Decentralized PDP/PEP with Identity Propagation

Flaws in OAuth protocol

A formal scientific analysis of the principles and mechanisms underlying OAuth 2.0 has been published. Two weaknesses have been identified. The rest of the protocol has been formally recognised as sound and secure. The weaknesses are

• allowing HTTP Temporary redirect (status 307), which can cause a browser to disclose sensitive information to a malicious Resource Server
• an attack on the Resource Server, tricking it to rely on a malicious Identity Provider (possibly using OpenId)

 

No exploits on these weaknesses are currently known to exist in the wild and the authors have proposed solutions for the vulnerabilities, which are being adopted by the working groups for OAuth and OpenID Connect.

Calendra lives on as Cognitum

Calendra Directory manager was a pretty good platform for rapidly developing web applications based on directories, databases, provisioning and workflow. As such it was a great tool for building Identity a Access management related applications.
Calendra was acquired by BMC Software, but never found its place in the portfolio of the company, and development slowed down.
This year ownership of Calendra was transferred to ITConcepts. Cognitum is the new name for the product. This month a new version of the product, Cognitum 7.7 is released. In addition to some bug fixes it aligns Cognitum with current standards: Java 6, JDBC 4, Tomcat 7 and Windows 7.
The roadmap for the product again looks ambitious now. The next version of the product is expected to merge some Calendra 4 features back into the main branch (Basket functionality, Studio Wizards, History actions...).
here's an overview of Cognitum's architecture:

Oracle buys Passlogix SSO

You got to eat if you want to grow, and Oracle keeps on festing on other companies.
The last buy is a very rational one, and one that will easily integrate into the company.
Oracle was already reselling Passlogix under its own brand as part of its Identity and access management suite and is in-housing the technology now. Additionally Sun Microsystems, which became a piece of the Oracle pie last year, was partnering with PassLogix for Sun Identity and Access management as well.
Oracle's Identity and Access Management suite, will emerge as of the completest in the market.