Re: [aerogear-dev] Modularizing the Android Library

Answers inline. On 2014-07-28, Summers Pittman wrote: > On 07/25/2014 03:01 PM, Bruno Oliveira wrote: >> On 2014-07-25, Lucas Holmquist wrote: >>> On Jul 25, 2014, at 1:25 PM, Bruno Oliveira <bruno(a)abstractj.org&gt; wrote: >>> >>>> On 2014-07-25, Lucas Holmquist wrote: >>>>> On Jul 25, 2014, at 1:16 PM, Bruno Oliveira <bruno(a)abstractj.org&gt; wrote: >>>>> >>>>>> On 2014-07-25, Summers Pittman wrote: >>>>>>> On 07/22/2014 11:06 AM, Bruno Oliveira wrote: >>>>>>>> Passos, what does aerogear-android-security stands for? Do we really >>>>>>>> need the authz module? My question is due to the fact that mostly it >>>>>>>> will be together with auth module, but I could be wrong. >>>>>>> You are wrong :) >>>>>> Do you have authorization without authentication? Or authentication with >>>>>> no authorization? >>>>> We have this in our JS lib, the Authenitcation module, just does the login/logout/enroll >>>>> >>>>> and the Authz module doesn’t rely on it, but connects to 3rd party OAuth2( the current adapter ) providers >>>> If it connects using a Token from a 3rd party service, is because it's based on some credential. So, >>>> I assume that you have authentication AND authorization, there's no magic ;) >>>> >>>> Either way, name it to whatever you guys think is the best. >>> yea, the names can be confusing here :). we should rename to “CoolSuperAwesomeThing” and “bob” :) >> As long as you do at your own repository, I'm ok. Meanwhile let's not >> mix the concept of OAuth2 with authorization only. > OAuth2 is an implementation of Authorization. We have Jira's for > OAuth1a, alternate work flows etc. Summers, there's no authorization without authentication before. Even with OAuth2 the client make use of the Bearer authentication scheme for example. If you assume that OAuth2 is authorization only, would be the same of assume that once my application is authorized on Twitter, I should be able to access many profiles as I want. Even if IETF says "The OAuth 2.0 Authorization Framework: Bearer Token Usage". > > A better way to think about it would be the auth module is user visible > credential authentication and authorization. The authz module is third > party authentication and authorization.a authz into any security context stands for "authorization", if you mix both concepts here, people will get confused. > > A while ago we did discuss revisiting authz/auth and see if they can be > meaningfully merged. This may be something for a different thread. As > it stands they don't make sense to be in the same module because they > work differently for different use cases. As I said, I trust in your judgment, but mix concepts will lead to confusion. > >> >>>>> >>>>>>> In general >>>>>>> >>>>>>> Auth module consumes a username and password and manages a session. >>>>>>> Authz fetches and consumers tokens and manages them through a >>>>>>> android.app.Service service. >>>>>>>> On 2014-07-22, Daniel Passos wrote: >>>>>>>>> Hey Guys, >>>>>>>>> >>>>>>>>> Summers and I started working on agdroid modules and remove some cyclic >>>>>>>>> dependencies. So we plan to split the agdroid on these modules: >>>>>>>>> >>>>>>>>> - aerogear-android-core >>>>>>>>> - aerogear-android-pipe >>>>>>>>> - aerogear-android-auth >>>>>>>>> - aerogear-android-autz >>>>>>>>> - aerogear-android-store (with option security dependecy to use >>>>>>>>> EncryptedStores) >>>>>>>>> - aerogear-android-security >>>>>>>>> - aerogear-android-push >>>>>>>>> - aerogear-android-push-ups >>>>>>>>> - aerogear-android-offline >>>>>>>>> >>>>>>>>> -- Passos >>>>>>>>> ​ >>>>>>>>> >>>>>>>>> >>>>>>>>> On Fri, May 9, 2014 at 3:55 AM, Corinne Krych <corinnekrych(a)gmail.com&gt; >>>>>>>>> wrote: >>>>>>>>> >>>>>>>>>> Oops >>>>>>>>>> [2] https://issues.jboss.org/browse/AGIOS-187 >>>>>>>>>> >>>>>>>>>> On 09 May 2014, at 08:52, Corinne Krych <corinnekrych(a)gmail.com&gt; wrote: >>>>>>>>>> >>>>>>>>>>> [2] https://issues.jboss.org/browse/AGIOS-192 >>>>>>>>>> _______________________________________________ >>>>>>>>>> aerogear-dev mailing list >>>>>>>>>> aerogear-dev(a)lists.jboss.org >>>>>>>>>> https://lists.jboss.org/mailman/listinfo/aerogear-dev >>>>>>>>>> >>>>>>>>> _______________________________________________ >>>>>>>>> aerogear-dev mailing list >>>>>>>>> aerogear-dev(a)lists.jboss.org >>>>>>>>> https://lists.jboss.org/mailman/listinfo/aerogear-dev >>>>>>>> -- >>>>>>>> >>>>>>>> abstractj >>>>>>>> PGP: 0x84DC9914 >>>>>>>> _______________________________________________ >>>>>>>> aerogear-dev mailing list >>>>>>>> aerogear-dev(a)lists.jboss.org >>>>>>>> https://lists.jboss.org/mailman/listinfo/aerogear-dev >>>>>>> >>>>>>> -- >>>>>>> Summers Pittman >>>>>>>>> Phone:404 941 4698 >>>>>>>>> Java is my crack. >>>>>>> _______________________________________________ >>>>>>> aerogear-dev mailing list >>>>>>> aerogear-dev(a)lists.jboss.org >>>>>>> https://lists.jboss.org/mailman/listinfo/aerogear-dev >>>>>> -- >>>>>> >>>>>> abstractj >>>>>> PGP: 0x84DC9914 >>>>>> _______________________________________________ >>>>>> aerogear-dev mailing list >>>>>> aerogear-dev(a)lists.jboss.org >>>>>> https://lists.jboss.org/mailman/listinfo/aerogear-dev >>>>> _______________________________________________ >>>>> aerogear-dev mailing list >>>>> aerogear-dev(a)lists.jboss.org >>>>> https://lists.jboss.org/mailman/listinfo/aerogear-dev >>>> >>>> -- >>>> >>>> abstractj >>>> PGP: 0x84DC9914 >>>> _______________________________________________ >>>> aerogear-dev mailing list >>>> aerogear-dev(a)lists.jboss.org >>>> https://lists.jboss.org/mailman/listinfo/aerogear-dev >>> _______________________________________________ >>> aerogear-dev mailing list >>> aerogear-dev(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/aerogear-dev >> >> -- >> >> abstractj >> PGP: 0x84DC9914 >> _______________________________________________ >> aerogear-dev mailing list >> aerogear-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/aerogear-dev > > > -- > Summers Pittman >>> Phone:404 941 4698 >>> Java is my crack. > > _______________________________________________ > aerogear-dev mailing list > aerogear-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/aerogear-dev -- abstractj PGP: 0x84DC9914 _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev