Damn, *bleepin* JAX-RS TCK has a test that requires DIGEST auth. When will Undertow in Wildfly support it? Before the next Wildfll Alpha would be nice.

Hmm there must be some issue or incomplete servlet integration because our management stuff uses Digest all of the place. I'll look into it. On Jun 3, 2013, at 4:07 PM, Bill Burke <bburke(a)redhat.com&gt; wrote: > https://issues.jboss.org/browse/UNDERTOW-34 > > DONE? > > On 6/3/2013 4:31 PM, Bill Burke wrote: >> Damn, *bleepin* JAX-RS TCK has a test that requires DIGEST auth. When >> will Undertow in Wildfly support it? Before the next Wildfll Alpha >> would be nice. >> > > -- > Bill Burke > JBoss, a division of Red Hat > http://bill.burkecentral.com > _______________________________________________ > undertow-dev mailing list > undertow-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/undertow-dev -- Jason T. Greene WildFly Lead / JBoss EAP Platform Architect JBoss, a division of Red Hat

Hmm there must be some issue or incomplete servlet integration because our management stuff uses Digest all of the place. I'll look into it. On Jun 3, 2013, at 4:07 PM, Bill Burke <bburke(a)redhat.com&gt; wrote: > https://issues.jboss.org/browse/UNDERTOW-34 > > DONE? > > On 6/3/2013 4:31 PM, Bill Burke wrote: >> Damn, *bleepin* JAX-RS TCK has a test that requires DIGEST auth. When >> will Undertow in Wildfly support it? Before the next Wildfll Alpha >> would be nice. >> > > -- > Bill Burke > JBoss, a division of Red Hat > http://bill.burkecentral.com > _______________________________________________ > undertow-dev mailing list > undertow-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/undertow-dev -- Jason T. Greene WildFly Lead / JBoss EAP Platform Architect JBoss, a division of Red Hat _______________________________________________ undertow-dev mailing list undertow-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/undertow-dev

Hello all, The changes to enable DIGEST authentication for deployed web applications when backed by the default security realm are almost complete, had a slight build issue yesterday but testing this today. Bearing in mind that our longer term plans are to back everything with PicketLink IDM do we see any benefit in getting this to work now with JAAS security domains as well? i.e. Out of the box Digest will work in WildFly 8 as long as authentication is delegated to the realm. Regards, Darran Lofthouse. On 04/06/13 12:17, Darran Lofthouse wrote: > The servlet side is on it's way. We had some outstanding IDM > integration issues to consider and I will have a small change to > contribute to PicketBox to restore the integration with the JAAS domains. > > (The reason it is in for domain management is because the > CallbackHandlers were easier to map to) > > Regards, > Darran Lofthouse. > > > On 03/06/13 22:17, Jason Greene wrote: >> Hmm there must be some issue or incomplete servlet integration because our management stuff uses Digest all of the place. I'll look into it. >> >> On Jun 3, 2013, at 4:07 PM, Bill Burke <bburke(a)redhat.com&gt; wrote: >> >>> https://issues.jboss.org/browse/UNDERTOW-34 >>> >>> DONE? >>> >>> On 6/3/2013 4:31 PM, Bill Burke wrote: >>>> Damn, *bleepin* JAX-RS TCK has a test that requires DIGEST auth. When >>>> will Undertow in Wildfly support it? Before the next Wildfll Alpha >>>> would be nice. >>> >>> -- >>> Bill Burke >>> JBoss, a division of Red Hat >>> http://bill.burkecentral.com >>> _______________________________________________ >>> undertow-dev mailing list >>> undertow-dev(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/undertow-dev >> >> -- >> Jason T. Greene >> WildFly Lead / JBoss EAP Platform Architect >> JBoss, a division of Red Hat >> >> >> _______________________________________________ >> undertow-dev mailing list >> undertow-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/undertow-dev > _______________________________________________ > undertow-dev mailing list > undertow-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/undertow-dev _______________________________________________ undertow-dev mailing list undertow-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/undertow-dev

JAX-RS 2 TCK needs DIGEST.

On 6/11/2013 8:23 AM, Jason Greene wrote: > Hmm I guess that means we need a picketlink IDM subsystem? > > Long term we need to support domains because EAP 6.3 (next year) is likely to pull in undertow as an optional server. > > Short term I think it depends on whether or not any of the TCKs need it > > On Jun 11, 2013, at 5:18 AM, Darran Lofthouse <darran.lofthouse(a)jboss.com&gt; wrote: > >> Hello all, >> >> The changes to enable DIGEST authentication for deployed web >> applications when backed by the default security realm are almost >> complete, had a slight build issue yesterday but testing this today. >> >> Bearing in mind that our longer term plans are to back everything with >> PicketLink IDM do we see any benefit in getting this to work now with >> JAAS security domains as well? >> >> i.e. Out of the box Digest will work in WildFly 8 as long as >> authentication is delegated to the realm. >> >> Regards, >> Darran Lofthouse. >> >> >> On 04/06/13 12:17, Darran Lofthouse wrote: >>> The servlet side is on it's way. We had some outstanding IDM >>> integration issues to consider and I will have a small change to >>> contribute to PicketBox to restore the integration with the JAAS domains. >>> >>> (The reason it is in for domain management is because the >>> CallbackHandlers were easier to map to) >>> >>> Regards, >>> Darran Lofthouse. >>> >>> >>> On 03/06/13 22:17, Jason Greene wrote: >>>> Hmm there must be some issue or incomplete servlet integration because our management stuff uses Digest all of the place. I'll look into it. >>>> >>>> On Jun 3, 2013, at 4:07 PM, Bill Burke <bburke(a)redhat.com&gt; wrote: >>>> >>>>> https://issues.jboss.org/browse/UNDERTOW-34 >>>>> >>>>> DONE? >>>>> >>>>> On 6/3/2013 4:31 PM, Bill Burke wrote: >>>>>> Damn, *bleepin* JAX-RS TCK has a test that requires DIGEST auth. When >>>>>> will Undertow in Wildfly support it? Before the next Wildfll Alpha >>>>>> would be nice. >>>>> >>>>> -- >>>>> Bill Burke >>>>> JBoss, a division of Red Hat >>>>> http://bill.burkecentral.com >>>>> _______________________________________________ >>>>> undertow-dev mailing list >>>>> undertow-dev(a)lists.jboss.org >>>>> https://lists.jboss.org/mailman/listinfo/undertow-dev >>>> >>>> -- >>>> Jason T. Greene >>>> WildFly Lead / JBoss EAP Platform Architect >>>> JBoss, a division of Red Hat >>>> >>>> >>>> _______________________________________________ >>>> undertow-dev mailing list >>>> undertow-dev(a)lists.jboss.org >>>> https://lists.jboss.org/mailman/listinfo/undertow-dev >>> _______________________________________________ >>> undertow-dev mailing list >>> undertow-dev(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/undertow-dev >> _______________________________________________ >> undertow-dev mailing list >> undertow-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/undertow-dev > > _______________________________________________ > undertow-dev mailing list > undertow-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/undertow-dev >

On 6/11/2013 9:42 AM, Darran Lofthouse wrote: > On 11/06/13 13:49, Bill Burke wrote: >> JAX-RS 2 TCK needs DIGEST. > > I understand we have a couple of TCK requirements for this but do they > need a configurable JAAS domain or is the default configuration backed > by a realm and a properties file sufficient? > Probably, right now the test runs against the "other", default, domain.

On Jun 11, 2013, at 7:23 AM, Jason Greene <jgreene(a)redhat.com&gt; wrote: > Hmm I guess that means we need a picketlink IDM subsystem? We have a subsystem ready.

> Long term we need to support domains because EAP 6.3 (next year) is likely to pull in undertow as an optional server. > > Short term I think it depends on whether or not any of the TCKs need it > > On Jun 11, 2013, at 5:18 AM, Darran Lofthouse <darran.lofthouse(a)jboss.com&gt; wrote: > >> Hello all, >> >> The changes to enable DIGEST authentication for deployed web >> applications when backed by the default security realm are almost >> complete, had a slight build issue yesterday but testing this today. >> >> Bearing in mind that our longer term plans are to back everything with >> PicketLink IDM do we see any benefit in getting this to work now with >> JAAS security domains as well? >> >> i.e. Out of the box Digest will work in WildFly 8 as long as >> authentication is delegated to the realm. >> >> Regards, >> Darran Lofthouse. >> >> >> On 04/06/13 12:17, Darran Lofthouse wrote: >>> The servlet side is on it's way. We had some outstanding IDM >>> integration issues to consider and I will have a small change to >>> contribute to PicketBox to restore the integration with the JAAS domains. >>> >>> (The reason it is in for domain management is because the >>> CallbackHandlers were easier to map to) >>> >>> Regards, >>> Darran Lofthouse. >>> >>> >>> On 03/06/13 22:17, Jason Greene wrote: >>>> Hmm there must be some issue or incomplete servlet integration because our management stuff uses Digest all of the place. I'll look into it. >>>> >>>> On Jun 3, 2013, at 4:07 PM, Bill Burke <bburke(a)redhat.com&gt; wrote: >>>> >>>>> https://issues.jboss.org/browse/UNDERTOW-34 >>>>> >>>>> DONE? >>>>> >>>>> On 6/3/2013 4:31 PM, Bill Burke wrote: >>>>>> Damn, *bleepin* JAX-RS TCK has a test that requires DIGEST auth. When >>>>>> will Undertow in Wildfly support it? Before the next Wildfll Alpha >>>>>> would be nice.

On Jun 11, 2013, at 12:26 PM, Anil Saldhana <Anil.Saldhana(a)redhat.com&gt; wrote: > On 06/11/2013 07:58 AM, Anil Saldhana wrote: >> >> On Jun 11, 2013, at 7:23 AM, Jason Greene <jgreene(a)redhat.com&gt; wrote: >> >>> Hmm I guess that means we need a picketlink IDM subsystem? >> We have a subsystem ready. > https://docs.jboss.org/author/display/PLINK/PicketLink+Subsystem > Feedback welcome. I like the typed syntax, but I do not like the fact this is using JPA over JDBC. It's going to create a dependency mess (now all wildfly distributions that want to use database auth will require Java EE), and it will slow server initialization for very little gain.

Yes the intention is that the existing realms will also be replaced, this will mean that WildFly will reach the point where there is only one security system to understand.

On 6/11/2013 3:07 PM, Jason Greene wrote: > > > >On Jun 11, 2013, at 12:26 PM, Anil Saldhana&lt;Anil.Saldhana(a)redhat.com&gt; wrote: > > >> >>On 06/11/2013 07:58 AM, Anil Saldhana wrote: >>> >>> >>> >>>On Jun 11, 2013, at 7:23 AM, Jason Greene&lt;jgreene(a)redhat.com&gt; wrote: >>> >>> >>>> >>>>Hmm I guess that means we need a picketlink IDM subsystem? >>> >>>We have a subsystem ready. >> >>https://docs.jboss.org/author/display/PLINK/PicketLink+Subsystem >> >>Feedback welcome. > > > >I like the typed syntax, but I do not like the fact this is using JPA over JDBC. It's going to create a dependency mess (now all wildfly distributions that want to use database auth will require Java EE), and it will slow server initialization for very little gain. > > They have a file store.

On Jun 11, 2013, at 2:20 PM, Anil Saldhana <Anil.Saldhana(a)redhat.com&gt; wrote: > On 06/11/2013 02:17 PM, Bill Burke wrote: >> On 6/11/2013 3:07 PM, Jason Greene wrote: >>>> >>>> On Jun 11, 2013, at 12:26 PM, Anil Saldhana&lt;Anil.Saldhana(a)redhat.com&gt; wrote: >>>> >>>>>> On 06/11/2013 07:58 AM, Anil Saldhana wrote: >>>>>>>> >>>>>>>> On Jun 11, 2013, at 7:23 AM, Jason Greene&lt;jgreene(a)redhat.com&gt; wrote: >>>>>>>> >>>>>>>>>> Hmm I guess that means we need a picketlink IDM subsystem? >>>>>>>> We have a subsystem ready. >>>>>> https://docs.jboss.org/author/display/PLINK/PicketLink+Subsystem >>>>>> Feedback welcome. >>>> >>>> I like the typed syntax, but I do not like the fact this is using JPA over JDBC. It's going to create a dependency mess (now all wildfly distributions that want to use database auth will require Java EE), and it will slow server initialization for very little gain. >>>> >> They have a file store. > The Identity Store implementations can be: > a) database via jpa > b) file system (created exclusively for Wildfly) > c) ldap > d) mix and match > > Regarding Jason's concern about database authentication requiring EE api > (due to JPA) slowing server startup, that is going to be tough as the > alternative would be straight JDBC. Why is that a problem though? JDBC isn't that hard, all vendors these days support portable ANSI 92 sql, and the complexity of queries that an IDM needs to execute is small.

Hmm I guess that means we need a picketlink IDM subsystem? Long term we need to support domains because EAP 6.3 (next year) is likely to pull in undertow as an optional server.

Short term I think it depends on whether or not any of the TCKs need it On Jun 11, 2013, at 5:18 AM, Darran Lofthouse <darran.lofthouse(a)jboss.com&gt; wrote: > Hello all, > > The changes to enable DIGEST authentication for deployed web > applications when backed by the default security realm are almost > complete, had a slight build issue yesterday but testing this today. > > Bearing in mind that our longer term plans are to back everything with > PicketLink IDM do we see any benefit in getting this to work now with > JAAS security domains as well? > > i.e. Out of the box Digest will work in WildFly 8 as long as > authentication is delegated to the realm. > > Regards, > Darran Lofthouse. > > > On 04/06/13 12:17, Darran Lofthouse wrote: >> The servlet side is on it's way. We had some outstanding IDM >> integration issues to consider and I will have a small change to >> contribute to PicketBox to restore the integration with the JAAS domains. >> >> (The reason it is in for domain management is because the >> CallbackHandlers were easier to map to) >> >> Regards, >> Darran Lofthouse. >> >> >> On 03/06/13 22:17, Jason Greene wrote: >>> Hmm there must be some issue or incomplete servlet integration because our management stuff uses Digest all of the place. I'll look into it. >>> >>> On Jun 3, 2013, at 4:07 PM, Bill Burke <bburke(a)redhat.com&gt; wrote: >>> >>>> https://issues.jboss.org/browse/UNDERTOW-34 >>>> >>>> DONE? >>>> >>>> On 6/3/2013 4:31 PM, Bill Burke wrote: >>>>> Damn, *bleepin* JAX-RS TCK has a test that requires DIGEST auth. When >>>>> will Undertow in Wildfly support it? Before the next Wildfll Alpha >>>>> would be nice. >>>> >>>> -- >>>> Bill Burke >>>> JBoss, a division of Red Hat >>>> http://bill.burkecentral.com >>>> _______________________________________________ >>>> undertow-dev mailing list >>>> undertow-dev(a)lists.jboss.org >>>> https://lists.jboss.org/mailman/listinfo/undertow-dev >>> >>> -- >>> Jason T. Greene >>> WildFly Lead / JBoss EAP Platform Architect >>> JBoss, a division of Red Hat >>> >>> >>> _______________________________________________ >>> undertow-dev mailing list >>> undertow-dev(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/undertow-dev >> _______________________________________________ >> undertow-dev mailing list >> undertow-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/undertow-dev > _______________________________________________ > undertow-dev mailing list > undertow-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/undertow-dev

On Jun 11, 2013, at 5:18 AM, Darran Lofthouse <darran.lofthouse(a)jboss.com&gt; wrote: > Hello all, > > The changes to enable DIGEST authentication for deployed web > applications when backed by the default security realm are almost > complete, had a slight build issue yesterday but testing this today. > > Bearing in mind that our longer term plans are to back everything with > PicketLink IDM do we see any benefit in getting this to work now with > JAAS security domains as well? It may be good to have it as a low priority task. I am unsure though any of our users want digest backed by JAAS. We can know once we release alphas and betas, whether users want digest/JAAS.