth2 is an authorization delegation protocol that allows one party’s accessing of an end user’s resources stored with another party without sharing any credentials. OAuth2 is often compared with SAML and OpenID Connect as their purposes and uses overlap, however these comparisons often refer to OAuth2 as OAuth. This has resulted in some confusion regarding OAuth2 and OAuth1.

\n

OAuth1 was published in 2010, and OAuth2 is a complete rewrite of OAuth1 released in 2012. The following section will go over the most significant needs that led to this rewrite, along with the change associated to address them.

\n

Support for non-browser based applications

\n

One of the commonly agreed-upon disadvantages of OAuth1 was the lack of support it offers to non-browser based application clients. OAuth2 has different authorization work flows to address authorization initiated by native application clients. This was one of the main advantages OAuth2 has over OAuth1. However, abuse of the flows in favour of convenience and ease can lead to insecure implementations of OAuth2. When using OAuth2 for mobile, desktop, or single page applications, it is recommended to refer to the IETF paper going over best OAuth2 practices for mobile apps: IETF.

\n

Ease of implementation

\n

OAuth1 was often criticized for the barrier it poses to writing a client as each exchange between client, server, and resource server requires a validation of a shared secret. This secret is used to sign the arguments for the authorization request by the client, subsequently the server signs the arguments with the client’s key to verify the legitimacy of the client. The arguments need to be passed in the exact order and is often finicky to write. Moreover, dealing with cryptographic signing of the requests in addition to this can be a pain.

\n

OAuth2 has delegated this part of the security to transfer over HTTPS. This means while OAuth1 is protocol-independent, OAuth2 requests must be sent over SSL. Since TLS already provides transport-level message privacy and integrity, some question the merit of arguably redundant client-side signing and argument sorting. Others have brought up concerns with completely delegating security to HTTPS, and mention reasons such as yet-undiscovered zero-day TLS vulnerabilities potentially compromising entire systems.

\n

Clear separation of roles

\n

The conceptualization of OAuth2 defines a resource server in addition to an authorization server. This means there is a clear separation of roles between the server that handles the authorization request, and the server that makes access-control decisions based on the response to the authorization request. This separation of concerns allows support for more flexible use cases.

\n

So, OAuth1 or OAuth2?

\n

All of the above points seem to suggest OAuth2 as a superior alternative to OAuth1, and that OAuth1 is obsolete. This is not the case. It is very rare to see a greenfield authorization system using OAuth1, and the only major player still using OAuth1 is Twitter -- they call their version OAuth1.0a. However, as far as security and usability is concerned, OAuth1 is still viable and perhaps even more secure than OAuth2 since it offers additional security on top of TLS-based precautions, and creates barriers in potentially compromising flows. An existing system that uses OAuth1 probably does not need to upgrade to OAuth2. New systems that rely on server-to-server authorization could probably leverage OAuth1 for the additional security as well. On the other hand, use cases that could benefit from a separation of concerns, non-browser support, and ease of client development should go for OAuth2.

\n

OAuth2 has received its own share of criticisms. For example, in 2012 Eran Hammer, one of the original authors of OAuth2, withdrew his name from the specification and wrote an article calling out its many flaws. However, even in this article he agreed with the usefulness of OAuth2, and that “at the hand of a developer with deep understanding of web security will likely result in a secure implementation”.

\n

OAuth2 is not necessarily more secure than OAuth1, and using OAuth2 does not inherently lead to better security. Many considerations must go into each specific implementation. For starters, the appropriate grant flow must be chosen with care pertaining to the use case; the redirect_uri must be validated sufficiently; and measures must be taken to prevent access tokens from ending up in the browser history. For additional security considerations, see this IETF work in progress draft on OAuth Security Best Current Practice.

\n","frontmatter":{"date":"May 31, 2019","updated_date":null,"description":"Learn about the differences between OAuth 1.0 and OAuth 2.0 and how OAuth 2.0 is superior to OAuth 1.0","title":"OAuth 1.0 VS OAuth 2.0","tags":["Oauth","Engineering"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/1c2dae61b8f7fee8ab8408c5d18cd8b4/14b42/pexels-photo-373543.jpg","srcSet":"/static/1c2dae61b8f7fee8ab8408c5d18cd8b4/f836f/pexels-photo-373543.jpg 200w,\n/static/1c2dae61b8f7fee8ab8408c5d18cd8b4/2244e/pexels-photo-373543.jpg 400w,\n/static/1c2dae61b8f7fee8ab8408c5d18cd8b4/14b42/pexels-photo-373543.jpg 800w,\n/static/1c2dae61b8f7fee8ab8408c5d18cd8b4/47498/pexels-photo-373543.jpg 1200w,\n/static/1c2dae61b8f7fee8ab8408c5d18cd8b4/0e329/pexels-photo-373543.jpg 1600w,\n/static/1c2dae61b8f7fee8ab8408c5d18cd8b4/2d44f/pexels-photo-373543.jpg 2250w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Ti Zhang","github":null,"avatar":null}}}},{"node":{"excerpt":"This blog post goes over how you can connect your SAAS/web application with the Azure AD world. Let’s take a look at how Azure AD works as…","fields":{"slug":"/engineering/azure-ad-as-an-identity-provider/"},"html":"

This blog post goes over how you can connect your SAAS/web application with the Azure AD world. Let’s take a look at how Azure AD works as an identity provider to provide your users with the ability to log in. e.g if anyone using Office 365, able to log on with their standard account or a federated one.

\n

Windows Azure provides a number of identity-based technologies to support such kind of requirements. As a means of illustrating this, we’ll show an example using Azure AD as an Identity Provider (IdP), connecting up to the LoginRadius SAAS application using the LoginRadius Admin Console.

\n\n

\n \n \n

\n\n

\n \n \n

\n

Here are the meanings of the terms, we have used above:

\n

Sign-On Url: This is where you want to send users to when accessing the \"application\".

\n

Reply URL: It's the Reply URL which is the address to which Azure AD will send the SAML authentication response.

\n

On the Service Provider side, the metadata from the tenant, Azure Identity Provider needs to be parsed and added to the configuration file. This is done by downloading the Azure IdP metadata file directly, e.g.

\n

https://login.microsoftonline.com/<AzureTenantID>/federationmetadata/2007-06/federationmetadata.xml

\n

This is all you need to know to go about creating a new application on the Azure portal and use Azure Ad as an Identity provider for login. With these and a number of services, Azure offers a solid convergence point for brokering connections with your web applications and workspaces.

\n","frontmatter":{"date":"May 30, 2019","updated_date":null,"description":null,"title":"Azure AD as an Identity provider","tags":["Engineering","Authentication","AzureAD"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1,"src":"/static/c3f65c00249c3107c5efe318d12ef2f9/bc59e/TN0lxUr0.png","srcSet":"/static/c3f65c00249c3107c5efe318d12ef2f9/69585/TN0lxUr0.png 200w,\n/static/c3f65c00249c3107c5efe318d12ef2f9/497c6/TN0lxUr0.png 400w,\n/static/c3f65c00249c3107c5efe318d12ef2f9/bc59e/TN0lxUr0.png 512w","sizes":"(max-width: 512px) 100vw, 512px"}}},"author":{"id":"Team LoginRadius","github":"LoginRadius","avatar":null}}}},{"node":{"excerpt":"Introduction First, let’s understand what is SSO (Single Sign-On). Introducing Single Sign On (SSO) to your customers can offer greater…","fields":{"slug":"/identity/what-is-single-sign-on/"},"html":"

Introduction

\n

First, let’s understand what is SSO (Single Sign-On). Introducing Single Sign On (SSO) to your customers can offer greater security and improved usability. That’s two of the many key benefits of SSO.

\n

Let’s face it. No one likes remembering credentials. They seem like exerting a lot of pressure on the memory. What's worse is many use the same username and password, irrespective of the application they are using.

\n

This is where the Single Sign On technology comes into focus and works like a champ. To understand this solution, let's consider an analogy: \"Imagine going to the mall, and at each store, you must register with the store for your first purchase. Then, every time after that, you have to prove who you are to buy something.\"

\n

Unfortunately, this is what happens when you shop online. Each website makes you create a new and unique identity specific to that website. On top of that, you have to login and authenticate each time.

\n

While some web properties do offer the option to sign in using social identity, the majority of customers still have to log in to each web property. This often happens even when the websites are part of the same parent organization. Let’s understand what is SSO and how SSO works.

\n

What is Single Sign-On?

\n

Single Sign-On (SSO)  is a method of authentication that allows websites to use other trustworthy sites to verify users. Single sign-on allows a user to log in to any independent application with a single ID and password.

\n

SSO is an essential feature of an Identity and Access Management (IAM) platform for controlling access. Verification of user identity is important when it comes to knowing which permissions a user will have. Talking about the sso examples, the LoginRadius Identity platform is one example of managing access that combines user identity management solutions with SSO solutions.

\n

How Single Sign On Works?

\n

Single sign-on (SSO) is a system that allows users to access multiple applications and services with just one set of login credentials.

\n

When we talk about how how SSO works- it does by authenticating a user's identity once and then granting access to all of the applications and services that the user is authorized to access. When a user attempts to access a resource from a service provider, the SSO system sends a request to the user's identity provider to authenticate the user's identity.

\n

Once the user is authenticated, the identity provider sends the necessary credentials to the service provider, allowing the user to access the requested resource. This process eliminates the need for users to remember and manage multiple usernames and passwords, streamlining the login process and improving the user experience.

\n

SSO also simplifies identity management for organizations, reducing the risk of data breaches and improving overall security.

\n

What Is a Single Sign-On (SSO) Authentication Token?

\n

An SSO authentication token is a crucial aspect of the SSO process. Once a user is successfully authenticated, the Identity Provider (IDP) generates a token. This token contains information about the user's identity and permissions. The Service Provider (SP) then recognizes this token, granting access to the user without the need for re-authentication. Tokens are typically encrypted to ensure secure transmission and storage of user data.

\n

How Are SAML and OAuth Used with Single Sign-On?

\n\n

What Makes a True Single Sign-On System?

\n

A true SSO system offers several key features:

\n\n

What is an SSO Software vs. an SSO Solution?

\n\n

What is App-to-App Single Sign-On (SSO)?

\n

App-to-App SSO authentication, also known as Service-to-Service SSO, enables seamless authentication and access between different applications within an organization's ecosystem. Instead of requiring users to log in multiple times when switching between apps, this approach maintains authentication sessions across the apps. It enhances productivity and user experience by eliminating the need for repeated logins.

\n

What is Single Sign-On (SSO) Software as a Service (SaaS)?

\n

SSO Software as a Service (SaaS) is a cloud-based solution that offers SSO functionality to organizations without the need for on-premises infrastructure. With SSO SaaS, organizations can easily implement SSO across their applications and services by subscribing to a third-party provider. This approach simplifies deployment, maintenance, and scalability of SSO, making it accessible to businesses of all sizes.

\n

How Does Single Sign-On (SSO) Fit into an Access Management Strategy?

\n

Integrating SSO authentication into an Access Management Strategy enhances security, user experience, and operational efficiency:

\n\n

Incorporating SSO into an Access Management Strategy strengthens overall security posture while simplifying user access across the organization's digital assets.

\n

What are the Benefits of Single Sign-On?

\n

Till now, we’ve learned how SSO works, now let’s understand its benefits. Single Sign-On clearly minimizes the risk of poor password habits. Also, removing login credentials from servers or network storage can help a great deal in preventing a cyber attack. 

\n

Benefits for Customers

\n

1. Seamless user experience

\n

Customers can use a single identity to navigate multiple web and mobile domains or service applications.

\n

2. Stronger password protection

\n

Because users only need to use one password, SSO makes generating, remembering, and using stronger passwords simpler for them.

\n

3. Reduces customer time

\n

The time spent on re-entering passwords for the same identity. Users will spend less time logging into various apps to do their work. Ultimately it enhances the productivity of businesses.

\n

\n \n \n

\n

Benefits for Business

\n

1. Improves conversions and revenue

\n

Customers can access all domains and services with a single active session.

\n

2. Mitigates risk

\n

Accessing third-party sites (user passwords are not stored or managed externally) becomes risk-free.

\n

3. Unifies customer profiles

\n

Creating a single instance of the customer data provides a centralized view of the customer across all channels.

\n

4. Reduces IT costs

\n

Due to fewer help desk calls about passwords, IT can spend less time helping users to remember or reset their passwords for hundreds of applications.

\n

What are the Different Types of Single Sign-On?

\n

Single sign-on (SSO) is not a one-size-fits-all solution, and there are several different types of SSO that organizations can choose from. The most common types of SSO include:

\n\n

How is Single Sign-On Implemented?

\n

Implementing single sign-on (SSO) requires careful planning and coordination between the identity provider and the service providers. The first step in implementing SSO is to choose an identity provider that supports the necessary protocols, such as SAML, OAuth, or OpenID Connect.

\n

Once the identity provider has been selected, the service providers must be configured to accept SSO requests from the identity provider. This typically involves configuring the service providers to trust the identity provider and to use the appropriate SSO protocol.

\n

The identity provider must also be configured to authenticate users and provide the necessary credentials to the service providers. Finally, the SSO system must be tested to ensure that it is working properly and that users are able to access the resources that they are authorized to access.

\n

How to Choose a Secure SSO Solution?

\n

Your SSO solution must meet the basic needs to support IT needs. That means a stable solution and a highly functional one. Today, digital transformation relies on a platform for Customer Identity and Access Management (CIAM), which includes SSO and other tools. So, here what you need to keep in mind while narrowing down your SSO solution. 

\n

\n \n \n

\n

7 Key Points to Consider While Choosing a Secure Single Sign-On Solution

\n

1. Support for Developers

\n

Make sure your SSO solution provides adequate life-cycle management API support and SDKs for major platforms.

\n

2. Authentication

\n

What about the extra layer of security? Find out if it supports MFA, adaptive authentication, automatic forced authentication, and more.

\n

3. Federation

\n

Find out if you will be allowed to use any corporate identity provider you prefer. Make sure it supports Microsoft Active Directory, Google Directory, etc.

\n

4. Mobile phones ready

\n

Ensure that your identity platform supports SSO for mobile devices and syncs well with various multi-factor authentication tools.

\n

5. Flexible rules governing passwords

\n

It should support password validation requirements like customizable password expiration limit, password complexity, and expiration notifications.

\n

6. Safety reputation

\n

Check out if it meets security standards like ISO 27017, ISO 27018, ISO 27001, SOC 2 Type 2, and global compliances like the GDPR and CCPA, etc.

\n

7. Behavioral analytics

\n

Find out if it allows you to blacklist or whitelist IPs, set responses to counter brute force attempts and there are provisions for re-authentication.

\n

How LoginRadius Single Sign-On Authentication Works?

\n

Since now you know what is an sso login, let’s understand how LoginRadius SSO is superior. Single sign on (SSO) can be implemented in several ways, but typically follows a standard or protocol, as well as several technologies which can enforce the standards/protocols listed below.

\n

1. Web SSO

\n

Web single sign-on enables your customers to access any of your connected web properties with a single identity. As customers navigate from one site to the next, your systems will be able to recognize who they are on each site.

\n

Web Single Sign-On also is known as LoginRadius Single Sign-On, is a browser-based session management system that uses browser storage mechanisms (sessionStorage, localStorage, Cookies) to hold the user session across your assets.

\n

\n \n \n

\n

This storage is stored on a centralized domain managed by LoginRadius and can be accessed via our JavaScript Single Sign-On APIs, or directly through a JSONP call. This session is integrated seamlessly into our standard Customer Identity and Access Management scripts.

\n

2. Mobile SSO

\n

Mobile single sign-on is like web SSO, except that customers can use a single identity to access connected mobile apps.

\n

\n \n \n

\n

Mobile SSO enables you to unify a user session across multiple apps that are serviced by a single account LoginRadius. It works by storing the LoginRadius access token in a shared session, either shared Android preferences or iOS keychain, which allows you to recognize a currently active session and access current user data sessions to configure your user account with each linked program.

\n

3. Federated SSO

\n

Federated single sign-on works a little differently than the web and mobile SSO. Rather than connecting websites or mobile apps, you use the login credentials held by partners. This happens by using industry-standard SSO protocols, which allow customers to gain access to web properties without authentication barriers.

\n

LoginRadius also acts as an IdP that stores and authenticates the identities used by end-users to log in to customer systems, applications, file servers, and more depending on their configuration.

\n

\n \n

SAML

\n

Security Assertion Markup Language (SAML) is an open standard enabling identity providers (IdP) to pass credentials for authorization to service providers. In simple terms, it means that you can log into several different websites using one set of credentials.

\n

LoginRadius supports both SAML 1.1 and SAML 2.0 flows to support LoginRadius either as an IDP or as a Service Provider (SP). LoginRadius supports SAML flows, both initiated by IDP and initiated by SP. 

\n

\n \n \n

\n

The LoginRadius Admin Console allows the SAML settings to be entirely self-service, allowing you to configure statements, keys, and endpoints to suit any SAML provider.

\n

JWT

\n

JSON Web Token (JWT) is a commonly used Single Sign-On protocol widely used in B2C applications and included in RFC 7519. This protocol helps you to create an encrypted token that is encoded in JSON. In LoginRadius, this can either be created via API or directly requested through the responses to the Login and Social Login interface.

\n

This token is then transferred and consumed on to the third-party service provider. The data to be collected can be mapped to the LoginRadius Admin Console. You can also configure the token's encryption method based on the service provider's specifications, which will consume the token.

\n

OAuth

\n

OAuth is an open-standard authorization protocol or framework that describes how unrelated servers and services can securely enable authenticated access to their assets without actually sharing the initial, related, single login credential. This is known as safe, third party, user-agent, delegated authorization in authentication parlance.

\n

LoginRadius may either function as an OAuth 2.0 Identity Provider or as a Service Provider delegating the authentication process to an IDP supporting the OAuth Project. The specifications for OAuth 2.0 are protected in RFC 6749.

\n

\n \n \n

\n

Such specs cover the various specifications and structured processes OAuth embraces. From the authorization of the service provider requesting authentication to the request for authorization from the end-user to the generation of the access token used to request the scoped data from the IDP after authentication.

\n

OpenID Connect

\n

OpenID Connect or (OIDC) is an authentication layer standardized by the OpenID Foundation atop the OAuth 2.0 framework. By following the specifications defined in the OpenID Connect specs, LoginRadius provides a way to integrate your OpenID Connect client with our API. These specs cover the various specifications and structured processes adopted by OpenID Link.

\n

Multipass

\n

Multipass is one of the most simple forms of authentication with SSO. Multipass is done through the generation of an authenticated JSON hash of the values to be sent to the service provider.

\n

Conclusion

\n

Deciding the best implementation method really depends on your individual situation, technical architecture, and business needs. \nIf you think a readymade SSO solution is best for your company, a customer identity provider like LoginRadius will help you achieve fast and easy implementation.

\n

FAQs

\n

1. What is an example of SSO?

\n

When we talk about what is an SSO login, the best example of SSO login is Google’s implementation of SSO in its products. For instance, if you’re logged in to Gmail, you automatically gain access to all other products of Google like YouTube, Google Drive, Google Photos, etc.

\n

2. What is the difference between single sign-on (SSO) and social login?

\n

SSO offers seamless authentication with one credential across multiple connected platforms or systems. On the other hand, social login allows users to access services by authenticating themselves using their social account credentials.

\n

3. What are the benefits and business advantages of single sign-on (SSO)?

\n

Businesses can leverage SSO to deliver a seamless user experience at every touchpoint. Moreover, SSO can help online platforms derive more conversions and growth.

\n

4. What is the difference between SSO and federation?

\n

The main difference between Identity Federation and SSO lies in the range of access. SSO allows users to use a single set of credentials to access multiple systems within a single organization (a single domain). On the other hand, Federation lets users access systems across federated organizations.

\n

5. How can I get SSO for my OTT platform?

\n

What is sso integration and how can i get it for my OTT platform? SSO integration can be done through a cloud-based CIAM solution like LoginRadius. The cutting-edge CIAM helps OTT platforms to deliver a seamless user experience across multiple touchpoints. Read more.

\n

6. What is the Single Sign-On (SSO) protocol?

\n

SSO protocol enables users to access multiple applications with a single set of login credentials using standards like SAML, OAuth, or OpenID Connect.

\n

7. What are three benefits of Single Sign-On (SSO)?

\n

Enhanced security, improved user experience, and increased productivity.

\n

8. What is the difference between Same Sign-On and Single Sign-On?

\n

Same Sign-On is not a standard term; Single Sign-On (SSO) allows users to log in once and access multiple applications securely.

\n

9. What is the purpose of Single Sign-On (SSO)?

\n

Simplify authentication for users and enhance security by allowing access to multiple applications with one login.

\n

\n \n \n

\n","frontmatter":{"date":"May 30, 2019","updated_date":null,"description":"SSO is an essential feature of an Identity and Access Management (IAM) access control platform. User identity authentication is important when it comes to understanding which permissions a user will have. One example of controlling access that integrates user identity management solutions with SSO solutions is the LoginRadius Identity platform.","title":"What is Single Sign-On (SSO) and How it Works?","tags":["sso","identity management","cx"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/a9ebd13642b2b5d88097a552e6facf0e/33aa5/what-is-sso.jpg","srcSet":"/static/a9ebd13642b2b5d88097a552e6facf0e/f836f/what-is-sso.jpg 200w,\n/static/a9ebd13642b2b5d88097a552e6facf0e/2244e/what-is-sso.jpg 400w,\n/static/a9ebd13642b2b5d88097a552e6facf0e/33aa5/what-is-sso.jpg 768w","sizes":"(max-width: 768px) 100vw, 768px"}}},"author":{"id":"Rakesh Soni","github":"oyesoni","avatar":"rakesh-soni.jpg"}}}},{"node":{"excerpt":"Every day, societies are becoming more digitized. Instead of speaking to a colleague, you’ll chat online. To hail a cab, just tap your phone…","fields":{"slug":"/identity/ccpa-introduction/"},"html":"

Every day, societies are becoming more digitized. Instead of speaking to a colleague, you’ll chat online. To hail a cab, just tap your phone screen. Need a doctor? There’s an app for that, too. All of this online activity gives businesses valuable consumer data (e.g., name, age, email addresses).

\n

However, starting January 01, 2020, the way you collect, store, and share this data may land you in trouble. If you’re unsure how the California Consumer Privacy Act (CCPA) will impact your company, keep reading. This introduction to CCPA compliance focuses on the most common questions that businesses have today.

\n

For more detailed information, including the major differences between GDPR and CCPA, check out our infographic.

\n

For now, let’s start with the basics.

\n

What is the California Consumer Privacy Act?

\n

The CCPA’s goal is to give consumers more information and control over how their personal information is being used. It will apply to all businesses that handle or collect data from California residents.

\n

What is residency based on? Basically, anyone who pays taxes to the State of California is a California consumer, whether they currently live in the Golden State or not. This California residency law site explains more:

\n

“Under California law, a person who visits the state for other than a temporary or transitory purpose is also a legal resident, subject to California taxation. Even visits can result in residency status. Examples of such visits include an indefinite stay for health reasons, extended stays (usually over six months), retirement, or employment that requires a prolonged or indefinite period to accomplish.”

\n

How do you comply with the California Consumer Privacy Act?

\n

Preparing for compliance can feel overwhelming. In fact, in a recent survey of American companies, nearly half had not begun implementing privacy policies (TrustArc, 2019).

\n

However, here are three ways you can get started now.

\n

Ensure that your decision-makers and key stakeholders know:

\n\n

Document and organize customer information, so your company knows:

\n\n

This will help you set up an efficient system for information retrieval should a customer or auditor request that info. Enlisting a Data Protection Officer or a Data Protection Team to handle these requests is a good idea.

\n

Review and update your privacy policies.

\n

A GDPR Privacy Policy will meet CalOPPA/CCPA requirements, but a CalOPPA/CCPA policy might not be GDPR-compliant. To be safe, be sure that your CCPA privacy policy is clearly defined and easily distinguishable from GDPR regulations.

\n

It’s also helpful to train your customer-facing employees on how privacy policies and CCPA compliance can improve customer trust and increase engagement.

\n

\n \n \n

\n

CCPA 2.0: What You Need to Know About the New CPRA

\n

On November 3, 2020, the voters in California approved the Consumer Privacy Rights Act (on the ballot as Proposition 24) with 56.1% of the vote. This revised version of the CCPA will further strengthen the consumer privacy rights for California citizens.

\n

We are thrilled to announce the passage of #Prop24, the California Privacy Rights Act, with a decisive majority of Californians supporting the measure to strengthen consumer privacy rights. #California once again makes history and leads the nation!

\n

— Yes on Prop 24 — Californians for Consumer Privacy (@caprivacyorg) November 4, 2020_

\n

While some of the changes took effect immediately, the law would become effective on January 1, 2023 with the majority of the enforcement set for July 1 of that year.

\n

CCPA 2.0: Key Aspects of the New CPRA

\n

Most significant new additions include:

\n\n

CCPA 2.0: Key Differences with the CCPA

\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
Parameter\n CCPA\n CPRA\n
Consumer Rights\n \n
    \n
  • Right to Know/Access \n
  • Right to Delete \n
  • Right to Opt-out of Sale \n
  • Right to Non-Discrimination\n
    • \n
\n 		All rights defined under the CCPA, plus: \n
    \n
  • Right to Rectification \n
  • Right to Limit Use and Disclosure of Sensitive Personal Information \n
    • \n
\n
Employee and B2B Exemption\n Expires on Jan 1, 2021 \n Expires on Jan 1, 2023\n
Personal Information\n Information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a consumer or household. \n Personal information, as well as “Sensitive Personal Information” which includes SSN, driver license numbers, biometric information, precise geolocation, and racial and ethnic origin etc. \n
Threshold Application\n It applies to businesses that collect personal information from California's consumers and meet any of the following:\n
    \n
  • A gross annual revenue of over $25 million.\n
  • Buy, receive, or sell the personal information of 50,000 or more California consumers, households, or devices.\n
  • Derive 50% or more of their annual revenue from selling California consumers’ personal information.\n
    • \n
\n 		It applies to businesses that collect personal information from California's consumers and meet any of the following:\n
    \n
  • A gross annual revenue of over $25 million.\n
  • Buy, receive, or sell the personal information of 100,000 or more California consumers, households, or devices.\n
  • Derive 50% or more of their annual revenue from selling or sharing California consumers’ personal information. \n
    • \n
\n
Enforcement\n \n
    \n
  • The Attorney General can pursue violations.\n
  • Consumers have a private right of action for a breach. \n
  • Businesses will have a 30–day cure period before imposing fine.\n
    • \n
\n 		\n
    \n
  • Consumers have a private right of action for a breach.\n
  • Businesses will be fined immediately with no cure period. \n
    • \n
\n
Use Limitation \n N/A \n Collection, retention, and use should be limited to what is necessary to provide goods or service. \n
\n

How Businesses Should Prepare for the New CPRA

\n

The good news for companies is that the implementation of the CPRA will not begin until July 2023. So, organizations have some time to plan out their new data policies.

\n

Step up data deletion policies

\n

Under CPRA, businesses will have to delete personal data after it has served its purpose. So, here's what you can do.

\n

Put an identity and access management (IAM) system in place to connect all personal data under centralized user profiles. With a single repository of consumer data, you can simplify compliance and abide more easily by the primary aspects of CPRA. They may include deleting personal data, making corrections, and offering reports to consumers upon request.

\n

Implement MFA for logins

\n

One way to improve the security of login credentials is by implementing multi-factor authentication (MFA). It puts a bar on automatic account access and enforces additional authentication layers such as a fingerprint or a one-time code in the event of an unusual login.

\n

It is a simple effort to prevent broken authentication attacks, such as credential stuffing, in which exposed login credentials become the gateway for identity thieves.

\n\n

With the CCPA, your organization needs to prepare for consent withdrawal. The LoginRadius Identity Platform centralizes all your customers’ personal information. You can document and manage your customers’ consent including withdrawal.

\n

Another core component of the CCPA is providing data access to auditors or customers, should they request it. With the LoginRadius Identity Platform, customer data is unified into one profile for easy access. You can also export it in an easy-to-read format.

\n

Last but not least, LoginRadius provides top-notch security that monitors and protects your customer data. For example, our CIAM software can encourage your customers to use intelligent passwords, protect the data against brute force attacks from hackers, block access to suspicious IPs, and more.

\n

Summary

\n

Following the old CCPA rules will not automatically lead to CCPA 2.0 compliance; don’t wait to be sued to find out. Let LoginRadius help your business become globally compliant. Not only does our technology meet the new CPRA regulations, but we continuously update it to meet new international privacy laws.

\n

\n \n \n

\n","frontmatter":{"date":"May 03, 2019","updated_date":null,"description":"On November 3, 2020, the voters in California approved the Consumer Privacy Rights Act (on the ballot as Proposition 24) with 56.1% of the vote. This revised version of the CCPA will further strengthen the consumer privacy rights for California citizens.","title":"California's CCPA 2.0 Passed: Everything You Need to Know About the New CPRA","tags":["ccpa","data privacy","compliance","customer trust"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":2.150537634408602,"src":"/static/6e185d6a87b7773ea2ca9a79de8d9527/c3e3a/ccpa-intro.jpg","srcSet":"/static/6e185d6a87b7773ea2ca9a79de8d9527/f836f/ccpa-intro.jpg 200w,\n/static/6e185d6a87b7773ea2ca9a79de8d9527/2244e/ccpa-intro.jpg 400w,\n/static/6e185d6a87b7773ea2ca9a79de8d9527/c3e3a/ccpa-intro.jpg 769w","sizes":"(max-width: 769px) 100vw, 769px"}}},"author":{"id":"Rakesh Soni","github":"oyesoni","avatar":"rakesh-soni.jpg"}}}},{"node":{"excerpt":"The conventional employee identity and access management (IAM) systems were initially designed to manage employee identities. And they aren…","fields":{"slug":"/identity/iam-vs-ciam/"},"html":"

The conventional employee identity and access management (IAM) systems were initially designed to manage employee identities. And they aren’t potent enough to cater to customers' diverse needs pertaining to user experience and security.

\n

Apart from this, employee IAM also doesn’t help when the needs of consumers are growing with every passing year, and internal identity management systems are not built to keep up.

\n

Users now expect a seamless and secure customer experience across multiple platforms, devices, and touchpoints. And the conventional IAM will always struggle to meet these requirements.

\n

Customer Identity and Access Management (CIAM) solutions help to improve the customer experience, reduce security risks, shrink costs, and increase the availability of applications.

\n

CIAM solutions are becoming more commonly used in organizations today because they provide several benefits. For example, a customer identity and access management (CIAM) solution can improve the customer experience by increasing the flexibility and customization of applications.

\n

CIAM solutions can also reduce security risks by allowing users to access only those applications they need for their work tasks.

\n

Finally, these solutions can be very cost-effective because they allow companies to scale their technology needs by providing an easy way to manage all users with one set of tools.

\n

This is where customer IAM solutions come in. These solutions have been built to handle customer authentication requirements, scalability, privacy and data regulations, user experience, and integration.

\n

Compared to employee IAM, a customer identity and access management (CIAM) solution improves the customer experience, reduces security risks, shrinks costs, and increases the availability of applications.

\n

In this infographic, we compare the following features of both an IAM and CIAM solution:

\n\n

\n \n \n

\n","frontmatter":{"date":"March 21, 2019","updated_date":null,"description":"In order to serve customers, conventional identity management is no longer enough. This truly ought to go without saying. After all, internal management systems were initially designed to handle employee identities, and consumer preferences are not generally matched with their preferences of a successful user experience.","title":"IAM vs. CIAM: Which Solution is Right For You?","tags":["iam","ciam","identity management"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.408450704225352,"src":"/static/33f5de275c064ffdda7e9e501bd74fa7/0756a/IAM-vs-CIAM-V01.01-01-1.png","srcSet":"/static/33f5de275c064ffdda7e9e501bd74fa7/69585/IAM-vs-CIAM-V01.01-01-1.png 200w,\n/static/33f5de275c064ffdda7e9e501bd74fa7/497c6/IAM-vs-CIAM-V01.01-01-1.png 400w,\n/static/33f5de275c064ffdda7e9e501bd74fa7/0756a/IAM-vs-CIAM-V01.01-01-1.png 768w","sizes":"(max-width: 768px) 100vw, 768px"}}},"author":{"id":"Rakesh Soni","github":"oyesoni","avatar":"rakesh-soni.jpg"}}}},{"node":{"excerpt":"What is JWT? What is OAuth2? JWT(Json Web Token) is a token format. It is digitally-signed, self-contained, and compact. It provides a…","fields":{"slug":"/engineering/using-jwt-with-oauth2-when-and-why/"},"html":"

What is JWT? What is OAuth2?

\n

JWT(Json Web Token) is a token format. It is digitally-signed, self-contained, and compact. It provides a convenient mechanism for transferring data. JWT is not inherently secure, but the use of JWT can ensure the authenticity of the message so long as the signature is verified and the integrity of the payload can be guaranteed. JWT is often used for stateless authentication in simple use cases involving non-complex systems.

\n

OAuth2 is an authorization protocol that builds upon the original OAuth protocol created in 2006, arising out of a need for authorization flows serving different kinds of applications from web and mobile apps to IoT. OAuth2 specifies the flows and standards under which authorization token exchanges should occur. OAuth2 does not encompass authentication, only authorization. For more information on OAuth2, please see IETF

\n

Using JWT with OAuth2

\n

JWT and OAuth2 are entirely different and serve different purposes, but they are compatible and can be used together. The OAuth2 protocol does not specify the format of the tokens, therefore JWTs can be incorporated into the usage of OAuth2.

\n

For example, the access_token returned from the OAuth2 Authorization Server could be a JWT carrying additional information in the payload. This could potentially increase performance by reducing round trips for the required information between the Resource Server and the Authorization Server. This is a good use case for incorporating JWT into OAuth2 implementations when transparent tokens are acceptable - there are scenarios requiring token opacity where this is not optimal.

\n

Another common way to use JWT in conjunction with OAuth2 is to issue two tokens: a reference token as access_token, and a JWT containing identity information in addition to that access token. In use cases where this implementation seems necessary, it is probably worth looking into OpenID Connect - an extension built upon OAuth2 and provides additional standardizations, including having an access_token and an id_token.

\n

A common misconception is that using JWT with OAuth2 increases the security of an application, this is not true. As mentioned earlier, JWT is not an inherently secure mechanism, and the security of OAuth2 is upheld through the definitions of the actors involved in the authorization process and the specific steps to be taken for this process in different use cases. Security concerns regarding OAuth2 are best addressed by choosing the appropriate OAuth2 grant flow for the application based on use case, not the token format.

\n

The advantages of using JWT in addition to OAuth2 is in increased performance and decreased process complexity when it comes to certain flows; however, this may increase development complexity. When deciding whether to use JWT on top of OAuth2, it is best to begin by considering whether the performance gain is meaningful to your application, and whether that is worth the additional work required for development.

\n","frontmatter":{"date":"March 11, 2019","updated_date":null,"description":"Learn how to use JWT with OAuth and when & why","title":"How to Use JWT with OAuth","tags":["JWT","Oauth","JSON Web Token"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/d14806f1306c0379a98cfb3b3feceac2/14b42/photo-1454165804606-c3d57bc86b40.jpg","srcSet":"/static/d14806f1306c0379a98cfb3b3feceac2/f836f/photo-1454165804606-c3d57bc86b40.jpg 200w,\n/static/d14806f1306c0379a98cfb3b3feceac2/2244e/photo-1454165804606-c3d57bc86b40.jpg 400w,\n/static/d14806f1306c0379a98cfb3b3feceac2/14b42/photo-1454165804606-c3d57bc86b40.jpg 800w,\n/static/d14806f1306c0379a98cfb3b3feceac2/47498/photo-1454165804606-c3d57bc86b40.jpg 1200w,\n/static/d14806f1306c0379a98cfb3b3feceac2/724e2/photo-1454165804606-c3d57bc86b40.jpg 1350w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Ti Zhang","github":null,"avatar":null}}}}]},"markdownRemark":{"excerpt":"Identity is evolving, and developers are at the forefront of this transformation. Every day brings a new learning—adapting to new standards…","fields":{"slug":"/identity/developer-first-identity-provider-loginradius/"},"html":"

Identity is evolving, and developers are at the forefront of this transformation. Every day brings a new learning—adapting to new standards and refining approaches to building secure, seamless experiences.

\n

We’re here to support developers on that journey. We know how important simplicity, efficiency, and well-structured documentation are when working with identity and access management solutions. That’s why we’ve redesigned the LoginRadius website—to be faster, more intuitive, and developer-first in every way.

\n

The goal? Having them spend less time searching and more time building.

\n

What’s New and Improved on the LoginRadius Website?

\n

LoginRadius’ vision is to give developers a product that simplifies identity management so they can focus on building, deploying, and scaling their applications. To enhance this experience, we’ve spent the last few months redesigning our interface— making navigation more intuitive and reassuring that essential resources are easily accessible.

\n

Here’s a closer look at what’s new and why it’s important:

\n

A Developer-Friendly Dark Theme

\n

\"This

\n

Developers spend long hours working in dark-themed IDEs and terminals, so we’ve designed the LoginRadius experience to be developer-friendly and align with that preference.

\n

The new dark mode reduces eye strain, enhances readability, and provides a seamless transition between a coding environment and our platform. Our new design features a clean, modern aesthetic with a consistent color scheme and Barlow typography, ensuring better readability. High-quality graphics and icons are thoughtfully placed to enhance the content without adding visual clutter.

\n

So, whether you’re navigating our API docs or configuring authentication into your system, our improved interface will make those extended development hours more comfortable and efficient.

\n

Clear Categorization for LoginRadius Capabilities

\n

\"This

\n

We’ve restructured our website to provide a straightforward breakdown of our customer identity and access management platform capabilities, helping you quickly find what you need:

\n\n

This structured layout ensures you can quickly understand each capability and how it integrates into your identity ecosystem.

\n

Developer-First Navigation

\n

\"This

\n

We’ve been analyzing developer workflows to identify how you access key resources. That’s why we redesigned our navigation with one goal in mind: to reduce clicks and make essential resources readily available.

\n

The new LoginRadius structure puts APIs, SDKs, and integration guides right at the menu bar under the Developers dropdown so you can get started faster. Our Products, Solutions, and Customer Services are also clearly categorized, helping development teams quickly find the right tools and make informed decisions.

\n

Quick Understanding of Integration Benefits

\n

\"This

\n

Developers now have a clear view of the tech stack available with LoginRadius, designed to support diverse business needs.

\n

Our platform offers pre-built SDKs for Node.js, Python, Java, and more, making CIAM integration seamless across popular programming languages and frameworks.

\n

Over to You Now!

\n

Check out our revamped LoginRadius website and see how the improved experience makes it easier to build, scale, and secure your applications.

\n

Do not forget to explore the improved navigation and API documentation, and get started with our free trial today. We’re excited to see what you’ll build with LoginRadius!

\n","frontmatter":{"date":"February 21, 2025","updated_date":null,"description":"LoginRadius’ vision is to give developers a product that simplifies identity management so they can focus on building, deploying, and scaling their applications. To enhance this experience, we’ve redesigned our website interface, making navigation more intuitive and reassuring that essential resources are easily accessible.","title":"Revamped & Ready: Introducing the New Developer-First LoginRadius Website","tags":["Developer tools","API","Identity Management","User Authentication"],"pinned":true,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.7857142857142858,"src":"/static/80b4e4fbe176a10a327d273504607f32/58556/hero-section.webp","srcSet":"/static/80b4e4fbe176a10a327d273504607f32/61e93/hero-section.webp 200w,\n/static/80b4e4fbe176a10a327d273504607f32/1f5c5/hero-section.webp 400w,\n/static/80b4e4fbe176a10a327d273504607f32/58556/hero-section.webp 800w,\n/static/80b4e4fbe176a10a327d273504607f32/99238/hero-section.webp 1200w,\n/static/80b4e4fbe176a10a327d273504607f32/7c22d/hero-section.webp 1600w,\n/static/80b4e4fbe176a10a327d273504607f32/1258b/hero-section.webp 2732w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Rakesh Soni","github":"oyesoni","avatar":"rakesh-soni.jpg"}}}},"pageContext":{"limit":6,"skip":840,"currentPage":141,"type":"///","numPages":161,"pinned":"ee8a4479-3471-53b1-bf62-d0d8dc3faaeb"}},"staticQueryHashes":["1171199041","1384082988","2100481360","23180105","528864852"]}