• • • • •
• • • •
User Data User Workflows Google ID Your Applications Application SDK Application SDK Application SDK ID Integrations Facebook Active Directory SAML
encodeSecret = "4pE8z3PBoHjnV1AhvGk+e8h2p+ShZpOnpr8cwHmMh1w=" computeHMACSHA256( header + "." + payload, base64DecodeToByteArray(encodedSecret) ) Signature Computation Pseudo-code
.signWith( SignatureAlgorithm.HS256, "secret".getBytes("UTF-8") ) Short but not Sweet
String b64EncodedSecret = "Yn2kjibddFAWtnPJ2AFlL8WXmohJMCvigQggaEypa5E="; .signWith( SignatureAlgorithm.HS256, b64EncodedSecret.getBytes("UTF-8") ) You’re Doing it Wrong
String b64EncodedSecret = "Yn2kjibddFAWtnPJ2AFlL8WXmohJMCvigQggaEypa5E="; .signWith( SignatureAlgorithm.HS512, TextCodec.BASE64.decode(b64EncodedSecret) ) Supersize that Secret!
AuthenticationService AuthorizationService ApplicationService OrganizationService DirectoryService AccountService GroupService Database Infrastructure
Database Infrastructure GroupServiceAccountService AuthenticationService AuthorizationService ApplicationService OrganizationService DirectoryService
● ○ ○ ● ● ● ● ● ● ○ ●