Mailing-List: contact general-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: general@incubator.apache.org
Received-SPF: neutral (nike.apache.org: local policy)
Message-ID: <4EBDA62B.4080701@nanthrax.net>
Date: Fri, 11 Nov 2011 23:48:11 +0100
From: =?ISO-8859-1?Q?Jean-Baptiste_Onofr=E9?= <jb@nanthrax.net>
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
 rv:7.0.1) Gecko/20110929 Thunderbird/7.0.1
MIME-Version: 1.0
To: general@incubator.apache.org
Subject: Re: [PROPOSAL][RFC] Fediz for the Apache Incubator
References: <4EAFBA3A.9020802@nanthrax.net>
 <7260BD87-F608-4369-A354-E5C6C75E09F4@webthing.com>
In-Reply-To: <7260BD87-F608-4369-A354-E5C6C75E09F4@webthing.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: quoted-printable

Hi Nick,

sorry for my late answer, I was busy with the ApacheCon presentation.

The current Fediz codebase doesn't support OID/OAuth. Of course, it=20
could be interested to support it, by implementing it or by leveraging=20
existing implementations.

Some pointer about OID/OAuth:
- OID/OAuth doesn't support claims based authorization.
- OID/OAuth doesn't address end-to-end security where identities can be=20
propagated from a SSO enabled web application to the web services.

WS-Federation is supported by Identity Providers like OpenAM, IBM=20
Tivoli, Microsoft ADFS, Oracle but there is no support for it in Tomcat,=20
Karaf, or JBoss for instance.

I hope it answers to your question.

Regards
JB

On 11/03/2011 12:25 PM, Nick Kew wrote:
>
> On 1 Nov 2011, at 09:22, Jean-Baptiste Onofr=E9 wrote:
>
>> Hi,
>>
>> I would like to propose Fediz to be an Apache Incubator project.
>
> As others have pointed out, this looks like some familiar technologies.
>
> We know that OpenID is widely supported, by web client, server and
> application software, and some of the biggest providers.  OpenAuth
> perhaps less so, but they're spoken of as a pair.
>
> How about a proper exposition of:
>   - Does Fediz include an implementaion of OID/OAuth?
>   - If yes, does it do other things too, and what's the motivation?
>     How would you react to accusations of "embrace and extend"?
> - If no, why should we want another, competing framework/standard?
> - If no, where is it in fact supported in the real world?
>
> I think we should see these issues properly addressed in the proposal!
>

--=20
Jean-Baptiste Onofr=E9
jbonofre@apache.org
http://blog.nanthrax.net
Talend - http://www.talend.com

---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org