7:22 a.m.
So, having seem the plans around Basic and Digest auth for Android and iOS, I am wondering
if there is any need for that on JS. Typically that is handled by the browser and them the
server maintains the session so I would lean toward not needing anything specific in JS
for these types of auth. Input welcome.
Kris
10:52 a.m.
On May 21, 2013, at 10:38 AM, Douglas Campos <qmx(a)qmx.me> wrote:
I think I was confused. So are we talking about Basic/Digest auth of REST endpoints? If
so, then this is a whole different beast. As far as I know, I have to manually create the
headers and do the back and forth which doesn't sound fun but if it's something we
need, I will work it into the roadmap.
9:12 a.m.
OK, so I am going to try to spell out the workflow as I see it working in JS. I would
appreciate any feedback on whether or not this is crazy/wrong.
Create Basic or Digest authenticator
Must include a callback to be fired when a request to auth is received from server
Create pipe which uses this authenticator
Attempt read, save or remove on this pipe
Endpoint returns 401 with header indicating type of auth required
Need to research that this won't trigger the browser's native Basic/Digest auth
handling
Fire user supplied auth callback passing it a reference to a "login" method that
the user will pass the credentials collected in the auth callback
Use "login" method to construct appropriate response to server's 401
This is the fun part :-P
Server responds to auth attempt
Success - continue to process original read, write or remove
Error - trigger a user supplied auth failure callback
Thanks!
On May 22, 2013, at 8:44 AM, Summers Pittman <supittma(a)redhat.com> wrote:
9:41 a.m.
I guess my other question is are Android and iOS implementing this as a direct
authentication method? For example, would I create a Digest auth module and specifically
call login without actually requesting a resource first? I don't particularly see how
this would work but thought I would ask.
On May 22, 2013, at 9:12 AM, Kris Borchers <kris(a)redhat.com> wrote:
9:44 a.m.
On 05/22/2013 10:41 AM, Kris Borchers wrote:
That is how it works at the moment. IN the case of basic on Android it
just caches the credentials. I havn't worked out how digest will do it
yet, but I am imagining it will reference a "login" url to get the
necessary headers from the 401.
9:43 a.m.
On 05/22/2013 10:12 AM, Kris Borchers wrote:
In the Android version, login is called by the developer, not by the
framework. This "primes" the authenticator which then provides whatever
tokens/headers/parameters/etc that the pipe will need to authenticate
the request.
This may have to be changed in the future to support multiple login flows.
9:47 a.m.
On May 22, 2013, at 9:43 AM, Summers Pittman <supittma(a)redhat.com> wrote:
Sorry, I may not have been clear here. The developer would be calling the login method
with my implementation too. Inside the callback they provide, their callback will be
passed the login method which they would then call.
10:39 a.m.
On May 22, 2013, at 5:43 PM, Summers Pittman <supittma(a)redhat.com> wrote:
same with iOS with an HttpBasic/Digest authentication module. Upon 'login',
credentials are 'cached' using a build-in system provided object (no http
request). When a request is made which requires authentication, the system checks first to
see if credentials exists in its store(which we cached earlier with 'login') and
if found it authenticates the session. Similar, when 'logout' is called, we remove
the cached credentials from the system.
for this particular context, the authentication module mechanism we have, fitted nicely
in filling the credential information to the system store, which uses them for
authentication (and hopefully enough
Thanks
Christos
10:52 a.m.
On May 22, 2013, at 10:39 AM, Christos Vasilakis <cvasilak(a)gmail.com> wrote:
This brings up a good point. If the browser doesn't do the caching for us in JS then I
am not sure we can pursue this. I do not feel comfortable doing any sort of credential
caching in JS as that is just asking for trouble.
7:06 p.m.
This will also put Basic/Digest authentication out of reach for the Cordova
apps as well right?
Can anything be done for Cordova apps? I can see wrapping iOS/Android
implementations as Cordova plugins as one solution but something pure JS
may feel better.
--
Gorkem
--
Gorkem
On Wed, May 22, 2013 at 11:52 AM, Kris Borchers <kris(a)redhat.com> wrote:
4324
days inactive
4328
days old
15 comments
7 participants
participants (7)
-
Bruno Oliveira -
Christos Vasilakis -
Douglas Campos -
Gorkem Ercan -
Kris Borchers -
Kris Borchers -
Summers Pittman