<div dir="ltr">Have in mind, this is all "progressing"...<div><br></div><div>Currently looking at JavaScript "secure" registration + CORS<div><br></div><div>Followed by:<br><div>* iOS SDK<br></div><div style>
* Java Sender</div><div style>* Android</div><div style><br></div><div style>-Matthias</div></div><div style><br></div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Jun 19, 2013 at 6:40 AM, Matthias Wessendorf <span dir="ltr"><<a href="mailto:matzew@apache.org" target="_blank">matzew@apache.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Bruno merged the security bits to MASTER.<div><br></div><div>A tag (0.1.0) of the previous MASTER (the one without security) has been created.</div>
<span class="HOEnZb"><font color="#888888"><div><br></div><div>-Matthias</div></font></span></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra">
<br><br><div class="gmail_quote">On Mon, Jun 17, 2013 at 2:52 PM, Matthias Wessendorf <span dir="ltr"><<a href="mailto:matzew@apache.org" target="_blank">matzew@apache.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><p style="line-height:22.727272033691406px;margin-right:0px;font-size:15.454545021057129px;margin-left:0px;margin-bottom:15px;font-family:Helvetica,arial,freesans,clean,sans-serif;margin-top:0px!important">
Hi,</p><p style="line-height:22.727272033691406px;font-size:15.454545021057129px;font-family:Helvetica,arial,freesans,clean,sans-serif;margin:15px 0px">I worked a bit on the initial security, after Bruno release the 1.0.1 versions of AG-Security.</p>
<h2 style="border-bottom-style:solid;border-bottom-width:1px;font-size:2em;font-family:Helvetica,arial,freesans,clean,sans-serif;margin:1em 0px 15px;padding:0px;border-bottom-color:rgb(238,238,238)"><a name="13f5abb946e152b8_13f5231a370033ad_management-of-pushapplications-and-mobilevariants" href="https://gist.github.com/anonymous/b82b7bb1b2d1ab36f92d#management-of-pushapplications-and-mobilevariants" style="color:rgb(65,131,196);text-decoration:none;display:block;padding-left:30px" target="_blank"><span></span></a>Management of PushApplications and MobileVariants</h2>
<p style="line-height:22.727272033691406px;font-size:15.454545021057129px;font-family:Helvetica,arial,freesans,clean,sans-serif;margin:15px 0px">Adding a (simple) <em>DEVELOPER</em> class (just that, no <em>fancy</em> roles yet).<br>
This is powered by AG-Security and the very wellknown "login"/"logout" will be used (and soon "enroll" for new users).</p><p style="line-height:22.727272033691406px;font-size:15.454545021057129px;font-family:Helvetica,arial,freesans,clean,sans-serif;margin:15px 0px">
A <em>DEVELOPER</em> is allowed to create/manage PushApplications and MobileVariants (including the standard CRUD flow).</p><p style="line-height:22.727272033691406px;font-size:15.454545021057129px;font-family:Helvetica,arial,freesans,clean,sans-serif;margin:15px 0px">
Here is a little cURL based flow:</p><h4 style="font-size:1.2em;font-family:Helvetica,arial,freesans,clean,sans-serif;margin:1em 0px 15px;padding:0px"><a name="13f5abb946e152b8_13f5231a370033ad_login" href="https://gist.github.com/anonymous/b82b7bb1b2d1ab36f92d#login" style="color:rgb(65,131,196);text-decoration:none;display:block;padding-left:30px" target="_blank"><span></span></a>Login:</h4>
<pre style="background-color:rgb(248,248,248);border-top-left-radius:3px;margin-bottom:15px;padding:6px 10px;line-height:19px;border-top-right-radius:3px;font-size:13px;overflow:auto;border-bottom-right-radius:3px;font-family:Consolas,'Liberation Mono',Courier,monospace;margin-top:15px;border:1px solid rgb(221,221,221);border-bottom-left-radius:3px">
<code style="font-family:Consolas,'Liberation Mono',Courier,monospace;font-size:12px;line-height:normal;margin:0px;padding:0px;border:none;background-color:transparent;border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px">curl -v -b cookies.txt -c cookies.txt
-H "Accept: application/json" -H "Content-type: application/json"
-X POST
-d '{"loginName": "admin", "password":"123"}'
<a href="http://localhost:8080/ag-push/rest/auth/login" target="_blank">http://localhost:8080/ag-push/rest/auth/login</a>
</code></pre><h4 style="font-size:1.2em;font-family:Helvetica,arial,freesans,clean,sans-serif;margin:1em 0px 15px;padding:0px"><a name="13f5abb946e152b8_13f5231a370033ad_create-new-pushapp" href="https://gist.github.com/anonymous/b82b7bb1b2d1ab36f92d#create-new-pushapp" style="color:rgb(65,131,196);text-decoration:none;display:block;padding-left:30px" target="_blank"><span></span></a>Create new PushApp:</h4>
<pre style="background-color:rgb(248,248,248);border-top-left-radius:3px;margin-bottom:15px;padding:6px 10px;line-height:19px;border-top-right-radius:3px;font-size:13px;overflow:auto;border-bottom-right-radius:3px;font-family:Consolas,'Liberation Mono',Courier,monospace;margin-top:15px;border:1px solid rgb(221,221,221);border-bottom-left-radius:3px">
<code style="font-family:Consolas,'Liberation Mono',Courier,monospace;font-size:12px;line-height:normal;margin:0px;padding:0px;border:none;background-color:transparent;border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px">curl -v -b cookies.txt -c cookies.txt -v
-H "Accept: application/json" -H "Content-type: application/json"
-X POST
-d '{"name" : "MyApp", "description" : "awesome app" }'
<a href="http://localhost:8080/ag-push/rest/applications" target="_blank">http://localhost:8080/ag-push/rest/applications</a>
</code></pre><h4 style="font-size:1.2em;font-family:Helvetica,arial,freesans,clean,sans-serif;margin:1em 0px 15px;padding:0px"><a name="13f5abb946e152b8_13f5231a370033ad_create-variant-here-simplepush-for-it" href="https://gist.github.com/anonymous/b82b7bb1b2d1ab36f92d#create-variant-here-simplepush-for-it" style="color:rgb(65,131,196);text-decoration:none;display:block;padding-left:30px" target="_blank"><span></span></a>Create Variant (here SimplePush) for it:</h4>
<pre style="background-color:rgb(248,248,248);border-top-left-radius:3px;margin-bottom:15px;padding:6px 10px;line-height:19px;border-top-right-radius:3px;font-size:13px;overflow:auto;border-bottom-right-radius:3px;font-family:Consolas,'Liberation Mono',Courier,monospace;margin-top:15px;border:1px solid rgb(221,221,221);border-bottom-left-radius:3px">
<code style="font-family:Consolas,'Liberation Mono',Courier,monospace;font-size:12px;line-height:normal;margin:0px;padding:0px;border:none;background-color:transparent;border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px">curl -v -b cookies.txt -c cookies.txt -v
-H "Accept: application/json" -H "Content-type: application/json"
-X POST
-d '{"pushNetworkURL" : "<a href="http://localhost:7777/endpoint/" target="_blank">http://localhost:7777/endpoint/</a>"}'
<a href="http://localhost:8080/ag-push/rest/applications/%7BPUSH_APP_ID%7D/simplePush" target="_blank">http://localhost:8080/ag-push/rest/applications/{PUSH_APP_ID}/simplePush</a>
</code></pre><h2 style="border-bottom-style:solid;border-bottom-width:1px;font-size:2em;font-family:Helvetica,arial,freesans,clean,sans-serif;margin:1em 0px 15px;padding:0px;border-bottom-color:rgb(238,238,238)">
<a name="13f5abb946e152b8_13f5231a370033ad_sending-push-notifications" href="https://gist.github.com/anonymous/b82b7bb1b2d1ab36f92d#sending-push-notifications" style="color:rgb(65,131,196);text-decoration:none;display:block;padding-left:30px" target="_blank"><span></span></a>Sending Push Notifications</h2>
<p style="line-height:22.727272033691406px;font-size:15.454545021057129px;font-family:Helvetica,arial,freesans,clean,sans-serif;margin:15px 0px">When a PushApplication is created, it will get a GENERATED <em>PUSH-APP-ID</em> (like before) and it will also have a generated <em>master secret</em>. For sending (NOW) you need HTTP BASIC auth against the SENDER HTTP interface:</p>
<pre style="background-color:rgb(248,248,248);border-top-left-radius:3px;margin-bottom:15px;padding:6px 10px;line-height:19px;border-top-right-radius:3px;font-size:13px;overflow:auto;border-bottom-right-radius:3px;font-family:Consolas,'Liberation Mono',Courier,monospace;margin-top:15px;border:1px solid rgb(221,221,221);border-bottom-left-radius:3px">
<code style="font-family:Consolas,'Liberation Mono',Courier,monospace;font-size:12px;line-height:normal;margin:0px;padding:0px;border:none;background-color:transparent;border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px">curl -u "{PushApplicationID}:{MasterSecret}"
-v -H "Accept: application/json" -H "Content-type: application/json"
-X POST
-d '{"key":"value", "alert":"HELLO!", "sound":"default", "badge":7,
"simple-push":"version=123"}'
<a href="http://localhost:8080/ag-push/rest/sender/broadcast" target="_blank">http://localhost:8080/ag-push/rest/sender/broadcast</a>
</code></pre><p style="line-height:22.727272033691406px;font-size:15.454545021057129px;font-family:Helvetica,arial,freesans,clean,sans-serif;margin:15px 0px">The user is a combination of PushApplicationID:MasterSecret, hence no need to include the PushApplicationID on the URL.....</p>
<h2 style="border-bottom-style:solid;border-bottom-width:1px;font-size:2em;font-family:Helvetica,arial,freesans,clean,sans-serif;margin:1em 0px 15px;padding:0px;border-bottom-color:rgb(238,238,238)"><a name="13f5abb946e152b8_13f5231a370033ad_device-registration" href="https://gist.github.com/anonymous/b82b7bb1b2d1ab36f92d#device-registration" style="color:rgb(65,131,196);text-decoration:none;display:block;padding-left:30px" target="_blank"><span></span></a>Device Registration</h2>
<p style="line-height:22.727272033691406px;font-size:15.454545021057129px;font-family:Helvetica,arial,freesans,clean,sans-serif;margin:15px 0px">When a MobileVariant is created, it will get a GENERATED <em>VARIANT-ID</em> (like before) and it will have a generated "variant secret" (valid ONLY!!! for that variant). Now a device needs to perform HTTP basic against that server, in order to register itself:</p>
<p style="line-height:22.727272033691406px;font-size:15.454545021057129px;font-family:Helvetica,arial,freesans,clean,sans-serif;margin:15px 0px">An Android (cURL) example:</p><pre style="background-color:rgb(248,248,248);border-top-left-radius:3px;margin-bottom:15px;padding:6px 10px;line-height:19px;border-top-right-radius:3px;font-size:13px;overflow:auto;border-bottom-right-radius:3px;font-family:Consolas,'Liberation Mono',Courier,monospace;margin-top:15px;border:1px solid rgb(221,221,221);border-bottom-left-radius:3px">
<code style="font-family:Consolas,'Liberation Mono',Courier,monospace;font-size:12px;line-height:normal;margin:0px;padding:0px;border:none;background-color:transparent;border-top-left-radius:3px;border-top-right-radius:3px;border-bottom-right-radius:3px;border-bottom-left-radius:3px">curl -u "{MobileVariantID}:{secret}"
-v -H "Accept: application/json" -H "Content-type: application/json"
-X POST
-d '{
"deviceToken" : "someTokenString",
"deviceType" : "ANDROID",
"mobileOperatingSystem" : "android",
"osVersion" : "4.0.1"
}'
<a href="http://localhost:8080/ag-push/rest/registry/device" target="_blank">http://localhost:8080/ag-push/rest/registry/device</a>
</code></pre><p style="line-height:22.727272033691406px;font-size:15.454545021057129px;font-family:Helvetica,arial,freesans,clean,sans-serif;margin:15px 0px">The user is a combination of MobileVariantID:MasterSecret, hence no need to include the MobileVariantID (was a http header in the past).</p>
<p style="margin:15px 0px"><font color="#000000" face="Helvetica, arial, freesans, clean, sans-serif"><span style="font-size:15.454545021057129px;line-height:22.727272033691406px">The work lives on a branch for now:</span></font><br>
<font color="#000000" face="Helvetica, arial, freesans, clean, sans-serif"><span style="font-size:15px;line-height:22.71875px"><a href="https://github.com/aerogear/aerogear-unified-push-server/tree/endpoint-security" target="_blank">https://github.com/aerogear/aerogear-unified-push-server/tree/endpoint-security</a></span></font><br>
</p><p style="line-height:22.727272033691406px;font-size:15.454545021057129px;font-family:Helvetica,arial,freesans,clean,sans-serif;margin:15px 0px"><br></p><p style="line-height:22.727272033691406px;margin-right:0px;font-size:15.454545021057129px;margin-left:0px;margin-bottom:0px!important;font-family:Helvetica,arial,freesans,clean,sans-serif;margin-top:15px">
FYI, the iOS SDK has been updated to reflect that: <a href="https://github.com/matzew/aerogear-push-ios-registration/commit/ef8001684c38144b5a8fb05abbb87d0ddf452b07" style="color:rgb(65,131,196);text-decoration:none" target="_blank">https://github.com/matzew/aerogear-push-ios-registration/commit/ef8001684c38144b5a8fb05abbb87d0ddf452b07</a></p>
<span><font color="#888888">
<div><br></div>-- <br>Matthias Wessendorf <br><br>blog: <a href="http://matthiaswessendorf.wordpress.com/" target="_blank">http://matthiaswessendorf.wordpress.com/</a><br>sessions: <a href="http://www.slideshare.net/mwessendorf" target="_blank">http://www.slideshare.net/mwessendorf</a><br>
twitter: <a href="http://twitter.com/mwessendorf" target="_blank">http://twitter.com/mwessendorf</a>
</font></span></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Matthias Wessendorf <br><br>blog: <a href="http://matthiaswessendorf.wordpress.com/" target="_blank">http://matthiaswessendorf.wordpress.com/</a><br>sessions: <a href="http://www.slideshare.net/mwessendorf" target="_blank">http://www.slideshare.net/mwessendorf</a><br>
twitter: <a href="http://twitter.com/mwessendorf" target="_blank">http://twitter.com/mwessendorf</a>
</div>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br>Matthias Wessendorf <br><br>blog: <a href="http://matthiaswessendorf.wordpress.com/" target="_blank">http://matthiaswessendorf.wordpress.com/</a><br>
sessions: <a href="http://www.slideshare.net/mwessendorf" target="_blank">http://www.slideshare.net/mwessendorf</a><br>twitter: <a href="http://twitter.com/mwessendorf" target="_blank">http://twitter.com/mwessendorf</a>
</div>