Mailing-List: contact dev-help@chemistry.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@chemistry.apache.org
Received-SPF: pass (athena.apache.org: domain of bhatian@comcast.net
 designates 76.96.62.96 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <4E0A43B5.7030707@alfresco.com>
References: <BANLkTinF20NbYbG0hF5kkr5Bji3et6tKuQ@mail.gmail.com>
	<4E0A43B5.7030707@alfresco.com>
Date: Tue, 28 Jun 2011 17:48:30 -0400
Message-ID: <BANLkTi=PbSQsoE=1tAknxgNXa7rKvBh=-Q@mail.gmail.com>
Subject: Re: Password handling by OpenCMIS
From: Naresh Bhatia <bhatian@comcast.net>
To: dev@chemistry.apache.org
Content-Type: multipart/alternative; boundary=20cf3002587af6912c04a6cca0eb

--20cf3002587af6912c04a6cca0eb
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Thanks. And I assume OpenCMIS can work with https without any modifications=
,
i.e. all I need to do is to set SessionParameter.ATOMPUB_URL to an https UR=
L
and I am ready to go. Correct?

Thanks.
Naresh


On Tue, Jun 28, 2011 at 5:12 PM, Florian M=FCller <
florian.mueller@alfresco.com> wrote:

> Hi Naresh,
>
> The CMIS specification doesn't define how the user authentication should
> work but it makes two recommendations:
> - For the AtomPub binding: HTTP Basic Authentication
> - For the Web Services binding: WS-Security UsernameToken
>
> Basically all repositories support those methods and they are used by
> default by OpenCMIS.
> Note, that in both cases usernames and passwords are sent in clear text.
> That is, on a production system you should ALWAYS use HTTPS!
>
> Some repositories also support more sophisticated and more secure
> authentication methods that don't require HTTPS.
> Please consult the repository vendor which additional methods are provide=
d.
>
> OpenCMIS can support those as well with a little bit of custom code. Plea=
se
> see [1][2][3].
>
>
> - Florian
>
>
> [1]
> http://chemistry.apache.org/java/developing/client/dev-client-bindings.ht=
ml#OpenCMISClientBindings-CustomAuthenticationProvider
> [2]
> http://chemistry.apache.org/java/0.4.0/maven/apidocs/org/apache/chemistry=
/opencmis/commons/spi/AuthenticationProvider.html
> [3] Java class:
> org.apache.chemistry.opencmis.client.bindings.spi.StandardAuthenticationP=
rovider
>
>
> On 28/06/2011 21:39, Naresh Bhatia wrote:
> > When I create a CMIS session using SessionFactory.createSession(), how =
is
> > the password sent to the server - is it sent in clear text, hashed, doe=
s
> it
> > depend on the protocol (AtomPub vs. Web Service)? Just trying to figure
> out
> > how secure it is between OpenCMIS and the server.
> >
> > Thanks.
> > Naresh
> >
>
>

--20cf3002587af6912c04a6cca0eb--