Re: Implementing Microprofile JWT

No, CDI-2 doesn't add that much we would need. The problem is really that IF we package this, then TomEE could _not_ run in Java7 anymore. Which is still the official pre-requisit for EE7 servers (Java8 is just optional). LieGrue, strub > Am 15.02.2018 um 14:05 schrieb Romain Manni-Bucau : >

Re: Implementing Microprofile JWT

2018-02-15 13:30 GMT+01:00 Rudy De Busscher : > > > > Can we assume Java8 for this attempt? > > Oh and more important: Will the integration work based on TomEE7 (would > > require Java7) or the upcoming TomEE8? > > I'd say we should focus on TomEE8 and Java8 > > > MicroProfile specs are defined in

Re: Implementing Microprofile JWT

> > Can we assume Java8 for this attempt? > Oh and more important: Will the integration work based on TomEE7 (would > require Java7) or the upcoming TomEE8? > I'd say we should focus on TomEE8 and Java8 MicroProfile specs are defined in Java 8, so TomEE8 seems the only option. regards Rudy On

Re: Implementing Microprofile JWT

> Am 15.02.2018 um 07:50 schrieb Romain Manni-Bucau : > > Le 15 févr. 2018 01:35, "David Blevins" a écrit : > > I understand there's kind of a meta conversation going on that all roads > and discussions need to end at there being something to put a > microprofile-jwt git repo. I wave a white

Re: Implementing Microprofile JWT

Le 15 févr. 2018 01:35, "David Blevins" a écrit : I understand there's kind of a meta conversation going on that all roads and discussions need to end at there being something to put a microprofile-jwt git repo. I wave a white flag and gently request a respite from that as I don't want everythin

Re: Implementing Microprofile JWT

I understand there's kind of a meta conversation going on that all roads and discussions need to end at there being something to put a microprofile-jwt git repo. I wave a white flag and gently request a respite from that as I don't want everything I write to be read as if I'm attempting to stee

Re: Implementing Microprofile JWT

We propagate to EJB the principal so we should have it working without a lot - never said "no" - of effort for all synchronous cases. I'm pretty sure it will be broken for the async - but natural user - flow (@Suspended or plain AsyncContext, EE Concurrency utilities will not work for servlet case

Re: Implementing Microprofile JWT

> On Feb 14, 2018, at 11:34 AM, Romain Manni-Bucau > wrote: > > If jsonp it can be @appscoped too technically I was definitely advocating for that and AppScoped was supported, but it got axed at the finish line the week before the 1.0 spec went final. We decided to cut scope (pun intended) t

Re: Implementing Microprofile JWT

If you want to have JWT working for ALL EE things then it's not MicroProfile-JWT anymore, isn't? It would be much more. Not bad of course, but still way beyond of what MicroProfile-JWT defines. Anyway, I asked myself how to 'slice' this the right way. And imo the natural interfaces would be som

Re: Implementing Microprofile JWT

Le 14 févr. 2018 19:47, "David Blevins" a écrit : > On Feb 14, 2018, at 9:01 AM, Romain Manni-Bucau wrote: > > interesting thing is JsonWebToken principal will not work with CDI by > design - due to proxies - so must use another unwrapped layer to get the > principal like jaspic or servlet layer

Re: Implementing Microprofile JWT

> On Feb 14, 2018, at 9:01 AM, Romain Manni-Bucau wrote: > > interesting thing is JsonWebToken principal will not work with CDI by > design - due to proxies - so must use another unwrapped layer to get the > principal like jaspic or servlet layers which will not require any change > in any of our

Re: Implementing Microprofile JWT

> On Feb 14, 2018, at 8:49 AM, Mark Struberg wrote: > >> >> I think one of the things we'll find most puzzling about how to do the >> integration is that the Tomcat flavor of this is written assuming the users >> exist in a Tomcat Realm. The whole point of JWT is that they do not and the >>

Re: Implementing Microprofile JWT

think we support jaspic at some point - at least javaee 7 tests were supposed to cover it, even for EJB while there is a request - not for @Timeout typically but this is out of scope for microprofile. interesting thing is JsonWebToken principal will not work with CDI by design - due to proxies - s

Re: Implementing Microprofile JWT

Thanks David, I've started to look into our SecurityService interface as well. It would need to evolve at some point. The couple username + password is not the best to support many authentication mechanisms. The realm interface in Tomcat is not the best either because it has like 5 or 6 strongly

Re: Implementing Microprofile JWT

> > I think one of the things we'll find most puzzling about how to do the > integration is that the Tomcat flavor of this is written assuming the users > exist in a Tomcat Realm. The whole point of JWT is that they do not and the > server has no such state. > > https://github.com/apache/tome

Re: Implementing Microprofile JWT

> On Feb 13, 2018, at 3:43 AM, John D. Ament wrote: > > The JWT spec is weird, because it defined non MP runtime behavior in addition > to MP runtime behavior; so there may be more integration work in a fuller app > server like TomEE. Agreed. I'd describe the MicorProfile JWT spec as almost a

Re: Implementing Microprofile JWT

project. > I asked for his permisson to forward, so here we go. > Txs Mike for the additional input! > > LieGrue, > strub > > >> >> Von: Mike Kienenberger >> Betreff: Aw: Implementing Microprofile JWT >> Datum: 13. Februar 2018 um 16:08:24 MEZ >

Re: Implementing Microprofile JWT

> > I'm more worried about the authorisation and authentication interface. I used JASPIC as it seemed to most natural way to feed the EE system with authorisation and authentication into the system. But probably need deep integration with server code because otherwise, the JWT authentication mec

Fwd: Implementing Microprofile JWT

Hi folks! Mike had a grat response on the imact and potential downsides of becoming an Umbrella project. I asked for his permisson to forward, so here we go. Txs Mike for the additional input! LieGrue, strub > > Von: Mike Kienenberger > Betreff: Aw: Implementing Microprofile JWT &g

Re: Implementing Microprofile JWT

Too early for me to figure this out. Really need to get an example working so that I can think of a cleaner design. -- Jean-Louis Monteiro http://twitter.com/jlouismonteiro http://www.tomitribe.com On Tue, Feb 13, 2018 at 4:58 PM, Mark Struberg wrote: > Might do as well. > But the JSON-P part i

Re: Implementing Microprofile JWT

Might do as well. But the JSON-P part is really well abstracted. So this is easy to plug-in. I'm more worried about the authorisation and authentication interface. Anything EE security seems way too heavyweight for me. This might work out for TomEE, but would kill it's use in any more lightweig

Re: Implementing Microprofile JWT

I was also thinking about a Johnzon extension (kinda) -- Jean-Louis Monteiro http://twitter.com/jlouismonteiro http://www.tomitribe.com On Tue, Feb 13, 2018 at 3:53 PM, Mark Struberg wrote: > I know JWT a bit and I wonder whether doing the signing part is just a bit > of Json (JSON-P) + commons

Re: Implementing Microprofile JWT

I know JWT a bit and I wonder whether doing the signing part is just a bit of Json (JSON-P) + commons-crypto? After all JWT is especially designed to be lightweight and straight forward. LieGrue, strub > Am 13.02.2018 um 15:33 schrieb Romain Manni-Bucau : > > 2018-02-13 15:28 GMT+01:00 Jean-L

Re: Implementing Microprofile JWT

2018-02-13 15:28 GMT+01:00 Jean-Louis Monteiro : > Thanks for the feedback Jon. > > I had a couple of exchanges with Rudy which is happy to contribute some > code as well. > From what I have understood and seen, most of the code is integration code > and there is at least from my current knowledge

Re: Implementing Microprofile JWT

Thanks for the feedback Jon. I had a couple of exchanges with Rudy which is happy to contribute some code as well. >From what I have understood and seen, most of the code is integration code and there is at least from my current knowledge a little bit of code to put together in a reusable manner i

Re: Implementing Microprofile JWT

2018-02-13 12:43 GMT+01:00 John D. Ament : > > > On 2018/02/12 20:42:58, Jonathan Gallimore > wrote: > > On Mon, Feb 12, 2018 at 8:20 PM, Romain Manni-Bucau < > rmannibu...@gmail.com> > > wrote: > > > > > No Andy, as mentionned in the discussion Geronimo hosts the > microprofile > > > @asf. This

Re: Implementing Microprofile JWT

On 2018/02/12 20:42:58, Jonathan Gallimore wrote: > On Mon, Feb 12, 2018 at 8:20 PM, Romain Manni-Bucau > wrote: > > > No Andy, as mentionned in the discussion Geronimo hosts the microprofile > > @asf. This is why jwt should probably be done in geronimo which is the asf > > ee related projec

Re: Implementing Microprofile JWT

> On Feb 12, 2018, at 1:45 PM, Mark Struberg wrote: > > It seems we all got hit on the wrong foot in some ways. > Why not take the chance to learn something and make it better. > For me: I should have asked what this is about instead of assuming something > which looked clear from my pov. Seems

Re: Implementing Microprofile JWT

It seems we all got hit on the wrong foot in some ways. Why not take the chance to learn something and make it better. For me: I should have asked what this is about instead of assuming something which looked clear from my pov. Seems I was wrong. @Andy what about creating a ticket on the issue tr

Re: Implementing Microprofile JWT

I find the discussions and working on TomEE have become tedious, contentious, unrewarding and fruitless in order to continue working on the project in my free time. That'd be why I've not contributed recently, but not speaking for others of course. I wasn't actually trying to start any implemen

Re: Implementing Microprofile JWT

I'll apologize for not doing more on TomEE 8. But that is simply a time thing, and not a Tomitribe thing. I still owe a fixed build on master (which I am working on tonight) and forward porting the latest master patches to the EE8 branch. That work is not forgotten, just has to be fitted in with ev

Re: Implementing Microprofile JWT

Well, let's be a bit more specific. a.) No, Geronimo of course does not have have a monopoly on creating microprofile implementations at the ASF. Nor does TomEE. Geronimo a good place for reusable JavaEE parts though. And G started to implement Microprofile specifications 2 years ago already. The

Re: Implementing Microprofile JWT

On Mon, Feb 12, 2018 at 8:20 PM, Romain Manni-Bucau wrote: > No Andy, as mentionned in the discussion Geronimo hosts the microprofile > @asf. This is why jwt should probably be done in geronimo which is the asf > ee related project umbrella. > I don't recall that discussion. Where did it take pl

Re: Implementing Microprofile JWT

Any issues let me know and I'll fix tomorrow - not staying up for the buildbot. On 12/02/18 21:14, Andy Gumbrecht wrote: "Parts of the components skeletons you just created" They're just logically named empty modules for pending work? On 12/02/18 20:42, Mark Struberg wrote: And what's tha

Re: Implementing Microprofile JWT

Reverted. On 12/02/18 21:14, Andy Gumbrecht wrote: "Parts of the components skeletons you just created" They're just logically named empty modules for pending work? On 12/02/18 20:42, Mark Struberg wrote: And what's that for? Is there any behind the scene stuff going on at Tomitribe or ca

Re: Implementing Microprofile JWT

No Andy, as mentionned in the discussion Geronimo hosts the microprofile @asf. This is why jwt should probably be done in geronimo which is the asf ee related project umbrella. I understand it is not the most convenient for tomitribe which probably perfers to own the full project(s) but as a found

Re: Implementing Microprofile JWT

"Parts of the components skeletons you just created" They're just logically named empty modules for pending work? On 12/02/18 20:42, Mark Struberg wrote: And what's that for? Is there any behind the scene stuff going on at Tomitribe or can we finally get back to discussing such things on the

Re: Implementing Microprofile JWT

And what's that for? Is there any behind the scene stuff going on at Tomitribe or can we finally get back to discussing such things on the Apache lists? Before we go on I'd would first finish the discussion how we want to turn TomEE into an umbrella project or how the structure would be. And whet

Re: Implementing Microprofile JWT

Added project stubs: https://github.com/apache/tomee/tree/master/microprofile Andy. On 05/02/18 11:17, Jean-Louis Monteiro wrote: Hi, Ok thanks guys. @Rudy, you are most welcome :) -- Jean-Louis Monteiro http://twitter.com/jlouismonteiro http://www.tomitribe.com On Fri, Feb 2, 2018 at 11:3

Re: Implementing Microprofile JWT

Hi, Ok thanks guys. @Rudy, you are most welcome :) -- Jean-Louis Monteiro http://twitter.com/jlouismonteiro http://www.tomitribe.com On Fri, Feb 2, 2018 at 11:39 AM, Rudy De Busscher wrote: > I think it is a very important spec, also for non-microprofile > implementations as it can enhance the

Re: Implementing Microprofile JWT

To clarify this even further: The Geronimo Server is now officially dead. But the Geronimo project is not. It alredy contains quite a few modular parts which are reused in many ASF projects and also outside. Examples is the geronimo-transaction-manager, geronimo-javamail, geronimo-config, xbean

Re: Implementing Microprofile JWT

I think it is a very important spec, also for non-microprofile implementations as it can enhance the interoperability of all servers. I'm also very interested in the implementation (and want to help a bit with it also :) ) regards Rudy On 2 February 2018 at 11:23, Mark Struberg wrote: > To c

Re: Implementing Microprofile JWT

2018-02-02 11:05 GMT+01:00 Otávio Gonçalves de Santana < osant...@tomitribe.com>: > Guys, I have a question: > > Why not a project to each implementation? > this is the case but geronimo is used as an umbrella project. > This way I can use just a specific if I want also. > exactly the goal and

Re: Implementing Microprofile JWT

Guys, I have a question: Why not a project to each implementation? This way I can use just a specific if I want also. On Fri, Feb 2, 2018 at 7:44 AM, Romain Manni-Bucau wrote: > Hi JL, > > Microprofile apache effort is hosted in geronimo and John already spoke > about it I think. Would probably

Re: Implementing Microprofile JWT

Hi JL, Microprofile apache effort is hosted in geronimo and John already spoke about it I think. Would probably saner to keep it all at the same place for the foundation. Romain Manni-Bucau @rmannibucau | Blog | Old Blog

Implementing Microprofile JWT

Hi all, I was wondering if we could have the Microprofile JWT implemented in TomEE. What do you think? I was reading the spec and I'd like to contribute that in. Jean-Louis -- Jean-Louis Monteiro http://twitter.com/jlouismonteiro http://www.tomitribe.com