[
Date Prev][
Date Next][
Thread Prev][
Thread Next][
Date Index][
Thread Index]
[
List Home]
RE: [higgins-dev] Demo post-mortem
|
Please explain, as STS is not an Authentication service, also the STS can
issue self signed tokens today, are you talking about supporting the
concept of "personal cards" ?
Anthony Nadalin | Work 512.838.0085 | Cell 512.289.4122
"Daniel Sanders"
<dsanders@novell.
com> To
Sent by: "'Higgins (Trust Framework) Project
higgins-dev-bounc developer discussions'"
es@xxxxxxxxxxx <higgins-dev@xxxxxxxxxxx>
cc
12/14/2006 09:59 Subject
AM RE: [higgins-dev] Demo post-mortem
Please respond to
"Higgins \(Trust
Framework\)
Project developer
discussions"
<higgins-dev@ecli
pse.org>
I wonder if during the call there would be time to discuss a next
potential step for the STS - supporting the other authentication methods
of CardSpace? I am specifically interested in being able to experiment
with authentication using a Self-issued token. I see this as possibly
being a very useful way to achieve single sign-on functionality.
Daniel Sanders
>>> "Paul Trevithick" <paul@xxxxxxxxxxxxxxxxx> 12/13/2006 7:07 PM >>>
Thanks for doing this Jim. Let me know if you'd like to go over some of
this on the call tomorrow. -Paul
From: higgins-dev-bounces@xxxxxxxxxxx
[mailto:higgins-dev-bounces@xxxxxxxxxxx] On Behalf Of Jim Sermersheim
Sent: Wednesday, December 13, 2006 7:44 PM
To: higgins-dev@xxxxxxxxxxx
Subject: Re: [higgins-dev] Demo post-mortem
FWIW, I put these here and took the liberty of assigning some names to
tasks (still need owners for a few)
>>> "Jim Sermersheim" <jimse@xxxxxxxxxx> 12/8/06 3:57 PM >>>
Add to the list:
- STS Configuration (https://bugs.eclipse.org/bugs/show_bug.cgi?id=163618
). The bug doesn't say anything else, but I think it has to do with how
the STS is configured to do things like: - insert a claim mapper between
itself and the IdAS CP (dependency on claim mapping task below), possibly
include a list of allowed CP's, etc.
- Name mappings. We used full DN values from the groupMembership. Should
have been simple (mapped) names.
- Update operations in IdAS instead of PHP LDAP. All the update
operations on the RP use PHP LDAP instead of IdAS.
- Location of dependency libraries. We had some in the STS deployment lib
directory, and others in the Tomcat shared lib. We need a methodology for
deciding where to locate these.
- BasicDateTimeValue couldn't be used because of some fishiness with the
time zones. Duane has the details.
- Verify that Mike's latest STS code is in, and we can build and deploy
ourselves.
- Check in fixes to card generator to Higgins. Separate from form ui
- Empty/missing claim (on forum)
- LDAP CP should support any URI as the context ref (i.e. http)
Jim
>>> "Jim Sermersheim" <jimse@xxxxxxxxxx> 12/7/06 5:47 PM >>>
I suggested that we do some kind of post-mortem evaluation of the work
done to get the demo working so we avoid letting things fall through the
cracks.
Probably the best thing to do is get everyone's feedback and then create a
task list or create bugzilla items for each.
The Novell team will meet tomorrow afternoon to come up with a list from
our experience, so look for the results of that later. Until then, a few
I can think of off the top of my head include:
- CardID to context mapping. We ended up making the CardID equal the
contextRef. It looked like this: file:///<some path on the IdAS machine
to a config file>?<some identifier inside the config file representing a
context>. There's already a bug for this (
https://bugs.eclipse.org/bugs/show_bug.cgi?id=163366). It would be nice
if we could come up with something a little more abstract so we're not
putting something as brittle and revealing as a local filename
- Claim/Attribute mapping. We ended up making the LDAP CP emit attributes
which are named just like cardspace claims... We'd like to do this via
configuration, or possibly a mapping CP, or something like that.
- STS builds are still not quite up to snuff -- see recent list traffic.
I can see there are a lot of others now that I look around, I have to run
for the evening so I'll pick back up in the AM.
Jim
_______________________________________________
higgins-dev mailing list
higgins-dev@xxxxxxxxxxx
https://dev.eclipse.org/mailman/listinfo/higgins-dev


