Mailing-List: contact dev-help@cxf.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cxf.apache.org
Received-SPF: neutral (nike.apache.org: local policy)
MIME-Version: 1.0
In-Reply-To: <53C2C851.9090600@die-schneider.net>
References: <53BE551D.5000303@die-schneider.net>
	<D225CD69196F3F4A9F4174B2FCA06F8811F07FA1@S10BE002.SH10.lan>
	<CAFNO4Hi-Drzvi1_HcAT4Y+hTSKu3yXZYyPMb5pCnMO9XF-md6A@mail.gmail.com>
	<53C2C851.9090600@die-schneider.net>
Date: Sun, 13 Jul 2014 18:01:19 -0700
Message-ID: 
 <CAFNO4HhOC+LOhNJPo2vyV54-QfYsUOw18pg2GyoTHo=xqy7rWQ@mail.gmail.com>
Subject: Re: Ideas for standardizing CXF authentication and authorization
From: Chris Geer <chris@cxtsoftware.com>
To: dev@cxf.apache.org
Content-Type: multipart/alternative; boundary=047d7b2e3dea33172504fe1cd42c

--047d7b2e3dea33172504fe1cd42c
Content-Type: text/plain; charset=UTF-8

Christian,

I'm not sure I have specific advice about how to approach Shiro
compatibility without spending some cycles on it. I think we could engage
Les and Shiro community to help though. One possible approach might just be
to have CXF use a pluggable approach so that it calls out to an API when it
checks if a user is authentication/authorized. That way a JAAS
implementation could be put in place but a Shiro or Spring Security
implementation could also be put in place. This would have to be made OSGI
friendly, but I bet it could be done.

I guess I just wanted to toss that out there so that any decisions that
were made wouldn't preclude using frameworks other than JAAS. In my
experience, using JAAS in an OSGI environments, with cross-service calls,
is very problematic so I'd just hate to see CXF require usage of JAAS. One
could argue that CXF didn't need to provide A&A at all in the core and
external libraries can be used through filters/interceptors as the
standard.

I'll give it some more thought as this conversation continues.

Chris


On Sun, Jul 13, 2014 at 10:56 AM, Christian Schneider <
chris@die-schneider.net> wrote:

> I think it would be great to stay compatible to the external security
> frameworks.
>
> What do you think needs to be considered regarding shiro?
>
> Christian
>
>
> Am 13.07.2014 17:50, schrieb Chris Geer:
>
>  While authentication/authorization is being discussed it would also be
>> good
>> if compatibility with Apache Shiro was kept in mind.
>>
>>
>>
> --
>  Christian Schneider
> http://www.liquid-reality.de
>
> Open Source Architect
> Talend Application Integration Division http://www.talend.com
>
>

--047d7b2e3dea33172504fe1cd42c--