Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

awesome-iam

👤 Identity and Access Management knowledge for cloud platforms
https://github.com/kdeldycke/awesome-iam

Last synced: about 1 month ago
JSON representation

Account Management

  • Things end users care about but programmers don't - In the same spirit as above, but broader: all the little things we overlook as developers but users really care about. In the top of that list lies account-centric features, diverse integration and import/export tools. I.e. all the enterprise customers needs to cover.
  • Separate the account, user and login/auth details - Sound advice to lay down the foundation of a future-proof IAM API.
  • Identity Beyond Usernames - On the concept of usernames as identifiers, and the complexities introduced when unicode characters meets uniqueness requirements.
  • Kratos - 💸 User login, user registration, 2FA and profile management.
  • UserFrosting - 🆓 Modern PHP user login and management framework.
  • As a user, I want… - A meta-critic of account management, in which features expected by the business clash with real user needs, in the form of user stories written by a fictional project manager.

Authentication

Identifiers

Authorization

ABAC frameworks

  • Keto - 💸 Policy decision point. It uses a set of access control policies, similar to AWS policies, in order to determine whether a subject is authorized to perform a certain action on a resource.
  • Ladon - 💸 Access control library, inspired by AWS.
  • Open Policy Agent - 🆓 An open-source general-purpose decision engine to create and enforce ABAC policies.
  • Attribute-Based Access Control - based access control.
  • Casbin - 🆓 Open-source access control library for Golang projects.

AWS policy tools

  • AWS IAM Roles, a tale of unnecessary complexity - The history of fast-growing AWS explains how the current scheme came to be, and how it compares to GCP's resource hierarchy.
  • Become an AWS IAM Policy Ninja - “In my nearly 5 years at Amazon, I carve out a little time each day, each week to look through the forums, customer tickets to try to find out where people are having trouble.”
  • An AWS IAM Security Tooling Reference - A comprehensive list of (maintained) tools for AWS IAM.
  • Policy Sentry - 🆓 Writing security-conscious IAM Policies by hand can be very tedious and inefficient. Policy Sentry helps users to create least-privilege policies in a matter of seconds.
  • IAM Floyd - 🆓 AWS IAM policy statement generator with fluent interface. Helps with creating type safe IAM policies and writing more restrictive/secure statements by offering conditions and ARN generation via IntelliSense. Available for Node.js, Python, .Net and Java.
  • IAMbic - 💸 GitOps for IAM. The Terraform of Cloud IAM. IAMbic is a multi-cloud identity and access management (IAM) control plane that centralizes and simplifies cloud access and permissions. It maintains an eventually consistent, human-readable, bi-directional representation of IAM in version control.

Macaroons

Other tools

  • Gubernator - 🆓 High performance rate-limiting micro-service and library.

Policy models

RBAC frameworks

  • Biscuit - Merges concepts from cookies, JWTs, macaroons and Open Policy Agent. “It provide a logic language based on Datalog to write authorization policies. It can store data, like JWT, or small conditions like Macaroons, but it is also able to represent more complex rules like role-based access control, delegation, hierarchies.”
  • Cerbos - 💸 An authorization endpoint to write context-aware access control policies.
  • Role-Based Access Control
  • FerrisKey - 🆓 Self-hosted, open-source, RBAC system written in Rust.
  • Athenz - 🆓 Set of services and libraries supporting service authentication and role-based authorization for provisioning and configuration.

ReBAC frameworks

Blocklists

Captcha

  • Bloom Filter - Perfect for this use-case, as bloom filters are designed to quickly check if an element is not in a (large) set. Variations of bloom filters exist for specific data types.

Emails

  • Temporary Email Address Domains - A list of domains for disposable and temporary email addresses. Useful for filtering your email list to increase open rates (sending email to these domains likely will not be opened).
  • Burner email providers - 🆓 A list of temporary email providers. And its derivative Python module.
  • MailChecker - 💸 Cross-language temporary (disposable/throwaway) email detection library.
  • `gman` - 🆓 “A Ruby gem to check if the owner of a given email address or website is working for THE MAN (a.k.a verifies government domains).” Good resource to hunt for potential government customers in your user base.
  • `check-if-email-exists` - 💸 Verify an email address's reachability over SMTP without sending anything, catching typos, disposable domains and role accounts at signup.

Hostnames and Subdomains

  • #1 - blacklist/blob/master/subdomain-blacklist.txt), #3.
  • `common-domain-prefix-suffix-list.tsv` - Top-5000 most common domain prefix/suffix list.
  • `xkeyscorerules100.txt` - NSA's XKeyscore matching rules for TOR and other anonymity preserving tools.
  • AMF site blocklist - Official French denylist of money-related fraud sites.
  • `hosts` - 🆓 Consolidates reputable hosts files, and merges them into a unified hosts file with duplicates removed.
  • `nextdns/metadata` - 💸 Extensive collection of list for security, privacy and parental control.
  • The Public Suffix List - 🆓 Mozilla's registry of public suffixes, under which Internet users can (or historically could) directly register names.
  • Country IP Blocks - 🆓 CIDR country-level IP data, straight from the Regional Internet Registries, updated hourly.

Profanity

Reserved IDs

Competitive Analysis

GDPR

Cryptography

Identifiers

  • An Overview of Cryptography - “This paper has two major purposes. The first is to define some of the terms and concepts behind basic cryptographic methods, and to offer a way to compare the myriad cryptographic schemes in use today. The second is to provide some real examples of cryptography in use today.”
  • Real World Crypto Symposium - Aims to bring together cryptography researchers with developers, focusing on uses in real-world environments such as the Internet, the cloud, and embedded devices.
  • Papers we love: Cryptography - Foundational papers of cryptography.

Footnotes

GDPR

  • 1 - quote-ref)

History

GDPR

  • cryptoanarchy.wiki - Cypherpunks overlaps with security. This wiki compiles information about the movement, its history and the people/events of note.

Machine Identity

Identifiers

  • SPIFFE/SPIRE - 🆓 A CNCF framework issuing short-lived, cryptographically-verifiable identities (SVIDs) to workloads across heterogeneous environments.
  • NanoMDM - 🆓 Minimalist Apple MDM server and library to enroll and manage the identity of Apple devices, inspired by MicroMDM.

Multi-factor auth

Identifiers

SMS-based

OAuth2 & OpenID

Other tools

  • OAuth 2.0
  • An Illustrated Guide to OAuth and OpenID Connect - Explain how these standards work using simplified illustrations.
  • OAuth 2 Simplified - A reference article describing the protocol in simplified format to help developers and service providers implement it.
  • OAuth 2.0 and OpenID Connect (in plain English) - Starts with an historical context on how these standards came to be, clears up the inaccuracies in the vocabulary, then details the protocols and its pitfalls to make it less intimidating.
  • How to Implement a Secure Central Authentication Service in Six Steps - Got multiple legacy systems to merge with their own login methods and accounts? Here is how to merge all that mess by the way of OIDC.
  • Open-Sourcing BuzzFeed's SSO Experience - OAuth2-friendly adaptation of the Central Authentication Service (CAS) protocol. You'll find there good OAuth user flow diagrams.
  • Hidden OAuth attack vectors - How to identify and exploit some of the key vulnerabilities found in OAuth 2.0 authentication mechanisms.
  • Awesome OpenID Connect - A curated list of providers, services, libraries, and resources for OpenID Connect.
  • OAuth 2.0 Security Best Current Practice - “Updates and extends the OAuth 2.0 Security Threat Model to incorporate practical experiences gathered since OAuth 2.0 was published and covers new threats relevant due to the broader application”.
  • Hydra - 💸 Open-source OIDC & OAuth2 Server Provider.
  • Keycloak - 🆓 Open-source Identity and Access Management. Supports OIDC, OAuth 2 and SAML 2, LDAP and AD directories, password policies.
  • authentik - 💸 Open-source Identity Provider similar to Keycloak.
  • ZITADEL - 💸 An Open-Source solution built with Go and Angular to manage all your systems, users and service accounts together with their roles and external identities. ZITADEL provides you with OIDC, OAuth 2.0, login & register flows, passwordless and MFA authentication. All this is built on top of eventsourcing in combination with CQRS to provide a great audit trail.
  • obligator - 🆓 Simple and opinionated OpenID Connect server designed for self-hosters. Single static binary with flat-file or SQLite storage.
  • Descope - Drag and drop your auth. Add authentication, user management, and authorization to your app with a few lines of code.
  • Casdoor - 🆓 A UI-first centralized authentication / Single-Sign-On (SSO) platform. Supports OAuth 2, OIDC, SAML 2, CAS, LDAP and SCIM, social logins, user management, WebAuthn and TOTP/MFA.

Overview

  • overview of cloud computing
  • IAM Is The Real Cloud Lock-In - A little click-baity, but author admit that “It depends on how much you trust them to 1. Stay in business; 2. Not jack up your prices; 3. Not deprecate services out from under you; 4. Provide more value to you in business acceleration than they take away in flexibility.”
  • IAM is hard. It's really hard. - “Overly permissive AWS IAM policies that allowed s3:GetObject to * (all) resources”, led to $80 million fine for Capital One. The only reason why you can't overlook IAM as a business owner.
  • The EnterpriseReady SaaS Feature Guides - The majority of the features making B2B users happy will be implemented by the IAM perimeter.

Password-based auth

Identifiers

Password-less auth

JWT

Public-Key Infrastructure (PKI)

  • PKI for busy people - Quick overview of the important stuff.
  • `lemur` - 🆓 Acts as a broker between CAs and environments, providing a central portal for developers to issue TLS certificates with 'sane' defaults.
  • CFSSL - 🆓 A swiss army knife for PKI/TLS by CloudFlare. Command line tool and an HTTP API server for signing, verifying, and bundling TLS certificates.
  • JA4+ - 💸 A suite of network fingerprinting methods to facilitate threat-hunting and analysis.

Security key

  • Webauthn and security keys - Describe how authentication works with security keys, details the protocols, and how they articulates with WebAuthn. Key takeaway: “There is no way to create a U2F key with webauthn however. (…) So complete the transition to webauthn of your login process first, then transition registration.”
  • OpenSK - 🆓 Open-source implementation for security keys written in Rust that supports both FIDO U2F and FIDO2 standards.
  • YubiKey Guide - Guide to using YubiKey as a SmartCard for storing GPG encryption, signing and authentication keys, which can also be used for SSH. Many of the principles in this document are applicable to other smart card devices.

SMS-based

WebAuthn

Privacy

Anonymization

GDPR

Profanity

SAML

Other tools

  • SAML vs. OAuth - “OAuth is a protocol for authorization: it ensures Bob goes to the right parking lot. In contrast, SAML is a protocol for authentication, or allowing Bob to get past the guardhouse.”
  • The Difference Between SAML 2.0 and OAuth 2.0 - “Even though SAML was actually designed to be widely applicable, its contemporary usage is typically shifted towards enterprise SSO scenarios. On the other hand, OAuth was designed for use with applications on the Internet, especially for delegated authorisation.”
  • What's the Difference Between OAuth, OpenID Connect, and SAML? - Identity is hard. Another take on the different protocol is always welcome to help makes sense of it all.
  • The Beer Drinker's Guide to SAML - SAML is arcane at times. A another analogy might helps get more sense out of it.
  • SAML is insecure by design - Not only weird, SAML is also insecure by design, as it relies on signatures based on XML canonicalization, not XML byte stream. Which means you can exploit XML parser/encoder differences.
  • The Difficulties of SAML Single Logout - On the technical and UX issues of single logout implementations.
  • The SSO Wall of Shame - A documented rant on the excessive pricing practiced by SaaS providers to activate SSO on their product. The author's point is, as a core security feature, SSO should be reasonably priced and not part of an exclusive tier.
  • SAML: A Fractal of Bad Design - “SAML is being crushed under the weight of its own complexity.” The author lists five flaws that compound: “1. Built on XML; 2. Canonicalization; 3. Enveloped signatures; 4. 'Kitchen-sink' design; 5. Ossification.” So instead of one more mitigation, identity providers get a deprecation plan: stop onboarding SAML integrations, migrate customers to OIDC, set a sunset date.

Secret Management

Hardware Security Module (HSM)

Other tools

  • Secret at Scale at Netflix - Solution based on blind signatures. See the slides.
  • High Availability in Google's Internal KMS - Not GCP's KMS, but the one at the core of their infrastructure. See the slides.
  • HashiCorp Vault - 💸 Secure, store and tightly control access to tokens, passwords, certificates, encryption keys.
  • Infisical - 💸 An alternative to HashiCorp Vault.
  • `trufflehog` - 💸 Searches through Git repositories for high entropy strings and secrets, digging deep into commit history.
  • `sops` - 🆓 Editor of encrypted files that supports YAML, JSON, ENV, INI and BINARY formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault, age, and PGP.
  • `gitleaks` - 🆓 Audit Git repos for secrets.

Security

Trust & Safety

Captcha

  • Awesome Captcha - Reference all open-source captcha libraries, integration, alternatives and cracking tools.
  • You (probably) don't need ReCAPTCHA - Starts with a rant on how the service is a privacy nightmare and is tedious UI-wise, then list alternatives.
  • Anubis - 🆓 An open-source solution to protect upstream resources from scraper bots.
  • Anti-captcha - 💸 Captchas solving service.

Fraud

Hardware Security Module (HSM)

Moderation

  • The despair and darkness of people will get to you - Moderation of huge social networks is performed by an army of outsourced subcontractors. These people are exposed to the worst and generally ends up with PTSD.
  • The Cleaners - A documentary on these teams of underpaid people removing posts and deleting accounts.
  • Still Logged In: What AR and VR Can Learn from MMOs - “If you host an online community, where people can harm another person: you are on the hook. And if you can't afford to be on the hook, don't host an online community”.
  • You either die an MVP or live long enough to build content moderation - “You can think about the solution space for this problem by considering three dimensions: cost, accuracy and speed. And two approaches: human review and machine review. Humans are great in one of these dimensions: accuracy. The downside is that humans are expensive and slow. Machines, or robots, are great at the other two dimensions: cost and speed - they're much cheaper and faster. But the goal is to find a robot solution that is also sufficiently accurate for your needs.”

Threat Intelligence

  • Standards related to Threat Intelligence - Open standards, tools and methodologies to support threat intelligence analysis.
  • MISP taxonomies and classification - Tags to organize information on “threat intelligence including cyber security indicators, financial fraud or counter-terrorism information.”
  • The challenges of file formats - At one point you will let users upload files in your system. Here is a corpus of suspicious media files that can be leveraged by scammers =to bypass security or fool users.
  • PhoneInfoga - 🆓 Tools to scan phone numbers using only free resources. The goal is to first gather standard information such as country, area, carrier and line type on any international phone numbers with a very good accuracy. Then search for footprints on search engines to try to find the VoIP provider or identify the owner.
  • Awesome Threat Intelligence - “A concise definition of Threat Intelligence: evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject's response to that menace or hazard.”
  • SpiderFoot - 🆓 An open source intelligence (OSINT) automation tool. It integrates with just about every data source available and uses a range of methods for data analysis, making that data easy to navigate.
  • SecLists - 🆓 Collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
  • PhishingKitTracker - 🆓 CSV database of email addresses used by threat actor in phishing kits.
  • Confusable Homoglyphs - 🆓 Homoglyphs is a common phishing trick.
  • Browser Fingerprinting: A survey - Fingerprints can be used as a source of signals to identify bots and fraudsters.
  • OSINT Stuff Tool Collection - “A collection of several hundred online tools for OSINT”: domain, IP, email, username and social-network lookups useful for unmasking fraud and abuse.