<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<title></title>
</head>
<body text="#000000" bgcolor="#ffffff">
(Adding Marcel to CC, as he worked on the PicketLink-Seam integration)<br>
<br>
Just to clarify a few things with the Seam/PicketLink integration.
The core security API in Seam 3 will not be changing drastically, it's
a proven API and it's what our users are already intimately familiar
with. What we *will* be doing is offloading all of the
enterprisey-type security features such as SSO, SAML, SPNEGO, Kerberos,
OpenID integration, etc onto PicketLink. I can't explain 100% how this
will be done at this stage because I'm just starting to get into the
integration work now, however we will most likely be providing the
following things at the very minimum:<br>
<br>
1) A filter that will propagate any servlet container security context
(i.e. the logged in user and their roles) to Seam if they are not
already authenticated (see
<a class="moz-txt-link-freetext" href="https://jira.jboss.org/jira/browse/JBSEAM-4559">https://jira.jboss.org/jira/browse/JBSEAM-4559</a>). This feature in
itself will take care of a whole heap of the security features that I
mentioned above, and allow us to remove our own implementation of
BASIC/DIGEST HTTP authentication (something that would be preferable
for us not to maintain).<br>
<br>
2) A filter that will propagate Seam's security context to PicketBox.
I've written this already (with Anil's help) - what this filter does is
allow users to use the built-in JEE security annotations, such as
@RolesAllowed, etc on their beans.<br>
<br>
3) Provide integration with PicketLink IDM via a Seam IdentityStore
implementation. This will give our users greater options as to which
type of security providers they can use for their apps.<br>
<br>
This list is just a starting point, and I'm sure as we make some more
progress we will find more areas where it will be advantageous to have
some form of tighter integration. The point of this exercise though is
really to draw a line between which security features Seam will
provide, and which features we will delegate to PicketLink. <br>
<br>
Our recommendation to users will be to just use the existing Seam
Security features for their standalone, self-contained apps that
require simple authentication based on a database or LDAP server. Once
their requirements grow beyond this however, our recommendation will be
to use Seam/PicketLink. PicketLink will be "the" way to do any
federated/enterprise identity stuff in Seam. <br>
<br>
This will allow us (the Seam team) to curb the amount of development
effort that we otherwise have to put into providing extra security
features in Seam.<br>
<br>
Hopefully that paints a clearer picture ;)<br>
<br>
Shane<br>
<br>
<br>
<br>
<br>
On 07/03/10 03:18, Dan Allen wrote:
<blockquote
cite="mid:19758da1003060918h586e1df3x1868e28a1c67d880@mail.gmail.com"
type="cite">Anil,
<div><br>
</div>
<div>I like the idea that we are separating out the security logic
from Seam 3 so that it can mature and integrate in its own
cycles...basically not being tied to Seam.</div>
<div><br>
</div>
<div>However, what concerns me is the change in developer experience.
Security in Seam 2 is so simple to understand. There is barely any
configuration, it ties in nicely with the managed ORM sessions and it
covers role-based, rule-based and ACL authorization, plain and simple.</div>
<div><br>
</div>
<div>From looking at the PicketBox wiki pages, I just see a lot of
configuration that makes my eyes cross. I just don't get what I am
looking at, really. Either it is going to be more complicated, or you
guys just don't have a basic example for people to grok. Can you paint
a clearer picture for us?</div>
<div><br>
</div>
<div>Thanks,</div>
<div><br>
</div>
<div>-Dan<br>
<br>
<div class="gmail_quote">On Fri, Mar 5, 2010 at 12:32 PM, PicketBox
JBoss <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:picketbox@gmail.com">picketbox@gmail.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Hi
all,<br>
(I created this gmail address for twitter for Project PicketBox. I
may as well use it for mailing lists).<br>
<br>
Shane and I had a couple of days of intense discussion on security at
Brisbane last week. Some of those discussions were fed back into the
PicketBox project. <br>
<br>
Read more on Project PicketBox here:<br>
<a moz-do-not-send="true"
href="http://anil-identity.blogspot.com/2010/03/project-picketbox-security-for-java.html"
target="_blank">http://anil-identity.blogspot.com/2010/03/project-picketbox-security-for-java.html</a><br>
<br>
I guess when Seam 3 is released, we are going to offload majority of
the security code to PicketBox.<br>
<br>
I will be loitering around this dev list to basically answer any
security related questions.<br>
<br>
Regards,<br>
Anil Saldhana<br>
<br>
_______________________________________________<br>
seam-dev mailing list<br>
<a moz-do-not-send="true" href="mailto:seam-dev@lists.jboss.org">seam-dev@lists.jboss.org</a><br>
<a moz-do-not-send="true"
href="https://lists.jboss.org/mailman/listinfo/seam-dev"
target="_blank">https://lists.jboss.org/mailman/listinfo/seam-dev</a><br>
<br>
</blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
Dan Allen<br>
Senior Software Engineer, Red Hat | Author of Seam in Action<br>
Registered Linux User #231597<br>
<br>
<a moz-do-not-send="true" href="http://mojavelinux.com">http://mojavelinux.com</a><br>
<a moz-do-not-send="true" href="http://mojavelinux.com/seaminaction">http://mojavelinux.com/seaminaction</a><br>
<a moz-do-not-send="true"
href="http://www.google.com/profiles/dan.j.allen">http://www.google.com/profiles/dan.j.allen</a><br>
</div>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
seam-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:seam-dev@lists.jboss.org">seam-dev@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/seam-dev">https://lists.jboss.org/mailman/listinfo/seam-dev</a>
</pre>
</blockquote>
<br>
</body>
</html>