#identityserver

[cyberdudebivash-news]

WSO2 Zero-Day Alert: Authentication Bypass Vulnerabilities Exposed – Patch Your Servers NOW!

Read the full report on -

WSO2 Zero-Day Alert: Authentication Bypass Vulnerabilities Exposed – Patch Your Servers NOW!

CVE-2025-10611, CVE-2025-9152, CVE-2025-9804 and related WSO2 flaws enable unauthenticated access. Patch guidance, detection hunts, and WAF

 #CyberDudeBivash #CyberBivash #WSO2 #APIM #IdentityServer #AuthenticationBypass #CVE202510611 #CVE20259152 #CVE20259804 #FIDO #ZeroTrust #ThreatWire

[darrellbooker]

IdentityServer: Needed you in my life years ago!!!

IdentityServer3 is a great tool by Thinktecture and this is how it changed everything for me….

This project was pretty typical to any other. A simple Bootstrap/Knockout .NET MVC using WebAPI for all my data calls with a companion Xamarin Forms app utilizing the same WebAPI.

Being in a rush to get a quick sample product up I used simple Basic Authentication to my WebAPIs which worked fine for the front end web pages as well as the Xamarin app. Near completion I ran into a problem where I was forced to use a MVC controller to facilitate downloading of a generated CSV and the damn MVC controller had no visibility to the Identity Claims created using the WebAPI authentication. I was stuck!!! I quickly set to Google to see if it was a way to transfer the claims from one to the other so I could get access to the info I needed. My second or third search result brought me to IdentityServer3 from Thinktecture.

This post would be a book if I tried to detail all the steps but in a nutshell I now have:

a) Central Identity Server-this website will be the single login point for all company wide websites

b) Single WebAPI site-all api’s will be housed here. Since many websites/apps will use common api’s it benefited to have some centralization.  IdentityServer3 allows for restricting access to the api’s to only those authenticated through the Identity Server

c) Slimdown websites and apps-now all websites and apps have become lightweight since all custom authentication has been removed as well as api calls to the database.

My Xamarin app plays nicely with it as well by authenticating against the server and receiving a token to be used for all future api calls.

Identity Server3 has lots of customization. Check out the docs and the many samples.

[sahanlm]

Configure WSO2 Identity server to use Apache DS LDAP

1. Configure a LDAP from Apache DS.

To configure Apache DS first download the latest version of apache directory studio from here.

Then install the setup (for windows users) and start the Apache Directory Studio.

Then go to "Window - > show view -> other " and select "LDAP servers".

In the server view click on "new server" and create a new server instance. Start the server by right clicking on the server instance and click on "start".

Then go to connections tab next to the LDAP servers tab and create a new connection.

This will open "New LDAP Connection" wizard.

Enter the connection details and click next. (Here in my example i run on localhost port 10389.)

In the next window you will be asked for parameters for authentication details.

Enter the parameters for simple authentication. In the Bind DN or user field, enter the DN of the administrator's account on the directory server (for the default instance of the Apache directory server, this is uid=admin,ou=system). In the Bind password field, enter the administrator's password (for the default instance of the Apache directory server, the administrator's password is secret). Click Finish

If the connection is successfully established, you should see an outline of the Directory Information Tree (DIT) in the LDAP Browser view. In the LDAP Browser view, drill down to the ou=users node, as shown.

Right-click on the ou=users node and select New Entry. The New Entry wizard appears. Leave the Entry Creation Method by clicking next. In the Object Classes pane, select inetOrgPerson from the list of Available object classes on the left and then click Add to populate the list of Selected object classes. Click Next.

In the Distinguished Name pane, complete the RDN field, putting uid in front and jdoe after the equals sign. Click Next.

Fill in the remaining mandatory attributes in the Attributes pane. Set the cn (common name) attribute to John Doe and the sn (surname) attribute to Doe. Click Finish.

To add a userPassword attribute to the user entry. In the LDAP Browser view, you should now be able to see a new node, uid=jdoe. Select the uid=jdoe node. Now, right-click in the Entry Editor view and select New Attribute. The New Attribute wizard appears. From the Attribute type drop-down list, select userPassword. Click Finish. The Password Editor dialog appears. In the Enter New Password field, enter the password, secret. Click Ok.

Point wso2 Identity server to the newly created external LDAP

Goto Identity server root folder and browse in to "wso2esb-{version}\repository\conf". Open "user-mgt.xml" in the editor.

Un-comment the commented section about external LDAP.

Change the password of connection as following line. (since our previously entered default password is "secret" we entered that below)

<Property name="ConnectionPassword">secret</Property>

Run the Identity server and create a new user by signup.

If all goes correctly you may be able to add new users by Identity server and, in Apache DS you may see the newly added  users.