Mailing-List: contact dev-help@syncope.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@syncope.apache.org
Date: Fri, 3 Mar 2017 13:01:46 +0000 (UTC)
From: "ASF subversion and git services (JIRA)" <jira@apache.org>
To: dev@syncope.apache.org
Message-ID: <JIRA.13047022.1488300688000.54412.1488546106094@Atlassian.JIRA>
In-Reply-To: <JIRA.13047022.1488300688000@Atlassian.JIRA>
References: <JIRA.13047022.1488300688000@Atlassian.JIRA> <JIRA.13047022.1488300688622@jira-lw-us.apache.org>
Subject: [jira] [Commented] (SYNCOPE-1035) JWT-based access to REST services
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
archived-at: Fri, 03 Mar 2017 13:01:52 -0000


    [ https://issues.apache.org/jira/browse/SYNCOPE-1035?page=3Dcom.atlassi=
an.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D15=
894301#comment-15894301 ]=20

ASF subversion and git services commented on SYNCOPE-1035:
----------------------------------------------------------

Commit 2b06bafc58ccc0d2b9a1be137f0965ff111b08d4 in syncope's branch refs/he=
ads/master from [~ilgrosso]
[ https://git-wip-us.apache.org/repos/asf?p=3Dsyncope.git;h=3D2b06baf ]

[SYNCOPE-1035] Fix for console logout


> JWT-based access to REST services
> ---------------------------------
>
>                 Key: SYNCOPE-1035
>                 URL: https://issues.apache.org/jira/browse/SYNCOPE-1035
>             Project: Syncope
>          Issue Type: New Feature
>          Components: client, console, core
>            Reporter: Francesco Chicchiricc=C3=B2
>            Assignee: Francesco Chicchiricc=C3=B2
>              Labels: rest
>             Fix For: 2.0.3, 2.1.0
>
>
> Since the beginning, access to the REST services is protected via Basic A=
uthentication, with credentials sent along each and every request.
> As improvement, we can switch to an architecture where there is an explic=
it REST service for obtaining some sort of token (requiring credentials) an=
d then all other REST services can be accessed by sending along such token =
instead of credentials.
> This will ease future works for enabling SSO via SAML, OAuth 2.0 or other=
 standards.
> About the token format, it seems that [JSON Web Tokens|https://jwt.io/] a=
re quite the default choice, especially considering the support that CXF al=
ready provides for that.


--
This message was sent by Atlassian JIRA
(v6.3.15#6346)