FWD » Core Development » User Interface

06/29/2023

12:08 PM Feature #3931: single sign-on for virtual desktop mode

Yes, if we go that route. Let's get everything described and agreed first. Greg Shah

11:31 AM Feature #3931: single sign-on for virtual desktop mode

I want to create 4GL attr @AUTH-BLOB@, do we add it to @SESSION@ as well? Galya B

11:25 AM Feature #3931: single sign-on for virtual desktop mode

> How are hooks provided? I don't think we have dependency injection or event system built-in.
A class implementin... Greg Shah

11:24 AM Feature #3931: single sign-on for virtual desktop mode

> The auth logic, where DB queries are done, should be part of FWD server?
It would be Java code that is written b... Greg Shah

11:05 AM Feature #3931: single sign-on for virtual desktop mode

How are hooks provided? I don't think we have dependency injection or event system built-in. Galya B

10:42 AM Feature #3931: single sign-on for virtual desktop mode

The auth logic, where DB queries are done, should be part of FWD server? Galya B

10:39 AM Feature #3931: single sign-on for virtual desktop mode

> FWD hits the customer's auth server and gets response success, the fwd user and some session specific data, blob
... Greg Shah

10:35 AM Feature #3931: single sign-on for virtual desktop mode

The most simple flow would be:
1. SSO Login screen is open
2. User/pass entered
3. FWD hits the customer's auth se... Galya B

10:30 AM Feature #3931: single sign-on for virtual desktop mode

Greg Shah wrote:
> I don't see this as a separate service.
I think we speak about different things here. It's not... Galya B

10:25 AM Feature #3931: single sign-on for virtual desktop mode

> All customers requesting sso login will have to provide authentication server - 3rd party integration that we suppo... Greg Shah

10:17 AM Feature #3931: single sign-on for virtual desktop mode

Continue from #7465.
Greg Shah wrote:
> We cannot require OAuth2 as part of this interface. We are providing sup... Galya B

11:09 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

It's on hold.. Just to mention what was wrong with my idea: WebRTC changed the specification and doesn't expose the l... Galya B

08:43 AM Feature #4129: map web client users to OS accounts

> Is @config/auth-plugins/option@ the way of defining FWD user for the web process? Its value is @bogus@ in testcases... Greg Shah

08:39 AM Feature #4129: map web client users to OS accounts

Add/remove/edit users and groups is in the admin UI. ACL add/remove/edit is also in the admin UI. Groups are subjec... Greg Shah

08:23 AM Feature #4129: map web client users to OS accounts

Also the FWD user @bogus@ is listed in @subjects@ in multiple @security/acl@ resources and I don't see a way to updat... Galya B

08:17 AM Feature #4129: map web client users to OS accounts

Is @config/auth-plugins/option@ the way of defining FWD user for the web process? Its value is @bogus@ in testcases, ... Galya B

06/28/2023

09:34 AM Feature #4853 (Hold): implement support for reporting a device-id which is meant to identify a un...

Greg Shah

09:31 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

I would love to indicate I'm pausing it. Unfortunately this is not an option in the Status field. Galya B

09:30 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

I appreciate it. Please pause work on this specific task. Greg Shah

09:12 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

Greg Shah wrote:
> Anything behind a NAT firewall will not expose the local IP at the TCP/IP level.
NAT is exactl... Galya B

09:03 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

> so they definitely will know about the host ip in the local network as well
Actually, I'm not so sure that is th... Greg Shah

08:49 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

@WebRTC@ is the only way to find more network details in the browser. If we don't rely on network details (host / ip)... Galya B

08:46 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

The problem is that I don't know enough about networks and network related code, so I'm not completely sure how the p... Galya B

08:40 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

The idea of a device-id is that it is stable and associated with the system on which the browser runs. The "local IP... Greg Shah

08:39 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

I was originally expecting the local IP to be the host IP and it probably is, when the protocol is used outside the b... Galya B

08:21 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

Greg Shah wrote:
> 2 tabs will have different "local IP" as will tabs in 2 different browser instances, correct?
... Galya B

08:21 AM Feature #4853 (WIP): implement support for reporting a device-id which is meant to identify a uni...

Greg Shah

08:20 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

> Without WebRTC local IP we can't differentiate between web users behind a proxy using standard machines with the sa... Greg Shah

06:23 AM Feature #4853 (Review): implement support for reporting a device-id which is meant to identify a ...

Galya B

06:14 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

Without WebRTC local IP we can't differentiate between web users behind a proxy using standard machines with the same... Galya B

06:04 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

Client preferences will not be related to this id, but to the FWD user and will be applied after login / web client s... Galya B

06/26/2023

03:49 PM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> FWD doesn't know anything about @user_client.xml@. What are you referencing here?
True. But t... Roger Borrello

03:37 PM Feature #4129: map web client users to OS accounts

FWD doesn't know anything about @user_client.xml@. What are you referencing here? Greg Shah

03:22 PM Feature #4129: map web client users to OS accounts

> 1. Should we implement a facility in our admin UI to create/delete and manage OS accounts? This probably includes ... Roger Borrello

01:29 PM Feature #4129: map web client users to OS accounts

> > The FWD user is unique enough.
> I can't imagine a customer who will create FWD users for each of their app / en... Greg Shah

12:07 PM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> The FWD user is unique enough.
I can't imagine a customer who will create FWD users for each of ... Galya B

11:31 AM Feature #4129: map web client users to OS accounts

> Just throwing a random idea here: If on successful login the app returns a unique id for the user instead of userna... Greg Shah

11:28 AM Feature #4129: map web client users to OS accounts

Galya B wrote:
> Greg Shah wrote:
> > If we assume that FWD really doesn't care about the app user
>
> > the ma... Greg Shah

09:42 AM Feature #4129: map web client users to OS accounts

Adding a few more details to the random idea above: Instead of creating multiple fwd users in the admin panel with th... Galya B

09:23 AM Feature #4129: map web client users to OS accounts

Just throwing a random idea here: If on successful login the app returns a unique id for the user instead of username... Galya B

04:23 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> If we assume that FWD really doesn't care about the app user
> the mapping of a given FWD acc... Galya B

11:53 AM Feature #4856: web client session forking

> Opening manually multiple browser windows in the same browser instance should fulfill the requirement.
The resul... Greg Shah

04:23 AM Feature #4856: web client session forking

Opening manually multiple browser windows in the same browser instance should fulfill the requirement. The identifier... Galya B

04:33 AM Feature #4854: origin affinity

As discussed earlier client-side web storage can't be persistent, because @localStorage@ relies on the host name, whi... Galya B

06/23/2023

11:37 AM Feature #4129: map web client users to OS accounts

> I thought the task is to map app-users to os-users in directory.xml, so this is somewhat different from what I got.... Greg Shah

10:47 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> We don't need the app user. The hook can return the FWD user that corresponds to the app user th... Galya B

10:39 AM Feature #4129: map web client users to OS accounts

> > We have no plan to store things in-memory.
>
> If there are any plans I don't know of, please share the direct... Greg Shah

10:38 AM Feature #4129: map web client users to OS accounts

> > Not that I know of. We have no plan to store things in-memory.
> How do you find the mapping of the app user wh... Greg Shah

10:30 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> We have no plan to store things in-memory.
If there are any plans I don't know of, please shar... Galya B

10:08 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> Not that I know of. We have no plan to store things in-memory.
How do you find the mapping of t... Galya B

10:05 AM Feature #4129: map web client users to OS accounts

> Is the argument about in-memory data structure not valid?
Not that I know of. We have no plan to store things i... Greg Shah

10:02 AM Feature #4129: map web client users to OS accounts

Is the argument about in-memory data structure not valid? Galya B

06:19 AM Feature #4129: map web client users to OS accounts

> > Do we need to store information about the app users?
> No, nothing other than knowing what FWD user and OS user ... Greg Shah

01:43 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> > If we cleanup after each user, do we really need 1:1?
>
> I'm not sure what you mean by cle... Galya B

01:30 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> It would be a natural approach to store some amount of this mapping information in the FWD accoun... Galya B

06/22/2023

03:57 PM Feature #4129: map web client users to OS accounts

> If we cleanup after each user, do we really need 1:1?
I'm not sure what you mean by cleanup, but I suspect the ... Greg Shah

06/21/2023

06:31 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> I also don't see exactly how we would implement a one-to-one mapping, which is the most common ca... Galya B

06/20/2023

05:02 PM Feature #4129: map web client users to OS accounts

> Before starting I need to have the directory.xml structure approved:
It is not fully clear the purpose of the @a... Greg Shah

07:30 AM Feature #4129: map web client users to OS accounts

Before starting I need to have the directory.xml structure approved:... Galya B

06/16/2023

03:26 PM Feature #4517: optionally back the 4GL features for Registry access with the user-specific offlin...

Galya B wrote:
> What class implements the global 4GL methods accessing the Windows registry store?
To the conver... Greg Shah

07:22 AM Feature #4517: optionally back the 4GL features for Registry access with the user-specific offlin...

!preferences.png! Galya B

06:24 AM Feature #4517: optionally back the 4GL features for Registry access with the user-specific offlin...

To sum it up: This FWD persistent storage should be used:
1. On non-Windows operating system for global environment ... Galya B

05:38 AM Feature #4517: optionally back the 4GL features for Registry access with the user-specific offlin...

What class implements the global 4GL methods accessing the Windows registry store? Galya B

10:04 AM Feature #3931: single sign-on for virtual desktop mode

Sorry for asking multiple times. Just want to make sure the old comments are not related, since it's quite important.... Galya B

10:03 AM Feature #3931: single sign-on for virtual desktop mode

We would implement the login outselves and just call the hook which is non-interactive code implemented by the custom... Greg Shah

10:02 AM Feature #3931: single sign-on for virtual desktop mode

I agree that the new login code is NOT 4GL code. That is what I meant in #3931-46 when I said "This hook will not be... Greg Shah

09:50 AM Feature #3931: single sign-on for virtual desktop mode

Greg Shah wrote:
> > For #3770-81, the simplest way is to provide a directory-configured auth hook which checks the ... Galya B

09:45 AM Feature #3931: single sign-on for virtual desktop mode

As part of moving to this approach, they will modify the application to bypass their normal 4GL login. We will only ... Greg Shah

09:33 AM Feature #3931: single sign-on for virtual desktop mode

Greg Shah wrote:
> This hook will not be 4GL code.
I mean their login page being 4GL will have to live a complete C... Galya B

09:29 AM Feature #3931: single sign-on for virtual desktop mode

> If the login screen is 4GL app controlled by the customer, how do we manage different sessions? We'll need a dedica... Greg Shah

08:29 AM Feature #3931: single sign-on for virtual desktop mode

4GL app needs OS user. OS user is determined after app login. App login needs 4GL app. And we have an infinite loop. Galya B

08:26 AM Feature #3931: single sign-on for virtual desktop mode

If the login screen is 4GL app controlled by the customer, how do we manage different sessions? We'll need a dedicate... Galya B

09:22 AM Feature #4129: map web client users to OS accounts

> OS users will have their passwords in directory encrypted like for @admin@ user.
I'm not sure this is needed in... Greg Shah

09:17 AM Feature #4129: map web client users to OS accounts

> What is FWD user? I understand the admin has access to the admin login and temp accounts are used for @NativeSecure... Greg Shah

08:38 AM Feature #4129: map web client users to OS accounts

OS users will have their passwords in directory encrypted like for @admin@ user. But I can't recall do we expect the ... Galya B

04:20 AM Feature #4129: map web client users to OS accounts

What is FWD user? I understand the admin has access to the admin login and temp accounts are used for @NativeSecureCo... Galya B

06:52 AM Feature #4854: origin affinity

We can swap the actual implementation at any time if any inconvenience is found, still using the Java interface @java... Galya B

06:45 AM Feature #4854: origin affinity

I think @java.util.prefs.Preferences@ may be a good enough generic solution for all clients. I'll just have to figure... Galya B

06:41 AM Feature #4854: origin affinity

@UserKeyValueStorage@ is an abstract class that implements @KeyValueStorage@ interface and follows the idea to store ... Sergey Ivanovskiy

06/15/2023

12:10 PM Feature #4854: origin affinity

> Actually if @UserKeyValueStorage@ is meant to be used only through 4GL methods, then its handling can happen on the... Greg Shah

10:11 AM Feature #4854: origin affinity

Actually if @UserKeyValueStorage@ is meant to be used only through 4GL methods, then its handling can happen on the F... Galya B

10:01 AM Feature #4854: origin affinity

Greg Shah wrote:
> * We have host + port affinity.
If in-app user is allocated port, this port can't be used for an... Galya B

09:58 AM Feature #4854: origin affinity

Greg Shah wrote:
> * Port affinity doesn't work when multiple brokers are in use.
This will write off some deployme... Galya B

09:54 AM Feature #4854: origin affinity

I'm having one ground breaking idea running in the background in my brain for a while... I'll try to flesh it out. Pe... Galya B

09:26 AM Feature #4854: origin affinity

> Originally the task intended to solve the problem of making ports stable for end-users. But there is another variab... Greg Shah

09:22 AM Feature #4854: origin affinity

Greg Shah wrote:
> * Increased points of failure.
> * Slower.
Well, having the client traffic go through an embedd... Galya B

09:19 AM Feature #4854: origin affinity

Originally the task intended to solve the problem of making ports stable for end-users. But there is another variable... Galya B

09:13 AM Feature #4854: origin affinity

The complications that are added by reverse proxy:
* More complex configuration.
* Increased points of failure.
... Greg Shah

09:09 AM Feature #4854: origin affinity

The problem with remote spawns is that it's probably the preferred deployment for some apps (the main way to spawn we... Galya B

07:17 AM Feature #4854: origin affinity

> @UserKeyValueStorage@ is not supposed to have 4GL interface, right?
Incorrect. See #4517.
> In FWD which one... Greg Shah

07:12 AM Feature #4854: origin affinity

> did I get this right?
Yes. There is also the [[p2j:Reverse Proxy]] case which adds complications. Greg Shah

07:04 AM Feature #4854: origin affinity

And a slightly unrelated question:
From @PreferencesFactory@ javadoc:
> @Preferences.userRoot()@ returns the user... Galya B

06:03 AM Feature #4854: origin affinity

@UserKeyValueStorage@ is not supposed to have 4GL interface, right? Galya B

05:46 AM Feature #4854: origin affinity

Actually remote hosts (different IPs) are an issue for @localStorage@ in general. Galya B

05:07 AM Feature #4854: origin affinity

There is an important limitation to working with domains. You need to know beforehand what domain / subdomain is mapp... Galya B

06/14/2023

02:32 PM Feature #4854: origin affinity

> If the stored data is not considered privacy-sensitive or exposing information that needs authorization, then the s... Greg Shah

06:13 AM Feature #4854: origin affinity

That being said, I actually remember that @localStorage@ data is readable by everyone with access to the device, it's... Galya B

06:07 AM Feature #4854: origin affinity

But before going too far with this task, let me ask the most important question: What type of data do we expect to be... Galya B

06:02 AM Feature #4854: origin affinity

Greg Shah wrote:
> > Then User @gbb@ is always redirected to its dedicated subdomain @https://e83aed3ddf.users.websi... Galya B

06/13/2023

08:33 AM Feature #4854: origin affinity

> > The number of users in these pools is going to be limited. The average pool side will be between 5 and 25 users.... Greg Shah

08:32 AM Feature #4854: origin affinity

> Enabling @*.users.website.com@ in the DNS to point to the FWD server's host.
Yes, with the proper Jetty config,... Greg Shah

08:06 AM Feature #4854: origin affinity

Greg Shah wrote:
> The number of users in these pools is going to be limited. The average pool side will be between... Galya B

08:03 AM Feature #4854: origin affinity

Greg Shah wrote:
> A DNS subdomain implies a dedicated IP address. Are you suggesting allocating an IP address and ... Galya B

07:42 AM Feature #4854: origin affinity

> I think I saw somewhere a task that was about reworking the spawning of new web clients as separate Jetty instances... Greg Shah

07:41 AM Feature #4854: origin affinity

> The max range of ports can be 49152-65535 (~16k).
Are you talking about the port number for the browser's sessio... Greg Shah

07:14 AM Feature #4854: origin affinity

I think I saw somewhere a task that was about reworking the spawning of new web clients as separate Jetty instances. ... Galya B

07:12 AM Feature #4854: origin affinity

The max range of ports can be 49152-65535 (~16k). This is the max number of concurrent sessions currently. When each ... Galya B

08:06 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

> Does it mean a browser instance at this point should be distinguishable?
Yes.
> If the UUID is unique for eac... Greg Shah

05:31 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

> This would be unique across all browser instances that connect to the same FWD server.
Does it mean a @browser ... Galya B

06/12/2023

01:01 PM Feature #4853 (WIP): implement support for reporting a device-id which is meant to identify a uni...

Galya B

06/09/2023

12:10 PM Feature #3931: single sign-on for virtual desktop mode

> Is mapping end-users to OS accounts in a manual way even possible? I guess the customer systems support sign-up and... Greg Shah

11:59 AM Feature #3931: single sign-on for virtual desktop mode

Another one to verify I got right: Are temp users used only to authenticate @NativeSecureConnection@ before the serve... Galya B

11:15 AM Feature #3931: single sign-on for virtual desktop mode

I'm not sure if I got this right: Is the spawner running as admin to allow spawning client processes with any other u... Galya B

11:11 AM Feature #3931: single sign-on for virtual desktop mode

Also is it an option to consider the possible implications of running multiple end-users with the same OS user or jus... Galya B

11:10 AM Feature #3931: single sign-on for virtual desktop mode

The question about the amount of end-users is also related to the OS user pooling implementation. If the pooling can'... Galya B

10:56 AM Feature #3931: single sign-on for virtual desktop mode

Is mapping end-users to OS accounts in a manual way even possible? I guess the customer systems support sign-up and d... Galya B