<div dir="ltr">FYI<div><br></div><div style>JIRAs for the "initial" security work:</div><div><div><br></div><div><br></div><div>All the endpoints are now secured:</div><div><a href="https://issues.jboss.org/browse/AGPUSH-59">https://issues.jboss.org/browse/AGPUSH-59</a></div>
<div><br></div><div>Details on the actual enpoints, on the AGSEC JIRA:</div><div><br></div><div>Enpoint for Push Apps is secure (using AG-Security):</div><div><a href="https://issues.jboss.org/browse/AGSEC-51">https://issues.jboss.org/browse/AGSEC-51</a></div>
<div><br></div><div>Enpoint for {Android|iOS|SimplePush} Variants is secure (using AG-Security):</div><div><a href="https://issues.jboss.org/browse/AGSEC-52">https://issues.jboss.org/browse/AGSEC-52</a></div><div><br></div>
<div>Enpoint for Device Registration is secure (Using HTTP Basic):</div><div><a href="https://issues.jboss.org/browse/AGSEC-50">https://issues.jboss.org/browse/AGSEC-50</a></div><div><br></div><div>Enpoint for SENDING is secure (Using HTTP Basic):</div>
<div><a href="https://issues.jboss.org/browse/AGSEC-54">https://issues.jboss.org/browse/AGSEC-54</a></div></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Jun 19, 2013 at 11:56 AM, Bruno Oliveira <span dir="ltr"><<a href="mailto:bruno@abstractj.org" target="_blank">bruno@abstractj.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Thanks Sebi, I'll look at this.<br>
<div class="im"><br>
Sebastien Blanc wrote:<br>
> FYI,<br>
><br>
> A "security" Java Sender branch has also been pushed :<br>
> <a href="https://github.com/aerogear/aerogear-unified-push-java-client/tree/security" target="_blank">https://github.com/aerogear/aerogear-unified-push-java-client/tree/security</a><br>
> It's using preemptive Basic Http Authentification but we will switch to<br>
> a more "classic" flow when AGPUSH-99 will be resolved.<br>
><br>
> Like Matthias said is "all in progress" work but "Push early, Push often"<br>
><br>
><br>
><br>
><br>
> On Wed, Jun 19, 2013 at 8:38 AM, Christos Vasilakis <<a href="mailto:cvasilak@gmail.com">cvasilak@gmail.com</a><br>
</div><div class="im">> <mailto:<a href="mailto:cvasilak@gmail.com">cvasilak@gmail.com</a>>> wrote:<br>
><br>
> looks great!<br>
><br>
> On Jun 17, 2013, at 3:52 PM, Matthias Wessendorf <<a href="mailto:matzew@apache.org">matzew@apache.org</a><br>
</div><div class="im">> <mailto:<a href="mailto:matzew@apache.org">matzew@apache.org</a>>> wrote:<br>
><br>
>> Hi,<br>
>><br>
>> I worked a bit on the initial security, after Bruno release the<br>
>> 1.0.1 versions of AG-Security.<br>
>><br>
>><br>
</div>>> <<a href="https://gist.github.com/anonymous/b82b7bb1b2d1ab36f92d#management-of-pushapplications-and-mobilevariants" target="_blank">https://gist.github.com/anonymous/b82b7bb1b2d1ab36f92d#management-of-pushapplications-and-mobilevariants</a>>Management<br>
>> of PushApplications and MobileVariants<br>
>><br>
>> Adding a (simple) /DEVELOPER/ class (just that, no /fancy/ roles yet).<br>
<div class="im">>> This is powered by AG-Security and the very wellknown<br>
>> "login"/"logout" will be used (and soon "enroll" for new users).<br>
>><br>
</div>>> A /DEVELOPER/ is allowed to create/manage PushApplications and<br>
<div class="im">>> MobileVariants (including the standard CRUD flow).<br>
>><br>
>> Here is a little cURL based flow:<br>
>><br>
>><br>
</div>>> <<a href="https://gist.github.com/anonymous/b82b7bb1b2d1ab36f92d#login" target="_blank">https://gist.github.com/anonymous/b82b7bb1b2d1ab36f92d#login</a>>Login:<br>
<div class="im">>><br>
>> |curl -v -b cookies.txt -c cookies.txt<br>
>> -H"Accept: application/json" -H"Content-type: application/json"<br>
>> -X POST<br>
>> -d'{"loginName":"admin","password":"123"}'<br>
>> <a href="http://localhost:8080/ag-push/rest/auth/login" target="_blank">http://localhost:8080/ag-push/rest/auth/login</a><br>
>> |<br>
>><br>
>><br>
</div>>> <<a href="https://gist.github.com/anonymous/b82b7bb1b2d1ab36f92d#create-new-pushapp" target="_blank">https://gist.github.com/anonymous/b82b7bb1b2d1ab36f92d#create-new-pushapp</a>>Create<br>
<div class="im">>> new PushApp:<br>
>><br>
>> |curl -v -b cookies.txt -c cookies.txt -v<br>
>> -H"Accept: application/json" -H"Content-type: application/json"<br>
>> -X POST<br>
>> -d'{"name" :"MyApp","description" :"awesome app" }'<br>
>> <a href="http://localhost:8080/ag-push/rest/applications" target="_blank">http://localhost:8080/ag-push/rest/applications</a><br>
>> |<br>
>><br>
>><br>
</div>>> <<a href="https://gist.github.com/anonymous/b82b7bb1b2d1ab36f92d#create-variant-here-simplepush-for-it" target="_blank">https://gist.github.com/anonymous/b82b7bb1b2d1ab36f92d#create-variant-here-simplepush-for-it</a>>Create<br>
<div class="im">>> Variant (here SimplePush) for it:<br>
>><br>
>> |curl -v -b cookies.txt -c cookies.txt -v<br>
>> -H"Accept: application/json" -H"Content-type: application/json"<br>
>> -X POST<br>
>> -d'{"pushNetworkURL" :"<a href="http://localhost:7777/endpoint/" target="_blank">http://localhost:7777/endpoint/</a>"}'<br>
</div>>> <a href="http://localhost:8080/ag-push/rest/applications/{PUSH_APP_ID}/simplePush" target="_blank">http://localhost:8080/ag-push/rest/applications/{PUSH_APP_ID}/simplePush</a> <<a href="http://localhost:8080/ag-push/rest/applications/%7BPUSH_APP_ID%7D/simplePush" target="_blank">http://localhost:8080/ag-push/rest/applications/%7BPUSH_APP_ID%7D/simplePush</a>><br>
>> |<br>
>><br>
>><br>
>> <<a href="https://gist.github.com/anonymous/b82b7bb1b2d1ab36f92d#sending-push-notifications" target="_blank">https://gist.github.com/anonymous/b82b7bb1b2d1ab36f92d#sending-push-notifications</a>>Sending<br>
<div class="im">>> Push Notifications<br>
>><br>
>> When a PushApplication is created, it will get a GENERATED<br>
</div>>> /PUSH-APP-ID/ (like before) and it will also have a generated<br>
>> /master secret/. For sending (NOW) you need HTTP BASIC auth<br>
<div class="im">>> against the SENDER HTTP interface:<br>
>><br>
>> |curl -u"{PushApplicationID}:{MasterSecret}"<br>
>> -v -H"Accept: application/json" -H"Content-type: application/json"<br>
>> -X POST<br>
>> -d'{"key":"value","alert":"HELLO!","sound":"default","badge":7,<br>
>> "simple-push":"version=123"}'<br>
>><br>
>> <a href="http://localhost:8080/ag-push/rest/sender/broadcast" target="_blank">http://localhost:8080/ag-push/rest/sender/broadcast</a><br>
>> |<br>
>><br>
>> The user is a combination of PushApplicationID:MasterSecret, hence<br>
>> no need to include the PushApplicationID on the URL.....<br>
>><br>
>><br>
</div>>> <<a href="https://gist.github.com/anonymous/b82b7bb1b2d1ab36f92d#device-registration" target="_blank">https://gist.github.com/anonymous/b82b7bb1b2d1ab36f92d#device-registration</a>>Device<br>
<div class="im">>> Registration<br>
>><br>
>> When a MobileVariant is created, it will get a GENERATED<br>
</div>>> /VARIANT-ID/ (like before) and it will have a generated "variant<br>
<div><div class="h5">>> secret" (valid ONLY!!! for that variant). Now a device needs to<br>
>> perform HTTP basic against that server, in order to register itself:<br>
>><br>
>> An Android (cURL) example:<br>
>><br>
>> |curl -u"{MobileVariantID}:{secret}"<br>
>> -v -H"Accept: application/json" -H"Content-type: application/json"<br>
>> -X POST<br>
>> -d'{<br>
>> "deviceToken" :"someTokenString",<br>
>> "deviceType" :"ANDROID",<br>
>> "mobileOperatingSystem" :"android",<br>
>> "osVersion" :"4.0.1"<br>
>> }'<br>
>><br>
>> <a href="http://localhost:8080/ag-push/rest/registry/device" target="_blank">http://localhost:8080/ag-push/rest/registry/device</a><br>
>> |<br>
>><br>
>> The user is a combination of MobileVariantID:MasterSecret, hence<br>
>> no need to include the MobileVariantID (was a http header in the<br>
>> past).<br>
>><br>
>> The work lives on a branch for now:<br>
>> <a href="https://github.com/aerogear/aerogear-unified-push-server/tree/endpoint-security" target="_blank">https://github.com/aerogear/aerogear-unified-push-server/tree/endpoint-security</a><br>
>><br>
>><br>
>> FYI, the iOS SDK has been updated to reflect that:<br>
>> <a href="https://github.com/matzew/aerogear-push-ios-registration/commit/ef8001684c38144b5a8fb05abbb87d0ddf452b07" target="_blank">https://github.com/matzew/aerogear-push-ios-registration/commit/ef8001684c38144b5a8fb05abbb87d0ddf452b07</a><br>
>><br>
>><br>
>> --<br>
>> Matthias Wessendorf<br>
>><br>
>> blog: <a href="http://matthiaswessendorf.wordpress.com/" target="_blank">http://matthiaswessendorf.wordpress.com/</a><br>
>> sessions: <a href="http://www.slideshare.net/mwessendorf" target="_blank">http://www.slideshare.net/mwessendorf</a><br>
>> twitter: <a href="http://twitter.com/mwessendorf" target="_blank">http://twitter.com/mwessendorf</a><br>
>> _______________________________________________<br>
>> aerogear-dev mailing list<br>
</div></div>>> <a href="mailto:aerogear-dev@lists.jboss.org">aerogear-dev@lists.jboss.org</a> <mailto:<a href="mailto:aerogear-dev@lists.jboss.org">aerogear-dev@lists.jboss.org</a>><br>
<div class="im">>> <a href="https://lists.jboss.org/mailman/listinfo/aerogear-dev" target="_blank">https://lists.jboss.org/mailman/listinfo/aerogear-dev</a><br>
><br>
><br>
> _______________________________________________<br>
> aerogear-dev mailing list<br>
</div>> <a href="mailto:aerogear-dev@lists.jboss.org">aerogear-dev@lists.jboss.org</a> <mailto:<a href="mailto:aerogear-dev@lists.jboss.org">aerogear-dev@lists.jboss.org</a>><br>
<div class="im HOEnZb">> <a href="https://lists.jboss.org/mailman/listinfo/aerogear-dev" target="_blank">https://lists.jboss.org/mailman/listinfo/aerogear-dev</a><br>
><br>
><br>
> _______________________________________________<br>
> aerogear-dev mailing list<br>
> <a href="mailto:aerogear-dev@lists.jboss.org">aerogear-dev@lists.jboss.org</a><br>
> <a href="https://lists.jboss.org/mailman/listinfo/aerogear-dev" target="_blank">https://lists.jboss.org/mailman/listinfo/aerogear-dev</a><br>
<br>
</div><span class="HOEnZb"><font color="#888888">--<br>
abstractj<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
_______________________________________________<br>
aerogear-dev mailing list<br>
<a href="mailto:aerogear-dev@lists.jboss.org">aerogear-dev@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/aerogear-dev" target="_blank">https://lists.jboss.org/mailman/listinfo/aerogear-dev</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br>Matthias Wessendorf <br><br>blog: <a href="http://matthiaswessendorf.wordpress.com/" target="_blank">http://matthiaswessendorf.wordpress.com/</a><br>
sessions: <a href="http://www.slideshare.net/mwessendorf" target="_blank">http://www.slideshare.net/mwessendorf</a><br>twitter: <a href="http://twitter.com/mwessendorf" target="_blank">http://twitter.com/mwessendorf</a>
</div>