Re: [security-dev] Entitlement versus Enforcement Model

On 11/07/2012 03:05 PM, Bill Burke wrote: > I committed some preliminary work a few months ago to prototype > Openstack's Keystone service and protocol. I want to ditch this work > though in favor of developing my own protocol as it seems Keystone is > very much in flux and they aren't sure of their own direction. It as a > good exercise though as I learned how AS7 and login-modules can fit > together and how you can dynamically set roles/identity *per-request*. > I also wrote a little utility that allows you to delegate authentication > to your security domain. (login-module-authenticator) > > https://github.com/resteasy/Resteasy/tree/master/jaxrs/security/skeleton-... > > I just started on my new (well really long time brewing) ideas this week > as Resteasy 3.0 beta 1 is now out. I plan on using JSON Web Token and > JSON Web Signatures. After evaluating these specs, they look very tight > and simple enough to build upon. Bill, last time I mentioned JWT and JWE, you chewed me. Yeah, pretty lightweight stuff and applicable to REST style services. It is possible that JWT lacks the richness that may be desired in a token, for certain usecases. I have not come across those use cases yet apart from serving SAML users over a REST style interface with JSON binding.