Easy access to security related documentation
by Bruno Oliveira
Good morning, I would like to suggest a new structure to all the
documents related with security. We have a great content on
aerogear.org, at the same time, hard to find. Because some items are
located at guides sections, others can be found at specs section.
That said I would like to suggest the following section under "guides"
section.
- Security
- Cryptography (Include a documentation revamped and revisited), usage
instructions and etc
- Authentication and Authorization
- Client
- Using OAuth2 with Android
- Using OAuth2 with iOS
- Using OAuth2 with JavaScript
- Server
- How to setup the server and references to Keycloak
I don't want to drop any documentation already done, only to revisit,
organize and improve. Thoughts?
--
abstractj
PGP: 0x84DC9914
10 years, 10 months
iOS SDK for OAuth2
by Bruno Oliveira
Good morning, I was reviewing our SDK for iOS and I have few questions:
1. For example at Shoot app. Why our users have to configure to insert
the app ID at Shoot-Info.plist and also insert the same app ID at
ViewController? I was just wondering that once the app ID is informed,
you don't need to inform it again.
2. We have a note:
"Because this demo securely stores OAuth2 tokens in your iOS keychain,
we chosen to use WhenPasscodeSet policy as a result to run this app you
need to have your passcode set"
I think that's amazing, but at the same time we instruct our devs, to
insert the client secret hard coded into the app. Something like:
let facebookConfig = FacebookConfig(
clientId: "XXXXXX",
clientSecret: "42",
scopes:["photo_upload, publish_actions"])
Doing the reverse engineering of the app, would permit me to get the
secret and mimic your FB app.
So I would like to remove the need to input the same information twice
and encrypt the client secret using password based encryption.
Let me know what do you think and I will start to file Jiras to myself.
Note: This is not an issue specific to iOS. All the projects will get
the same love and feedback.
--
abstractj
PGP: 0x84DC9914
10 years, 10 months
Chrome Push Messages
by Lucas Holmquist
Hello,
now that the 1.0.0-final is pretty much out for the UnifiedPush Server, i’m starting to look at the new API that Chrome apps use for sending push notifications.
the TL;DR of it is, it’s basically the same as Android now.( no more refresh tokens and access tokens and such )
So the question is, do we need to have a deprecation period on what is currently there?
The v1 of the chrome pushMessaging api has become legacy and it is recommended to use the new stuff. https://developer.chrome.com/apps/cloudMessagingV1
While i have looked to deeply, it’s possible we can use the same “Variant” structure for Chrome Apps, Since they will be using the same Network
wdyt?
-Luke
10 years, 10 months
iOS push error
by Matthias Wessendorf
Hi Harini,
I opened a new thread for this to make it easier to follow up on this
subject.
I just tested my Push Server and iOS just worked fine. Here are a few
questions:
* Did you upload the correct .p12 file for the iOS variant?
* Or did you replace a development cert with a production cert ?
* Did it work a few days ago?
* Did you try to reboot the instance via the openshift UI ?
Thanks,
Matthias
On Tue, Jan 27, 2015 at 1:08 PM, Sekar, Harini <harini.sekar(a)rntbci.com>
wrote:
> Hi guys,
>
> Have deployed the aerogear in openshit and push notification for IOS is
> not working
> Error :
> reason: Error sending payload to APNs server:
> sun.security.validator.ValidatorException: No trusted certificate found
>
> please help me sort this out
>
> Thanks & Regards
> Harini S
>
> --
Matthias Wessendorf
blog: http://matthiaswessendorf.wordpress.com/
sessions: http://www.slideshare.net/mwessendorf
twitter: http://twitter.com/mwessendorf
10 years, 10 months
Amazon Device Messaging (ADM) support on UPS
by Sebastien Blanc
Hi Folks,
I've just submitted a PR to support ADM (Amazon Device Messaging) on UPS[1]
, yay !
A few notes :
- The Java ADM connector is also managed by AeroGear [2], it's not yet
on Maven Central, so you will need to clone it and build it
- The Client SDK (and updated Cordova Plugin) is not yet available but
to make this PR testable, we have adapted a Cordova App that Amazon use as
sample to show ADM, this fork will register with UPS [3], this app contains
also all the instructions to get started
- About the client SDK, FireOS (Amazon's OS) is almost "just" Android,
so we should be able to reuse most of our Android Lib [4], we jsut need to
remove the GCM part and use the ADM library instead. I will start work on
that today and ping our Android gods to see which is the best way to do
that.
So anyone who has a Amazon Tablet, please give it a shot and report on the
PR !
Have fun !
Sebi
[1] https://github.com/aerogear/aerogear-unifiedpush-server/pull/480
[2] https://github.com/aerogear/java-adm
[3] https://github.com/sebastienblanc/adm-cordova-sample
10 years, 10 months
