<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>On Nov 7, 2012, at 13:47, Anil Saldhana <<a href="mailto:Anil.Saldhana@redhat.com">Anil.Saldhana@redhat.com</a>> wrote:</div><div><br></div><blockquote type="cite"><div>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<div class="moz-cite-prefix">On 11/07/2012 10:28 AM, Jason Porter
wrote:<br>
</div>
<blockquote cite="mid:CAF9TksOKLrZ-kY84UzX4ZDS2-TACSXm2VoZDNUgGP2-Up0QsXQ@mail.gmail.com" type="cite">This is something I've been thinking about actually. A
small side project I'm working on during the late hours of the
evening is going to be doing something like this. My current line
of thinking is to authenticate once and pass back a token then
double check the token and IP address with each request and have a
server side timeout for their authorized session. I know it's not
the same as what you're talking about, but I couldn't come up with
anything good to stop spoofing a valid token and also enforcing a
time limit to a secure session. <br>
</blockquote>
Jason - good thinking. What you are trying to do maps perfectly
into a SAML rich structure but exceeds the JSON Web Token work (JWT
<a class="moz-txt-link-freetext" href="http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-05">http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-05</a>) that
is going on in IETF. Toward this, I have been thinking that we
definitely need a JSON Token representation of the SAML XML
structure (that can capture identity, authentication, attribute,
authorization decisions etc). Basically a literal translation of the
SAML XML structures into JSON.<br></div></blockquote><div><br></div><div>I'm okay using what I have now and then migrating to whatever we come up with and use as a test case later. </div><br><blockquote type="cite"><div>
<blockquote cite="mid:CAF9TksOKLrZ-kY84UzX4ZDS2-TACSXm2VoZDNUgGP2-Up0QsXQ@mail.gmail.com" type="cite">
<div class="gmail_extra">
<br>
<br>
<div class="gmail_quote">On Wed, Nov 7, 2012 at 8:53 AM, Anil
Saldhana <span dir="ltr"><<a moz-do-not-send="true" href="mailto:Anil.Saldhana@redhat.com" target="_blank">Anil.Saldhana@redhat.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi All,<br>
this is an issue I see more at a client (in the classic
client/server<br>
paradigm) that the computing industry is moving toward.<br>
<br>
With the increasing push towards mobility, cloud and REST<br>
architectures, I think access control decisions may have to
be made<br>
where a decision is needed. So instead of making 100
authorization<br>
calls to the server, we need a model where one call is made
to the<br>
server (given user, context etc) and we get back a set of
entitlements<br>
(or permissions) that need to be applied at the client side.<br>
<br>
Examples include a mobile client (such as banking) that
needs to figure<br>
out what aspects of the mobile screen the user is entitled
to see and<br>
what operations he is capable of performing.<br>
<br>
The industry has put too much emphasis on the enforcement
model<br>
(meaning, make 100 authorization calls to the glorified
server). There<br>
has been almost no models for the entitlement approach.<br>
<br>
I have prototyped something here:<br>
<a moz-do-not-send="true" href="https://docs.jboss.org/author/display/SECURITY/EntitlementsManager" target="_blank">https://docs.jboss.org/author/display/SECURITY/EntitlementsManager</a><br>
<br>
The entitlements should be sent in a JSON response.<br>
<br>
Also, trying to get this standardized in the industry via
the OASIS<br>
Cloud Authorization TC.<br>
<a moz-do-not-send="true" href="https://lists.oasis-open.org/archives/oasis-charter-discuss/201210/msg00003.html" target="_blank">https://lists.oasis-open.org/archives/oasis-charter-discuss/201210/msg00003.html</a><br>
<br>
I have a hunch that projects such as Aerogear, Drools, Errai
and<br>
Infinispan may need this model.<br>
<br>
Thoughts?<br>
<br>
Regards,<br>
Anil<br>
</blockquote>
</div>
</div>
</blockquote>
</div></blockquote></body></html>