Re: Implementing Microprofile JWT

2018-02-15 Thread Mark Struberg
No, CDI-2 doesn't add that much we would need. The problem is really that IF we package this, then TomEE could _not_ run in Java7 anymore. Which is still the official pre-requisit for EE7 servers (Java8 is just optional). LieGrue, strub > Am 15.02.2018 um 14:05 schrieb Romain Manni-Bucau

Re: Implementing Microprofile JWT

2018-02-15 Thread Romain Manni-Bucau
2018-02-15 13:30 GMT+01:00 Rudy De Busscher : > > > > Can we assume Java8 for this attempt? > > Oh and more important: Will the integration work based on TomEE7 (would > > require Java7) or the upcoming TomEE8? > > I'd say we should focus on TomEE8 and Java8 > > >

Re: Implementing Microprofile JWT

2018-02-15 Thread Rudy De Busscher
> > Can we assume Java8 for this attempt? > Oh and more important: Will the integration work based on TomEE7 (would > require Java7) or the upcoming TomEE8? > I'd say we should focus on TomEE8 and Java8 MicroProfile specs are defined in Java 8, so TomEE8 seems the only option. regards Rudy On

Re: Implementing Microprofile JWT

2018-02-15 Thread Mark Struberg
> Am 15.02.2018 um 07:50 schrieb Romain Manni-Bucau : > > Le 15 févr. 2018 01:35, "David Blevins" a écrit : > > I understand there's kind of a meta conversation going on that all roads > and discussions need to end at there being something to

Re: Implementing Microprofile JWT

2018-02-14 Thread Romain Manni-Bucau
Le 15 févr. 2018 01:35, "David Blevins" a écrit : I understand there's kind of a meta conversation going on that all roads and discussions need to end at there being something to put a microprofile-jwt git repo. I wave a white flag and gently request a respite from that

Re: Implementing Microprofile JWT

2018-02-14 Thread David Blevins
I understand there's kind of a meta conversation going on that all roads and discussions need to end at there being something to put a microprofile-jwt git repo. I wave a white flag and gently request a respite from that as I don't want everything I write to be read as if I'm attempting to

Re: Implementing Microprofile JWT

2018-02-14 Thread David Blevins
> On Feb 14, 2018, at 11:34 AM, Romain Manni-Bucau > wrote: > > If jsonp it can be @appscoped too technically I was definitely advocating for that and AppScoped was supported, but it got axed at the finish line the week before the 1.0 spec went final. We decided to

Re: Implementing Microprofile JWT

2018-02-14 Thread Mark Struberg
If you want to have JWT working for ALL EE things then it's not MicroProfile-JWT anymore, isn't? It would be much more. Not bad of course, but still way beyond of what MicroProfile-JWT defines. Anyway, I asked myself how to 'slice' this the right way. And imo the natural interfaces would be

Re: Implementing Microprofile JWT

2018-02-14 Thread Romain Manni-Bucau
Le 14 févr. 2018 19:47, "David Blevins" a écrit : > On Feb 14, 2018, at 9:01 AM, Romain Manni-Bucau wrote: > > interesting thing is JsonWebToken principal will not work with CDI by > design - due to proxies - so must use another unwrapped layer to

Re: Implementing Microprofile JWT

2018-02-14 Thread David Blevins
> On Feb 14, 2018, at 9:01 AM, Romain Manni-Bucau wrote: > > interesting thing is JsonWebToken principal will not work with CDI by > design - due to proxies - so must use another unwrapped layer to get the > principal like jaspic or servlet layers which will not require

Re: Implementing Microprofile JWT

2018-02-14 Thread David Blevins
> On Feb 14, 2018, at 8:49 AM, Mark Struberg wrote: > >> >> I think one of the things we'll find most puzzling about how to do the >> integration is that the Tomcat flavor of this is written assuming the users >> exist in a Tomcat Realm. The whole point of JWT is

Re: Implementing Microprofile JWT

2018-02-14 Thread Romain Manni-Bucau
think we support jaspic at some point - at least javaee 7 tests were supposed to cover it, even for EJB while there is a request - not for @Timeout typically but this is out of scope for microprofile. interesting thing is JsonWebToken principal will not work with CDI by design - due to proxies -

Re: Implementing Microprofile JWT

2018-02-14 Thread Jean-Louis Monteiro
Thanks David, I've started to look into our SecurityService interface as well. It would need to evolve at some point. The couple username + password is not the best to support many authentication mechanisms. The realm interface in Tomcat is not the best either because it has like 5 or 6 strongly

Re: Implementing Microprofile JWT

2018-02-14 Thread Mark Struberg
> > I think one of the things we'll find most puzzling about how to do the > integration is that the Tomcat flavor of this is written assuming the users > exist in a Tomcat Realm. The whole point of JWT is that they do not and the > server has no such state. > >

Re: Implementing Microprofile JWT

2018-02-14 Thread David Blevins
> On Feb 13, 2018, at 3:43 AM, John D. Ament wrote: > > The JWT spec is weird, because it defined non MP runtime behavior in addition > to MP runtime behavior; so there may be more integration work in a fuller app > server like TomEE. Agreed. I'd describe the

Re: Implementing Microprofile JWT

2018-02-14 Thread David Blevins
Can you put that on the Umbrella thread? More for clean archiving and collecting everything in one spot. -David > On Feb 13, 2018, at 8:25 AM, Mark Struberg wrote: > > Hi folks! > > Mike had a grat response on the imact and potential downsides of becoming an >

Re: Implementing Microprofile JWT

2018-02-13 Thread Rudy De Busscher
> > I'm more worried about the authorisation and authentication interface. I used JASPIC as it seemed to most natural way to feed the EE system with authorisation and authentication into the system. But probably need deep integration with server code because otherwise, the JWT authentication

Re: Implementing Microprofile JWT

2018-02-13 Thread Jean-Louis Monteiro
Too early for me to figure this out. Really need to get an example working so that I can think of a cleaner design. -- Jean-Louis Monteiro http://twitter.com/jlouismonteiro http://www.tomitribe.com On Tue, Feb 13, 2018 at 4:58 PM, Mark Struberg wrote: > Might do as

Re: Implementing Microprofile JWT

2018-02-13 Thread Mark Struberg
Might do as well. But the JSON-P part is really well abstracted. So this is easy to plug-in. I'm more worried about the authorisation and authentication interface. Anything EE security seems way too heavyweight for me. This might work out for TomEE, but would kill it's use in any more

Re: Implementing Microprofile JWT

2018-02-13 Thread Jean-Louis Monteiro
I was also thinking about a Johnzon extension (kinda) -- Jean-Louis Monteiro http://twitter.com/jlouismonteiro http://www.tomitribe.com On Tue, Feb 13, 2018 at 3:53 PM, Mark Struberg wrote: > I know JWT a bit and I wonder whether doing the signing part is just a bit

Re: Implementing Microprofile JWT

2018-02-13 Thread Mark Struberg
I know JWT a bit and I wonder whether doing the signing part is just a bit of Json (JSON-P) + commons-crypto? After all JWT is especially designed to be lightweight and straight forward. LieGrue, strub > Am 13.02.2018 um 15:33 schrieb Romain Manni-Bucau : > >

Re: Implementing Microprofile JWT

2018-02-13 Thread Romain Manni-Bucau
2018-02-13 15:28 GMT+01:00 Jean-Louis Monteiro : > Thanks for the feedback Jon. > > I had a couple of exchanges with Rudy which is happy to contribute some > code as well. > From what I have understood and seen, most of the code is integration code > and there is at

Re: Implementing Microprofile JWT

2018-02-13 Thread Jean-Louis Monteiro
Thanks for the feedback Jon. I had a couple of exchanges with Rudy which is happy to contribute some code as well. >From what I have understood and seen, most of the code is integration code and there is at least from my current knowledge a little bit of code to put together in a reusable manner

Re: Implementing Microprofile JWT

2018-02-13 Thread Romain Manni-Bucau
2018-02-13 12:43 GMT+01:00 John D. Ament : > > > On 2018/02/12 20:42:58, Jonathan Gallimore > wrote: > > On Mon, Feb 12, 2018 at 8:20 PM, Romain Manni-Bucau < > rmannibu...@gmail.com> > > wrote: > > > > > No Andy, as mentionned in the

Re: Implementing Microprofile JWT

2018-02-13 Thread John D . Ament
On 2018/02/12 20:42:58, Jonathan Gallimore wrote: > On Mon, Feb 12, 2018 at 8:20 PM, Romain Manni-Bucau > wrote: > > > No Andy, as mentionned in the discussion Geronimo hosts the microprofile > > @asf. This is why jwt should probably be

Re: Implementing Microprofile JWT

2018-02-12 Thread David Blevins
> On Feb 12, 2018, at 1:45 PM, Mark Struberg wrote: > > It seems we all got hit on the wrong foot in some ways. > Why not take the chance to learn something and make it better. > For me: I should have asked what this is about instead of assuming something > which

Re: Implementing Microprofile JWT

2018-02-12 Thread Mark Struberg
It seems we all got hit on the wrong foot in some ways. Why not take the chance to learn something and make it better. For me: I should have asked what this is about instead of assuming something which looked clear from my pov. Seems I was wrong. @Andy what about creating a ticket on the issue

Re: Implementing Microprofile JWT

2018-02-12 Thread Andy Gumbrecht
I find the discussions and working on TomEE have become tedious, contentious, unrewarding and fruitless in order to continue working on the project in my free time. That'd be why I've not contributed recently, but not speaking for others of course. I wasn't actually trying to start any

Re: Implementing Microprofile JWT

2018-02-12 Thread Jonathan Gallimore
I'll apologize for not doing more on TomEE 8. But that is simply a time thing, and not a Tomitribe thing. I still owe a fixed build on master (which I am working on tonight) and forward porting the latest master patches to the EE8 branch. That work is not forgotten, just has to be fitted in with

Re: Implementing Microprofile JWT

2018-02-12 Thread Mark Struberg
Well, let's be a bit more specific. a.) No, Geronimo of course does not have have a monopoly on creating microprofile implementations at the ASF. Nor does TomEE. Geronimo a good place for reusable JavaEE parts though. And G started to implement Microprofile specifications 2 years ago already.

Re: Implementing Microprofile JWT

2018-02-12 Thread Jonathan Gallimore
On Mon, Feb 12, 2018 at 8:20 PM, Romain Manni-Bucau wrote: > No Andy, as mentionned in the discussion Geronimo hosts the microprofile > @asf. This is why jwt should probably be done in geronimo which is the asf > ee related project umbrella. > I don't recall that

Re: Implementing Microprofile JWT

2018-02-12 Thread Andy Gumbrecht
Any issues let me know and I'll fix tomorrow - not staying up for the buildbot. On 12/02/18 21:14, Andy Gumbrecht wrote: "Parts of the components skeletons you just created" They're just logically named empty modules for pending work? On 12/02/18 20:42, Mark Struberg wrote: And what's

Re: Implementing Microprofile JWT

2018-02-12 Thread Andy Gumbrecht
Reverted. On 12/02/18 21:14, Andy Gumbrecht wrote: "Parts of the components skeletons you just created" They're just logically named empty modules for pending work? On 12/02/18 20:42, Mark Struberg wrote: And what's that for? Is there any behind the scene stuff going on at Tomitribe or

Re: Implementing Microprofile JWT

2018-02-12 Thread Romain Manni-Bucau
No Andy, as mentionned in the discussion Geronimo hosts the microprofile @asf. This is why jwt should probably be done in geronimo which is the asf ee related project umbrella. I understand it is not the most convenient for tomitribe which probably perfers to own the full project(s) but as a

Re: Implementing Microprofile JWT

2018-02-12 Thread Andy Gumbrecht
"Parts of the components skeletons you just created" They're just logically named empty modules for pending work? On 12/02/18 20:42, Mark Struberg wrote: And what's that for? Is there any behind the scene stuff going on at Tomitribe or can we finally get back to discussing such things on

Re: Implementing Microprofile JWT

2018-02-12 Thread Mark Struberg
And what's that for? Is there any behind the scene stuff going on at Tomitribe or can we finally get back to discussing such things on the Apache lists? Before we go on I'd would first finish the discussion how we want to turn TomEE into an umbrella project or how the structure would be. And

Re: Implementing Microprofile JWT

2018-02-12 Thread Andy Gumbrecht
Added project stubs: https://github.com/apache/tomee/tree/master/microprofile Andy. On 05/02/18 11:17, Jean-Louis Monteiro wrote: Hi, Ok thanks guys. @Rudy, you are most welcome :) -- Jean-Louis Monteiro http://twitter.com/jlouismonteiro http://www.tomitribe.com On Fri, Feb 2, 2018 at

Re: Implementing Microprofile JWT

2018-02-05 Thread Jean-Louis Monteiro
Hi, Ok thanks guys. @Rudy, you are most welcome :) -- Jean-Louis Monteiro http://twitter.com/jlouismonteiro http://www.tomitribe.com On Fri, Feb 2, 2018 at 11:39 AM, Rudy De Busscher wrote: > I think it is a very important spec, also for non-microprofile >

Re: Implementing Microprofile JWT

2018-02-02 Thread Mark Struberg
To clarify this even further: The Geronimo Server is now officially dead. But the Geronimo project is not. It alredy contains quite a few modular parts which are reused in many ASF projects and also outside. Examples is the geronimo-transaction-manager, geronimo-javamail, geronimo-config,

Re: Implementing Microprofile JWT

2018-02-02 Thread Rudy De Busscher
I think it is a very important spec, also for non-microprofile implementations as it can enhance the interoperability of all servers. I'm also very interested in the implementation (and want to help a bit with it also :) ) regards Rudy On 2 February 2018 at 11:23, Mark Struberg

Re: Implementing Microprofile JWT

2018-02-02 Thread Romain Manni-Bucau
2018-02-02 11:05 GMT+01:00 Otávio Gonçalves de Santana < osant...@tomitribe.com>: > Guys, I have a question: > > Why not a project to each implementation? > this is the case but geronimo is used as an umbrella project. > This way I can use just a specific if I want also. > exactly the goal

Re: Implementing Microprofile JWT

2018-02-02 Thread Otávio Gonçalves de Santana
Guys, I have a question: Why not a project to each implementation? This way I can use just a specific if I want also. On Fri, Feb 2, 2018 at 7:44 AM, Romain Manni-Bucau wrote: > Hi JL, > > Microprofile apache effort is hosted in geronimo and John already spoke > about it

Re: Implementing Microprofile JWT

2018-02-02 Thread Romain Manni-Bucau
Hi JL, Microprofile apache effort is hosted in geronimo and John already spoke about it I think. Would probably saner to keep it all at the same place for the foundation. Romain Manni-Bucau @rmannibucau | Blog | Old Blog