3:07 p.m.
We do have WebSeal backed by Tivoli in our legacy application. The new REST endpoints are
built on top of the legacy EJB application. It is not an entirely new application. Slowly
the HTML5/Rest layers will replace the legacy system.
There could be others in the forum who have this setup. Any initial pointers ?
Thanks,
Mohan
-----Original Message-----
From: Stian Thorgersen [mailto:stian@redhat.com]
Sent: Monday, February 02, 2015 1:43 PM
To: Radhakrishnan, Mohan (Cognizant)
Cc: keycloak-user(a)lists.jboss.org
Subject: Re: [keycloak-user] Rest endpoint and AngularJS client
----- Original Message -----
From: "Mohan Radhakrishnan"
<Mohan.Radhakrishnan(a)cognizant.com>
To: keycloak-user(a)lists.jboss.org
Sent: Saturday, 31 January, 2015 1:42:39 PM
Subject: [keycloak-user] Rest endpoint and AngularJS client
Hi,
This is my first post. We have a large HealthCare domain Rest
application with an AngularJS client. We may require role-based access
control of HTML views. We can consult LDAP to get these. But due to
some internal reasons we are not going to use OAuth now. It may be a future enhancement.
Are these types of HTML5/JS applications still protected effectively
based on roles ? I wanted to know before I start reading more about
Keycloak because OAuth is not used now.
An HTML5/JS application doesn't have any access control. All it can do is hide
features a user can't access. The access control has to be done on the REST endpoints.
This is a perfect fit for OpenID Connect.
When you login to Keycloak your app is given a token, that includes the roles the user can
access. These can then be used by the AngularJS app to enable/disable features. When
invoking REST endpoints the token is passed along, which then allows the REST endpoints to
verify if the user has access to the requested resource or not.
In summary Keycloak and OpenID Connect are perfect fits for the type of application
you're doing.
Thanks,
Mohan
This e-mail and any files transmitted with it are for the sole use of
the intended recipient(s) and may contain confidential and privileged
information. If you are not the intended recipient(s), please reply to
the sender and destroy all copies of the original message. Any
unauthorized review, use, disclosure, dissemination, forwarding,
printing or copying of this email, and/or any action taken in reliance
on the contents of this e-mail is strictly prohibited and may be
unlawful. Where permitted by applicable law, this e-mail and other
e-mail communications sent to and from Cognizant e-mail addresses may be monitored.
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
This e-mail and any files
transmitted with it are for the sole use of the intended recipient(s) and may contain
confidential and privileged information. If you are not the intended recipient(s), please
reply to the sender and destroy all copies of the original message. Any unauthorized
review, use, disclosure, dissemination, forwarding, printing or copying of this email,
and/or any action taken in reliance on the contents of this e-mail is strictly prohibited
and may be unlawful. Where permitted by applicable law, this e-mail and other e-mail
communications sent to and from Cognizant e-mail addresses may be monitored.