date:20181009

Re: [Architecture] [Announce] WSO2 Product Installation Resources Released!!!

2018-10-09 Thread Youcef HILEM

Hi,
Thank you for this release.
Pattern 3 is not included in the WSO2 API Manager v2.6.0.1 -
https://github.com/wso2/kubernetes-apim/releases/tag/v2.6.0.1

Thanks
Youcef HILEM



--
Sent from: 
http://wso2-oxygen-tank.10903.n7.nabble.com/WSO2-Architecture-f62919.html
___
Architecture mailing list
Architecture@wso2.org
https://mail.wso2.org/cgi-bin/mailman/listinfo/architecture

Re: [Architecture] [Announce] WSO2 Product Installation Resources Released!!!

2018-10-09 Thread Nuwan Dias

Hi Vimukthi,

Why is it that the API Manager artifacts have a 4 digit versioning and the
others have the standard 3 digit versioning?

Thanks,
NuwanD.

On Wed, Oct 10, 2018 at 1:42 AM Vimukthi Perera  wrote:

> WSO2 Installation Experience team is pleased to announce the release of
> Ansible, AWS, Docker, Kubernetes, Puppet and Vagrant resources for WSO2
> products.
> Ansible
>
> Related artifacts:
>
>-
>
>WSO2 API Manager v2.6.0.1 -
>https://github.com/wso2/ansible-apim/releases/tag/v2.6.0.1
>-
>
>WSO2 Identity Server v5.7.0 -
>https://github.com/wso2/ansible-is/releases/tag/v5.7.0.1
>-
>
>WSO2 Stream Processor v4.3.0 -
>https://github.com/wso2/ansible-sp/releases/tag/v4.3.0.1
>-
>
>WSO2 Enterprise Integrator v6.4.0 -
>https://github.com/wso2/ansible-ei/releases/tag/v6.4.0.1
>
>
> Issues:
>
>-
>
>WSO2 API Manager - https://github.com/wso2/ansible-apim/issues
>-
>
>WSO2 Identity Server - https://github.com/wso2/ansible-is/issues
>-
>
>WSO2 Stream Processor - https://github.com/wso2/ansible-sp/issues
>-
>
>WSO2 Enterprise Integrator - https://github.com/wso2/ansible-ei/issues
>
> AWS
>
> Related artifacts:
>
>-
>
>WSO2 API Manager v2.6.0.1 -
>https://github.com/wso2/aws-apim/releases/tag/v2.6.0.1
>-
>
>WSO2 Identity Server v5.7.0 -
>https://github.com/wso2/aws-is/releases/tag/v5.7.0.1
>-
>
>WSO2 Stream Processor v4.3.0 -
>https://github.com/wso2/aws-sp/releases/tag/v4.3.0.1
>-
>
>WSO2 Enterprise Integrator v6.4.0 -
>https://github.com/wso2/aws-ei/releases/tag/v6.4.0.1
>
>
> Issues:
>
>-
>
>WSO2 API Manager - https://github.com/wso2/aws-apim/issues
>-
>
>WSO2 Identity Server - https://github.com/wso2/aws-is/issues
>-
>
>WSO2 Stream Processor - https://github.com/wso2/aws-sp/issues
>-
>
>WSO2 Enterprise Integrator - https://github.com/wso2/aws-ei/issues
>
> Docker
>
> Related artifacts:
>
>-
>
>WSO2 API Manager v2.6.0.1 -
>https://github.com/wso2/docker-apim/releases/tag/v2.6.0.1
>-
>
>WSO2 Identity Server v5.7.0 -
>https://github.com/wso2/docker-is/releases/tag/v5.7.0.1
>-
>
>WSO2 Stream Processor v4.3.0 -
>https://github.com/wso2/docker-sp/releases/tag/v4.3.0.1
>-
>
>WSO2 Enterprise Integrator v6.4.0 -
>https://github.com/wso2/docker-ei/releases/tag/v6.4.0.1
>
>
> Issues:
>
>-
>
>WSO2 API Manager - https://github.com/wso2/docker-apim/issues
>-
>
>WSO2 Identity Server - https://github.com/wso2/docker-is/issues
>-
>
>WSO2 Stream Processor - https://github.com/wso2/docker-sp/issues
>-
>
>WSO2 Enterprise Integrator - https://github.com/wso2/docker-ei/issues
>
> Kubernetes
>
> Related artifacts:
>
>-
>
>WSO2 API Manager v2.6.0.1 -
>https://github.com/wso2/kubernetes-apim/releases/tag/v2.6.0.1
>-
>
>WSO2 Identity Server v5.7.0 -
>https://github.com/wso2/kubernetes-is/releases/tag/v5.7.0.1
>-
>
>WSO2 Stream Processor v4.3.0 -
>https://github.com/wso2/kubernetes-sp/releases/tag/v4.3.0.1
>-
>
>WSO2 Enterprise Integrator v6.4.0 -
>https://github.com/wso2/kubernetes-ei/releases/tag/v6.4.0.1
>
>
> Issues:
>
>-
>
>WSO2 API Manager - https://github.com/wso2/kubernetes-apim/issues
>-
>
>WSO2 Identity Server - https://github.com/wso2/kubernetes-is/issues
>-
>
>WSO2 Stream Processor - https://github.com/wso2/kubernetes-sp/issues
>-
>
>WSO2 Enterprise Integrator -
>https://github.com/wso2/kubernetes-ei/issues
>
> Puppet
>
> Related artifacts:
>
>-
>
>WSO2 API Manager v2.6.0.1 -
>https://github.com/wso2/puppet-apim/releases/tag/v2.6.0.1
>-
>
>WSO2 Identity Server v5.7.0 -
>https://github.com/wso2/puppet-is/releases/tag/v5.7.0.1
>-
>
>WSO2 Stream Processor v4.3.0 -
>https://github.com/wso2/puppet-sp/releases/tag/v4.3.0.1
>-
>
>WSO2 Enterprise Integrator v6.4.0 -
>https://github.com/wso2/puppet-ei/releases/tag/v6.4.0.1
>
>
> Issues:
>
>-
>
>WSO2 API Manager - https://github.com/wso2/puppet-apim/issues
>-
>
>WSO2 Identity Server - https://github.com/wso2/puppet-is/issues
>-
>
>WSO2 Stream Processor - https://github.com/wso2/puppet-sp/issues
>-
>
>WSO2 Enterprise Integrator - https://github.com/wso2/puppet-ei/issues
>
> Vagrant
>
> Related artifacts:
>
>-
>
>WSO2 API Manager v2.6.0.1 -
>https://github.com/wso2/vagrant-apim/releases/tag/v2.6.0.1
>-
>
>WSO2 Identity Server v5.7.0 -
>https://github.com/wso2/vagrant-is/releases/tag/v5.7.0.1
>-
>
>WSO2 Stream Processor v4.3.0 -
>https://github.com/wso2/vagrant-sp/releases/tag/v4.3.0.1
>-
>
>WSO2 Enterprise Integrator v6.4.0 -
>https://github.com/wso2/vagrant-ei/releases/tag/v6.4.0.1
>
>
> Issues:
>
>-
>
>WSO2 API Manager - https://github.com/wso2/vagrant-apim/issues
>-
>
>WSO2 Identity Server -

Re: [Architecture] Implementing SAML ECP profile for WSO2 IS

2018-10-09 Thread Johann Nallathamby

@IAM team  why not we use the inbound framework for
this task. Then we don't need to register a new servlet, just write the
connector to process the SOAP message. The implementation will be much
simpler, and it will save effort in writing JDBC logic in storing
properties, etc.

@Harsha Thirimanna  @Pushpalanka Jayawardhana
 did a similar implementation for a customer successfully.
May be we can get some pointers from it.

@Winma Heenatigala   to overcome the consent issue, I think
we need a way to dynamically suppress the consent page. May be introduce a
new request attribute for this, which can only set by other components by
calling the API (not by the HTTP request).

Regards,
Johann.

On Fri, Sep 28, 2018 at 11:32 AM Winma Heenatigala  wrote:

> Hi all,
>
> As I mentioned in my previous email, I completed my research on the ECP
> profile and started to implement it for WSO2 identity server.
>  For testing purposes I needed an ECP enabled Service Provider and a
> client. For that I used Shibboleth SP and a Simple Bash client[1] provided
> by Shibboleth.
>
> I created a new Servlet called SAMLECPProviderServlet  to capture the
> SOAP binded SAML authentication request sent by the Enhanced Client.The
> basic auth credentials (username and password) were sent by the client to
> the IDP in the http request authorization header. Using a request wrapper,
> basic auth credentials were set to the sectoken parameter, the saml request
> was extracted from the soap envelope and forwarded the new  request to the
> SAMLSSOProviderServlet. Then the request could process in the way that the
> Request Path Authenticator works. Inside the SAMLSSOServlet , for the
> requests from the ECP clients a separate response was created where the
> saml response was enclosed in a soap envelope.
>
> However, since the client is browserless there is an issue in providing
> user consents. When I disabled SSO Consent Management from the server and
> tested the client, the client worked fine.
> Now I am working on finding a way to give the user consents without the
> browser.
>
> [1]
> https://wiki.shibboleth.net/confluence/display/SHIB2/Contributions#Contributions-simplebash
>
> Thank you!
> Winma
>
>
> On Mon, Sep 3, 2018 at 10:57 PM Winma Heenatigala  wrote:
>
>>
>> Hi all,
>>
>> I am working on a project to implement SAML ECP profile for WSO2 IS.
>> Here is a brief summary on my project progress.
>>
>> *Introduction*
>> Web Based SSO profile supports for browser based clients to SSO.In
>> contrast SAML ECP(Enhanced Clients or Proxies) profile supports non-browser
>> based clients such as desktop clients to SSO.
>>
>> *Progress*
>> I researched on existing IDPs that has SAML ECP profile implemented.From
>> my research results I found that Shibboleth is the best  among the ECP
>> enabled  IDPs. As the initial step to the project I downloaded an existing
>> ECP client and connected it with Shibboleth to examined how the ECP client
>> works.
>>
>> During the discussion held today, we discussed about how the message flow
>> happens in the ECP. During the meeting we verified that although the SP
>> sends a set of IDP s in the Response message, the ECP actually choses the
>> IDP on its own and the client itself must validates whether the choosen IDP
>> is one of the IDPs accepted by the SP. We also discussed on the importance
>> of  having RelayState.
>>
>>
>> The following documents were written on connecting the ECP client with
>> Shibboleth.
>>
>> https://medium.com/@winma.15/installation-of-shibboleth-idp-in-ubuntu-3acc57075cad
>>
>> https://medium.com/@winma.15/shibboleth-sp-installation-in-ubuntu-d284b8d850da
>>
>> https://medium.com/@winma.15/connecting-ecp-with-shibboleth-using-wso2-identity-server-user-store-540f616ee968
>>
>> Thank you!
>> Winma
>>
>>
>> *Winma Heenatigala*
>> *Trainee Software Engineer | WSO2*
>>
>> *Mobile : +94719132444*
>>
>>
>>
>>
>
> --
>
> *Winma Heenatigala*
> *Trainee Software Engineer | WSO2*
>
> *Mobile : +94719132444*
>
>
>
> --
> You received this message because you are subscribed to the Google Groups
> "WSO2 Engineering Group" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to engineering-group+unsubscr...@wso2.com.
> For more options, visit https://groups.google.com/a/wso2.com/d/optout.
>


-- 

*Johann Dilantha Nallathamby*
Senior Lead Solutions Engineer
WSO2, Inc.
lean.enterprise.middleware

Mobile: *+94 77 7776950*
LinkedIn: *http://www.linkedin.com/in/johann-nallathamby
*
Medium: *https://medium.com/@johann_nallathamby
*
Twitter: *@dj_nallaa*
___
Architecture mailing list
Architecture@wso2.org
https://mail.wso2.org/cgi-bin/mailman/listinfo/architecture

Re: [Architecture] [Announce] WSO2 Product Installation Resources Released!!!

2018-10-09 Thread Vimukthi Perera

Hi Nuwan,

On Wed, Oct 10, 2018 at 7:36 AM Nuwan Dias  wrote:

> Hi Vimukthi,
>
> Why is it that the API Manager artifacts have a 4 digit versioning and the
> others have the standard 3 digit versioning?
>
> All the producs have the 4 digit versioning. Please see the link. It was
my mistake that I have added the release tag to the Name in API Manager.
Extremely sorry.

Regards,


> Thanks,
> NuwanD.
>
> On Wed, Oct 10, 2018 at 1:42 AM Vimukthi Perera  wrote:
>
>> WSO2 Installation Experience team is pleased to announce the release of
>> Ansible, AWS, Docker, Kubernetes, Puppet and Vagrant resources for WSO2
>> products.
>> Ansible
>>
>> Related artifacts:
>>
>>-
>>
>>WSO2 API Manager v2.6.0.1 -
>>https://github.com/wso2/ansible-apim/releases/tag/v2.6.0.1
>>-
>>
>>WSO2 Identity Server v5.7.0 -
>>https://github.com/wso2/ansible-is/releases/tag/v5.7.0.1
>>-
>>
>>WSO2 Stream Processor v4.3.0 -
>>https://github.com/wso2/ansible-sp/releases/tag/v4.3.0.1
>>-
>>
>>WSO2 Enterprise Integrator v6.4.0 -
>>https://github.com/wso2/ansible-ei/releases/tag/v6.4.0.1
>>
>>
>> Issues:
>>
>>-
>>
>>WSO2 API Manager - https://github.com/wso2/ansible-apim/issues
>>-
>>
>>WSO2 Identity Server - https://github.com/wso2/ansible-is/issues
>>-
>>
>>WSO2 Stream Processor - https://github.com/wso2/ansible-sp/issues
>>-
>>
>>WSO2 Enterprise Integrator - https://github.com/wso2/ansible-ei/issues
>>
>> AWS
>>
>> Related artifacts:
>>
>>-
>>
>>WSO2 API Manager v2.6.0.1 -
>>https://github.com/wso2/aws-apim/releases/tag/v2.6.0.1
>>-
>>
>>WSO2 Identity Server v5.7.0 -
>>https://github.com/wso2/aws-is/releases/tag/v5.7.0.1
>>-
>>
>>WSO2 Stream Processor v4.3.0 -
>>https://github.com/wso2/aws-sp/releases/tag/v4.3.0.1
>>-
>>
>>WSO2 Enterprise Integrator v6.4.0 -
>>https://github.com/wso2/aws-ei/releases/tag/v6.4.0.1
>>
>>
>> Issues:
>>
>>-
>>
>>WSO2 API Manager - https://github.com/wso2/aws-apim/issues
>>-
>>
>>WSO2 Identity Server - https://github.com/wso2/aws-is/issues
>>-
>>
>>WSO2 Stream Processor - https://github.com/wso2/aws-sp/issues
>>-
>>
>>WSO2 Enterprise Integrator - https://github.com/wso2/aws-ei/issues
>>
>> Docker
>>
>> Related artifacts:
>>
>>-
>>
>>WSO2 API Manager v2.6.0.1 -
>>https://github.com/wso2/docker-apim/releases/tag/v2.6.0.1
>>-
>>
>>WSO2 Identity Server v5.7.0 -
>>https://github.com/wso2/docker-is/releases/tag/v5.7.0.1
>>-
>>
>>WSO2 Stream Processor v4.3.0 -
>>https://github.com/wso2/docker-sp/releases/tag/v4.3.0.1
>>-
>>
>>WSO2 Enterprise Integrator v6.4.0 -
>>https://github.com/wso2/docker-ei/releases/tag/v6.4.0.1
>>
>>
>> Issues:
>>
>>-
>>
>>WSO2 API Manager - https://github.com/wso2/docker-apim/issues
>>-
>>
>>WSO2 Identity Server - https://github.com/wso2/docker-is/issues
>>-
>>
>>WSO2 Stream Processor - https://github.com/wso2/docker-sp/issues
>>-
>>
>>WSO2 Enterprise Integrator - https://github.com/wso2/docker-ei/issues
>>
>> Kubernetes
>>
>> Related artifacts:
>>
>>-
>>
>>WSO2 API Manager v2.6.0.1 -
>>https://github.com/wso2/kubernetes-apim/releases/tag/v2.6.0.1
>>-
>>
>>WSO2 Identity Server v5.7.0 -
>>https://github.com/wso2/kubernetes-is/releases/tag/v5.7.0.1
>>-
>>
>>WSO2 Stream Processor v4.3.0 -
>>https://github.com/wso2/kubernetes-sp/releases/tag/v4.3.0.1
>>-
>>
>>WSO2 Enterprise Integrator v6.4.0 -
>>https://github.com/wso2/kubernetes-ei/releases/tag/v6.4.0.1
>>
>>
>> Issues:
>>
>>-
>>
>>WSO2 API Manager - https://github.com/wso2/kubernetes-apim/issues
>>-
>>
>>WSO2 Identity Server - https://github.com/wso2/kubernetes-is/issues
>>-
>>
>>WSO2 Stream Processor - https://github.com/wso2/kubernetes-sp/issues
>>-
>>
>>WSO2 Enterprise Integrator -
>>https://github.com/wso2/kubernetes-ei/issues
>>
>> Puppet
>>
>> Related artifacts:
>>
>>-
>>
>>WSO2 API Manager v2.6.0.1 -
>>https://github.com/wso2/puppet-apim/releases/tag/v2.6.0.1
>>-
>>
>>WSO2 Identity Server v5.7.0 -
>>https://github.com/wso2/puppet-is/releases/tag/v5.7.0.1
>>-
>>
>>WSO2 Stream Processor v4.3.0 -
>>https://github.com/wso2/puppet-sp/releases/tag/v4.3.0.1
>>-
>>
>>WSO2 Enterprise Integrator v6.4.0 -
>>https://github.com/wso2/puppet-ei/releases/tag/v6.4.0.1
>>
>>
>> Issues:
>>
>>-
>>
>>WSO2 API Manager - https://github.com/wso2/puppet-apim/issues
>>-
>>
>>WSO2 Identity Server - https://github.com/wso2/puppet-is/issues
>>-
>>
>>WSO2 Stream Processor - https://github.com/wso2/puppet-sp/issues
>>-
>>
>>WSO2 Enterprise Integrator - https://github.com/wso2/puppet-ei/issues
>>
>> Vagrant
>>
>> Related artifacts:
>>
>>-
>>
>>WSO2 API Manager v2.6.0.1 -
>>https://github.com/wso2/vagrant-apim/releases/tag/v2.6.0.1
>>-
>>
>>WSO2 Identity

Re: [Architecture] [Announce] WSO2 Product Installation Resources Released!!!

2018-10-09 Thread Nuwan Dias

On Wed, Oct 10, 2018 at 10:22 AM Vimukthi Perera  wrote:

> Hi Nuwan,
>
> On Wed, Oct 10, 2018 at 7:36 AM Nuwan Dias  wrote:
>
>> Hi Vimukthi,
>>
>> Why is it that the API Manager artifacts have a 4 digit versioning and
>> the others have the standard 3 digit versioning?
>>
>> All the producs have the 4 digit versioning. Please see the link. It was
> my mistake that I have added the release tag to the Name in API Manager.
> Extremely sorry.
>

Yup, I missed the tag name and only noticed the label.

>
> Regards,
>
>
>> Thanks,
>> NuwanD.
>>
>> On Wed, Oct 10, 2018 at 1:42 AM Vimukthi Perera 
>> wrote:
>>
>>> WSO2 Installation Experience team is pleased to announce the release of
>>> Ansible, AWS, Docker, Kubernetes, Puppet and Vagrant resources for WSO2
>>> products.
>>> Ansible
>>>
>>> Related artifacts:
>>>
>>>-
>>>
>>>WSO2 API Manager v2.6.0.1 -
>>>https://github.com/wso2/ansible-apim/releases/tag/v2.6.0.1
>>>-
>>>
>>>WSO2 Identity Server v5.7.0 -
>>>https://github.com/wso2/ansible-is/releases/tag/v5.7.0.1
>>>-
>>>
>>>WSO2 Stream Processor v4.3.0 -
>>>https://github.com/wso2/ansible-sp/releases/tag/v4.3.0.1
>>>-
>>>
>>>WSO2 Enterprise Integrator v6.4.0 -
>>>https://github.com/wso2/ansible-ei/releases/tag/v6.4.0.1
>>>
>>>
>>> Issues:
>>>
>>>-
>>>
>>>WSO2 API Manager - https://github.com/wso2/ansible-apim/issues
>>>-
>>>
>>>WSO2 Identity Server - https://github.com/wso2/ansible-is/issues
>>>-
>>>
>>>WSO2 Stream Processor - https://github.com/wso2/ansible-sp/issues
>>>-
>>>
>>>WSO2 Enterprise Integrator -
>>>https://github.com/wso2/ansible-ei/issues
>>>
>>> AWS
>>>
>>> Related artifacts:
>>>
>>>-
>>>
>>>WSO2 API Manager v2.6.0.1 -
>>>https://github.com/wso2/aws-apim/releases/tag/v2.6.0.1
>>>-
>>>
>>>WSO2 Identity Server v5.7.0 -
>>>https://github.com/wso2/aws-is/releases/tag/v5.7.0.1
>>>-
>>>
>>>WSO2 Stream Processor v4.3.0 -
>>>https://github.com/wso2/aws-sp/releases/tag/v4.3.0.1
>>>-
>>>
>>>WSO2 Enterprise Integrator v6.4.0 -
>>>https://github.com/wso2/aws-ei/releases/tag/v6.4.0.1
>>>
>>>
>>> Issues:
>>>
>>>-
>>>
>>>WSO2 API Manager - https://github.com/wso2/aws-apim/issues
>>>-
>>>
>>>WSO2 Identity Server - https://github.com/wso2/aws-is/issues
>>>-
>>>
>>>WSO2 Stream Processor - https://github.com/wso2/aws-sp/issues
>>>-
>>>
>>>WSO2 Enterprise Integrator - https://github.com/wso2/aws-ei/issues
>>>
>>> Docker
>>>
>>> Related artifacts:
>>>
>>>-
>>>
>>>WSO2 API Manager v2.6.0.1 -
>>>https://github.com/wso2/docker-apim/releases/tag/v2.6.0.1
>>>-
>>>
>>>WSO2 Identity Server v5.7.0 -
>>>https://github.com/wso2/docker-is/releases/tag/v5.7.0.1
>>>-
>>>
>>>WSO2 Stream Processor v4.3.0 -
>>>https://github.com/wso2/docker-sp/releases/tag/v4.3.0.1
>>>-
>>>
>>>WSO2 Enterprise Integrator v6.4.0 -
>>>https://github.com/wso2/docker-ei/releases/tag/v6.4.0.1
>>>
>>>
>>> Issues:
>>>
>>>-
>>>
>>>WSO2 API Manager - https://github.com/wso2/docker-apim/issues
>>>-
>>>
>>>WSO2 Identity Server - https://github.com/wso2/docker-is/issues
>>>-
>>>
>>>WSO2 Stream Processor - https://github.com/wso2/docker-sp/issues
>>>-
>>>
>>>WSO2 Enterprise Integrator - https://github.com/wso2/docker-ei/issues
>>>
>>> Kubernetes
>>>
>>> Related artifacts:
>>>
>>>-
>>>
>>>WSO2 API Manager v2.6.0.1 -
>>>https://github.com/wso2/kubernetes-apim/releases/tag/v2.6.0.1
>>>-
>>>
>>>WSO2 Identity Server v5.7.0 -
>>>https://github.com/wso2/kubernetes-is/releases/tag/v5.7.0.1
>>>-
>>>
>>>WSO2 Stream Processor v4.3.0 -
>>>https://github.com/wso2/kubernetes-sp/releases/tag/v4.3.0.1
>>>-
>>>
>>>WSO2 Enterprise Integrator v6.4.0 -
>>>https://github.com/wso2/kubernetes-ei/releases/tag/v6.4.0.1
>>>
>>>
>>> Issues:
>>>
>>>-
>>>
>>>WSO2 API Manager - https://github.com/wso2/kubernetes-apim/issues
>>>-
>>>
>>>WSO2 Identity Server - https://github.com/wso2/kubernetes-is/issues
>>>-
>>>
>>>WSO2 Stream Processor - https://github.com/wso2/kubernetes-sp/issues
>>>-
>>>
>>>WSO2 Enterprise Integrator -
>>>https://github.com/wso2/kubernetes-ei/issues
>>>
>>> Puppet
>>>
>>> Related artifacts:
>>>
>>>-
>>>
>>>WSO2 API Manager v2.6.0.1 -
>>>https://github.com/wso2/puppet-apim/releases/tag/v2.6.0.1
>>>-
>>>
>>>WSO2 Identity Server v5.7.0 -
>>>https://github.com/wso2/puppet-is/releases/tag/v5.7.0.1
>>>-
>>>
>>>WSO2 Stream Processor v4.3.0 -
>>>https://github.com/wso2/puppet-sp/releases/tag/v4.3.0.1
>>>-
>>>
>>>WSO2 Enterprise Integrator v6.4.0 -
>>>https://github.com/wso2/puppet-ei/releases/tag/v6.4.0.1
>>>
>>>
>>> Issues:
>>>
>>>-
>>>
>>>WSO2 API Manager - https://github.com/wso2/puppet-apim/issues
>>>-
>>>
>>>WSO2 Identity Server - https://github.com/wso2/puppet-is/issues
>>>-
>>>
>>>

Re: [Architecture] [APIM][300][Store] Feature to change password of an user

2018-10-09 Thread Johann Nallathamby

Hi Vithursa,

On Sun, Oct 7, 2018 at 11:29 AM Dulanja Liyanage  wrote:

> On Thu, Sep 6, 2018 at 5:30 PM, Vithursa Mahendrarajah 
> wrote:
>
>> Hi Dulanja,
>>
>> Please find my answers in-line:
>>
>> On Thu, Sep 6, 2018 at 10:45 AM Dulanja Liyanage 
>> wrote:
>>
>>> Hi Vithursa,
>>>
>>> Few questions:
>>>
>>> 1. What happens when the user enters a wrong username? As a security
>>> best practice, the returned message must not indicate that the username is
>>> invalid. Because, a rogue user can determine valid usernames of the system
>>> by using this feature (i.e. username harvesting). Therefore, for both valid
>>> and invalid usernames, system should show a message similar to "A password
>>> reset email has been sent to the registered email address".
>>>
>>
>> As per current implementation, it returns message to indicate that the
>> user name is invalid. I am agreeing with the point you mentioned, but on
>> the other hand, it will not give a proper guide in situation like when user
>> mistakenly enters their user name wrong.  I checked this feature in other
>> accounts as well which indicate whether the user name is valid or not.
>>
>
According to Forrester's CIAM security maturity model as well, this is the
recommended behavior for the same reason Dulanja has pointed out. I have
sent a mail on this in [1]. See point # 12.

I will paste the relevant content here to make it easier. Ignore the color
encoding, red are the ones not in IS right now and green are the ones that
are there.

a) Message displayed to the user should looks like following, and not
> reveal if the user was actually found in the system.
> "If this email address refers to a valid user, we will send instructions
> to the email address on how to recover the password.” Alternatively, you
> can show the user a partial view of the email address (i.e.,“a
> r...@hotmail.com”) and ask the user to correctly complete it before allowing
> them to proceed.
>
> b) Having a captcha or a simple arithmetic test before updating the
> password.
>
> c) Sending email and SMS notifications when tasks begin and end.
>

> Social media and similar sites might prioritize UX over security and opt
> to inform the user whether the username is valid or not. But we need to
> consider other organizations, for example financial institutes like banks, who
> maintain strict security policies that expect to avoid username
> enumeration. There's a good reason why OWASP has recommendations on
> username enumeration (Refer "Authentication and Error Messages" in [1].
> Also refer this stackexchange discussion at [2]. There are numerous other
> resources on the web).
>
> The ideal solution to this problem of UX vs. security would be to make
> this behaviour configurable. Have a config that governs the message
> returned from the API level. If making this configurable is too much
> hassle, then give priority to security in this case. Because, if we give
> priority to UX, then in future a customer might request a patch to make the
> messages generic due to their security policies. I'm telling this because
> that has already happened in the case of Identity Server.
>

IMO, we don't even need a property to control this behavior. Any serious
business will accept this if we reason it out why we've designed it in this
way. The ones who really want to get rid of it are less serious about their
business and WSO2 doesn't have many of those ones. Worst case they can
customize the UI for themselves.

[1] "[IAM] Complying with Forrester’s Customer IAM Security Maturity
Assessment Model" in strategy-gr...@wso2.com

Regards,
Johann.


>
> An additional security measure that needs to be in place for password
> reset is a mechanism to avoid automated bots trying usernames and flooding
> the system. Since password reset is not a frequent task, user will not get
> much inconvenienced. Please consider that as well.
>
> [1] https://www.owasp.org/index.php/Authentication_Cheat_Sheet
> [2]
> https://security.stackexchange.com/questions/98082/forgot-password-and-revealing-whether-account-exists
>
>>
>>> 2. How are you storing the confirmation codes against the user? Is it as
>>> a claim of the user or in the registry?
>>>
>>
>> I hoped to store it as a claim of user (admin has access to confirmation
>> code).
>>
>> 3. What is the validity of the confirmation code and how you plan to
>>> cleanup the expired/used codes?
>>>
>>
>> We can define it to be a day and store generated time along with the
>> code.  Regarding the cleanup of used codes, once the user clicks on the
>> link, gets verified and resets password. we can remove the confirmation
>> code after successful reset. It won't be valid thereafter.
>> Regarding the cleanup of expired codes,we do not need to remove expired
>> codes as there will be one code per user, validating expiry of confirmation
>> code would be enough. If it is necessary, we can do it by weekly scheduled
>> task.
>>
>> Also, to verify the confirmation code, we can

[Architecture] [Announce] The WSO2 Enterprise Integrator 6.4.0 Released!

2018-10-09 Thread Thishani Lucas

*Hi All,The WSO2 Integration team is pleased to announce the release of
version 6.4.0 of the WSO2 Enterprise Integrator (WSO2 EI). WSO2 EI is an
open source integration product with a low-footprint, that is intuitive,
and cloud and container-native. It enables enterprise integration experts
to easily build, scale, and secure sophisticated integration solutions to
accomplish digital agility. Unlike other integration products, WSO2 EI is
unified and contains an integration runtime, message broker, business
process model, analytics, and visual tooling capabilities that do not
require any assembly.  Being open source, WSO2 EI, enables greater
extensibility and platform-independence. The low-footprint allows
enterprises to integrate faster. This saves money and time while lowering
the technological risks. Installation and Running Downloading, Installing
and Running the Integrator*





























*Using Installer 1. From our product page https://wso2.com/integration/
, download the platform specific product
installer.2. Run the installer.3. Once finished, the product will be
installed and ready for use.4. Point your browser to the URL
https://localhost:9443/carbon .5. Use
"admin", "admin" as username and password to log in as an admin user.Using
Binary 1. Download the wso2ei-6.4.0.zip file from our product page
https://wso2.com/integration/ .2. Extract
the downloaded wso2ei-6.4.0.zip file.3. Go to the bin directory in the
extracted folder.4. Run integrator.sh or integrator.bat as appropriate.5.
Point your browser to the URL https://localhost:9443/carbon
.6. Use "admin", "admin" as username and
password to log in as an admin user.7. If you need to start the OSGi
console with the server, use the property -DosgiConsole when starting the
server.Running other Runtimes Individually (Analytics, Broker,
Business-Process, MSF4J and micro-Integrator)Using Installer 1. To run the
analytics profile, open new terminal and run: `$ wso2ei-6.4.0-analytics`2.
To run the broker profile, open new terminal and run: `$
wso2ei-6.4.0-broker`3. To run the business process profile, open new
terminal and run:`$ wso2ei-6.4.0-business-process`4. To run the micro
integrator profile, open new terminal and run: `$
wso2ei-6.4.0-micro-integrator`5. To run the MSF4J profile, open new
terminal and run:`$ wso2ei-6.4.0-msf4j`Using Binary 1. Extract
wso2ei-6.4.0.zip and go to the extracted directory.2. Go to
wso2ei-6.4.0/wso2 directory.3. Go to appropriate runtime directory
(analytics/broker/business-process/msf4j/ micro-integrator) /bin.4. Execute
wso2server.sh or wso2server.bat. (carbon.sh or carbon.bat for msf4j
profile)5. Access the URL related to the required runtime. (For example,
use https://localhost:9445/carbon  for the
business-process runtime)New features for this releaseDocker Support for
the Micro IntegratorA pre-configured docker file to build a docker image of
the Micro Integrator with a carbon app is included with the Micro
Integrator profile. You can simply copy the unzip distribution of WSO2 EI
to the wso2ei-6.4.0/wso2/micro-integrator/dockerfiles/files directory and
the carbon apps to the
 wso2ei-6.4.0/wso2/micro-integrator/dockerfiles/files/carbonapps directory,
and execute the command ‘docker build . -t micro-integrator:6.4.0’ to build
the image. To read more on this, see Running the Micro Integrator on Docker
.Faster
Analytics Engine with Low Resource RequirementsThe WSO2 EI Analytics
profile which was based on WSO2 Data Analytics Server (WSO2 DAS) is
replaced with the latest version of WSO2 Stream Processor (WSO2 SP). This
is faster and requires low resources than WSO2 DAS. To read more on this,
see Working with Analytics
.REST Admin API
for Micro IntegratorA REST admin API is introduced to the Micro Integrator
profile to list down the proxy services and APIs deployed in the profile.
The REST admin API is bundled as a carbon app and deployed in the Micro
Integrator profile itself. After the profile start-up, call the following
URLs to list down the deployed proxy services and APIs, respectively. -
http://:8290/wso2-micro-integrator/proxy-services-
http://:8290/wso2-micro-integrator/apis Improvements to EI
ToolingWSO2 EI Tooling 6.4.0 is released on top of Eclipse Oxygen which is
the latest Eclipse release. This is released with the latest Tooling Kernel
and includes fixes for major usability and stability issues. WSO2 EI Tooing
6.4.0 is faster, better, and much easier for developers to create and
manage artifacts.Key Features of WSO2 EI - Proxy services - facilitating
synchronous/asynchronous transport, interface (WSDL/Schema/Policy), message
format (SOAP 1.1/1.2,

[Architecture] [Announce] WSO2 Product Installation Resources Released!!!

2018-10-09 Thread Vimukthi Perera

WSO2 Installation Experience team is pleased to announce the release of
Ansible, AWS, Docker, Kubernetes, Puppet and Vagrant resources for WSO2
products.
Ansible

Related artifacts:

   -

   WSO2 API Manager v2.6.0.1 -
   https://github.com/wso2/ansible-apim/releases/tag/v2.6.0.1
   -

   WSO2 Identity Server v5.7.0 -
   https://github.com/wso2/ansible-is/releases/tag/v5.7.0.1
   -

   WSO2 Stream Processor v4.3.0 -
   https://github.com/wso2/ansible-sp/releases/tag/v4.3.0.1
   -

   WSO2 Enterprise Integrator v6.4.0 -
   https://github.com/wso2/ansible-ei/releases/tag/v6.4.0.1


Issues:

   -

   WSO2 API Manager - https://github.com/wso2/ansible-apim/issues
   -

   WSO2 Identity Server - https://github.com/wso2/ansible-is/issues
   -

   WSO2 Stream Processor - https://github.com/wso2/ansible-sp/issues
   -

   WSO2 Enterprise Integrator - https://github.com/wso2/ansible-ei/issues

AWS

Related artifacts:

   -

   WSO2 API Manager v2.6.0.1 -
   https://github.com/wso2/aws-apim/releases/tag/v2.6.0.1
   -

   WSO2 Identity Server v5.7.0 -
   https://github.com/wso2/aws-is/releases/tag/v5.7.0.1
   -

   WSO2 Stream Processor v4.3.0 -
   https://github.com/wso2/aws-sp/releases/tag/v4.3.0.1
   -

   WSO2 Enterprise Integrator v6.4.0 -
   https://github.com/wso2/aws-ei/releases/tag/v6.4.0.1


Issues:

   -

   WSO2 API Manager - https://github.com/wso2/aws-apim/issues
   -

   WSO2 Identity Server - https://github.com/wso2/aws-is/issues
   -

   WSO2 Stream Processor - https://github.com/wso2/aws-sp/issues
   -

   WSO2 Enterprise Integrator - https://github.com/wso2/aws-ei/issues

Docker

Related artifacts:

   -

   WSO2 API Manager v2.6.0.1 -
   https://github.com/wso2/docker-apim/releases/tag/v2.6.0.1
   -

   WSO2 Identity Server v5.7.0 -
   https://github.com/wso2/docker-is/releases/tag/v5.7.0.1
   -

   WSO2 Stream Processor v4.3.0 -
   https://github.com/wso2/docker-sp/releases/tag/v4.3.0.1
   -

   WSO2 Enterprise Integrator v6.4.0 -
   https://github.com/wso2/docker-ei/releases/tag/v6.4.0.1


Issues:

   -

   WSO2 API Manager - https://github.com/wso2/docker-apim/issues
   -

   WSO2 Identity Server - https://github.com/wso2/docker-is/issues
   -

   WSO2 Stream Processor - https://github.com/wso2/docker-sp/issues
   -

   WSO2 Enterprise Integrator - https://github.com/wso2/docker-ei/issues

Kubernetes

Related artifacts:

   -

   WSO2 API Manager v2.6.0.1 -
   https://github.com/wso2/kubernetes-apim/releases/tag/v2.6.0.1
   -

   WSO2 Identity Server v5.7.0 -
   https://github.com/wso2/kubernetes-is/releases/tag/v5.7.0.1
   -

   WSO2 Stream Processor v4.3.0 -
   https://github.com/wso2/kubernetes-sp/releases/tag/v4.3.0.1
   -

   WSO2 Enterprise Integrator v6.4.0 -
   https://github.com/wso2/kubernetes-ei/releases/tag/v6.4.0.1


Issues:

   -

   WSO2 API Manager - https://github.com/wso2/kubernetes-apim/issues
   -

   WSO2 Identity Server - https://github.com/wso2/kubernetes-is/issues
   -

   WSO2 Stream Processor - https://github.com/wso2/kubernetes-sp/issues
   -

   WSO2 Enterprise Integrator - https://github.com/wso2/kubernetes-ei/issues

Puppet

Related artifacts:

   -

   WSO2 API Manager v2.6.0.1 -
   https://github.com/wso2/puppet-apim/releases/tag/v2.6.0.1
   -

   WSO2 Identity Server v5.7.0 -
   https://github.com/wso2/puppet-is/releases/tag/v5.7.0.1
   -

   WSO2 Stream Processor v4.3.0 -
   https://github.com/wso2/puppet-sp/releases/tag/v4.3.0.1
   -

   WSO2 Enterprise Integrator v6.4.0 -
   https://github.com/wso2/puppet-ei/releases/tag/v6.4.0.1


Issues:

   -

   WSO2 API Manager - https://github.com/wso2/puppet-apim/issues
   -

   WSO2 Identity Server - https://github.com/wso2/puppet-is/issues
   -

   WSO2 Stream Processor - https://github.com/wso2/puppet-sp/issues
   -

   WSO2 Enterprise Integrator - https://github.com/wso2/puppet-ei/issues

Vagrant

Related artifacts:

   -

   WSO2 API Manager v2.6.0.1 -
   https://github.com/wso2/vagrant-apim/releases/tag/v2.6.0.1
   -

   WSO2 Identity Server v5.7.0 -
   https://github.com/wso2/vagrant-is/releases/tag/v5.7.0.1
   -

   WSO2 Stream Processor v4.3.0 -
   https://github.com/wso2/vagrant-sp/releases/tag/v4.3.0.1
   -

   WSO2 Enterprise Integrator v6.4.0 -
   https://github.com/wso2/vagrant-ei/releases/tag/v6.4.0.1


Issues:

   -

   WSO2 API Manager - https://github.com/wso2/vagrant-apim/issues
   -

   WSO2 Identity Server - https://github.com/wso2/vagrant-is/issues
   -

   WSO2 Stream Processor - https://github.com/wso2/vagrant-sp/issues
   -

   WSO2 Enterprise Integrator - https://github.com/wso2/vagrant-ei/issues


How You Can Contribute

Join our mailing list and correspond with the developers directly.

Developer List: d...@wso2.org

User List: u...@wso2.org

Reporting Issues

We encourage you to report issues and documentation faults regarding
WSO2 Ansible,
AWS, Docker, Kubernetes, Puppet and Vagrant resource through respective
repositories by creating issues.

Thank you!

WSO2 Installation Experience

Re: [Architecture] [Announce] WSO2 Product Installation Resources Released!!!

Re: [Architecture] [Announce] WSO2 Product Installation Resources Released!!!

Re: [Architecture] Implementing SAML ECP profile for WSO2 IS

Re: [Architecture] [Announce] WSO2 Product Installation Resources Released!!!

Re: [Architecture] [Announce] WSO2 Product Installation Resources Released!!!

Re: [Architecture] [APIM][300][Store] Feature to change password of an user

[Architecture] [Announce] The WSO2 Enterprise Integrator 6.4.0 Released!

[Architecture] [Announce] WSO2 Product Installation Resources Released!!!

8 matches

Site Navigation

Mail list logo

Footer information