[forge-dev] Multitenancy for Forge as a Service

[George Gastaldi]

Hey Andrew,

Yes, this is a really important question, and it's something that I believe
that the Forge architecture supports out-of-the-box. Every interaction with
the UI API (the Forge commands, per say) is stored in a request-scoped
UIContext[1] object that is initialized when a command is invoked and
destroyed when the command finishes executing. That means that you can
execute multiple concurrent commands in a single Forge instance and they
will not affect each other.

When it comes to security, as a good practice, it is important to restrict
the commands that the exposed REST service can execute.
That's why in the Obsidian backend[2] we only expose a REST endpoint[3]
consuming the Forge API to execute a limited number of commands (more
specifically, the ones exposed by the obsidian-addon[4])

Last but not least, as the Forge Online app is just a PoC illustrating how
Forge can work in a web environment, it does not impose restrictions to the
supported commands, therefore it shouldn't be a web app to be used in
production.

PS: It would be nice to ping the Fabric8 team for this matter as they are
already using Forge as their project generator solution for a long time now.

I hope this helps. Looking forward to this list of requirements and happy
to discuss about this anytime.

[1] -
https://github.com/forge/core/tree/master/ui#uicommand-execution-lifecycle
[2] - https://github.com/obsidian-toaster/generator-backend
[3] -
https://github.com/obsidian-toaster/generator-backend/blob/master/src/main/java/org/obsidiantoaster/generator/rest/ObsidianResource.java
[4] - https://github.com/obsidian-toaster/obsidian-addon

Best Regards,

*George Gastaldi*

https://onename.com/gastaldi

On Tue, Jan 31, 2017 at 9:27 PM, Andrew Lee Rubinger <alr at redhat.com> wrote:

> Hi, all:
>
> We have some requests coming down the pike from the Developer Group with
> regards to running Forge as a Service (which is great!).
>
> Additionally, I'm suspecting this will soon be very important for us as
> well, as we continue to build out what's currently known as the "Obsidian
> Generator", using Forge as a backend.
>
> I'm hoping the Forge team will kindly advise as to our preparedness for
> running Forge in a multitenant environment.  Concerns may include resource
> consumption (not running an instance-per-user), security, etc.  Have we yet
> broached this subject specifically in the prototypes I've seen thus far
> using Forge Online?
>
> I've requested of the Developer Group a list of requirements they've
> devised; will send those along here when I have them.  In the meantime,
> mind describing where we currently stand?
>
> S,
> ALR
>
> --
> Red Hat Developer Group Architecture
> @ALRubinger
> _______________________________________________
> forge-dev mailing list
> forge-dev at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/forge-dev
>