8:41 a.m.
Hello team!
On Thu, Oct 9, 2014 at 4:49 AM, Bruno Oliveira <bruno(a)abstractj.org> wrote:
Note: Not only for Keycloak, but also compatible with other
technologies
like passport on Node.js.
Great point on being compatible with passport.js! To ensure our OAuth2
client SDKs do work against node.js (w/ passport.js), how about we build a
Node.js based version of our "Shoot-n-Share backend" ([1]), that is
protected by Passport.js?
It could be a (simple) a 'clone' of our java version. I think for Luke, our
Node.js pro, it would be a fairly simple task :)
On the client side, the Android/iOS versions of Shoot-n-Share would simply
offer a new upload target for Passport.js, instead of 'just' FB,
Google-Drive and Keycloak.
That way we will also learn how much Passport.js is actually different,
similar to what we learned on how Google/FB are different ;-)
Another interesting aspect of this is that, once we are ready to release
our OAuth2 SDKs, it would be awesome to actually ship a node.js based demo
as well, instead of just a Java-based backend demo. That would clearly
show, our client libs are working across different backend technologies.
Any thoughts?
-Matthias
[1] https://github.com/aerogear/aerogear-backend-cookbook/tree/master/Shoot
In the end, OAuth2 is just a protocol and
should support other servers.
- Should we provide examples for OpenID connect? Or abstractions?
To track this issue, we have the following Jira[3] and another for
OpenID connect[4]. Fell free to link to your respective project.
[1] -
http://transcripts.jboss.org/meeting/irc.freenode.org/aerogear/2014/aerog...
[2] - https://gist.github.com/abstractj/04136c6df85cea5f35d1
[3] - https://issues.jboss.org/browse/AGSEC-180
[4] - https://issues.jboss.org/browse/AGSEC-190
--
abstractj
PGP: 0x84DC9914
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
--
Matthias Wessendorf
blog: http://matthiaswessendorf.wordpress.com/
sessions: http://www.slideshare.net/mwessendorf
twitter: http://twitter.com/mwessendorf
12:38 p.m.
New subject: Node.js / Passport.js thoughts (was: Re: OAuth2, OpenID connect and AeroGear)
i think this could be interesting.
On Oct 30, 2014, at 9:41 AM, Matthias Wessendorf
<matzew(a)apache.org> wrote:
Hello team!
On Thu, Oct 9, 2014 at 4:49 AM, Bruno Oliveira <bruno(a)abstractj.org
<mailto:bruno@abstractj.org>> wrote:
Note: Not only for Keycloak, but also compatible with other technologies
like passport on Node.js.
Great point on being compatible with passport.js! To ensure our OAuth2 client SDKs do
work against node.js (w/ passport.js), how about we build a Node.js based version of our
"Shoot-n-Share backend" ([1]), that is protected by Passport.js?
It could be a (simple) a 'clone' of our java version. I think for Luke, our
Node.js pro, it would be a fairly simple task :)
not sure i’ve looked at the java version :)
On the client side, the Android/iOS versions of Shoot-n-Share would simply offer a new
upload target for Passport.js, instead of 'just' FB, Google-Drive and Keycloak.
That way we will also learn how much Passport.js is actually different, similar to what
we learned on how Google/FB are different ;-)
Another interesting aspect of this is that, once we are ready to release our OAuth2 SDKs,
it would be awesome to actually ship a node.js based demo as well, instead of just a
Java-based backend demo. That would clearly show, our client libs are working across
different backend technologies.
Any thoughts?
-Matthias
[1] https://github.com/aerogear/aerogear-backend-cookbook/tree/master/Shoot
<https://github.com/aerogear/aerogear-backend-cookbook/tree/master/Shoot>
In the end, OAuth2 is just a protocol and
should support other servers.
- Should we provide examples for OpenID connect? Or abstractions?
To track this issue, we have the following Jira[3] and another for
OpenID connect[4]. Fell free to link to your respective project.
[1] -
http://transcripts.jboss.org/meeting/irc.freenode.org/aerogear/2014/aerog...
<http://transcripts.jboss.org/meeting/irc.freenode.org/aerogear/2014/aerog...
[2] - https://gist.github.com/abstractj/04136c6df85cea5f35d1
<https://gist.github.com/abstractj/04136c6df85cea5f35d1>
[3] - https://issues.jboss.org/browse/AGSEC-180
<https://issues.jboss.org/browse/AGSEC-180>
[4] - https://issues.jboss.org/browse/AGSEC-190
<https://issues.jboss.org/browse/AGSEC-190>
--
abstractj
PGP: 0x84DC9914
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org <mailto:aerogear-dev@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/aerogear-dev
<https://lists.jboss.org/mailman/listinfo/aerogear-dev>
--
Matthias Wessendorf
blog: http://matthiaswessendorf.wordpress.com/
<http://matthiaswessendorf.wordpress.com/>
sessions: http://www.slideshare.net/mwessendorf
<http://www.slideshare.net/mwessendorf>
twitter: http://twitter.com/mwessendorf
<http://twitter.com/mwessendorf>_______________________________________...
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
12:47 p.m.
New subject: Node.js / Passport.js thoughts (was: Re: OAuth2, OpenID connect and AeroGear)
On Oct 30, 2014, at 3:41 PM, Matthias Wessendorf <matzew(a)apache.org> wrote:
Hello team!
On Thu, Oct 9, 2014 at 4:49 AM, Bruno Oliveira <bruno(a)abstractj.org> wrote:
Note: Not only for Keycloak, but also compatible with other technologies
like passport on Node.js.
Great point on being compatible with passport.js! To ensure our OAuth2 client SDKs do
work against node.js (w/ passport.js), how about we build a Node.js based version of our
"Shoot-n-Share backend" ([1]), that is protected by Passport.js?
It could be a (simple) a 'clone' of our java version. I think for Luke, our
Node.js pro, it would be a fairly simple task :)
sounds good, not a JS ninja but can help on the documentation part.
On the client side, the Android/iOS versions of Shoot-n-Share would simply offer a new
upload target for Passport.js, instead of 'just' FB, Google-Drive and Keycloak.
That way we will also learn how much Passport.js is actually different, similar to what
we learned on how Google/FB are different ;-)
guess if Passport.js is completely different, we can always extend the generic iOS OAuth2
module we have and provide a Passport.js adapter (as we do with the FB for example)
Thanks,
Christos
Another interesting aspect of this is that, once we are ready to release our OAuth2 SDKs,
it would be awesome to actually ship a node.js based demo as well, instead of just a
Java-based backend demo. That would clearly show, our client libs are working across
different backend technologies.
Any thoughts?
-Matthias
[1] https://github.com/aerogear/aerogear-backend-cookbook/tree/master/Shoot
In the end, OAuth2 is just a protocol and
should support other servers.
- Should we provide examples for OpenID connect? Or abstractions?
To track this issue, we have the following Jira[3] and another for
OpenID connect[4]. Fell free to link to your respective project.
[1] -
http://transcripts.jboss.org/meeting/irc.freenode.org/aerogear/2014/aerog...
[2] - https://gist.github.com/abstractj/04136c6df85cea5f35d1
[3] - https://issues.jboss.org/browse/AGSEC-180
[4] - https://issues.jboss.org/browse/AGSEC-190
--
abstractj
PGP: 0x84DC9914
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
--
Matthias Wessendorf
blog: http://matthiaswessendorf.wordpress.com/
sessions: http://www.slideshare.net/mwessendorf
twitter: http://twitter.com/mwessendorf
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
3:46 a.m.
New subject: Node.js / Passport.js thoughts (was: Re: OAuth2, OpenID connect and AeroGear)
On 2014-10-30, Christos Vasilakis wrote:
On Oct 30, 2014, at 3:41 PM, Matthias Wessendorf <matzew(a)apache.org> wrote:
> Hello team!
>
> On Thu, Oct 9, 2014 at 4:49 AM, Bruno Oliveira <bruno(a)abstractj.org> wrote:
> Note: Not only for Keycloak, but also compatible with other technologies
> like passport on Node.js.
>
> Great point on being compatible with passport.js! To ensure our OAuth2 client SDKs
do work against node.js (w/ passport.js), how about we build a Node.js based version of
our "Shoot-n-Share backend" ([1]), that is protected by Passport.js?
>
> It could be a (simple) a 'clone' of our java version. I think for Luke, our
Node.js pro, it would be a fairly simple task :)
sounds good, not a JS ninja but can help on the documentation part.
>
> On the client side, the Android/iOS versions of Shoot-n-Share would simply offer a
new upload target for Passport.js, instead of 'just' FB, Google-Drive and
Keycloak.
>
> That way we will also learn how much Passport.js is actually different, similar to
what we learned on how Google/FB are different ;-)
guess if Passport.js is completely different, we can always extend the generic iOS OAuth2
module we have and provide a Passport.js adapter (as we do with the FB for example)
I'm ok with this, but a bit concerned about us being focused on
technologies instead of the RFC.
Thanks,
Christos
>
> Another interesting aspect of this is that, once we are ready to release our OAuth2
SDKs, it would be awesome to actually ship a node.js based demo as well, instead of just a
Java-based backend demo. That would clearly show, our client libs are working across
different backend technologies.
>
> Any thoughts?
>
> -Matthias
>
>
> [1] https://github.com/aerogear/aerogear-backend-cookbook/tree/master/Shoot
>
>
>
> In the end, OAuth2 is just a protocol and
> should support other servers.
>
> - Should we provide examples for OpenID connect? Or abstractions?
>
> To track this issue, we have the following Jira[3] and another for
> OpenID connect[4]. Fell free to link to your respective project.
>
>
> [1] -
>
http://transcripts.jboss.org/meeting/irc.freenode.org/aerogear/2014/aerog...
>
> [2] - https://gist.github.com/abstractj/04136c6df85cea5f35d1
>
> [3] - https://issues.jboss.org/browse/AGSEC-180
>
> [4] - https://issues.jboss.org/browse/AGSEC-190
> --
>
> abstractj
> PGP: 0x84DC9914
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
>
>
>
> --
> Matthias Wessendorf
>
> blog: http://matthiaswessendorf.wordpress.com/
> sessions: http://www.slideshare.net/mwessendorf
> twitter: http://twitter.com/mwessendorf
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
--
abstractj
PGP: 0x84DC9914
1:13 p.m.
New subject: Node.js / Passport.js thoughts (was: Re: OAuth2, OpenID connect and AeroGear)
On Oct 30, 2014, at 9:41 AM, Matthias Wessendorf
<matzew(a)apache.org> wrote:
Hello team!
On Thu, Oct 9, 2014 at 4:49 AM, Bruno Oliveira <bruno(a)abstractj.org
<mailto:bruno@abstractj.org>> wrote:
Note: Not only for Keycloak, but also compatible with other technologies
like passport on Node.js.
Great point on being compatible with passport.js! To ensure our OAuth2 client SDKs do
work against node.js (w/ passport.js), how about we build a Node.js based version of our
"Shoot-n-Share backend" ([1]), that is protected by Passport.js?
So to clear up some confusion that might be happening with what passport is, it is not an
OAuth2 server thing.
it’s really just middleware(think of it as a servlet filter for you java weenies) for
express.js, and by using adapters(like a FB or google), it can secure RESTful endpoints
in that express.js app.
I think the thing that we can do here is make a keycloack adapter for passport, using the
OAuth2 protocol( similar to passports FB and google adapters );
It could be a (simple) a 'clone' of our java version. I think for Luke, our
Node.js pro, it would be a fairly simple task :)
On the client side, the Android/iOS versions of Shoot-n-Share would simply offer a new
upload target for Passport.js, instead of 'just' FB, Google-Drive and Keycloak.
That way we will also learn how much Passport.js is actually different, similar to what
we learned on how Google/FB are different ;-)
Another interesting aspect of this is that, once we are ready to release our OAuth2 SDKs,
it would be awesome to actually ship a node.js based demo as well, instead of just a
Java-based backend demo. That would clearly show, our client libs are working across
different backend technologies.
Any thoughts?
-Matthias
[1] https://github.com/aerogear/aerogear-backend-cookbook/tree/master/Shoot
<https://github.com/aerogear/aerogear-backend-cookbook/tree/master/Shoot>
In the end, OAuth2 is just a protocol and
should support other servers.
- Should we provide examples for OpenID connect? Or abstractions?
To track this issue, we have the following Jira[3] and another for
OpenID connect[4]. Fell free to link to your respective project.
[1] -
http://transcripts.jboss.org/meeting/irc.freenode.org/aerogear/2014/aerog...
<http://transcripts.jboss.org/meeting/irc.freenode.org/aerogear/2014/aerog...
[2] - https://gist.github.com/abstractj/04136c6df85cea5f35d1
<https://gist.github.com/abstractj/04136c6df85cea5f35d1>
[3] - https://issues.jboss.org/browse/AGSEC-180
<https://issues.jboss.org/browse/AGSEC-180>
[4] - https://issues.jboss.org/browse/AGSEC-190
<https://issues.jboss.org/browse/AGSEC-190>
--
abstractj
PGP: 0x84DC9914
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org <mailto:aerogear-dev@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/aerogear-dev
<https://lists.jboss.org/mailman/listinfo/aerogear-dev>
--
Matthias Wessendorf
blog: http://matthiaswessendorf.wordpress.com/
<http://matthiaswessendorf.wordpress.com/>
sessions: http://www.slideshare.net/mwessendorf
<http://www.slideshare.net/mwessendorf>
twitter: http://twitter.com/mwessendorf
<http://twitter.com/mwessendorf>_______________________________________...
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
1:20 p.m.
New subject: Node.js / Passport.js thoughts (was: Re: OAuth2, OpenID connect and AeroGear)
On Thu, Oct 30, 2014 at 7:13 PM, Lucas Holmquist <lholmqui(a)redhat.com>
wrote:
On Oct 30, 2014, at 9:41 AM, Matthias Wessendorf <matzew(a)apache.org>
wrote:
Hello team!
On Thu, Oct 9, 2014 at 4:49 AM, Bruno Oliveira <bruno(a)abstractj.org>
wrote:
> Note: Not only for Keycloak, but also compatible with other technologies
> like passport on Node.js.
Great point on being compatible with passport.js! To ensure our OAuth2
client SDKs do work against node.js (w/ passport.js), how about we build a
Node.js based version of our "Shoot-n-Share backend" ([1]), that is
protected by Passport.js?
So to clear up some confusion that might be happening with what passport
is, it is not an OAuth2 server thing.
it’s really just middleware(think of it as a servlet filter for you java
weenies) for express.js, and by using adapters(like a FB or google), it
can secure RESTful endpoints in that express.js app.
I think the thing that we can do here is make a keycloack adapter for
passport, using the OAuth2 protocol( similar to passports FB and google
adapters );
+1 would be nice to get this in https://issues.jboss.org/browse/AGJS-252
On short term, it would be possible to use their existing adapters for
FB/Google and protect the node.js backend with these adapters, right ?
Sounds like the AGJS-252 is the ultimate solution we want, but I think for
a quick test/verification (or even example) of our Android/iOS OAuth2
clients, using the FB/Google adapters from passprt.js would be a good first
start ?
-Matthias
It could be a (simple) a 'clone' of our java version. I think for Luke,
our Node.js pro, it would be a fairly simple task :)
On the client side, the Android/iOS versions of Shoot-n-Share would simply
offer a new upload target for Passport.js, instead of 'just' FB,
Google-Drive and Keycloak.
That way we will also learn how much Passport.js is actually different,
similar to what we learned on how Google/FB are different ;-)
Another interesting aspect of this is that, once we are ready to release
our OAuth2 SDKs, it would be awesome to actually ship a node.js based demo
as well, instead of just a Java-based backend demo. That would clearly
show, our client libs are working across different backend technologies.
Any thoughts?
-Matthias
[1]
https://github.com/aerogear/aerogear-backend-cookbook/tree/master/Shoot
> In the end, OAuth2 is just a protocol and
> should support other servers.
>
> - Should we provide examples for OpenID connect? Or abstractions?
>
> To track this issue, we have the following Jira[3] and another for
> OpenID connect[4]. Fell free to link to your respective project.
>
>
> [1] -
>
>
http://transcripts.jboss.org/meeting/irc.freenode.org/aerogear/2014/aerog...
>
> [2] - https://gist.github.com/abstractj/04136c6df85cea5f35d1
>
> [3] - https://issues.jboss.org/browse/AGSEC-180
>
> [4] - https://issues.jboss.org/browse/AGSEC-190
> --
>
> abstractj
> PGP: 0x84DC9914
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
>
--
Matthias Wessendorf
blog: http://matthiaswessendorf.wordpress.com/
sessions: http://www.slideshare.net/mwessendorf
twitter: http://twitter.com/mwessendorf
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
--
Matthias Wessendorf
blog: http://matthiaswessendorf.wordpress.com/
sessions: http://www.slideshare.net/mwessendorf
twitter: http://twitter.com/mwessendorf
1:21 p.m.
New subject: Node.js / Passport.js thoughts (was: Re: OAuth2, OpenID connect and AeroGear)
On Oct 30, 2014, at 2:20 PM, Matthias Wessendorf
<matzew(a)apache.org> wrote:
On Thu, Oct 30, 2014 at 7:13 PM, Lucas Holmquist <lholmqui(a)redhat.com
<mailto:lholmqui@redhat.com>> wrote:
> On Oct 30, 2014, at 9:41 AM, Matthias Wessendorf <matzew(a)apache.org
<mailto:matzew@apache.org>> wrote:
>
> Hello team!
>
> On Thu, Oct 9, 2014 at 4:49 AM, Bruno Oliveira <bruno(a)abstractj.org
<mailto:bruno@abstractj.org>> wrote:
> Note: Not only for Keycloak, but also compatible with other technologies
> like passport on Node.js.
>
> Great point on being compatible with passport.js! To ensure our OAuth2 client SDKs do
work against node.js (w/ passport.js), how about we build a Node.js based version of our
"Shoot-n-Share backend" ([1]), that is protected by Passport.js?
So to clear up some confusion that might be happening with what passport is, it is not an
OAuth2 server thing.
it’s really just middleware(think of it as a servlet filter for you java weenies) for
express.js, and by using adapters(like a FB or google), it can secure RESTful endpoints
in that express.js app.
I think the thing that we can do here is make a keycloack adapter for passport, using the
OAuth2 protocol( similar to passports FB and google adapters );
+1 would be nice to get this in https://issues.jboss.org/browse/AGJS-252
<https://issues.jboss.org/browse/AGJS-252>
On short term, it would be possible to use their existing adapters for FB/Google and
protect the node.js backend with these adapters, right ?
i think we can do that
Sounds like the AGJS-252 is the ultimate solution we want, but I think for a quick
test/verification (or even example) of our Android/iOS OAuth2 clients, using the FB/Google
adapters from passprt.js would be a good first start ?
-Matthias
>
> It could be a (simple) a 'clone' of our java version. I think for Luke, our
Node.js pro, it would be a fairly simple task :)
>
> On the client side, the Android/iOS versions of Shoot-n-Share would simply offer a
new upload target for Passport.js, instead of 'just' FB, Google-Drive and
Keycloak.
>
> That way we will also learn how much Passport.js is actually different, similar to
what we learned on how Google/FB are different ;-)
>
> Another interesting aspect of this is that, once we are ready to release our OAuth2
SDKs, it would be awesome to actually ship a node.js based demo as well, instead of just a
Java-based backend demo. That would clearly show, our client libs are working across
different backend technologies.
>
> Any thoughts?
>
> -Matthias
>
>
> [1] https://github.com/aerogear/aerogear-backend-cookbook/tree/master/Shoot
<https://github.com/aerogear/aerogear-backend-cookbook/tree/master/Shoot>
>
>
>
> In the end, OAuth2 is just a protocol and
> should support other servers.
>
> - Should we provide examples for OpenID connect? Or abstractions?
>
> To track this issue, we have the following Jira[3] and another for
> OpenID connect[4]. Fell free to link to your respective project.
>
>
> [1] -
>
http://transcripts.jboss.org/meeting/irc.freenode.org/aerogear/2014/aerog...
<http://transcripts.jboss.org/meeting/irc.freenode.org/aerogear/2014/aerog...
>
> [2] - https://gist.github.com/abstractj/04136c6df85cea5f35d1
<https://gist.github.com/abstractj/04136c6df85cea5f35d1>
>
> [3] - https://issues.jboss.org/browse/AGSEC-180
<https://issues.jboss.org/browse/AGSEC-180>
>
> [4] - https://issues.jboss.org/browse/AGSEC-190
<https://issues.jboss.org/browse/AGSEC-190>
> --
>
> abstractj
> PGP: 0x84DC9914
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org <mailto:aerogear-dev@lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
<https://lists.jboss.org/mailman/listinfo/aerogear-dev>
>
>
>
> --
> Matthias Wessendorf
>
> blog: http://matthiaswessendorf.wordpress.com/
<http://matthiaswessendorf.wordpress.com/>
> sessions: http://www.slideshare.net/mwessendorf
<http://www.slideshare.net/mwessendorf>
> twitter: http://twitter.com/mwessendorf
<http://twitter.com/mwessendorf>_______________________________________...
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org <mailto:aerogear-dev@lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
<https://lists.jboss.org/mailman/listinfo/aerogear-dev>
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org <mailto:aerogear-dev@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/aerogear-dev
<https://lists.jboss.org/mailman/listinfo/aerogear-dev>
--
Matthias Wessendorf
blog: http://matthiaswessendorf.wordpress.com/
<http://matthiaswessendorf.wordpress.com/>
sessions: http://www.slideshare.net/mwessendorf
<http://www.slideshare.net/mwessendorf>
twitter: http://twitter.com/mwessendorf
<http://twitter.com/mwessendorf>_______________________________________...
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org <mailto:aerogear-dev@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/aerogear-dev
<https://lists.jboss.org/mailman/listinfo/aerogear-dev>
1:43 p.m.
New subject: Node.js / Passport.js thoughts (was: Re: OAuth2, OpenID connect and AeroGear)
As a learning exercise I just wrote a MEAN application with both web and
mobile (cordova) front-ends. The Node.js backend is using passport.js
to both authenticate against Gooale's Oauth2 and to secure the REST API
I implemented with Express.
I should be able to spare some cycles if you could use some extra hands
on this.
Brian
On 14-10-30 11:21 AM, Lucas Holmquist wrote:
> On Oct 30, 2014, at 2:20 PM, Matthias Wessendorf <matzew(a)apache.org
> <mailto:matzew@apache.org>> wrote:
>
>
>
> On Thu, Oct 30, 2014 at 7:13 PM, Lucas Holmquist <lholmqui(a)redhat.com
> <mailto:lholmqui@redhat.com>> wrote:
>
>
>> On Oct 30, 2014, at 9:41 AM, Matthias Wessendorf
>> <matzew(a)apache.org <mailto:matzew@apache.org>> wrote:
>>
>> Hello team!
>>
>> On Thu, Oct 9, 2014 at 4:49 AM, Bruno
>> Oliveira <bruno(a)abstractj.org <mailto:bruno@abstractj.org>>
wrote:
>> Note: Not only for Keycloak, but also compatible with other
>> technologies
>> like passport on Node.js.
>>
>> Great point on being compatible with passport.js! To ensure our
>> OAuth2 client SDKs do work against node.js (w/ passport.js), how
>> about we build a Node.js based version of our "Shoot-n-Share
>> backend" ([1]), that is protected by Passport.js?
>
> So to clear up some confusion that might be happening with what
> passport is, it is not an OAuth2 server thing.
>
> it’s really just middleware(think of it as a servlet filter for
> you java weenies) for express.js, and by using adapters(like a
> FB or google), it can secure RESTful endpoints in that express.js
> app.
>
> I think the thing that we can do here is make a keycloack adapter
> for passport, using the OAuth2 protocol( similar to passports FB
> and google adapters );
>
>
> +1 would be nice to get this in https://issues.jboss.org/browse/AGJS-252
>
> On short term, it would be possible to use their existing adapters
> for FB/Google and protect the node.js backend with these adapters,
> right ?
i think we can do that
>
>
> Sounds like the AGJS-252 is the ultimate solution we want, but I
> think for a quick test/verification (or even example) of our
> Android/iOS OAuth2 clients, using the FB/Google adapters from
> passprt.js would be a good first start ?
>
> -Matthias
>
>
>
>
>
>
>
>
>>
>> It could be a (simple) a 'clone' of our java version. I think
>> for Luke, our Node.js pro, it would be a fairly simple task :)
>>
>> On the client side, the Android/iOS versions of Shoot-n-Share
>> would simply offer a new upload target for Passport.js, instead
>> of 'just' FB, Google-Drive and Keycloak.
>>
>> That way we will also learn how much Passport.js is actually
>> different, similar to what we learned on how Google/FB are
>> different ;-)
>>
>> Another interesting aspect of this is that, once we are ready to
>> release our OAuth2 SDKs, it would be awesome to actually ship a
>> node.js based demo as well, instead of just a Java-based backend
>> demo. That would clearly show, our client libs are working
>> across different backend technologies.
>>
>> Any thoughts?
>>
>> -Matthias
>>
>>
>> [1] https://github.com/aerogear/aerogear-backend-cookbook/tree/master/Shoot
>>
>>
>>
>>
>> In the end, OAuth2 is just a protocol and
>> should support other servers.
>>
>> - Should we provide examples for OpenID connect? Or
>> abstractions?
>>
>> To track this issue, we have the following Jira[3] and
>> another for
>> OpenID connect[4]. Fell free to link to your respective project.
>>
>>
>> [1] -
>>
http://transcripts.jboss.org/meeting/irc.freenode.org/aerogear/2014/aerog...
>>
>> [2] - https://gist.github.com/abstractj/04136c6df85cea5f35d1
>>
>> [3] - https://issues.jboss.org/browse/AGSEC-180
>>
>> [4] - https://issues.jboss.org/browse/AGSEC-190
>> --
>>
>> abstractj
>> PGP: 0x84DC9914
>> _______________________________________________
>> aerogear-dev mailing list
>> aerogear-dev(a)lists.jboss.org
>> <mailto:aerogear-dev@lists.jboss.org>
>> https://lists.jboss.org/mailman/listinfo/aerogear-dev
>>
>>
>>
>>
>> --
>> Matthias Wessendorf
>>
>> blog: http://matthiaswessendorf.wordpress.com/
>> sessions: http://www.slideshare.net/mwessendorf
>> twitter: http://twitter.com/mwessendorf
>> _______________________________________________
>> aerogear-dev mailing list
>> aerogear-dev(a)lists.jboss.org <mailto:aerogear-dev@lists.jboss.org>
>> https://lists.jboss.org/mailman/listinfo/aerogear-dev
>
>
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org <mailto:aerogear-dev@lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
>
>
>
>
> --
> Matthias Wessendorf
>
> blog: http://matthiaswessendorf.wordpress.com/
> sessions: http://www.slideshare.net/mwessendorf
> twitter: http://twitter.com/mwessendorf
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org <mailto:aerogear-dev@lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
2:11 p.m.
New subject: Node.js / Passport.js thoughts (was: Re: OAuth2, OpenID connect and AeroGear)
sounds good to me, if you wanna help ;)
On Thursday, October 30, 2014, Brian Leathem <bleathem(a)gmail.com> wrote:
As a learning exercise I just wrote a MEAN application with both web
and
mobile (cordova) front-ends. The Node.js backend is using passport.js to
both authenticate against Gooale's Oauth2 and to secure the REST API I
implemented with Express.
I should be able to spare some cycles if you could use some extra hands on
this.
Brian
On 14-10-30 11:21 AM, Lucas Holmquist wrote:
On Oct 30, 2014, at 2:20 PM, Matthias Wessendorf <matzew(a)apache.org
<javascript:_e(%7B%7D,'cvml','matzew@apache.org');>> wrote:
On Thu, Oct 30, 2014 at 7:13 PM, Lucas Holmquist <lholmqui(a)redhat.com
<javascript:_e(%7B%7D,'cvml','lholmqui@redhat.com');>> wrote:
>
> On Oct 30, 2014, at 9:41 AM, Matthias Wessendorf <matzew(a)apache.org
> <javascript:_e(%7B%7D,'cvml','matzew@apache.org');>> wrote:
>
> Hello team!
>
> On Thu, Oct 9, 2014 at 4:49 AM, Bruno Oliveira <bruno(a)abstractj.org
> <javascript:_e(%7B%7D,'cvml','bruno@abstractj.org');>>
wrote:
> Note: Not only for Keycloak, but also compatible with other technologies
> like passport on Node.js.
>
> Great point on being compatible with passport.js! To ensure our OAuth2
> client SDKs do work against node.js (w/ passport.js), how about we build a
> Node.js based version of our "Shoot-n-Share backend" ([1]), that is
> protected by Passport.js?
>
>
> So to clear up some confusion that might be happening with what
> passport is, it is not an OAuth2 server thing.
>
> it’s really just middleware(think of it as a servlet filter for you
> java weenies) for express.js, and by using adapters(like a FB or google),
> it can secure RESTful endpoints in that express.js app.
>
> I think the thing that we can do here is make a keycloack adapter for
> passport, using the OAuth2 protocol( similar to passports FB and google
> adapters );
>
+1 would be nice to get this in https://issues.jboss.org/browse/AGJS-252
On short term, it would be possible to use their existing adapters for
FB/Google and protect the node.js backend with these adapters, right ?
i think we can do that
Sounds like the AGJS-252 is the ultimate solution we want, but I think
for a quick test/verification (or even example) of our Android/iOS OAuth2
clients, using the FB/Google adapters from passprt.js would be a good first
start ?
-Matthias
>
>
>
>
> It could be a (simple) a 'clone' of our java version. I think for Luke,
> our Node.js pro, it would be a fairly simple task :)
>
> On the client side, the Android/iOS versions of Shoot-n-Share would
> simply offer a new upload target for Passport.js, instead of 'just' FB,
> Google-Drive and Keycloak.
>
> That way we will also learn how much Passport.js is actually different,
> similar to what we learned on how Google/FB are different ;-)
>
> Another interesting aspect of this is that, once we are ready to
> release our OAuth2 SDKs, it would be awesome to actually ship a node.js
> based demo as well, instead of just a Java-based backend demo. That would
> clearly show, our client libs are working across different backend
> technologies.
>
> Any thoughts?
>
> -Matthias
>
>
> [1]
> https://github.com/aerogear/aerogear-backend-cookbook/tree/master/Shoot
>
>
>
>
>> In the end, OAuth2 is just a protocol and
>> should support other servers.
>>
>> - Should we provide examples for OpenID connect? Or abstractions?
>>
>> To track this issue, we have the following Jira[3] and another for
>> OpenID connect[4]. Fell free to link to your respective project.
>>
>>
>> [1] -
>>
>>
http://transcripts.jboss.org/meeting/irc.freenode.org/aerogear/2014/aerog...
>>
>> [2] - https://gist.github.com/abstractj/04136c6df85cea5f35d1
>>
>> [3] - https://issues.jboss.org/browse/AGSEC-180
>>
>> [4] - https://issues.jboss.org/browse/AGSEC-190
>> --
>>
>> abstractj
>> PGP: 0x84DC9914
>> _______________________________________________
>> aerogear-dev mailing list
>> aerogear-dev(a)lists.jboss.org
>>
<javascript:_e(%7B%7D,'cvml','aerogear-dev@lists.jboss.org');>
>> https://lists.jboss.org/mailman/listinfo/aerogear-dev
>>
>
>
>
> --
> Matthias Wessendorf
>
> blog: http://matthiaswessendorf.wordpress.com/
> sessions: http://www.slideshare.net/mwessendorf
> twitter: http://twitter.com/mwessendorf
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org
> <javascript:_e(%7B%7D,'cvml','aerogear-dev@lists.jboss.org');>
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
>
>
>
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org
> <javascript:_e(%7B%7D,'cvml','aerogear-dev@lists.jboss.org');>
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
>
--
Matthias Wessendorf
blog: http://matthiaswessendorf.wordpress.com/
sessions: http://www.slideshare.net/mwessendorf
twitter: http://twitter.com/mwessendorf
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
<javascript:_e(%7B%7D,'cvml','aerogear-dev@lists.jboss.org');>
https://lists.jboss.org/mailman/listinfo/aerogear-dev
_______________________________________________
aerogear-dev mailing listaerogear-dev(a)lists.jboss.org
<javascript:_e(%7B%7D,'cvml','aerogear-dev@lists.jboss.org');>https://lists.jboss.org/mailman/listinfo/aerogear-dev
--
Sent from Gmail Mobile
3:43 a.m.
New subject: Node.js / Passport.js thoughts (was: Re: OAuth2, OpenID connect and AeroGear)
On 2014-10-30, Lucas Holmquist wrote:
> On Oct 30, 2014, at 9:41 AM, Matthias Wessendorf <matzew(a)apache.org> wrote:
>
> Hello team!
>
> On Thu, Oct 9, 2014 at 4:49 AM, Bruno Oliveira <bruno(a)abstractj.org
<mailto:bruno@abstractj.org>> wrote:
> Note: Not only for Keycloak, but also compatible with other technologies
> like passport on Node.js.
>
> Great point on being compatible with passport.js! To ensure our OAuth2 client SDKs
do work against node.js (w/ passport.js), how about we build a Node.js based version of
our "Shoot-n-Share backend" ([1]), that is protected by Passport.js?
So to clear up some confusion that might be happening with what passport is, it is not an
OAuth2 server thing.
it’s really just middleware(think of it as a servlet filter for you java weenies) for
express.js, and by using adapters(like a FB or google), it can secure RESTful endpoints
in that express.js app.
I think the thing that we can do here is make a keycloack adapter for passport, using the
OAuth2 protocol( similar to passports FB and google adapters );
You're correct. What I meant in my previous e-mail, was the fact that we
not necessarily need to be tied to some technology, but think about
other technologies as well.
>
> It could be a (simple) a 'clone' of our java version. I think for Luke, our
Node.js pro, it would be a fairly simple task :)
>
> On the client side, the Android/iOS versions of Shoot-n-Share would simply offer a
new upload target for Passport.js, instead of 'just' FB, Google-Drive and
Keycloak.
>
> That way we will also learn how much Passport.js is actually different, similar to
what we learned on how Google/FB are different ;-)
>
> Another interesting aspect of this is that, once we are ready to release our OAuth2
SDKs, it would be awesome to actually ship a node.js based demo as well, instead of just a
Java-based backend demo. That would clearly show, our client libs are working across
different backend technologies.
>
> Any thoughts?
>
> -Matthias
>
>
> [1] https://github.com/aerogear/aerogear-backend-cookbook/tree/master/Shoot
<https://github.com/aerogear/aerogear-backend-cookbook/tree/master/Shoot>
>
>
>
> In the end, OAuth2 is just a protocol and
> should support other servers.
>
> - Should we provide examples for OpenID connect? Or abstractions?
>
> To track this issue, we have the following Jira[3] and another for
> OpenID connect[4]. Fell free to link to your respective project.
>
>
> [1] -
>
http://transcripts.jboss.org/meeting/irc.freenode.org/aerogear/2014/aerog...
<http://transcripts.jboss.org/meeting/irc.freenode.org/aerogear/2014/aerog...
>
> [2] - https://gist.github.com/abstractj/04136c6df85cea5f35d1
<https://gist.github.com/abstractj/04136c6df85cea5f35d1>
>
> [3] - https://issues.jboss.org/browse/AGSEC-180
<https://issues.jboss.org/browse/AGSEC-180>
>
> [4] - https://issues.jboss.org/browse/AGSEC-190
<https://issues.jboss.org/browse/AGSEC-190>
> --
>
> abstractj
> PGP: 0x84DC9914
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org <mailto:aerogear-dev@lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
<https://lists.jboss.org/mailman/listinfo/aerogear-dev>
>
>
>
> --
> Matthias Wessendorf
>
> blog: http://matthiaswessendorf.wordpress.com/
<http://matthiaswessendorf.wordpress.com/>
> sessions: http://www.slideshare.net/mwessendorf
<http://www.slideshare.net/mwessendorf>
> twitter: http://twitter.com/mwessendorf
<http://twitter.com/mwessendorf>_______________________________________...
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
--
abstractj
PGP: 0x84DC9914
3:52 a.m.
New subject: Node.js / Passport.js thoughts (was: Re: OAuth2, OpenID connect and AeroGear)
On 30 Oct 2014, at 19:13, Lucas Holmquist <lholmqui(a)redhat.com> wrote:
As we said passport itself is not an oauth2 provider. You could couple it with KC or
another interesting integration is OAuth2rize + passport which provides an Oauth2 server.
see [1], [2]
[1]
http://scottksmith.com/blog/2014/07/02/beer-locker-building-a-restful-api...
[2] https://github.com/jaredhanson/oauth2orize
I’d love to take a deeper look at this example… wdyt Luke?
> On Oct 30, 2014, at 9:41 AM, Matthias Wessendorf <matzew(a)apache.org> wrote:
>
> Hello team!
>
> On Thu, Oct 9, 2014 at 4:49 AM, Bruno Oliveira <bruno(a)abstractj.org> wrote:
> Note: Not only for Keycloak, but also compatible with other technologies
> like passport on Node.js.
>
> Great point on being compatible with passport.js! To ensure our OAuth2 client SDKs do
work against node.js (w/ passport.js), how about we build a Node.js based version of our
"Shoot-n-Share backend" ([1]), that is protected by Passport.js?
So to clear up some confusion that might be happening with what passport is, it is not an
OAuth2 server thing.
it’s really just middleware(think of it as a servlet filter for you java weenies) for
express.js, and by using adapters(like a FB or google), it can secure RESTful endpoints
in that express.js app.
So basically you can use passport to secure your endpoint using openId connect (on top of
oauth2). you login as google user and your secure your endpoint with google access token.
with passport.js you can go the authz code grant way because you store token on server
side. Refresh and access token are never stored in browser app.
Right?
On native app we’re doing what passport.js is doing but directly on device… not sure there
is anything interesting to demo on native app, it’s more a web or cordova thing. I would
say either use key cloak/passport Js for web pure app and corodva app or use corodva
native oauth2 plugin.
I think the thing that we can do here is make a keycloack adapter for passport, using the
OAuth2 protocol( similar to passports FB and google adapters );
+1 on keycloak/passport.js integration
>
> It could be a (simple) a 'clone' of our java version. I think for Luke, our
Node.js pro, it would be a fairly simple task :)
>
> On the client side, the Android/iOS versions of Shoot-n-Share would simply offer a
new upload target for Passport.js, instead of 'just' FB, Google-Drive and
Keycloak.
>
> That way we will also learn how much Passport.js is actually different, similar to
what we learned on how Google/FB are different ;-)
>
> Another interesting aspect of this is that, once we are ready to release our OAuth2
SDKs, it would be awesome to actually ship a node.js based demo as well, instead of just a
Java-based backend demo. That would clearly show, our client libs are working across
different backend technologies.
>
> Any thoughts?
>
> -Matthias
>
>
> [1] https://github.com/aerogear/aerogear-backend-cookbook/tree/master/Shoot
>
>
>
> In the end, OAuth2 is just a protocol and
> should support other servers.
>
> - Should we provide examples for OpenID connect? Or abstractions?
>
> To track this issue, we have the following Jira[3] and another for
> OpenID connect[4]. Fell free to link to your respective project.
>
>
> [1] -
>
http://transcripts.jboss.org/meeting/irc.freenode.org/aerogear/2014/aerog...
>
> [2] - https://gist.github.com/abstractj/04136c6df85cea5f35d1
>
> [3] - https://issues.jboss.org/browse/AGSEC-180
>
> [4] - https://issues.jboss.org/browse/AGSEC-190
> --
>
> abstractj
> PGP: 0x84DC9914
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
>
>
>
> --
> Matthias Wessendorf
>
> blog: http://matthiaswessendorf.wordpress.com/
> sessions: http://www.slideshare.net/mwessendorf
> twitter: http://twitter.com/mwessendorf
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
7:39 a.m.
New subject: Node.js / Passport.js thoughts (was: Re: OAuth2, OpenID connect and AeroGear)
On Nov 3, 2014, at 4:52 AM, Corinne Krych
<corinnekrych(a)gmail.com> wrote:
On 30 Oct 2014, at 19:13, Lucas Holmquist <lholmqui(a)redhat.com
<mailto:lholmqui@redhat.com>> wrote:
>
>> On Oct 30, 2014, at 9:41 AM, Matthias Wessendorf <matzew(a)apache.org>
wrote:
>>
>> Hello team!
>>
>> On Thu, Oct 9, 2014 at 4:49 AM, Bruno Oliveira <bruno(a)abstractj.org>
wrote:
>> Note: Not only for Keycloak, but also compatible with other technologies
>> like passport on Node.js.
>>
>> Great point on being compatible with passport.js! To ensure our OAuth2 client
SDKs do work against node.js (w/ passport.js), how about we build a Node.js based version
of our "Shoot-n-Share backend" ([1]), that is protected by Passport.js?
>
> So to clear up some confusion that might be happening with what passport is, it is
not an OAuth2 server thing.
>
> it’s really just middleware(think of it as a servlet filter for you java weenies) for
express.js, and by using adapters(like a FB or google), it can secure RESTful endpoints
in that express.js app.
So basically you can use passport to secure your endpoint using openId connect (on top of
oauth2). you login as google user and your secure your endpoint with google access token.
with passport.js you can go the authz code grant way because you store token on server
side. Refresh and access token are never stored in browser app.
Right?
i haven’t played with it yet, but that is my thought
On native app we’re doing what passport.js is doing but directly on device… not sure
there is anything interesting to demo on native app, it’s more a web or cordova thing. I
would say either use key cloak/passport Js for web pure app and corodva app or use corodva
native oauth2 plugin.
i have the same feelings, this is more web related
>
> I think the thing that we can do here is make a keycloack adapter for passport, using
the OAuth2 protocol( similar to passports FB and google adapters );
+1 on keycloak/passport.js integration
>
>
As we said passport itself is not an oauth2 provider. You could couple it with KC or
another interesting integration is OAuth2rize + passport which provides an Oauth2 server.
see [1], [2]
[1]
http://scottksmith.com/blog/2014/07/02/beer-locker-building-a-restful-api...
<http://scottksmith.com/blog/2014/07/02/beer-locker-building-a-restful-api...
[2] https://github.com/jaredhanson/oauth2orize
<https://github.com/jaredhanson/oauth2orize>
I’d love to take a deeper look at this example… wdyt Luke?
go go go!!
>
>>
>> It could be a (simple) a 'clone' of our java version. I think for Luke,
our Node.js pro, it would be a fairly simple task :)
>>
>> On the client side, the Android/iOS versions of Shoot-n-Share would simply offer
a new upload target for Passport.js, instead of 'just' FB, Google-Drive and
Keycloak.
>>
>> That way we will also learn how much Passport.js is actually different, similar
to what we learned on how Google/FB are different ;-)
>>
>> Another interesting aspect of this is that, once we are ready to release our
OAuth2 SDKs, it would be awesome to actually ship a node.js based demo as well, instead of
just a Java-based backend demo. That would clearly show, our client libs are working
across different backend technologies.
>>
>> Any thoughts?
>>
>> -Matthias
>>
>>
>> [1] https://github.com/aerogear/aerogear-backend-cookbook/tree/master/Shoot
>>
>>
>>
>> In the end, OAuth2 is just a protocol and
>> should support other servers.
>>
>> - Should we provide examples for OpenID connect? Or abstractions?
>>
>> To track this issue, we have the following Jira[3] and another for
>> OpenID connect[4]. Fell free to link to your respective project.
>>
>>
>> [1] -
>>
http://transcripts.jboss.org/meeting/irc.freenode.org/aerogear/2014/aerog...
>>
>> [2] - https://gist.github.com/abstractj/04136c6df85cea5f35d1
>>
>> [3] - https://issues.jboss.org/browse/AGSEC-180
>>
>> [4] - https://issues.jboss.org/browse/AGSEC-190
>> --
>>
>> abstractj
>> PGP: 0x84DC9914
>> _______________________________________________
>> aerogear-dev mailing list
>> aerogear-dev(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/aerogear-dev
>>
>>
>>
>> --
>> Matthias Wessendorf
>>
>> blog: http://matthiaswessendorf.wordpress.com/
>> sessions: http://www.slideshare.net/mwessendorf
>> twitter: http://twitter.com/mwessendorf
>> _______________________________________________
>> aerogear-dev mailing list
>> aerogear-dev(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/aerogear-dev
>
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org <mailto:aerogear-dev@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/aerogear-dev
<https://lists.jboss.org/mailman/listinfo/aerogear-dev>
2:13 a.m.
New subject: Node.js / Passport.js thoughts (was: Re: OAuth2, OpenID connect and AeroGear)
On Nov 3, 2014 1:53 AM, "Corinne Krych" <corinnekrych(a)gmail.com> wrote:
On 30 Oct 2014, at 19:13, Lucas Holmquist <lholmqui(a)redhat.com> wrote:
>
>> On Oct 30, 2014, at 9:41 AM, Matthias Wessendorf <matzew(a)apache.org>
wrote:
>>
>> Hello team!
>>
>> On Thu, Oct 9, 2014 at 4:49 AM, Bruno Oliveira <bruno(a)abstractj.org>
wrote:
>> Note: Not only for Keycloak, but also compatible with other
technologies
>> like passport on Node.js.
>>
>> Great point on being compatible with passport.js! To ensure our OAuth2
client SDKs do work against node.js (w/ passport.js), how about we build a
Node.js based version of our "Shoot-n-Share backend" ([1]), that is
protected by Passport.js?
>
> So to clear up some confusion that might be happening with what
passport is,
it is not an OAuth2 server thing.
>
> it’s really just middleware(think of it as a servlet filter for you
java
weenies) for express.js, and by using adapters(like a FB or google),
it can secure RESTful endpoints in that express.js app.
So basically you can use passport to secure your endpoint using openId
connect (on
top of oauth2). you login as google user and your secure your
endpoint with google access token.
with passport.js you can go the authz code grant way because you
store
token on server side. Refresh and access token are never stored in browser
app.
Right?
The browser will include the returned oauth2 token with ever request to
establish authorization. This token /may/ be stored as a cookie or in
local storage to facilitate that until the user logs out.
A number of paaport.js extensions exist providing a simplified api for
dealing with a particular oauth implementation, eg:
https://github.com/jaredhanson/passport-google-oauth
A module integrating passport with keycloak might indeed be interesting.
Certainly augmenting the demo to show they play nice together should be
useful.
Brian
On native app we’re doing what passport.js is doing but directly on
device… not
sure there is anything interesting to demo on native app, it’s
more a web or cordova thing. I would say either use key cloak/passport Js
for web pure app and corodva app or use corodva native oauth2 plugin.
>
> I think the thing that we can do here is make a keycloack adapter for
passport, using the OAuth2 protocol( similar to passports FB and google
adapters );
+1 on keycloak/passport.js integration
>
>
As we said passport itself is not an oauth2 provider. You could couple it
with KC
or
another interesting integration is OAuth2rize + passport which
provides
an Oauth2 server. see [1], [2]
[1]
http://scottksmith.com/blog/2014/07/02/beer-locker-building-a-restful-api...
[2] https://github.com/jaredhanson/oauth2orize
I’d love to take a deeper look at this example… wdyt Luke?
>
>>
>> It could be a (simple) a 'clone' of our java version. I think for
Luke, our Node.js pro, it would be a fairly simple task :)
>>
>> On the client side, the Android/iOS versions of Shoot-n-Share would
simply
offer a new upload target for Passport.js, instead of 'just' FB,
Google-Drive and Keycloak.
>>
>> That way we will also learn how much Passport.js is actually
different,
similar to what we learned on how Google/FB are different ;-)
>>
>> Another interesting aspect of this is that, once we are ready to
release
our OAuth2 SDKs, it would be awesome to actually ship a node.js
based demo as well, instead of just a Java-based backend demo. That would
clearly show, our client libs are working across different backend
technologies.
>>
>> Any thoughts?
>>
>> -Matthias
>>
>>
>> [1]
https://github.com/aerogear/aerogear-backend-cookbook/tree/master/Shoot
>>
>>
>>
>> In the end, OAuth2 is just a protocol and
>> should support other servers.
>>
>> - Should we provide examples for OpenID connect? Or abstractions?
>>
>> To track this issue, we have the following Jira[3] and another for
>> OpenID connect[4]. Fell free to link to your respective project.
>>
>>
>> [1] -
>>
http://transcripts.jboss.org/meeting/irc.freenode.org/aerogear/2014/aerog...
>>
>> [2] - https://gist.github.com/abstractj/04136c6df85cea5f35d1
>>
>> [3] - https://issues.jboss.org/browse/AGSEC-180
>>
>> [4] - https://issues.jboss.org/browse/AGSEC-190
>> --
>>
>> abstractj
>> PGP: 0x84DC9914
>> _______________________________________________
>> aerogear-dev mailing list
>> aerogear-dev(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/aerogear-dev
>>
>>
>>
>> --
>> Matthias Wessendorf
>>
>> blog: http://matthiaswessendorf.wordpress.com/
>> sessions: http://www.slideshare.net/mwessendorf
>> twitter: http://twitter.com/mwessendorf
>> _______________________________________________
>> aerogear-dev mailing list
>> aerogear-dev(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/aerogear-dev
>
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
3709
days inactive
3714
days old
12 comments
6 participants
participants (6)
-
Brian Leathem -
Bruno Oliveira -
Christos Vasilakis -
Corinne Krych -
Lucas Holmquist -
Matthias Wessendorf