<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Jun 4, 2013 at 3:05 PM, Bruno Oliveira <span dir="ltr"><<a href="mailto:bruno@abstractj.org" target="_blank">bruno@abstractj.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Morning, maybe I'm not understanding your question, but we already have<br>
this discussion and in the end the conclusion was about the lack of<br>
documentation on AGSEC (<a href="https://issues.jboss.org/browse/AGSEC-60" target="_blank">https://issues.jboss.org/browse/AGSEC-60</a>)<br>
<br>
Am I wrong?<br></blockquote><div><br></div><div style>I don't think you are wrong there.</div><div style><br></div><div style><br></div><div style>I guess this mail is related.</div><div style><br></div><div style><br>
</div><div style>For iOS/Android, we are "trying" to implement the basic/digest support by using the "AuthModule" interface. This interface provides:</div><div style>* enroll </div><div style>* login</div>
<div style>* logout</div><div style><br></div><div style>Which, as stated in the referenced bug, does not make much sense.</div><div style><br></div><div style><br></div><div style>Kris now shared, that on JS he went a different road, so that for JS-Basic/JS-Digest he does not need to worry about "enroll", "login" etc.</div>
<div style><br></div><div style>I think that should be done for iOS/Android as well</div><div style><br></div><div style><br></div><div style><br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
No real login exists, because we are making use of servlet filters from<br>
PicketLink.<br>
<div class="HOEnZb"><div class="h5"><br>
Matthias Wessendorf wrote:<br>
> Hi,<br>
><br>
> perhaps this is more "AeroGear-Security VS HTTP Basic/Digest", but first<br>
> some background informations:<br>
><br>
> our different "AuthenticationModule" implementations, for Android, iOS<br>
> and JavaScript, were created for the AeroGear-Security REST-APIs, which<br>
> are described here:<br>
> <a href="http://aerogear.org/docs/specs/aerogear-rest-api/" target="_blank">http://aerogear.org/docs/specs/aerogear-rest-api/</a><br>
><br>
> Here are the three different client platform implementations:<br>
><br>
> * Android:<br>
> <a href="https://github.com/aerogear/aerogear-android/blob/master/src/org/jboss/aerogear/android/authentication/AuthenticationModule.java#L50-L74" target="_blank">https://github.com/aerogear/aerogear-android/blob/master/src/org/jboss/aerogear/android/authentication/AuthenticationModule.java#L50-L74</a><br>
><br>
> * iOS:<br>
> <a href="https://github.com/aerogear/aerogear-ios/blob/master/AeroGear-iOS/AeroGear-iOS/security/AGAuthenticationModule.h#L143-L179" target="_blank">https://github.com/aerogear/aerogear-ios/blob/master/AeroGear-iOS/AeroGear-iOS/security/AGAuthenticationModule.h#L143-L179</a><br>
><br>
> * JavaScript:<br>
> <a href="https://github.com/aerogear/aerogear-js/blob/master/src/authentication/adapters/rest.js#L224-L436" target="_blank">https://github.com/aerogear/aerogear-js/blob/master/src/authentication/adapters/rest.js#L224-L436</a><br>
><br>
> So, basically the interface(or the different implementations) covers the<br>
> following functionality, described in the above spec:<br>
> * enroll<br>
> * login<br>
> * logout<br>
><br>
> So far so good.<br>
><br>
><br>
> However, looking at the recent work for BASIC/DIGEST (e.g.<br>
> <a href="http://aerogear-dev.1069024.n5.nabble.com/aerogear-dev-iOS-Basic-Digest-Thoughts-td2847.html" target="_blank">http://aerogear-dev.1069024.n5.nabble.com/aerogear-dev-iOS-Basic-Digest-Thoughts-td2847.html</a>),<br>
> I think it might be confusing that there is no real login call against<br>
> the server, like in the above codee, for AG-Security<br>
><br>
> Instead, the "login", is _only_ applying the credentials to that<br>
> subsequent requests can read (a) protected URL(s). Similar to "logout":<br>
> Only a _reset_ of the credentials is happening. No server endpoint is<br>
> invoked.<br>
> See also <a href="http://lists.jboss.org/pipermail/aerogear-dev/2013-May/002810.html" target="_blank">http://lists.jboss.org/pipermail/aerogear-dev/2013-May/002810.html</a><br>
><br>
><br>
> Similar to the "enroll"; The iOS proposal throws an exception, similar<br>
> to the Android version:<br>
><br>
> <a href="https://github.com/aerogear/aerogear-android/blob/master/src/org/jboss/aerogear/android/authentication/impl/HttpBasicAuthenticationModule.java#L164" target="_blank">https://github.com/aerogear/aerogear-android/blob/master/src/org/jboss/aerogear/android/authentication/impl/HttpBasicAuthenticationModule.java#L164</a><br>
><br>
> <a href="https://github.com/cvasilak/aerogear-ios/blob/basic.digest.auth/AeroGear-iOS/AeroGear-iOS/security/AGHttpBasicDigestAuthentication.m#L93-L95" target="_blank">https://github.com/cvasilak/aerogear-ios/blob/basic.digest.auth/AeroGear-iOS/AeroGear-iOS/security/AGHttpBasicDigestAuthentication.m#L93-L95</a><br>
><br>
> To me, looks like none of the methods of the "AuthenticationModule<br>
> interface" are properly used, or am I wrong?<br>
><br>
><br>
> I think my question is: Does it really make sense to kinda try to add<br>
> the BASIC/DIGEST support into the "AuthenticationModule interface"?? or,<br>
> could there be something else ?<br>
><br>
> Not sure, I guess since I am not sure, I am asking here :)<br>
><br>
> Any feedback is appreciated!<br>
><br>
> Thanks!<br>
> Matthias<br>
><br>
> --<br>
> Matthias Wessendorf<br>
><br>
> blog: <a href="http://matthiaswessendorf.wordpress.com/" target="_blank">http://matthiaswessendorf.wordpress.com/</a><br>
> sessions: <a href="http://www.slideshare.net/mwessendorf" target="_blank">http://www.slideshare.net/mwessendorf</a><br>
> twitter: <a href="http://twitter.com/mwessendorf" target="_blank">http://twitter.com/mwessendorf</a><br>
><br>
</div></div><div class="HOEnZb"><div class="h5">> _______________________________________________<br>
> aerogear-dev mailing list<br>
> <a href="mailto:aerogear-dev@lists.jboss.org">aerogear-dev@lists.jboss.org</a><br>
> <a href="https://lists.jboss.org/mailman/listinfo/aerogear-dev" target="_blank">https://lists.jboss.org/mailman/listinfo/aerogear-dev</a><br>
_______________________________________________<br>
aerogear-dev mailing list<br>
<a href="mailto:aerogear-dev@lists.jboss.org">aerogear-dev@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/aerogear-dev" target="_blank">https://lists.jboss.org/mailman/listinfo/aerogear-dev</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br>Matthias Wessendorf <br><br>blog: <a href="http://matthiaswessendorf.wordpress.com/" target="_blank">http://matthiaswessendorf.wordpress.com/</a><br>
sessions: <a href="http://www.slideshare.net/mwessendorf" target="_blank">http://www.slideshare.net/mwessendorf</a><br>twitter: <a href="http://twitter.com/mwessendorf" target="_blank">http://twitter.com/mwessendorf</a>
</div></div>