Return-Path: Delivered-To: apmail-jackrabbit-users-archive@locus.apache.org Received: (qmail 16647 invoked from network); 27 Nov 2007 16:00:20 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.2) by minotaur.apache.org with SMTP; 27 Nov 2007 16:00:20 -0000 Received: (qmail 59936 invoked by uid 500); 27 Nov 2007 16:00:05 -0000 Delivered-To: apmail-jackrabbit-users-archive@jackrabbit.apache.org Received: (qmail 59926 invoked by uid 500); 27 Nov 2007 16:00:05 -0000 Mailing-List: contact users-help@jackrabbit.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: users@jackrabbit.apache.org Delivered-To: mailing list users@jackrabbit.apache.org Received: (qmail 59917 invoked by uid 99); 27 Nov 2007 16:00:05 -0000 Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 27 Nov 2007 08:00:05 -0800 X-ASF-Spam-Status: No, hits=2.2 required=10.0 tests=HTML_MESSAGE,SPF_PASS,WHOIS_MYPRIVREG X-Spam-Check-By: apache.org Received-SPF: pass (nike.apache.org: local policy) Received: from [129.20.128.64] (HELO mailrelais2.univ-rennes1.fr) (129.20.128.64) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 27 Nov 2007 16:00:00 +0000 Received: from localhost (mailscan.univ-rennes1.fr [129.20.128.58]) by mailrelais2.univ-rennes1.fr (Postfix) with ESMTP id 8E9922F7D; Tue, 27 Nov 2007 16:59:39 +0100 (MET) X-Virus-Scanned: amavisd-new at univ-rennes1.fr Received: from mailrelais2.univ-rennes1.fr ([129.20.128.64]) by localhost (mailscan.univ-rennes1.fr [129.20.128.58]) (amavisd-new, port 10036) with ESMTP id LHBxaphINHNJ; Tue, 27 Nov 2007 16:59:11 +0100 (MET) Received: from [129.20.129.80] (pr129080.cri.univ-rennes1.fr [129.20.129.80]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mailrelais2.univ-rennes1.fr (Postfix) with ESMTP id 114C72EC1; Tue, 27 Nov 2007 16:16:17 +0100 (MET) Message-ID: <474C34BD.9090207@univ-rennes1.fr> Date: Tue, 27 Nov 2007 16:16:13 +0100 From: Raymond Bourges Reply-To: raymond.bourges@univ-rennes1.fr User-Agent: Thunderbird 2.0.0.9 (Windows/20071031) MIME-Version: 1.0 To: Slide Users Mailing List CC: users@jackrabbit.apache.org, user@commons.apache.org Subject: Re: The state of WebDAV Clients References: <14055094.2165211196091755412.JavaMail.servlet@kundenserver> In-Reply-To: <14055094.2165211196091755412.JavaMail.servlet@kundenserver> Content-Type: multipart/mixed; boundary="------------060203020707040206060400" X-Virus-Checked: Checked by ClamAV on apache.org --------------060203020707040206060400 Content-Type: multipart/alternative; boundary="------------000007020402050806000900" --------------000007020402050806000900 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Hi, About: “Oliver made a fix in Subversion, but there was nobody who could release a fixed Slide, either as a minor update to the last Slide release years ago, or as a new release of the current code in Subversion.” In ESUP-Portail project we have made a lot of work over Slide. Perhaps because of our poor English we didn’t communicate about this. Sorry. Slide is used in many universities in France and we make a patch for Slide 2.1. You can find it here: http://www.esup-portail.org/consortium/espace/Securite/ESUP-2007-AVI-004-COR.zip It takes the form of a patch of AbstractWebdavMethod Class in order to use a special EntityResolver that avoid XML Entity attack. It works on LOCK method like Oliver’s patch and with other commands like PROPFIND. About ESUP-Portail project work over Slide we have: - Authentication Filter (LDAP, SSO with CAS and Shibboleth) - Specific Slide stores for groups (uPortal groups and Shibboleth’s attributes based groups) - A Quota for WebDAV (RFC 4331) based on Slide event mechanism Of course we plan to use Jackrabbit WebDAV server now. But, at this time, I don’t know if we can rewrite Slide extension in a jackrabbit environment. I just sign on jackrabbit mailing lists. Jackrabbit seems to be to ACP compliant. I find some information in “Coming from Slide...” thread in users mailing list. But have you some information on how to plug specific WebDAV group implementations in Jackrabbit? Is it spring enabled for example? Thanks a lot. Some information about ESUP-Portail WebDAV project: - Web site: http://sourcesup.cru.fr/esup-webdav-srv/current/index.html - The project site: http://sourcesup.cru.fr/projects/esup-webdav-srv/ - A recent presentation of Shibboleth mechanism: http://www.terena.org/activities/eurocamp/november07/slides/bourges-the-shibboleth-enabled-webdav.pdf ossfwot@dubioso.net a écrit : > Hello Chris, > > >> JackRabbit does not currently have a WebDAV client implementation >> according to this post >> (http://www.nabble.com/Webdav-Client-Examples--tf4803755.html#a13852979). >> > > The way I read this post, they have the implementation. > It is just not released as a separate component. > > The released version of the Slide WebDAV client is > based on HttpClient 2.0, which has been unsupported > for years. It also includes contrib code from > HttpClient which was never supported in the first > place. > > >> I think it is clear that there is a need for >> a project like this. >> > > That is good to know. > > >> Has there been any though in starting an Apache >> Commons project to provide WebDAV support? >> > > Not as a Commons project, but it was discussed > as a part of HttpComponents. The most recent > discussion took place on general@jakarta: > http://www.nabble.com/-discuss--Slide-%2B-HttpComponents-%3D%3E-TLP-tf4207242.html > > We made sure that the scope of the new > HttpComponents TLP allows for releasing > a WebDAV client, whether that is based on > Slide or Jackrabbit or something else. But > projects depend on volunteers to do the work. > > >> My understanding was that the Slide client was >> stable and would probably provide a good starting >> point for a WebDAV client. >> > > It has no unit tests, no developer community, > and is based on an HttpClient API scheduled > for replacement. The Jackrabbit WebDAV client > is also based on an HttpClient API scheduled > for replacement, but it has a developer community. > I don't know about their unit tests. > > >> For more information on my WebDAV research see this post: >> http://pragmaticchris.blogspot.com/2007/11/java-webdav-clients.html >> > > Thanks for the pointers. I may post a comment on > your blog later this week. For now: we did not retire > Slide because Jackrabbit is a perfect replacement. > We retired Slide because it had no developer > community that could address a security vulnerability: > http://www.nabble.com/Warning%3A-Security-Bug-in-Slide-tf4736066.html > > Oliver made a fix in Subversion, but there was > nobody who could release a fixed Slide, either > as a minor update to the last Slide release years > ago, or as a new release of the current code in > Subversion. Projects that cannot address security > vulnerabilities need to be retired. This does not > depend on the availability of an alternative. It > depends only on the availability of a developer > community. > > Users of the current Slide codebase are welcome > to fork and support the code. They are even more > welcome to form a new project to move away from > the HttpClient 2.x/3.x API. I'm willing to invest > some effort into that next year, after we've > completed the HttpComponents move to TLP. But > at the moment, I don't see too many people working > on a WebDAV client. If you know any, please send > them our way :-) The best starting point for now > would be the Jackrabbit client code that is just > waiting for somebody to release it. > > Of course you can always continue to use the > Slide WebDAV client. There wasn't much support > for some time, so the situation didn't really > change by the retirement. It is now just obvious > to anybody that the code is unsupported. > > cheers, > Roland > > --------------------------------------------------------------------- > To unsubscribe, e-mail: slide-user-unsubscribe@jakarta.apache.org > For additional commands, e-mail: slide-user-help@jakarta.apache.org > > --------------000007020402050806000900 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit Hi,

About: “Oliver made a fix in Subversion, but there was nobody who could release a fixed Slide, either as a minor update to the last Slide release years ago, or as a new release of the current code in Subversion.”

In ESUP-Portail project we have made a lot of work over Slide. Perhaps because of our poor English we didn’t communicate about this. Sorry.

Slide is used in many universities in France and we make a patch for Slide 2.1. You can find it here: http://www.esup-portail.org/consortium/espace/Securite/ESUP-2007-AVI-004-COR.zip

It takes the form of a patch of AbstractWebdavMethod Class in order to use a special EntityResolver that avoid XML Entity attack. It works on LOCK method like Oliver’s patch and with other commands like PROPFIND.

About ESUP-Portail project work over Slide we have:
- Authentication Filter (LDAP, SSO with CAS and Shibboleth)
- Specific Slide stores for groups (uPortal groups and Shibboleth’s attributes based groups)
- A Quota for WebDAV (RFC 4331) based on Slide event mechanism

Of course we plan to use Jackrabbit WebDAV server now. But, at this time, I don’t know if we can rewrite Slide extension in a jackrabbit environment. I just sign on jackrabbit mailing lists.

Jackrabbit seems to be to ACP compliant. I find some information in “Coming from Slide...” thread in users mailing list.
But have you some information on how to plug specific WebDAV group implementations in Jackrabbit? Is it spring enabled for example?

Thanks a lot.

Some information about ESUP-Portail WebDAV project:
- Web site: http://sourcesup.cru.fr/esup-webdav-srv/current/index.html
- The project site: http://sourcesup.cru.fr/projects/esup-webdav-srv/
- A recent presentation of Shibboleth mechanism: http://www.terena.org/activities/eurocamp/november07/slides/bourges-the-shibboleth-enabled-webdav.pdf


ossfwot@dubioso.net a écrit : 
Hello Chris,

  
JackRabbit does not currently have a WebDAV client implementation
according to this post
(http://www.nabble.com/Webdav-Client-Examples--tf4803755.html#a13852979).
    

The way I read this post, they have the implementation.
It is just not released as a separate component.

The released version of the Slide WebDAV client is
based on HttpClient 2.0, which has been unsupported
for years. It also includes contrib code from
HttpClient which was never supported in the first
place.

  
I think it is clear that there is a need for
a project like this.
    

That is good to know.

  
Has there been any though in starting an Apache
Commons project to provide WebDAV support?
    

Not as a Commons project, but it was discussed
as a part of HttpComponents. The most recent
discussion took place on general@jakarta:
http://www.nabble.com/-discuss--Slide-%2B-HttpComponents-%3D%3E-TLP-tf4207242.html

We made sure that the scope of the new
HttpComponents TLP allows for releasing
a WebDAV client, whether that is based on
Slide or Jackrabbit or something else. But
projects depend on volunteers to do the work.

  
My understanding was that the Slide client was
stable and would probably provide a good starting
point for a WebDAV client.
    

It has no unit tests, no developer community,
and is based on an HttpClient API scheduled
for replacement. The Jackrabbit WebDAV client
is also based on an HttpClient API scheduled
for replacement, but it has a developer community.
I don't know about their unit tests.

  
For more information on my WebDAV research see this post:
http://pragmaticchris.blogspot.com/2007/11/java-webdav-clients.html
    

Thanks for the pointers. I may post a comment on
your blog later this week. For now: we did not retire 
Slide because Jackrabbit is a perfect replacement.
We retired Slide because it had no developer
community that could address a security vulnerability:
http://www.nabble.com/Warning%3A-Security-Bug-in-Slide-tf4736066.html

Oliver made a fix in Subversion, but there was
nobody who could release a fixed Slide, either
as a minor update to the last Slide release years
ago, or as a new release of the current code in
Subversion. Projects that cannot address security
vulnerabilities need to be retired. This does not
depend on the availability of an alternative. It
depends only on the availability of a developer
community.

Users of the current Slide codebase are welcome
to fork and support the code. They are even more
welcome to form a new project to move away from
the HttpClient 2.x/3.x API. I'm willing to invest
some effort into that next year, after we've
completed the HttpComponents move to TLP. But
at the moment, I don't see too many people working
on a WebDAV client. If you know any, please send
them our way :-) The best starting point for now
would be the Jackrabbit client code that is just
waiting for somebody to release it.

Of course you can always continue to use the
Slide WebDAV client. There wasn't much support
for some time, so the situation didn't really
change by the retirement. It is now just obvious
to anybody that the code is unsupported.

cheers,
  Roland

---------------------------------------------------------------------
To unsubscribe, e-mail: slide-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: slide-user-help@jakarta.apache.org

--------------000007020402050806000900-- --------------060203020707040206060400--