Re: [Architecture] [Dev] Binding access token to the browser for new IAM Portal Applications

2019-10-30 Thread Johann Nallathamby
Hi Darshana, On Sat, Sep 28, 2019 at 8:29 PM Darshana Gunawardana wrote: > Hi Johann, > > On Sat, Sep 21, 2019 at 10:43 AM Johann Nallathamby > wrote: > >> Hi Thanuja, >> >> Did we consider sending the access token itself as a secure, http-only >> cookie to the browser instead of binding it to

Re: [Architecture] [Dev] Binding access token to the browser for new IAM Portal Applications

2019-10-30 Thread Johann Nallathamby
Hi Prakhash, On Mon, Sep 23, 2019 at 4:34 PM Prakhash Sivakumar wrote: > Hi Johann, > > On Sat, Sep 21, 2019 at 7:13 AM Johann Nallathamby > wrote: > >> Hi Thanuja, >> >> Did we consider sending the access token itself as a secure, http-only >> cookie to the browser instead of binding it to a

Re: [Architecture] [IAM][IS 5.10.0] REST APIs For Federated Associations Of The User

2019-10-30 Thread Tharindu Bandara
Hi all, Today we had a review meeting[1] to finalize the swagger API definition[2]. Please find the meeting notes below. *Participants:* +Thanuja Jayasinghe +Isura Karunaratne +Tharindu Bandara *Notes:* - *[GET] : /me/associations * - This API returns a list of associated users.

Re: [Architecture] [IAM][IS 5.10.0] REST APIs For Federated Associations Of The User

2019-10-30 Thread Tharindu Bandara
Hi Darshana, Why do we need the, > >- [POST] : /{user-id}/federated-associations > > The same API is available for the local account association. Now for the federated account scenario, we grant this capability to an admin user, as an admin API. We cannot provide a */me *API for this

Re: [Architecture] [IAM][IS 5.10.0] REST APIs For Federated Associations Of The User

2019-10-30 Thread Darshana Gunawardana
Hi Isura\Tharindu, Why do we need the, > > >- [POST] : /{user-id}/federated-associations > > Thanks, On Wed, Oct 30, 2019 at 10:00 AM Tharindu Bandara wrote: > Hi Isura, > > I think this API is not required. If this is supported, anyone can >> associate federated accounts without