Re: [aerogear-dev] Security on AeroGear

Answers inline. Matthias Wessendorf wrote: > Hi Bruno, > > > On Tue, Jul 2, 2013 at 11:48 AM, Bruno Oliveira <bruno(a)abstractj.org > <mailto:bruno@abstractj.org>> wrote: > > Good morning everyone, I'm planning to include JWS (to add digital > signatures per mobile application)/JWT (to issue a token at each > transaction or session) support on AeroGear and I was looking at OAuth2 > bearer token (which make use of JWT/JWS behind the scenes) > implementation from RESTEasy. > > I was reading about how to properly include it and now we have a > decision to make (we because it will affect the way the client side and > security is not an island :). RESTEasy bearer tokens is completely tied > to JBoss > ( http://docs.jboss.org/resteasy/docs/3.0.1.Final/userguide/html/oauth2.htm... ) > and I'm not saying it is a bad thing, but with vert.x, TorqueBox, > Nodej...I'm not sure if it's a good idea. > > > > That is because of (from the requirements): "A username/password based > JBoss security domain", right? > Nope. This comes from the requirement "add security to AG" :)

Username/Password are cool, the goal here is to add token between client/server. This token will come with timestamp, in this way if someone eavesdropping your connection steal your username/password, the token will be required. > > An example of Bearer Token usage extracted from RFC > (http://tools.ietf.org/html/rfc6750) > > HTTP/1.1 200 OK > Content-Type: application/json;charset=UTF-8 > Cache-Control: no-store > Pragma: no-cache > > { > "access_token":"mF_9.B5f-4.1JqM", > "token_type":"Bearer", > "expires_in":3600, > "refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA" > } > > Pros: RESTEasy team already did it > Cons: The configuration setup might be hard to newcomers (please look at > the documentation > http://docs.jboss.org/resteasy/docs/3.0.1.Final/userguide/html/oauth2.htm... ), > we will be tied to JBoss. > > So, do we have an alternative? Yes. > > > good :-) > > Make use of JWT module only from > RESTEasy > > > you mean only the JWT(==JSON Web Token) - not the "bearer token" ? Yes.

> > and we still can benefit of digital signatures and tokens. > > > > The digital signatures would be still JWS (==JSON Web Signature) ? Yup, to avoid confusion: - JSON Web signatures: can be used to sign http requests against the server (do not replace the certificate) and avoid DDoS against the server, non repudiation

- JSON Web token: another security layer (OPTIONAL). If for some reason SSL was misconfigured, broken....you still have this layer of security (this token is time-based, "MACed" and irreversible). > > > An example of JWT usage extracted from RFC > (http://tools.ietf.org/html/draft-jones-json-web-token-10#page-6) > > { > "iss":"joe", > "exp":1300819380, > "http://example.com/is_root":true > } > > Pros: Flexibility, we have people already doing it > (https://wiki.mozilla.org/WebAPI/WebPayment). > > > So our "client side" hook could be basically used with that WebPayment > thing, right ? No. Sorry, I should explain that better, this is just an example. We will not make use of WebPayment API, this is a snippet from Mozilla (I was giving the credit, instead of just cut & paste. And also showing an example where JWT is used).

Into our project will be just JWT/JWS implementation with the RESTEasy module.

> > We will make use of > RESTEasy module and do not reinvent the wheel. > > > +1 on reusing existing code. Not sure I fully understand (see my above > comments on JWS/JWT :) Feel free to ask, sorry for my bad explanation.

> > > Cons: The authorization model must be implemented and adapted to our > needs > > > That could be done on-top of what we already have for AeroGear Security ? Yup, that's the idea. > > > -Matthias > > > So what do you think? > > ps: SAML is not an option for me now. > > -- > abstractj > > _______________________________________________ > aerogear-dev mailing list > aerogear-dev(a)lists.jboss.org <mailto:aerogear-dev@lists.jboss.org> > https://lists.jboss.org/mailman/listinfo/aerogear-dev > > > > > -- > Matthias Wessendorf > > blog: http://matthiaswessendorf.wordpress.com/ > sessions: http://www.slideshare.net/mwessendorf > twitter: http://twitter.com/mwessendorf > > _______________________________________________ > aerogear-dev mailing list > aerogear-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/aerogear-dev -- abstractj _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev