RESTApp : Token validation instead of BASIC AUTH

[rangoo]

I am planning to use the Activiti REST app with a Token instead of basic authentication. I extended UserEntityManager to overide

 

checkPassword(String userId, String password)‍

I will receive a SAML Token instead of username/password from my REST Clients. so I will have to pass - UserID as null and a TokenStringinstead of password as there is no method which just accepts single parameter.

1) Should I still  overide checkpassword method although it doesn't look cleaner

OR

2) Should I modify Activiti Engine sources to add another command class. For UserEntityManager  to have a checkToken(String token) Method and  I could change loginResoucre.login method like this

getIdentityService().checkToken instead of pe.getIdentityService().checkPassword(‍

OR

3) Writing my Own REST App makes sense in my case ?
 
Suggestions are welcome

[trademak]

Hi,

What do you use to validate the SAML token?
Adding a token-based authentication/authorization mechanism to Activiti would be an interesting improvement.
Therefore it would be good to know which SAML implementation you are using.

Best regards,

[rangoo]

Yes Indeed.  We chose Activiti over a commercial product so we can customize our security. We are using SAML 2.0.

[jbarrez]

Wouldn't that required an identity provider server whenever you want to use it (my SAML is rusty)?
How easy could this be made pluggable?

But yes: saml authentication is something that would be very interesting to have!

[ronald_van_kuij]

1: yes, an idp is needed
2: pluggable in what way? Different implementations in Activiti?

[rangoo]

True. We do have an Identity provider server and we are given an API to call it(to obtain, exchange & validate tokens). I am not a SAML expert either. Perhaps we need a  few methods(to exchange & validate tokens)in UserEntityManager for developers to override.

[jbarrez]

@Ronald and @ rangoo: pluggable in the way that people would specifically be able to turn it on.

I don't know how widespread SAML is these das (I did a consultancy gig 5 years ago on it, and back then it was mostly academical instituations),
but it is something that is probably wanted by some people (but i dont have the knowledge anymore)