IMPERSONATION METHOD ON AUTHORIZATION SERVER USING CLIENT-INITIATED BACK-CHANNEL AUTHENTICATION PROTOCOL
<p class="Abstract"><span>There is an impersonation (login as) feature in several applications that can be used by system administrators who have special privileges. This feature can be utilized by development and maintenance teams that have administrator rights to reproduce er...
Main Authors: | , , , |
---|---|
Format: | Article |
Language: | English |
Published: |
Institut Teknologi Sepuluh Nopember
2021-01-01
|
Series: | JUTI: Jurnal Ilmiah Teknologi Informasi |
Online Access: | http://juti.if.its.ac.id/index.php/juti/article/view/1022 |
id |
doaj-90304b5a84574d569f5017ef163ebc2d |
---|---|
record_format |
Article |
spelling |
doaj-90304b5a84574d569f5017ef163ebc2d2021-05-29T12:50:12ZengInstitut Teknologi Sepuluh NopemberJUTI: Jurnal Ilmiah Teknologi Informasi1412-63892406-85352021-01-01191374810.12962/j24068535.v19i1.a1022495IMPERSONATION METHOD ON AUTHORIZATION SERVER USING CLIENT-INITIATED BACK-CHANNEL AUTHENTICATION PROTOCOLRizky Januar Akbar0Nurul Fajrin Ariyani1Adistya Azhar2Andika Andra3Departemen Teknik Informatika, Institut Teknologi Sepuluh NopemberDepartemen Teknik Informatika, Institut Teknologi Sepuluh NopemberDepartemen Teknik Informatika, Institut Teknologi Sepuluh NopemberDepartemen Teknik Informatika, Institut Teknologi Sepuluh Nopember<p class="Abstract"><span>There is an impersonation (login as) feature in several applications that can be used by system administrators who have special privileges. This feature can be utilized by development and maintenance teams that have administrator rights to reproduce errors or bugs, to check specific features in applications according to the specific users’ login sessions. Beside its benefits, there is a security vulnerability that allows administrators to abuse the rights. They can access users’ private data or execute some activities inside the system without account or resource owners’ consents.</span></p><p class="Abstract"><span>This research proposes an impersonation method on authorization server using Client-Initiated Back-channel Authentication (CIBA) protocol. This method prevents impersonation without account or resource owners’ consent. The application will ask users’ authentication and permission via authentication device possessed by resource owners before the administrator performs impersonation. By utilizing authentication device, the impersonation feature should be preceded by users’ consent and there is no direct interaction needed between the administrator and resource owners to prove the users’ identities. The result shows that the implementation of CIBA protocol can be used to complement the impersonation method and can also run on the authorization server that uses OAuth 2.0 and OpenID Connect 1.0 protocols. The system testing is done by adopting FAPI CIBA conformance testing.</span></p>http://juti.if.its.ac.id/index.php/juti/article/view/1022 |
collection |
DOAJ |
language |
English |
format |
Article |
sources |
DOAJ |
author |
Rizky Januar Akbar Nurul Fajrin Ariyani Adistya Azhar Andika Andra |
spellingShingle |
Rizky Januar Akbar Nurul Fajrin Ariyani Adistya Azhar Andika Andra IMPERSONATION METHOD ON AUTHORIZATION SERVER USING CLIENT-INITIATED BACK-CHANNEL AUTHENTICATION PROTOCOL JUTI: Jurnal Ilmiah Teknologi Informasi |
author_facet |
Rizky Januar Akbar Nurul Fajrin Ariyani Adistya Azhar Andika Andra |
author_sort |
Rizky Januar Akbar |
title |
IMPERSONATION METHOD ON AUTHORIZATION SERVER USING CLIENT-INITIATED BACK-CHANNEL AUTHENTICATION PROTOCOL |
title_short |
IMPERSONATION METHOD ON AUTHORIZATION SERVER USING CLIENT-INITIATED BACK-CHANNEL AUTHENTICATION PROTOCOL |
title_full |
IMPERSONATION METHOD ON AUTHORIZATION SERVER USING CLIENT-INITIATED BACK-CHANNEL AUTHENTICATION PROTOCOL |
title_fullStr |
IMPERSONATION METHOD ON AUTHORIZATION SERVER USING CLIENT-INITIATED BACK-CHANNEL AUTHENTICATION PROTOCOL |
title_full_unstemmed |
IMPERSONATION METHOD ON AUTHORIZATION SERVER USING CLIENT-INITIATED BACK-CHANNEL AUTHENTICATION PROTOCOL |
title_sort |
impersonation method on authorization server using client-initiated back-channel authentication protocol |
publisher |
Institut Teknologi Sepuluh Nopember |
series |
JUTI: Jurnal Ilmiah Teknologi Informasi |
issn |
1412-6389 2406-8535 |
publishDate |
2021-01-01 |
description |
<p class="Abstract"><span>There is an impersonation (login as) feature in several applications that can be used by system administrators who have special privileges. This feature can be utilized by development and maintenance teams that have administrator rights to reproduce errors or bugs, to check specific features in applications according to the specific users’ login sessions. Beside its benefits, there is a security vulnerability that allows administrators to abuse the rights. They can access users’ private data or execute some activities inside the system without account or resource owners’ consents.</span></p><p class="Abstract"><span>This research proposes an impersonation method on authorization server using Client-Initiated Back-channel Authentication (CIBA) protocol. This method prevents impersonation without account or resource owners’ consent. The application will ask users’ authentication and permission via authentication device possessed by resource owners before the administrator performs impersonation. By utilizing authentication device, the impersonation feature should be preceded by users’ consent and there is no direct interaction needed between the administrator and resource owners to prove the users’ identities. The result shows that the implementation of CIBA protocol can be used to complement the impersonation method and can also run on the authorization server that uses OAuth 2.0 and OpenID Connect 1.0 protocols. The system testing is done by adopting FAPI CIBA conformance testing.</span></p> |
url |
http://juti.if.its.ac.id/index.php/juti/article/view/1022 |
work_keys_str_mv |
AT rizkyjanuarakbar impersonationmethodonauthorizationserverusingclientinitiatedbackchannelauthenticationprotocol AT nurulfajrinariyani impersonationmethodonauthorizationserverusingclientinitiatedbackchannelauthenticationprotocol AT adistyaazhar impersonationmethodonauthorizationserverusingclientinitiatedbackchannelauthenticationprotocol AT andikaandra impersonationmethodonauthorizationserverusingclientinitiatedbackchannelauthenticationprotocol |
_version_ |
1721422159551660032 |