On Thu, Oct 9, 2014 at 6:35 AM, Bruno Oliveira <bruno(a)abstractj.org> wrote:
For the fine grained authorization model, Keycloak already implements
it
with:
@Path("bananas")
@SecurityDomain("aerogear")
public class BananaService {
@GET
@Produces("application/json")
@RolesAllowed("admin")
public List<String> getBananas() {
return something();
}
}
Is this the correct place to implement the query?
https://github.com/aerogear/aerogear-unifiedpush-server/blob/4641e69362ba...
On 2014-10-08, Bruno Oliveira wrote:
> On 2014-10-08, Matthias Wessendorf wrote:
> > On Wed, Oct 8, 2014 at 6:25 PM, Bruno Oliveira <bruno(a)abstractj.org>
wrote:
> >
> > > On 2014-10-08, Matthias Wessendorf wrote:
> > > > On Wed, Oct 8, 2014 at 5:34 PM, Bruno Oliveira <
bruno(a)abstractj.org>
> > > wrote:
> > > >
> > > > > If I understood correctly what we want to achieve tl;dr is:
> > > > >
> > > > > - Include a JPA query on UPS to list all app/variants on UPS
> > > > >
> > > >
> > > > yes
> > > >
> > > >
> > > > > - Introduce fine grained permissions for this query. Into this
way we
> > > > > can differentiate admin from developers[1]
> > > > >
> > > >
> > > > the 'how' is tbd;
> > >
> > > I just want to check if my reading is correct and we can start to
work
> > > on the "how" with Jiras. If you are fine with it.
> > >
> > > > today we query for the user's own apps/variant:
> > > >
> > >
https://github.com/aerogear/aerogear-unifiedpush-server/blob/master/jaxrs...
> > > >
> > > > One (simple) option is: the underlying service could do a
"select *
> > > > from..." if the role is 'admin'
> > >
> > > Alright. But the query must display that some app "golum"
belongs to
> > > "abstractj" and another app with the same name, belongs to
matzew.
> > > Because is pretty likely to happen naming duplication.
> > >
> >
> > yeah, sure. That info is already present on the PushApplication -
currently
> > that is just not displayed.
> >
> >
> > >
> > > >
> > > >
> > > > > - Create an interface on UPS to the admin, otherwise the whole
> > > > > implementation is useless.
> > > > >
> > > >
> > > > what do you mean ?
> > >
> > > If you query the database for all apps created. How do you delete the
> > > application "golum" created by bruno if I have 10 apps named
"golum"
in
> > > my database?
> > >
> >
> > Ah, ok. I was wondering you wanted to define some completely new UI :)
> >
> > I had something like this in mind (yes, I am not a designer :))
> >
http://people.apache.org/~matzew/AdminViewOnApps.png
>
> The interface design is not a big deal. Would be nice to add some
> filtering to the search:
>
> - search by owner
> - search by variant
> - search by app name
>
>
> >
> > That's just one initial thought. Once we agree on this overall
feature, I
> > think we will nail the details of the 'how' in the relevant JIRA
subtasks
> > of AGPUSH-697.
> > However I fully agree that we need to apply some tweaks to the
existing UI,
> > so that the owner name is visible when the 'admin' is looking at the
> > "application overview" page, like in the screenshot.
>
> Subtasks already created:
https://issues.jboss.org/browse/AGPUSH-697
>
>
> >
> >
> > >
> > > That's why I think the mininum for the UPS admin interface must be
> > > defined, right
> > > now, before start the whole implementation. What would you expect to
see
> > > when you query the whole database?
> > >
> >
> > I thought about adding 'pagination' on the "application
overview" page,
> > similar like we do on the installations.
> >
> > -Matthias
> >
> >
> >
> > >
> > > >
> > > >
> > > > >
> > > > > >From my understanding, Keycloak will just manage these users
and
> > > unless
> > > > > something has changed, we provide the fine grained
authorization
model
> > > on
> > > > > UPS. Like
> > > > > we did in the past.
> > > > >
> > > >
> > > > yeah, the users live in Keycloak - we somehow differentiate on the
> > > > role/user if we do a "select all" or just those for the
specific
user
> > > >
> > > >
> > > > >
> > > > > Am I correct?
> > > > >
> > > > > [1] -
> > >
http://lists.jboss.org/pipermail/keycloak-dev/2014-May/001851.html
> > > > >
> > > > > On 2014-10-08, Matthias Wessendorf wrote:
> > > > > > Hi,
> > > > > >
> > > > > > as of today, we have a single user (admin), to revisit that
we
have
> > > > > > AGPUSH-697 (see [1]).
> > > > > >
> > > > > > Based on changes over the months (e.g new UI and being
based on
> > > > > Keycloak),
> > > > > > I have updated our old spec/gist:
> > > > > >
https://gist.github.com/matzew/ed0055000a8347488a37
> > > > > >
> > > > > > Greetings,
> > > > > > Matthias
> > > > > >
> > > > > > [1]
https://issues.jboss.org/browse/AGPUSH-697
> > > > > >
> > > > > > --
> > > > > > Matthias Wessendorf
> > > > > >
> > > > > > blog:
http://matthiaswessendorf.wordpress.com/
> > > > > > sessions:
http://www.slideshare.net/mwessendorf
> > > > > > twitter:
http://twitter.com/mwessendorf
> > > > >
> > > > > > _______________________________________________
> > > > > > aerogear-dev mailing list
> > > > > > aerogear-dev(a)lists.jboss.org
> > > > > >
https://lists.jboss.org/mailman/listinfo/aerogear-dev
> > > > >
> > > > >
> > > > > --
> > > > >
> > > > > abstractj
> > > > > PGP: 0x84DC9914
> > > > > _______________________________________________
> > > > > aerogear-dev mailing list
> > > > > aerogear-dev(a)lists.jboss.org
> > > > >
https://lists.jboss.org/mailman/listinfo/aerogear-dev
> > > > >
> > > >
> > > >
> > > >
> > > > --
> > > > Matthias Wessendorf
> > > >
> > > > blog:
http://matthiaswessendorf.wordpress.com/
> > > > sessions:
http://www.slideshare.net/mwessendorf
> > > > twitter:
http://twitter.com/mwessendorf
> > >
> > > > _______________________________________________
> > > > aerogear-dev mailing list
> > > > aerogear-dev(a)lists.jboss.org
> > > >
https://lists.jboss.org/mailman/listinfo/aerogear-dev
> > >
> > >
> > > --
> > >
> > > abstractj
> > > PGP: 0x84DC9914
> > > _______________________________________________
> > > aerogear-dev mailing list
> > > aerogear-dev(a)lists.jboss.org
> > >
https://lists.jboss.org/mailman/listinfo/aerogear-dev
> > >
> >
> >
> >
> > --
> > Matthias Wessendorf
> >
> > blog:
http://matthiaswessendorf.wordpress.com/
> > sessions:
http://www.slideshare.net/mwessendorf
> > twitter:
http://twitter.com/mwessendorf
>
> > _______________________________________________
> > aerogear-dev mailing list
> > aerogear-dev(a)lists.jboss.org
> >
https://lists.jboss.org/mailman/listinfo/aerogear-dev
>
>
> --
>
> abstractj
> PGP: 0x84DC9914
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org
>
https://lists.jboss.org/mailman/listinfo/aerogear-dev
--
abstractj
PGP: 0x84DC9914
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev