The Water Cooler - 2019-06-18

« first day (2624 days earlier) ← previous day next day → last day (1753 days later) »

8:55 AM

Faith in humanity.. further depleted:

-2

Q: How to deal with medical information about a new applicatant

I'm working in a small team at a (growing) startup, and have been asked about a developer applying who worked at my previous company. He started after I left, so I didn't get to know him personally. However, I get on well with my former colleagues and had met them occasionally, so I'd heard some ...

not only it's none of his business, but it's only a rumor, which may be exaggerated/deformed

I'm taking a wild stab in the dark here that this is a made-up question.

@Snow yeah could be.. in which case my faith in humanity still goes down, just for different reasons. I mean what kind of person makes up crap like that just to ask it here? The mind boggles

You haven't been here for very long, have you?

@Snow lol I know it happens, I just still don't understand why

9:07 AM

This is the internet, people type for the joy of being heard.

10:01 AM

geez.. spam question deleted by the community in less than a minute

that's some goin!

By mistack i accept two offers now can i choose one what ever i want? — user105818 9 mins ago

not sure if made-up or just dumb

@Kepotx methinks the misleading nature of the question was an intentional move to try and avoid owning up to the "mistack" of accepting both

TL:DR; "Did I screw up?"

short answer: yes

10:56 AM

Hmmmmmmm. So if I process a GDPR personal info deletion request for a user/client, how can I actually confirm to that user that this was done? If I actually carried out the request I wouldn't know how to contact them any more... If I mail or call them then by definition I still possess PII on them at the time...

Schrodinger's GDPR? :)

@Lilienthal The notification to them that you've deleted the PII is considered part of your audit log and so long as it is retained and "used" only for that purpose you're fine

the right to erasure doesn't cover holding/processing PII for purposes such as recording compliance

Mister Positive

11:33 AM

Hello...

11:48 AM

@MisterPositive Due to GDPR, I'm forbidden to answer you.

Mister Positive

GDPR....

hmm

first cup of coffee FWIW

Anyone worked with Identity Server 4?

12:04 PM

@MisterPositive a bit.. been a couple of years though

12:31 PM

@motosubatsu Hah, good to know. ;)

@Lilienthal no worries.. GDPR is a tangled mess of seeming contradictions, general vagueness and steaming cow manure

it's kinda hard to work out up from down with it sometimes

Mister Positive

12:58 PM

@motosubatsu Looking at this for SSO

@MisterPositive should do the job pretty well - are you planning on integrating with external providers?

(google auth etc)

Mister Positive

1:16 PM

@motosubatsu definitely with Win AD

but probably not Auth0 and the like. ( at least not yet )

1:38 PM

@MisterPositive if you were only doing AD integration then it's overkill IMO - but if you think there is a possibility of adding another provider down the line (even if it's only a possibility) it will save you pain in the long run

Mister Positive

1:57 PM

Well, for me @motosubatsu I need to secure API's as well as add seemless log in to apps that live inside and ourside our DMZ

AD for sure, but I token based security, with expiration, etc.

that works for both AD and non AD sites.

yeah Identity Server sounds like a clear win there

Mister Positive

@motosubatsu yeah....and some of our interfaces need it too. GIANT implementation

and of course Core compatible.

remember any gotchas or sources for coding advise?

Where is @RoryAlsop when you need security counseling?

nothing that comes to mind.. the docs are pretty well written :)

Mister Positive

Good deal. I may pick your brain from time to time if you don't mind :-)

no probs :)

I assume you're familiar with standard ASP.NET Identity ?

2:13 PM

You rang?

I haven't been a programmer for 20 years or so, so these new languages are a bit alien to me. I'm happy with C, COBOL, Forth, Pascal and other proper languages :-)

Mister Positive

2:41 PM

@RoryAlsop LOL

@RoryAlsop Getting ready to do an Identity Server Implementation...

Just thought of you and hadn't chatted with you in a bit

@motosubatsu Somewhat. I will be when I am done though...

@MisterPositive I'd say it's worth giving yourself a refresher on that as a first step

Mister Positive

Roger that. Identity Server built on top of that or part of it?

@MisterPositive sort of the first thing.. but not quite

Mister Positive

{please continue}

Identity Server provides the authentication middleware - but you're going to need something to authenticate against

a list of users and their permissions (aka "claims" in Identity lingo)

Mister Positive

2:51 PM

Ah I see.

by using ASP.NET Identity you'll get all that - in a way that pretty seamlessly correlates with how IdentityServer works

you could roll your own of course

but why bother when Microsoft have done the hard work for you ?

Mister Positive

So...most of our applications currently use AD for Authentication. We have another app that uses standard User and PWD against a SQL Server DB, and then one that is internal only ( for now ) that isn't secured at all

The boss said he want SSO

:-)

So I am/was thinking Identity Server 4 as part of the solution

is the plan for everyone who uses these to have an AD login?

Mister Positive

@motosubatsu probably not

I was thinking hoping we could do AD on Azure and essentially gain single sign on through that

AND

we may SAAS our applications and have to use their LDAP for Authentication while we handle authorization

3:07 PM

if you're AD is on azure and you may have users without AD logins then Identity Server is just the ticket :)

Mister Positive

@motosubatsu Good, I was hoping I was on the right track.

you basically (ha!) implement IdentityServer as what's termed a "Federation Gateway" (no it's nothing to do with star trek)

Mister Positive

@motosubatsu Star Trek!!!

Azure or on-prem AD then become an "external" authentication provider to the IdentityServer

so they use one login screen but login with whatever account they have

Mister Positive

@motosubatsu So far we are in sync

3:11 PM

you use ASP.NET Identity to provide the user store for the IdentityServer (which is absurdly easy - they clearly intended you to do that)

that does bring a gotcha to mind actually

Mister Positive

@motosubatsu do tell

por favor

when you're acting as a Federation Gateway you need to handle what happens if the user signs out of the external provider directly

i.e. not through your IdentityServer sign out page

it varies from provider to provider but IdentityServer has docs to cover the scenario

Mister Positive

yeah I got a lot or reading to do and a few plural sight courses I will be taking

@MisterPositive yeah there's PluralSight courses specifically around IdentityServer IIRC

they might be worth adding to the list

Mister Positive

There are and they are on my list

as in today

and the next few

3:18 PM

googling on the subject can get confusing - particularly around any ASP.NET Identity aspects, there was a significant change when it went to v2 and if you come across old info you can get lost very quickly!

Mister Positive

@motosubatsu yeah getting lost in the weeds sucks

don't wanna do that

Mister Positive

3:34 PM

@motosubatsu Are you voting at the IPS?

3:52 PM

@MisterPositive already voted :)

you?

4:06 PM

@MisterPositive happily voted

I also voted. From looking at the questionaire votes, it seems there's a clear favourite.

@Snow oh, I didn't check those votes. [scurries off to have a look]

lol. We were talking yesterday about people who vote on these elections without looking at the meta questions/answers for the nominees...

4:25 PM

New badges ahead , for people who like badges.

Adios to Unfriendly Badges: Ahoy, Lifejacket and Lifeboat

Jon Ericson on June 18, 2019

Analytical

Documentation badges

Tumbleweed and Reversal

Julia Silge’s analysis demonstrated that the Tumbleweed badge wasn’t serving its purpose.

Meg Risdal is our Product Manager who led us to make these changes.

Jane Willborn wrote the code.

Nick Craver made sure the Lifejacket and Lifeboat triggers don’t break the site.

Ben Voigt suggested the trigger we used first for Winter Bash hats and now for two new badges.

A bunch of people tested those triggers on our sites and prodded us to keep considering something like these new badges. We also got a bunch of feedback about Reversal and especially Tumbleweed that helped us understand how they worked in practice. We’ve got an amazing community here! …

4:39 PM

The new badges are being retrospectively award now, so you may see some badges appear for your old answers and wonder what the heck they're about.

3

« first day (2624 days earlier) ← previous day next day → last day (1753 days later) »

Transcript for

Jun '1918

The Water Cooler

General chit-chat for workplace.stackexchange.com. Feel free t...

ask-your-manager use-headphones

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile