On May 23, 2013, at 2:45 PM, Bruno Oliveira wrote: > How to properly file jiras? > > Once security is a cross-cutting concern affecting most part of the > projects on AeroGear, people might get confused about how to file a JIRA > for security. > > So here comes my recommendation: > > - Issues related with specific projects like JS, Android and iOS should > be created into the respective jiras: AGJS, AGDROID and AGIOS. (is my > suggestion only) > > - If the issue is something that abstractj|slacker should definitely > take a look or should work on it, please, create a link into AGSEC. For > example: https://issues.jboss.org/browse/AGSEC-28 I think this makes sense to me.

> Here is the list of planned components for the AGSEC project in JIRA: > > - examples: demos, example of usage, snippets > - docs: documentation about how to make use of security libraries, blog > posts, updates on aerogear.org > - CI: updates on CI like new jobs to be created or improvements > - OTP: TOTP& HOTP components which affects the server, iOS, Android and JS > - crypto: implementations of cryptographic algorithms to support > server/client side > - security-*: aerogear-security, aerogear-security-picketlink and > aerogear-security-shiro. > - social: Twitter, Facebook, Google (any social networks to share your > password with friends) > - auth: authentication methods to be provided (Basic, Digest, LDAP, > OAuth2, Hawk, Mozilla Persona, Two-factor) > - authZ: authorization methods to be implemented or supported. Not sure of the diff with auth and authZ?

> - storage: issues and features related with encrypted storage > - cache: issues and features related with encrypted cache To you want to add in general components like openshift, testing, tooling, etc...?

On May 23, 2013, at 3:36 PM, Bruno Oliveira wrote: > > > Jay Balunas wrote: >> On May 23, 2013, at 2:45 PM, Bruno Oliveira wrote: >> >>> How to properly file jiras? >>> >>> Once security is a cross-cutting concern affecting most part of the >>> projects on AeroGear, people might get confused about how to file a JIRA >>> for security. >>> >>> So here comes my recommendation: >>> >>> - Issues related with specific projects like JS, Android and iOS should >>> be created into the respective jiras: AGJS, AGDROID and AGIOS. (is my >>> suggestion only) >>> >>> - If the issue is something that abstractj|slacker should definitely >>> take a look or should work on it, please, create a link into AGSEC. For >>> example: https://issues.jboss.org/browse/AGSEC-28 >> >> I think this makes sense to me. > > I can document it if necessary. +1, but where - in the AGSEC description section, or somewhere on in the docs? Perhaps in an updated version of http://aerogear.org/docs/guides/JIRAUsage/ ? It needs to be updated for the different jira sub-projects anyway. > >> >>> Here is the list of planned components for the AGSEC project in JIRA: >>> >>> - examples: demos, example of usage, snippets >>> - docs: documentation about how to make use of security libraries, blog >>> posts, updates on aerogear.org >>> - CI: updates on CI like new jobs to be created or improvements >>> - OTP: TOTP& HOTP components which affects the server, iOS, Android and JS >>> - crypto: implementations of cryptographic algorithms to support >>> server/client side >>> - security-*: aerogear-security, aerogear-security-picketlink and >>> aerogear-security-shiro. >>> - social: Twitter, Facebook, Google (any social networks to share your >>> password with friends) >>> - auth: authentication methods to be provided (Basic, Digest, LDAP, >>> OAuth2, Hawk, Mozilla Persona, Two-factor) >>> - authZ: authorization methods to be implemented or supported. >> >> Not sure of the diff with auth and authZ? > > auth - will be issues or feature requests for authentication. > Ex: > > - Add two-factor authentication support to JS > - Application X raises http 500 on login > - AeroGear security should provide support for captchas (meh) > > authZ - anything directly related with authorization > Ex: > > - Add Role-Based Authorization support on AeroGear security > - Even after provide the correct credentials user Homer is receiving > HTTP 401 response > > Makes sense? Yup, now I see what you mean. Would it be better to spell them out all the way then? authentication and authorization ?

> >> >>> - storage: issues and features related with encrypted storage >>> - cache: issues and features related with encrypted cache >> >> To you want to add in general components like openshift, testing, tooling, etc...? > > Initially I'm not sure if it's necessary, but of course we can add it. +1 we don't need to add right away, but be able to add as needed. > What do you have in mind is something like: > > - openshift: for examples on OpenShift and eventual issues > > So if some demo has security issues the correct approach would be: > openshift, examples? Or if there are issues directly related to security features when hosted on OpenShift, or specific security integration for openshift, etc... > > - testing: For the efforts leaded by Karel, I'm +1000. For unit testing > we assume that Bruno should write it, if not, I promise to punish him. > > - tooling: Nor sure which kind of tasks to include here. Once we already > have AGRAD and security is all around I'm concerned about overlapping, > so I'm trying to be cautious. Yeah, not as concerned about this one good point > > > > _______________________________________________ > aerogear-dev mailing list > aerogear-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/aerogear-dev _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev

Thanks Kris. Here comes the update list of suggested components for AGSEC: - examples: demos, example of usage, snippets - docs: documentation about how to make use of security libraries, blog posts, updates on aerogear.org - CI: updates on CI like new jobs to be created or improvements - OTP: TOTP & HOTP components which affects the server, iOS, Android and JS - crypto: implementations of cryptographic algorithms to support server/client side - security-*: aerogear-security, aerogear-security-picketlink and aerogear-security-shiro. - social: Twitter, Facebook, Google (any social networks to share your password with friends) - authentication: authentication methods to be provided (Basic, Digest, LDAP, OAuth2, Hawk, Mozilla Persona, Two-factor) - authorization: authorization methods to be implemented or supported. - storage: issues and features related with encrypted storage - cache: issues and features related with encrypted cache - openshift: for examples on OpenShift and eventual issues - testing: For the efforts leaded by Karel. Kris Borchers wrote: >> Yup, now I see what you mean. Would it be better to spell them out >> all the way then? authentication and authorization ? > > +1 - It's not obvious what authZ is at a glance. _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev

Thanks Kris. Here comes the update list of suggested components for AGSEC: - examples: demos, example of usage, snippets - docs: documentation about how to make use of security libraries, blog posts, updates on aerogear.org - CI: updates on CI like new jobs to be created or improvements - OTP: TOTP& HOTP components which affects the server, iOS, Android and JS - crypto: implementations of cryptographic algorithms to support server/client side - security-*: aerogear-security, aerogear-security-picketlink and aerogear-security-shiro. - social: Twitter, Facebook, Google (any social networks to share your password with friends) - authentication: authentication methods to be provided (Basic, Digest, LDAP, OAuth2, Hawk, Mozilla Persona, Two-factor) - authorization: authorization methods to be implemented or supported. - storage: issues and features related with encrypted storage - cache: issues and features related with encrypted cache - openshift: for examples on OpenShift and eventual issues - testing: For the efforts leaded by Karel. Kris Borchers wrote: >> Yup, now I see what you mean. Would it be better to spell them out >> all the way then? authentication and authorization ? > +1 - It's not obvious what authZ is at a glance. _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev