topic Re: RESTApp : Token validation instead of BASIC AUTH in Alfresco Archive

RESTApp : Token validation instead of BASIC AUTH

rangoo — Mon, 08 Apr 2013 22:37:38 GMT

I am planning to use the Activiti REST app with a Token instead of basic authentication. I extended UserEntityManager to overide checkPassword(String userId, String password)‍I will receive a SAML Token instead of username/password from my REST Clients. so I will have to pass - UserID as null and a

Re: RESTApp : Token validation instead of BASIC AUTH

trademak — Tue, 09 Apr 2013 13:58:15 GMT

Hi,

What do you use to validate the SAML token?
Adding a token-based authentication/authorization mechanism to Activiti would be an interesting improvement.
Therefore it would be good to know which SAML implementation you are using.

Best regards,

Re: RESTApp : Token validation instead of BASIC AUTH

rangoo — Tue, 09 Apr 2013 16:10:28 GMT

Yes Indeed. We chose Activiti over a commercial product so we can customize our security. We are using SAML 2.0.

Re: RESTApp : Token validation instead of BASIC AUTH

jbarrez — Wed, 10 Apr 2013 14:25:00 GMT

Wouldn't that required an identity provider server whenever you want to use it (my SAML is rusty)?
How easy could this be made pluggable?

But yes: saml authentication is something that would be very interesting to have!

Re: RESTApp : Token validation instead of BASIC AUTH

ronald_van_kuij — Wed, 10 Apr 2013 16:51:58 GMT

1: yes, an idp is needed
2: pluggable in what way? Different implementations in Activiti?

Re: RESTApp : Token validation instead of BASIC AUTH

rangoo — Wed, 10 Apr 2013 17:06:06 GMT

True. We do have an Identity provider server and we are given an API to call it(to obtain, exchange & validate tokens). I am not a SAML expert either. Perhaps we need a few methods(to exchange & validate tokens)in UserEntityManager for developers to override.

Re: RESTApp : Token validation instead of BASIC AUTH

jbarrez — Thu, 11 Apr 2013 09:27:11 GMT

@Ronald and @ rangoo: pluggable in the way that people would specifically be able to turn it on.

I don't know how widespread SAML is these das (I did a consultancy gig 5 years ago on it, and back then it was mostly academical instituations),
but it is something that is probably wanted by some people (but i dont have the knowledge anymore)