<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Dec 3, 2013 at 12:21 PM, Bruno Oliveira <span dir="ltr"><<a href="mailto:bruno@abstractj.org" target="_blank">bruno@abstractj.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">Hi Sebi, few comments inline.<br>
<div class="im"><br>
On December 3, 2013 at 8:54:22 AM, Sebastien Blanc (<a href="mailto:scm.blanc@gmail.com">scm.blanc@gmail.com</a>) wrote:<br>
><br>
>Hi,<br>
>I wanted to start a fresh new thread about user management in the Unified<br>
>Push Server, please check below the proposition I made for the next release<br>
>(0.10.0) , feel free to comment / ask questions etc ...<br>
><br>
>(<a href="https://gist.github.com/sebastienblanc/6547605" target="_blank">https://gist.github.com/sebastienblanc/6547605</a>)<br>
>User Management for the Aerogear Unfied Push<br>
>Server<br>
>Introduction<br>
><br>
>The goal of this document is to describe how the User Management will be<br>
>implemented in the Unified Push Server. Currently there is only one user<br>
>created by default when installing UPS. Having the possibility to create<br>
>multiple users is a "Must Have" and should be manageable from the Admin<br>
>Console. Some roles should also be introduced<br>
>Roles /<br>
>Permissions<br>
><br>
>There will be 3 different roles in this first version :<br>
><br>
</div>>- *Admin* : The Admin is like the super-user, it can access all the<br>
<div class="im">>features of UPS including the creation of users.<br>
</div>>- *Developer* : The developer can create/read/update and delete<br>
>Applications/variants.<br>
>- *viewer* : Can only 'Read', can be useful for monitoring apps (or for<br>
<div class="im">>the future UPS Forge Plugin).<br>
<br>
</div>Here the Developer role will be able to reset user’s password? Or his own password?<br></blockquote><div> </div><div><span style="font-family:arial,sans-serif;font-size:12.800000190734863px">Sorry, I was not specific enough here, I meant reset the secret of an push applications or a variant not the password of the user (I updated the gist) </span> </div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
><br>
>Role / actionCreateUpdateReadDeleteReset pwdUser MngtAdminXXXXXXDeveloperXXX<br>
>XXViewer X<br>
<div class="im">>User<br>
>management flow<br>
><br>
>An Admin can create new user by providing a loginName. This will be<br>
>possible through :<br>
><br>
</div>>- The console<br>
>- The REST service<br>
<div class="im">><br>
>Password<br>
>Management<br>
><br>
>At creation, the user will have a default password , i.e 123.<br>
<br>
</div>I think here is the problem which we can’t delay anymore. At the creation we should probably send an e-mail with the encrypted url for the password setup.<br>
<br>
Is not the same thing, but the url approach can be something similar to what SP does to register channels.<br></blockquote><div><br></div><div><span style="font-family:arial,sans-serif;font-size:12.800000190734863px"> Agreed, but we must find a "email" solution that works both on a "custom" deployed UPS and on a UPS deployed through the openshift cartdridge. There are probably solutions but my idea was to have this simple solution for the 0.10.0 and the email flow for the 1.0 release.</span></div>
<div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div class="im"><br>
>First Login<br>
><br>
>When logging in for this first time, the new created user will be prompted<br>
>to change his password.<br>
<br>
</div>Same thing there, I think users should be able to reset their own password.<br></blockquote><div> </div><div><span style="font-family:arial,sans-serif;font-size:12.800000190734863px">Make sense but that would imply that an user can manage his account, again for 0.10.0 I'm not sure we can get it in (there is a lot of stuff open for UPS 0.10.0 beside user management). </span> </div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div class="im"><br>
>Reset<br>
>Password Instruction<br>
><br>
>If a user wants to reset his password, he has to request it manually<br>
>(email, post pigeon ...) to an admin. The password will be again the<br>
>default one and the user will have to change it again when logging in.<br>
>Scope<br>
>of the current permissions<br>
><br>
>Currently, a authenticated user can see all the applications / variants /<br>
>installations, no matter he is the author or not. There is also no concept<br>
>of groups, that may come in the future releases.<br>
>Security<br>
>Implementation<br>
><br>
>Currently, it would be possible to implement this using<br>
>Aerogear-Security-Picketlink and with some raw Picketlink :<br>
><br>
</div>>- Login / Logout / Registration : AG-Security offers all we need<br>
>- Roles and permissions : AG-Security offers a secures annotation that<br>
<div class="im">>can be used to protect the endpoints.<br>
><br>
>I know there are some concerns about this last points (Role escalation etc<br>
>...) and would like to have advice / feedback on what is acceptable /<br>
>doable for the 0.10.0 release (15/01).<br>
</div>>_______________________________________________<br>
>aerogear-dev mailing list<br>
><a href="mailto:aerogear-dev@lists.jboss.org">aerogear-dev@lists.jboss.org</a><br>
><a href="https://lists.jboss.org/mailman/listinfo/aerogear-dev" target="_blank">https://lists.jboss.org/mailman/listinfo/aerogear-dev</a><br>
<span class=""><font color="#888888"><br>
-- <br>
abstractj<br>
</font></span></blockquote></div><br></div></div>