Good morning peeps, yesterday I started to replace AeroGear Security on Unified Push server by Keycloak and you might be asking: “Why?”. Keycloak is a SSO with some handy features like TOTP, OAuth2, user management support and I think we have too much to contribute, is the only way to have some success with security, “divide to conquer" (at least for authorization and authentication). So will ag-security be discontinued? No! Keycloak is still on Alpha and we have to test it against our projects before fully replace ag-security, but the only way to upstream our needs, is to using it. This replacement only applies to authentication/authorization features, we still have a ton of projects which Keycloak is not able to replace like: TOTP, crypto and OAuth2 on mobile, our focus. - PoC So let’s talk about this replacement, any dependency on ag-security was removed from the push server and replaced by Keycloak: https://github.com/abstractj/aerogear-unifiedpush-server/tree/openshift Based on Keycloak examples, I just did copy & paste from one of the demos ( https://github.com/abstractj/auth-server/tree/openshift) to create a server. Keycloak requires Resteasy 3.0.4, for this reason I had to manually replace some modules on JBoss. To test it go to: http://push-abstractj.rhcloud.com/ag-push/ you must be redirected to Keycloak, enter: username: john(a)doe.com password: password You must be redirected to agpush console, keep in mind that I took some shortcuts to get this demo working, so for example the create will fail because I removed everything related into the ember interface. Is also possible to enable TOTP, user’s registration and whatever you want. So what do you think? -- abstractj _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev

On Dec 20, 2013, at 2:11 PM, Bruno Oliveira <bruno(a)abstractj.org&gt; wrote: > Good morning peeps, yesterday I started to replace AeroGear Security on Unified Push server by Keycloak and you might be asking: “Why?”. Keycloak is a SSO with some handy features like TOTP, OAuth2, user management support and I think we have too much to contribute, is the only way to have some success with security, “divide to conquer" (at least for authorization and authentication). > > So will ag-security be discontinued? No! Keycloak is still on Alpha and we have to test it against our projects before fully replace ag-security, but the only way to upstream our needs, is to using it. +1 valid point and demo worked great! nice work! > > This replacement only applies to authentication/authorization features, we still have a ton of projects which Keycloak is not able to replace like: TOTP, crypto and OAuth2 on mobile, our focus. > > - PoC > > So let’s talk about this replacement, any dependency on ag-security was removed from the push server and replaced by Keycloak: https://github.com/abstractj/aerogear-unifiedpush-server/tree/openshift > > Based on Keycloak examples, I just did copy & paste from one of the demos (https://github.com/abstractj/auth-server/tree/openshift) to create a server. Keycloak requires Resteasy 3.0.4, for this reason I had to manually replace some modules on JBoss. > > To test it go to: http://push-abstractj.rhcloud.com/ag-push/ you must be redirected to Keycloak, enter: > > username: john(a)doe.com > password: password > > You must be redirected to agpush console, keep in mind that I took some shortcuts to get this demo working, so for example the create will fail because I removed everything related into the ember interface. > > Is also possible to enable TOTP, user’s registration and whatever you want. > > So what do you think? > > -- > abstractj > > _______________________________________________ > aerogear-dev mailing list > aerogear-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/aerogear-dev _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev

Keycloak already has the user management stuff, so I think is just a matter of play with it and check if it will meet our needs, if not, we can always suggest something at keycloak-dev.

Regarding hold or not, let’s not rush on it. At the moment my suggestion is to play with keycloak and check what’s missing.

-- abstractj On December 20, 2013 at 10:40:51 AM, Sebastien Blanc (scm.blanc(a)gmail.com) wrote: >> Awesome ! > But does it make sense for me to hold on the User Management stuff > as that will also be migrated to KeyCloak ? > Seb _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev

Hello, it's nice to see an effort for integrating keycloak. Especially the User Management part is something which sounds very promising. For instance I like how a request against "http://push-abstractj.rhcloud.com/ag-push" redirects me to the Keycloak server and after a sucessful login back to the AdminUI. Sweet! I understand this is an early PoC, but the user login bits already look good! A few things I noticed: * After login, I get a list of PushApplications, but I can't click into them to see details (I assume this is due to your changes to the ember interface - with is perfectly fine) * Sending Push Notifications (e.g. using the CURL command) does not work (used the PushAppID/MasterSecret from the HTTP REST response on AdminUI overview page ;-)) I assume this is because the endpoint for sending is also protected by the SSO/Keycloak facility, hence the HTTP Basic auth is not triggered there (guess). Since the HTTP Basic is also used when a device tries to register against a variant, I am guess the same issue is present there as well. Perhaps the HTTP-Basic for SENDING and DEVICE-REGISTRATION could be done w/ something else, e.g. OAuth2 Greetings, Matthias On Fri, Dec 20, 2013 at 1:11 PM, Bruno Oliveira <bruno(a)abstractj.org&gt;wrote: > Good morning peeps, yesterday I started to replace AeroGear Security on > Unified Push server by Keycloak and you might be asking: “Why?”. Keycloak > is a SSO with some handy features like TOTP, OAuth2, user management > support and I think we have too much to contribute, is the only way to have > some success with security, “divide to conquer" (at least for authorization > and authentication). > > So will ag-security be discontinued? No! Keycloak is still on Alpha and > we have to test it against our projects before fully replace ag-security, > but the only way to upstream our needs, is to using it. > > This replacement only applies to authentication/authorization features, > we still have a ton of projects which Keycloak is not able to replace like: > TOTP, crypto and OAuth2 on mobile, our focus. > > - PoC > > So let’s talk about this replacement, any dependency on ag-security was > removed from the push server and replaced by Keycloak: > https://github.com/abstractj/aerogear-unifiedpush-server/tree/openshift > > Based on Keycloak examples, I just did copy & paste from one of the demos > (https://github.com/abstractj/auth-server/tree/openshift) to create a > server. Keycloak requires Resteasy 3.0.4, for this reason I had to manually > replace some modules on JBoss. > > To test it go to: http://push-abstractj.rhcloud.com/ag-push/ you must be > redirected to Keycloak, enter: > > username: john(a)doe.com > password: password > > You must be redirected to agpush console, keep in mind that I took some > shortcuts to get this demo working, so for example the create will fail > because I removed everything related into the ember interface. > > Is also possible to enable TOTP, user’s registration and whatever you > want. > > So what do you think? > > -- > abstractj > > _______________________________________________ > aerogear-dev mailing list > aerogear-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/aerogear-dev -- Matthias Wessendorf blog: http://matthiaswessendorf.wordpress.com/ sessions: http://www.slideshare.net/mwessendorf twitter: http://twitter.com/mwessendorf

Something that also comes to mind is: If the UPS relies on KeyCloak, it's one more complex component that is required for the installation process. Meaning: At least a running server instance of Keycloak is required. Not sure if that helps in simplifying things :-) On Fri, Jan 3, 2014 at 1:52 PM, Matthias Wessendorf <matzew(a)apache.org&gt;wrote: > Hello, > > it's nice to see an effort for integrating keycloak. Especially the User > Management part is something which sounds very promising. For instance I > like how a request against "http://push-abstractj.rhcloud.com/ag-push" > redirects me to the Keycloak server and after a sucessful login back to the > AdminUI. Sweet! > > I understand this is an early PoC, but the user login bits already look > good! > > > A few things I noticed: > > * After login, I get a list of PushApplications, but I can't click into > them to see details (I assume this is due to your changes to the ember > interface - with is perfectly fine) > * Sending Push Notifications (e.g. using the CURL command) does not work > (used the PushAppID/MasterSecret from the HTTP REST response on AdminUI > overview page ;-)) > I assume this is because the endpoint for sending is also protected by the > SSO/Keycloak facility, hence the HTTP Basic auth is not triggered there > (guess). > > Since the HTTP Basic is also used when a device tries to register against > a variant, I am guess the same issue is present there as well. > > Perhaps the HTTP-Basic for SENDING and DEVICE-REGISTRATION could be done > w/ something else, e.g. OAuth2 > > > > Greetings, > Matthias > > > > > > On Fri, Dec 20, 2013 at 1:11 PM, Bruno Oliveira <bruno(a)abstractj.org&gt;wrote: > >> Good morning peeps, yesterday I started to replace AeroGear Security on >> Unified Push server by Keycloak and you might be asking: “Why?”. Keycloak >> is a SSO with some handy features like TOTP, OAuth2, user management >> support and I think we have too much to contribute, is the only way to have >> some success with security, “divide to conquer" (at least for authorization >> and authentication). >> >> So will ag-security be discontinued? No! Keycloak is still on Alpha and >> we have to test it against our projects before fully replace ag-security, >> but the only way to upstream our needs, is to using it. >> >> This replacement only applies to authentication/authorization features, >> we still have a ton of projects which Keycloak is not able to replace like: >> TOTP, crypto and OAuth2 on mobile, our focus. >> >> - PoC >> >> So let’s talk about this replacement, any dependency on ag-security was >> removed from the push server and replaced by Keycloak: >> https://github.com/abstractj/aerogear-unifiedpush-server/tree/openshift >> >> Based on Keycloak examples, I just did copy & paste from one of the demos >> (https://github.com/abstractj/auth-server/tree/openshift) to create a >> server. Keycloak requires Resteasy 3.0.4, for this reason I had to manually >> replace some modules on JBoss. >> >> To test it go to: http://push-abstractj.rhcloud.com/ag-push/ you must be >> redirected to Keycloak, enter: >> >> username: john(a)doe.com >> password: password >> >> You must be redirected to agpush console, keep in mind that I took some >> shortcuts to get this demo working, so for example the create will fail >> because I removed everything related into the ember interface. >> >> Is also possible to enable TOTP, user’s registration and whatever you >> want. >> >> So what do you think? >>https://github.com/kpiwko/keycloak/commit/2c93f787b60c0ec1f437983c83b79aff4a593f90 >> -- >> abstractj >> >> _______________________________________________ >> aerogear-dev mailing list >> aerogear-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/aerogear-dev > > > > > -- > Matthias Wessendorf > > blog: http://matthiaswessendorf.wordpress.com/ > sessions: http://www.slideshare.net/mwessendorf > twitter: http://twitter.com/mwessendorf >

Hijacking the thread, maybe we can think about a keycloak cartridge on OpenShift in the future.

Wdyt? -- abstractj On January 7, 2014 at 10:13:52 AM, Karel Piwko (kpiwko(a)redhat.com) wrote: > > That said, it might make our OpenShift cartridge setup more > complicated but > again that's not something users(read consumers) should hit. > > Karel _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev

On Wed, Jan 8, 2014 at 9:49 AM, Bruno Oliveira <bruno(a)abstractj.org&gt; wrote: > Hijacking the thread, maybe we can think about a keycloak cartridge on > OpenShift in the future. > +1 I'd like that > > Wdyt? > > -- > abstractj > > On January 7, 2014 at 10:13:52 AM, Karel Piwko (kpiwko(a)redhat.com) wrote: > > > That said, it might make our OpenShift cartridge setup more > > complicated but > > again that's not something users(read consumers) should hit. > > > > Karel > > _______________________________________________ > aerogear-dev mailing list > aerogear-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/aerogear-dev >

Hijacking the thread, maybe we can think about a keycloak cartridge on OpenShift in the future. Wdyt?

> +9003 ;) Push runs on WildFly doesn't it? I wonder if Push and Keycloak could be add-on cartridges to the WildFly cartridge making it possible to add one or both.

----- Original Message ----- > From: "Summers Pittman" <supittma(a)redhat.com&gt; > To: aerogear-dev(a)lists.jboss.org > Sent: Wednesday, 8 January, 2014 2:22:31 PM > Subject: Re: [aerogear-dev] Keycloak on AeroGear > > On 01/08/2014 03:49 AM, Bruno Oliveira wrote: > > Hijacking the thread, maybe we can think about a keycloak cartridge on > > OpenShift in the future. > > > > Wdyt? > > > +9001 +9003 ;) Push runs on WildFly doesn't it? I wonder if Push and Keycloak could be add-on cartridges to the WildFly cartridge making it possible to add one or both. > _______________________________________________ > aerogear-dev mailing list > aerogear-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/aerogear-dev > _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev

I have updated the branch w/ their recent changes from this weeks alpha-1 release, and submitted a PR against abstractj's repo: https://github.com/abstractj/aerogear-unifiedpush-server/pull/1 More to come Greetings, Matthias On Fri, Dec 20, 2013 at 1:11 PM, Bruno Oliveira <bruno(a)abstractj.org&gt;wrote: > Good morning peeps, yesterday I started to replace AeroGear Security on > Unified Push server by Keycloak and you might be asking: “Why?”. Keycloak > is a SSO with some handy features like TOTP, OAuth2, user management > support and I think we have too much to contribute, is the only way to have > some success with security, “divide to conquer" (at least for authorization > and authentication). > > So will ag-security be discontinued? No! Keycloak is still on Alpha and > we have to test it against our projects before fully replace ag-security, > but the only way to upstream our needs, is to using it. > > This replacement only applies to authentication/authorization features, > we still have a ton of projects which Keycloak is not able to replace like: > TOTP, crypto and OAuth2 on mobile, our focus. > > - PoC > > So let’s talk about this replacement, any dependency on ag-security was > removed from the push server and replaced by Keycloak: > https://github.com/abstractj/aerogear-unifiedpush-server/tree/openshift > > Based on Keycloak examples, I just did copy & paste from one of the demos > (https://github.com/abstractj/auth-server/tree/openshift) to create a > server. Keycloak requires Resteasy 3.0.4, for this reason I had to manually > replace some modules on JBoss. > > To test it go to: http://push-abstractj.rhcloud.com/ag-push/ you must be > redirected to Keycloak, enter: > > username: john(a)doe.com > password: password > > You must be redirected to agpush console, keep in mind that I took some > shortcuts to get this demo working, so for example the create will fail > because I removed everything related into the ember interface. > > Is also possible to enable TOTP, user’s registration and whatever you > want. > > So what do you think? > > -- > abstractj > > _______________________________________________ > aerogear-dev mailing list > aerogear-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/aerogear-dev -- Matthias Wessendorf blog: http://matthiaswessendorf.wordpress.com/ sessions: http://www.slideshare.net/mwessendorf twitter: http://twitter.com/mwessendorf

Any specific reason to limit the scope to admin page only? I'm thinking about login for regular users

— abstractj On Sun, Jan 26, 2014 at 9:11 AM, Matthias Wessendorf <matzew(a)apache.org&gt;wrote: > Hello! > > I have a few more updates: > > On my branch (a fork from Bruno's branch), the URLs for the actual > sending and the device-registration (both 'protected' via HTTP-Basic), now > work again. I have 'limited' the scope of the Keycloak 'protection' to the > AdminUI. > > Greetings, > Matthias > > > > On Fri, Jan 24, 2014 at 6:05 PM, Matthias Wessendorf <matzew(a)apache.org&gt;wrote: > >> I have updated the branch w/ their recent changes from this weeks >> alpha-1 release, and submitted a PR against abstractj's repo: >> https://github.com/abstractj/aerogear-unifiedpush-server/pull/1 >> >> More to come >> >> Greetings, >> Matthias >> >> >> >> On Fri, Dec 20, 2013 at 1:11 PM, Bruno Oliveira <bruno(a)abstractj.org&gt;wrote: >> >>> Good morning peeps, yesterday I started to replace AeroGear Security on >>> Unified Push server by Keycloak and you might be asking: “Why?”. Keycloak >>> is a SSO with some handy features like TOTP, OAuth2, user management >>> support and I think we have too much to contribute, is the only way to have >>> some success with security, “divide to conquer" (at least for authorization >>> and authentication). >>> >>> So will ag-security be discontinued? No! Keycloak is still on Alpha and >>> we have to test it against our projects before fully replace ag-security, >>> but the only way to upstream our needs, is to using it. >>> >>> This replacement only applies to authentication/authorization features, >>> we still have a ton of projects which Keycloak is not able to replace like: >>> TOTP, crypto and OAuth2 on mobile, our focus. >>> >>> - PoC >>> >>> So let’s talk about this replacement, any dependency on ag-security was >>> removed from the push server and replaced by Keycloak: >>> https://github.com/abstractj/aerogear-unifiedpush-server/tree/openshift >>> >>> Based on Keycloak examples, I just did copy & paste from one of the >>> demos (https://github.com/abstractj/auth-server/tree/openshift) to >>> create a server. Keycloak requires Resteasy 3.0.4, for this reason I had to >>> manually replace some modules on JBoss. >>> >>> To test it go to: http://push-abstractj.rhcloud.com/ag-push/ you must >>> be redirected to Keycloak, enter: >>> >>> username: john(a)doe.com >>> password: password >>> >>> You must be redirected to agpush console, keep in mind that I took some >>> shortcuts to get this demo working, so for example the create will fail >>> because I removed everything related into the ember interface. >>> >>> Is also possible to enable TOTP, user’s registration and whatever you >>> want. >>> >>> So what do you think? >>> >>> -- >>> abstractj >>> >>> _______________________________________________ >>> aerogear-dev mailing list >>> aerogear-dev(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/aerogear-dev >> >> >> >> >> -- >> Matthias Wessendorf >> >> blog: http://matthiaswessendorf.wordpress.com/ >> sessions: http://www.slideshare.net/mwessendorf >> twitter: http://twitter.com/mwessendorf >> > > > > -- > Matthias Wessendorf > > blog: http://matthiaswessendorf.wordpress.com/ > sessions: http://www.slideshare.net/mwessendorf > twitter: http://twitter.com/mwessendorf > _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev

Hello Bruno, On Sun, Jan 26, 2014 at 1:20 PM, Bruno Oliveira <bruno(a)abstractj.org&gt;wrote: > Any specific reason to limit the scope to admin page only? I'm thinking > about login for regular users Not sure I follow. What do you mean w/ "regular users"? Before my change very thing was restricted by Keycloak (/*). I did not really change there a lot, however I just removed the URLs for 'device-registration' and 'sending': https://github.com/matzew/aerogear-unifiedpush-server/blob/keycloak/src/m... So, currently the following is protected by Keycloak: * Admin UI (not speaking about a specific admin user) * REST APIs that are accessed by the Admin UI, like: - http://aerogear.org/docs/specs/aerogear-push-rest/PushApplication/ - http://aerogear.org/docs/specs/aerogear-push-rest/Variants/ Perviously the 'device-registration' and 'sending' URL were protected as well. Removing them from the 'keycloak protection' is really the only change Greetings, Matthias > -- > abstractj > > > On Sun, Jan 26, 2014 at 9:11 AM, Matthias Wessendorf <matzew(a)apache.org&gt;wrote: > >> Hello! >> >> I have a few more updates: >> >> On my branch (a fork from Bruno's branch), the URLs for the actual >> sending and the device-registration (both 'protected' via HTTP-Basic), now >> work again. I have 'limited' the scope of the Keycloak 'protection' to the >> AdminUI. >> >> Greetings, >> Matthias >> >> >> >> On Fri, Jan 24, 2014 at 6:05 PM, Matthias Wessendorf <matzew(a)apache.org&gt;wrote: >> >>> I have updated the branch w/ their recent changes from this weeks >>> alpha-1 release, and submitted a PR against abstractj's repo: >>> https://github.com/abstractj/aerogear-unifiedpush-server/pull/1 >>> >>> More to come >>> >>> Greetings, >>> Matthias >>> >>> >>> >>> On Fri, Dec 20, 2013 at 1:11 PM, Bruno Oliveira <bruno(a)abstractj.org&gt;wrote: >>> >>>> Good morning peeps, yesterday I started to replace AeroGear Security >>>> on Unified Push server by Keycloak and you might be asking: "Why?". >>>> Keycloak is a SSO with some handy features like TOTP, OAuth2, user >>>> management support and I think we have too much to contribute, is the only >>>> way to have some success with security, "divide to conquer" (at least for >>>> authorization and authentication). >>>> >>>> So will ag-security be discontinued? No! Keycloak is still on Alpha >>>> and we have to test it against our projects before fully replace >>>> ag-security, but the only way to upstream our needs, is to using it. >>>> >>>> This replacement only applies to authentication/authorization >>>> features, we still have a ton of projects which Keycloak is not able to >>>> replace like: TOTP, crypto and OAuth2 on mobile, our focus. >>>> >>>> - PoC >>>> >>>> So let's talk about this replacement, any dependency on ag-security >>>> was removed from the push server and replaced by Keycloak: >>>> https://github.com/abstractj/aerogear-unifiedpush-server/tree/openshift >>>> >>>> Based on Keycloak examples, I just did copy & paste from one of the >>>> demos (https://github.com/abstractj/auth-server/tree/openshift) to >>>> create a server. Keycloak requires Resteasy 3.0.4, for this reason I had to >>>> manually replace some modules on JBoss. >>>> >>>> To test it go to: http://push-abstractj.rhcloud.com/ag-push/ you must >>>> be redirected to Keycloak, enter: >>>> >>>> username: john(a)doe.com >>>> password: password >>>> >>>> You must be redirected to agpush console, keep in mind that I took >>>> some shortcuts to get this demo working, so for example the create will >>>> fail because I removed everything related into the ember interface. >>>> >>>> Is also possible to enable TOTP, user's registration and whatever you >>>> want. >>>> >>>> So what do you think? >>>> >>>> -- >>>> abstractj >>>> >>>> _______________________________________________ >>>> aerogear-dev mailing list >>>> aerogear-dev(a)lists.jboss.org >>>> https://lists.jboss.org/mailman/listinfo/aerogear-dev >>> >>> >>> >>> >>> -- >>> Matthias Wessendorf >>> >>> blog: http://matthiaswessendorf.wordpress.com/ >>> sessions: http://www.slideshare.net/mwessendorf >>> twitter: http://twitter.com/mwessendorf >>> >> >> >> >> -- >> Matthias Wessendorf >> >> blog: http://matthiaswessendorf.wordpress.com/ >> sessions: http://www.slideshare.net/mwessendorf >> twitter: http://twitter.com/mwessendorf >> > > > _______________________________________________ > aerogear-dev mailing list > aerogear-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/aerogear-dev > -- Matthias Wessendorf blog: http://matthiaswessendorf.wordpress.com/ sessions: http://www.slideshare.net/mwessendorf twitter: http://twitter.com/mwessendorf _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev

On Wed, Jan 29, 2014 at 3:57 PM, Bruno Oliveira <bruno(a)abstractj.org&gt;wrote: > Sorry I just missed your e-mail during while the syncalipse was happening. > > What I meant was something like: admin, developers, regular users and how > to deal with these roles. Maybe this is planned to the next steps, but at > some point we need to test how KeyCloak could protect our endpoints and > deal with multiple roles. > yes, the 'ui part' (and the underlying endpoints) being protected by keycloak; On the next steps is also looking at different roles for this. I was never speaking about a specific user/role - more generically protecting the "Admin UI", which can be consumed by users w/ different roles -Matthias > > > On Sun, Jan 26, 2014 at 10:41 AM, Matthias Wessendorf <matzew(a)apache.org&gt;wrote: > >> Hello Bruno, >> >> >> On Sun, Jan 26, 2014 at 1:20 PM, Bruno Oliveira <bruno(a)abstractj.org&gt;wrote: >> >>> Any specific reason to limit the scope to admin page only? I'm thinking >>> about login for regular users >> >> >> Not sure I follow. What do you mean w/ "regular users"? >> >> >> Before my change very thing was restricted by Keycloak (/*). I did not >> really change there a lot, however I just removed the URLs for >> 'device-registration' and 'sending': >> >> https://github.com/matzew/aerogear-unifiedpush-server/blob/keycloak/src/m... >> >> So, currently the following is protected by Keycloak: >> * Admin UI (not speaking about a specific admin user) >> * REST APIs that are accessed by the Admin UI, like: >> - http://aerogear.org/docs/specs/aerogear-push-rest/PushApplication/ >> - http://aerogear.org/docs/specs/aerogear-push-rest/Variants/ >> >> Perviously the 'device-registration' and 'sending' URL were protected as >> well. Removing them from the 'keycloak protection' is really the only change >> >> Greetings, >> Matthias >> >> >> >>> -- >>> abstractj >>> >>> >>> On Sun, Jan 26, 2014 at 9:11 AM, Matthias Wessendorf <matzew(a)apache.org >>> > wrote: >>> >>>> Hello! >>>> >>>> I have a few more updates: >>>> >>>> On my branch (a fork from Bruno's branch), the URLs for the actual >>>> sending and the device-registration (both 'protected' via HTTP-Basic), now >>>> work again. I have 'limited' the scope of the Keycloak 'protection' to the >>>> AdminUI. >>>> >>>> Greetings, >>>> Matthias >>>> >>>> >>>> >>>> On Fri, Jan 24, 2014 at 6:05 PM, Matthias Wessendorf < >>>> matzew(a)apache.org&gt; wrote: >>>> >>>>> I have updated the branch w/ their recent changes from this weeks >>>>> alpha-1 release, and submitted a PR against abstractj's repo: >>>>> https://github.com/abstractj/aerogear-unifiedpush-server/pull/1 >>>>> >>>>> More to come >>>>> >>>>> Greetings, >>>>> Matthias >>>>> >>>>> >>>>> >>>>> On Fri, Dec 20, 2013 at 1:11 PM, Bruno Oliveira <bruno(a)abstractj.org&gt;wrote: >>>>> >>>>>> Good morning peeps, yesterday I started to replace AeroGear Security >>>>>> on Unified Push server by Keycloak and you might be asking: "Why?". >>>>>> Keycloak is a SSO with some handy features like TOTP, OAuth2, user >>>>>> management support and I think we have too much to contribute, is the only >>>>>> way to have some success with security, "divide to conquer" (at least for >>>>>> authorization and authentication). >>>>>> >>>>>> So will ag-security be discontinued? No! Keycloak is still on Alpha >>>>>> and we have to test it against our projects before fully replace >>>>>> ag-security, but the only way to upstream our needs, is to using it. >>>>>> >>>>>> This replacement only applies to authentication/authorization >>>>>> features, we still have a ton of projects which Keycloak is not able to >>>>>> replace like: TOTP, crypto and OAuth2 on mobile, our focus. >>>>>> >>>>>> - PoC >>>>>> >>>>>> So let's talk about this replacement, any dependency on ag-security >>>>>> was removed from the push server and replaced by Keycloak: >>>>>> https://github.com/abstractj/aerogear-unifiedpush-server/tree/openshift >>>>>> >>>>>> Based on Keycloak examples, I just did copy & paste from one of the >>>>>> demos (https://github.com/abstractj/auth-server/tree/openshift) to >>>>>> create a server. Keycloak requires Resteasy 3.0.4, for this reason I had to >>>>>> manually replace some modules on JBoss. >>>>>> >>>>>> To test it go to: http://push-abstractj.rhcloud.com/ag-push/ you >>>>>> must be redirected to Keycloak, enter: >>>>>> >>>>>> username: john(a)doe.com >>>>>> password: password >>>>>> >>>>>> You must be redirected to agpush console, keep in mind that I took >>>>>> some shortcuts to get this demo working, so for example the create will >>>>>> fail because I removed everything related into the ember interface. >>>>>> >>>>>> Is also possible to enable TOTP, user's registration and whatever >>>>>> you want. >>>>>> >>>>>> So what do you think? >>>>>> >>>>>> -- >>>>>> abstractj >>>>>> >>>>>> _______________________________________________ >>>>>> aerogear-dev mailing list >>>>>> aerogear-dev(a)lists.jboss.org >>>>>> https://lists.jboss.org/mailman/listinfo/aerogear-dev >>>>> >>>>> >>>>> >>>>> >>>>> -- >>>>> Matthias Wessendorf >>>>> >>>>> blog: http://matthiaswessendorf.wordpress.com/ >>>>> sessions: http://www.slideshare.net/mwessendorf >>>>> twitter: http://twitter.com/mwessendorf >>>>> >>>> >>>> >>>> >>>> -- >>>> Matthias Wessendorf >>>> >>>> blog: http://matthiaswessendorf.wordpress.com/ >>>> sessions: http://www.slideshare.net/mwessendorf >>>> twitter: http://twitter.com/mwessendorf >>>> >>> >>> >>> _______________________________________________ >>> aerogear-dev mailing list >>> aerogear-dev(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/aerogear-dev >>> >> >> >> >> -- >> Matthias Wessendorf >> >> blog: http://matthiaswessendorf.wordpress.com/ >> sessions: http://www.slideshare.net/mwessendorf >> twitter: http://twitter.com/mwessendorf >> >> _______________________________________________ >> aerogear-dev mailing list >> aerogear-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/aerogear-dev >> > > > > -- > > -- > "The measure of a man is what he does with power" - Plato > - > @abstractj > - > Volenti Nihil Difficile > > _______________________________________________ > aerogear-dev mailing list > aerogear-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/aerogear-dev > -- Matthias Wessendorf blog: http://matthiaswessendorf.wordpress.com/ sessions: http://www.slideshare.net/mwessendorf twitter: http://twitter.com/mwessendorf