FWD » Core Development » User Interface

07/05/2023

12:53 PM Feature #3931: single sign-on for virtual desktop mode

I'm still not sure if we need to enable SSO server-wide or just for certain clients. When SSO will be server-wide alw... Galya B

12:45 PM Feature #3931: single sign-on for virtual desktop mode

Sandbox in 3931a based on trunk 14637, commits 14638 & 14639.
What I did:
* The same login page and POST request ... Galya B

08:14 AM Feature #3931: single sign-on for virtual desktop mode

> I guess we want to make Virtual Desktop allow association of fwd users to os users without passwords with trusted s... Greg Shah

08:13 AM Feature #3931: single sign-on for virtual desktop mode

> But I'm not sure if changing the @auth-plugin@ to a new that serves the SSO flow will affect other clients that are... Greg Shah

07/04/2023

01:43 PM Feature #3931 (WIP): single sign-on for virtual desktop mode

Branch 3931a created. Galya B

07/03/2023

12:07 PM Feature #3931: single sign-on for virtual desktop mode

Basically sessions will have to be created under the fwd user associated with the login form request.
Some identif... Galya B

11:41 AM Feature #3931: single sign-on for virtual desktop mode

The @auth-plugin@ has to be changed for web, because that's where the FWD user is associated with the security contex... Galya B

11:16 AM Feature #4129: map web client users to OS accounts

> From #3770:
> >add 4GL API for authentication
I don't plan to keep this part. There is no need for the 4GL cod... Greg Shah

11:15 AM Feature #4129: map web client users to OS accounts

> As it is now, there is no user interaction / input before spawning the client process under the os user.
There i... Greg Shah

11:13 AM Feature #4129: map web client users to OS accounts

> but it will not improve on using only one os user and trustedspawner for embedded, which is in #4129#Improvements p... Greg Shah

11:09 AM Feature #4129: map web client users to OS accounts

From #3770:
>add 4GL API for authentication
>call this API before spawning
How do you know the user/pass at th... Galya B

11:07 AM Feature #4129: map web client users to OS accounts

As it is now, there is no user interaction / input before spawning the client process under the os user. Galya B

11:05 AM Feature #4129: map web client users to OS accounts

Reusing the auth back-end will make in-app users authentication consistent between both web drivers, but it will not ... Galya B

11:01 AM Feature #4129: map web client users to OS accounts

> In hotel gui isn't the embedded login an in-app login?
Not exactly. It is currently a custom integration to han... Greg Shah

10:57 AM Feature #4129: map web client users to OS accounts

I mean for embedded there is no FWD login. We'll rework the one for Virtual Desktop, but for embedded there is nothin... Galya B

10:52 AM Feature #4129: map web client users to OS accounts

In hotel gui isn't the embedded login an in-app login? Galya B

10:51 AM Feature #4129: map web client users to OS accounts

In both scenarios there will not be an in-app login. Greg Shah

10:50 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> Probably not since the UI requirements might be different, but we will want the same backend auth... Galya B

10:49 AM Feature #4129: map web client users to OS accounts

> Currently embedded is using only @trustedspawner@ and only one account @webClient/defaultAccount@, that's how it's ... Greg Shah

10:15 AM Feature #4129: map web client users to OS accounts

Currently embedded is using only @trustedspawner@ and only one account @webClient/defaultAccount@, that's how it's ha... Galya B

09:24 AM Feature #4129: map web client users to OS accounts

What about:... Galya B

06:03 AM Feature #4129: map web client users to OS accounts

I was finally able to follow the security context creation flow and most importantly the association with fwd user fo... Galya B

06/30/2023

12:45 PM Feature #4129: map web client users to OS accounts

I've followed the process of creating a web client and documented in [[internal-documentation:Sign-in#Virtual-Desktop... Galya B

08:56 AM Feature #4129: map web client users to OS accounts

> > Moving this stuff around is out of scope.
> Speaking of out of scope, what do you say about revamp of brokers u... Greg Shah

08:47 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> I don't understand this point. The requirement is to allow a login to a particular web client to... Galya B

08:47 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> Moving this stuff around is out of scope.
Speaking of out of scope, what do you say about revam... Galya B

08:40 AM Feature #4129: map web client users to OS accounts

> On the other hand I don't know how applicable is the case of the app storing user specific data on the broker that ... Greg Shah

08:38 AM Feature #4129: map web client users to OS accounts

> > The remote broker interface would need enhancement to provide account management features.
> It will also requir... Greg Shah

07:45 AM Feature #4129: map web client users to OS accounts

On the other hand I don't know how applicable is the case of the app storing user specific data on the broker that ne... Galya B

07:08 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> The remote broker interface would need enhancement to provide account management features.
It wi... Galya B

06:40 AM Feature #4129: map web client users to OS accounts

> > > I can't imagine a customer who will create FWD users for each of their app / end users.
> >
> > We have mult... Greg Shah

06:37 AM Feature #4129: map web client users to OS accounts

Galya B wrote:
> Greg Shah wrote:
> > Add/remove/edit users and groups is in the admin UI. ACL add/remove/edit is ... Greg Shah

06:36 AM Feature #4129: map web client users to OS accounts

> > 1. Should we implement a facility in our admin UI to create/delete and manage OS accounts? This probably include... Greg Shah

05:04 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> > I can't imagine a customer who will create FWD users for each of their app / end users.
>
> ... Galya B

04:43 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> Add/remove/edit users and groups is in the admin UI. ACL add/remove/edit is also in the admin UI... Galya B

03:29 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> 1. Should we implement a facility in our admin UI to create/delete and manage OS accounts? This ... Galya B

09:41 AM Feature #4856: web client session forking

> Now can I start the implementation? :) There is not much more to consider in the flow of #4856 and #3931. Better do... Greg Shah

09:32 AM Feature #4856: web client session forking

Now can I start the implementation? :) There is not much more to consider in the flow of #4856 and #3931. Better do a... Galya B

09:20 AM Feature #4856: web client session forking

Yes, I think that is correct. Greg Shah

09:13 AM Feature #4856: web client session forking

And if single login page is enabled and auth hook impl provided, then call the auth hook to ask for a new forked sess... Galya B

09:11 AM Feature #4856: web client session forking

To sum up the implementation details: Add button to the web driver wrapper container, click opens a new tab / new cli... Galya B

09:10 AM Feature #4856: web client session forking

> "Session forking" is somewhat too strong expression in my opinion.
I don't have a better term. We are literally... Greg Shah

09:08 AM Feature #4856: web client session forking

> Alright, so we save one OS login screen with the whole operation.
Worst case, yes. For the single signon case, ... Greg Shah

09:06 AM Feature #4856: web client session forking

"Session forking" is somewhat too strong expression in my opinion. Galya B

09:05 AM Feature #4856: web client session forking

Alright, so we save one OS login screen with the whole operation. Galya B

09:05 AM Feature #4856: web client session forking

> New client process / FWD session will open the same "entry point" 4GL process that has login.
Yes, that is OK.
... Greg Shah

09:04 AM Feature #4856: web client session forking

> Let it be js click.
>
> So, how do I determine if the customer app has login or not?
From a javascript/web cl... Greg Shah

08:59 AM Feature #4856: web client session forking

New client process / FWD session will open the same "entry point" 4GL process that has login. It needs to know it's f... Galya B

08:57 AM Feature #4856: web client session forking

Let it be js click.
So, how do I determine if the customer app has login or not? If single login page is not enabl... Galya B

08:54 AM Feature #4856: web client session forking

> > We cannot assume there is an auth server involved and if one is part of the solution it would only be hidden behi... Greg Shah

08:49 AM Feature #4856: web client session forking

Greg Shah wrote:
> I don't see why we need 4GL code involved. The idea here was to implement this forking as a buil... Galya B

08:42 AM Feature #4856: web client session forking

Greg Shah wrote:
> We cannot assume there is an auth server involved and if one is part of the solution it would onl... Galya B

08:30 AM Feature #4856: web client session forking

> May I do a POC for #4856 and #3931 in a new branch? Otherwise the sign-in tasks come to standstill.
I'm not yet ... Greg Shah

08:29 AM Feature #4856: web client session forking

> The whole thing will also require some custom 4GL method that triggers FWD actions: first on the server get the blo... Greg Shah

08:24 AM Feature #4856: web client session forking

> A new login session should be created by the auth server.
We cannot assume there is an auth server involved and... Greg Shah

07:52 AM Feature #4856: web client session forking

May I do a POC for #4856 and #3931 in a new branch? Otherwise the sign-in tasks come to standstill. Galya B

03:51 AM Feature #4856: web client session forking

The whole thing will also require some custom 4GL method that triggers FWD actions: first on the server get the blob,... Galya B

03:44 AM Feature #4856: web client session forking

Greg Shah wrote:
> Note the requirement to avoid additional authentication.
A new login session should be created b... Galya B

09:23 AM Feature #4854: origin affinity

With the server-side state, we may not implement origin affinity at all. Greg Shah

09:19 AM Feature #4854: origin affinity

If port affinity is the to-go solution, it will require licensing policy in place from the get go. Otherwise how to k... Galya B

06/29/2023

12:08 PM Feature #3931: single sign-on for virtual desktop mode

Yes, if we go that route. Let's get everything described and agreed first. Greg Shah

11:31 AM Feature #3931: single sign-on for virtual desktop mode

I want to create 4GL attr @AUTH-BLOB@, do we add it to @SESSION@ as well? Galya B

11:25 AM Feature #3931: single sign-on for virtual desktop mode

> How are hooks provided? I don't think we have dependency injection or event system built-in.
A class implementin... Greg Shah

11:24 AM Feature #3931: single sign-on for virtual desktop mode

> The auth logic, where DB queries are done, should be part of FWD server?
It would be Java code that is written b... Greg Shah

11:05 AM Feature #3931: single sign-on for virtual desktop mode

How are hooks provided? I don't think we have dependency injection or event system built-in. Galya B

10:42 AM Feature #3931: single sign-on for virtual desktop mode

The auth logic, where DB queries are done, should be part of FWD server? Galya B

10:39 AM Feature #3931: single sign-on for virtual desktop mode

> FWD hits the customer's auth server and gets response success, the fwd user and some session specific data, blob
... Greg Shah

10:35 AM Feature #3931: single sign-on for virtual desktop mode

The most simple flow would be:
1. SSO Login screen is open
2. User/pass entered
3. FWD hits the customer's auth se... Galya B

10:30 AM Feature #3931: single sign-on for virtual desktop mode

Greg Shah wrote:
> I don't see this as a separate service.
I think we speak about different things here. It's not... Galya B

10:25 AM Feature #3931: single sign-on for virtual desktop mode

> All customers requesting sso login will have to provide authentication server - 3rd party integration that we suppo... Greg Shah

10:17 AM Feature #3931: single sign-on for virtual desktop mode

Continue from #7465.
Greg Shah wrote:
> We cannot require OAuth2 as part of this interface. We are providing sup... Galya B

11:09 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

It's on hold.. Just to mention what was wrong with my idea: WebRTC changed the specification and doesn't expose the l... Galya B

08:43 AM Feature #4129: map web client users to OS accounts

> Is @config/auth-plugins/option@ the way of defining FWD user for the web process? Its value is @bogus@ in testcases... Greg Shah

08:39 AM Feature #4129: map web client users to OS accounts

Add/remove/edit users and groups is in the admin UI. ACL add/remove/edit is also in the admin UI. Groups are subjec... Greg Shah

08:23 AM Feature #4129: map web client users to OS accounts

Also the FWD user @bogus@ is listed in @subjects@ in multiple @security/acl@ resources and I don't see a way to updat... Galya B

08:17 AM Feature #4129: map web client users to OS accounts

Is @config/auth-plugins/option@ the way of defining FWD user for the web process? Its value is @bogus@ in testcases, ... Galya B

06/28/2023

09:34 AM Feature #4853 (Hold): implement support for reporting a device-id which is meant to identify a un...

Greg Shah

09:31 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

I would love to indicate I'm pausing it. Unfortunately this is not an option in the Status field. Galya B

09:30 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

I appreciate it. Please pause work on this specific task. Greg Shah

09:12 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

Greg Shah wrote:
> Anything behind a NAT firewall will not expose the local IP at the TCP/IP level.
NAT is exactl... Galya B

09:03 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

> so they definitely will know about the host ip in the local network as well
Actually, I'm not so sure that is th... Greg Shah

08:49 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

@WebRTC@ is the only way to find more network details in the browser. If we don't rely on network details (host / ip)... Galya B

08:46 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

The problem is that I don't know enough about networks and network related code, so I'm not completely sure how the p... Galya B

08:40 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

The idea of a device-id is that it is stable and associated with the system on which the browser runs. The "local IP... Greg Shah

08:39 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

I was originally expecting the local IP to be the host IP and it probably is, when the protocol is used outside the b... Galya B

08:21 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

Greg Shah wrote:
> 2 tabs will have different "local IP" as will tabs in 2 different browser instances, correct?
... Galya B

08:21 AM Feature #4853 (WIP): implement support for reporting a device-id which is meant to identify a uni...

Greg Shah

08:20 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

> Without WebRTC local IP we can't differentiate between web users behind a proxy using standard machines with the sa... Greg Shah

06:23 AM Feature #4853 (Review): implement support for reporting a device-id which is meant to identify a ...

Galya B

06:14 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

Without WebRTC local IP we can't differentiate between web users behind a proxy using standard machines with the same... Galya B

06:04 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

Client preferences will not be related to this id, but to the FWD user and will be applied after login / web client s... Galya B

06/26/2023

03:49 PM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> FWD doesn't know anything about @user_client.xml@. What are you referencing here?
True. But t... Roger Borrello

03:37 PM Feature #4129: map web client users to OS accounts

FWD doesn't know anything about @user_client.xml@. What are you referencing here? Greg Shah

03:22 PM Feature #4129: map web client users to OS accounts

> 1. Should we implement a facility in our admin UI to create/delete and manage OS accounts? This probably includes ... Roger Borrello

01:29 PM Feature #4129: map web client users to OS accounts

> > The FWD user is unique enough.
> I can't imagine a customer who will create FWD users for each of their app / en... Greg Shah

12:07 PM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> The FWD user is unique enough.
I can't imagine a customer who will create FWD users for each of ... Galya B

11:31 AM Feature #4129: map web client users to OS accounts

> Just throwing a random idea here: If on successful login the app returns a unique id for the user instead of userna... Greg Shah

11:28 AM Feature #4129: map web client users to OS accounts

Galya B wrote:
> Greg Shah wrote:
> > If we assume that FWD really doesn't care about the app user
>
> > the ma... Greg Shah

09:42 AM Feature #4129: map web client users to OS accounts

Adding a few more details to the random idea above: Instead of creating multiple fwd users in the admin panel with th... Galya B

09:23 AM Feature #4129: map web client users to OS accounts

Just throwing a random idea here: If on successful login the app returns a unique id for the user instead of username... Galya B

04:23 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> If we assume that FWD really doesn't care about the app user
> the mapping of a given FWD acc... Galya B

11:53 AM Feature #4856: web client session forking

> Opening manually multiple browser windows in the same browser instance should fulfill the requirement.
The resul... Greg Shah

04:23 AM Feature #4856: web client session forking

Opening manually multiple browser windows in the same browser instance should fulfill the requirement. The identifier... Galya B

04:33 AM Feature #4854: origin affinity

As discussed earlier client-side web storage can't be persistent, because @localStorage@ relies on the host name, whi... Galya B

06/23/2023

11:37 AM Feature #4129: map web client users to OS accounts

> I thought the task is to map app-users to os-users in directory.xml, so this is somewhat different from what I got.... Greg Shah

10:47 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> We don't need the app user. The hook can return the FWD user that corresponds to the app user th... Galya B

10:39 AM Feature #4129: map web client users to OS accounts

> > We have no plan to store things in-memory.
>
> If there are any plans I don't know of, please share the direct... Greg Shah

10:38 AM Feature #4129: map web client users to OS accounts

> > Not that I know of. We have no plan to store things in-memory.
> How do you find the mapping of the app user wh... Greg Shah

10:30 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> We have no plan to store things in-memory.
If there are any plans I don't know of, please shar... Galya B

10:08 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> Not that I know of. We have no plan to store things in-memory.
How do you find the mapping of t... Galya B

10:05 AM Feature #4129: map web client users to OS accounts

> Is the argument about in-memory data structure not valid?
Not that I know of. We have no plan to store things i... Greg Shah

10:02 AM Feature #4129: map web client users to OS accounts

Is the argument about in-memory data structure not valid? Galya B

06:19 AM Feature #4129: map web client users to OS accounts

> > Do we need to store information about the app users?
> No, nothing other than knowing what FWD user and OS user ... Greg Shah

01:43 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> > If we cleanup after each user, do we really need 1:1?
>
> I'm not sure what you mean by cle... Galya B

01:30 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> It would be a natural approach to store some amount of this mapping information in the FWD accoun... Galya B

06/22/2023

03:57 PM Feature #4129: map web client users to OS accounts

> If we cleanup after each user, do we really need 1:1?
I'm not sure what you mean by cleanup, but I suspect the ... Greg Shah

06/21/2023

06:31 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> I also don't see exactly how we would implement a one-to-one mapping, which is the most common ca... Galya B

06/20/2023

05:02 PM Feature #4129: map web client users to OS accounts

> Before starting I need to have the directory.xml structure approved:
It is not fully clear the purpose of the @a... Greg Shah

07:30 AM Feature #4129: map web client users to OS accounts

Before starting I need to have the directory.xml structure approved:... Galya B

06/16/2023

03:26 PM Feature #4517: optionally back the 4GL features for Registry access with the user-specific offlin...

Galya B wrote:
> What class implements the global 4GL methods accessing the Windows registry store?
To the conver... Greg Shah

07:22 AM Feature #4517: optionally back the 4GL features for Registry access with the user-specific offlin...

!preferences.png! Galya B

06:24 AM Feature #4517: optionally back the 4GL features for Registry access with the user-specific offlin...

To sum it up: This FWD persistent storage should be used:
1. On non-Windows operating system for global environment ... Galya B

05:38 AM Feature #4517: optionally back the 4GL features for Registry access with the user-specific offlin...

What class implements the global 4GL methods accessing the Windows registry store? Galya B

10:04 AM Feature #3931: single sign-on for virtual desktop mode

Sorry for asking multiple times. Just want to make sure the old comments are not related, since it's quite important.... Galya B

10:03 AM Feature #3931: single sign-on for virtual desktop mode

We would implement the login outselves and just call the hook which is non-interactive code implemented by the custom... Greg Shah

10:02 AM Feature #3931: single sign-on for virtual desktop mode

I agree that the new login code is NOT 4GL code. That is what I meant in #3931-46 when I said "This hook will not be... Greg Shah

09:50 AM Feature #3931: single sign-on for virtual desktop mode

Greg Shah wrote:
> > For #3770-81, the simplest way is to provide a directory-configured auth hook which checks the ... Galya B

09:45 AM Feature #3931: single sign-on for virtual desktop mode

As part of moving to this approach, they will modify the application to bypass their normal 4GL login. We will only ... Greg Shah

09:33 AM Feature #3931: single sign-on for virtual desktop mode

Greg Shah wrote:
> This hook will not be 4GL code.
I mean their login page being 4GL will have to live a complete C... Galya B

09:29 AM Feature #3931: single sign-on for virtual desktop mode

> If the login screen is 4GL app controlled by the customer, how do we manage different sessions? We'll need a dedica... Greg Shah

08:29 AM Feature #3931: single sign-on for virtual desktop mode

4GL app needs OS user. OS user is determined after app login. App login needs 4GL app. And we have an infinite loop. Galya B

08:26 AM Feature #3931: single sign-on for virtual desktop mode

If the login screen is 4GL app controlled by the customer, how do we manage different sessions? We'll need a dedicate... Galya B

09:22 AM Feature #4129: map web client users to OS accounts

> OS users will have their passwords in directory encrypted like for @admin@ user.
I'm not sure this is needed in... Greg Shah

09:17 AM Feature #4129: map web client users to OS accounts

> What is FWD user? I understand the admin has access to the admin login and temp accounts are used for @NativeSecure... Greg Shah

08:38 AM Feature #4129: map web client users to OS accounts

OS users will have their passwords in directory encrypted like for @admin@ user. But I can't recall do we expect the ... Galya B

04:20 AM Feature #4129: map web client users to OS accounts

What is FWD user? I understand the admin has access to the admin login and temp accounts are used for @NativeSecureCo... Galya B

06:52 AM Feature #4854: origin affinity

We can swap the actual implementation at any time if any inconvenience is found, still using the Java interface @java... Galya B

06:45 AM Feature #4854: origin affinity

I think @java.util.prefs.Preferences@ may be a good enough generic solution for all clients. I'll just have to figure... Galya B

06:41 AM Feature #4854: origin affinity

@UserKeyValueStorage@ is an abstract class that implements @KeyValueStorage@ interface and follows the idea to store ... Sergey Ivanovskiy

06/15/2023

12:10 PM Feature #4854: origin affinity

> Actually if @UserKeyValueStorage@ is meant to be used only through 4GL methods, then its handling can happen on the... Greg Shah

10:11 AM Feature #4854: origin affinity

Actually if @UserKeyValueStorage@ is meant to be used only through 4GL methods, then its handling can happen on the F... Galya B

10:01 AM Feature #4854: origin affinity

Greg Shah wrote:
> * We have host + port affinity.
If in-app user is allocated port, this port can't be used for an... Galya B

09:58 AM Feature #4854: origin affinity

Greg Shah wrote:
> * Port affinity doesn't work when multiple brokers are in use.
This will write off some deployme... Galya B

09:54 AM Feature #4854: origin affinity

I'm having one ground breaking idea running in the background in my brain for a while... I'll try to flesh it out. Pe... Galya B

09:26 AM Feature #4854: origin affinity

> Originally the task intended to solve the problem of making ports stable for end-users. But there is another variab... Greg Shah

09:22 AM Feature #4854: origin affinity

Greg Shah wrote:
> * Increased points of failure.
> * Slower.
Well, having the client traffic go through an embedd... Galya B

09:19 AM Feature #4854: origin affinity

Originally the task intended to solve the problem of making ports stable for end-users. But there is another variable... Galya B

09:13 AM Feature #4854: origin affinity

The complications that are added by reverse proxy:
* More complex configuration.
* Increased points of failure.
... Greg Shah

09:09 AM Feature #4854: origin affinity

The problem with remote spawns is that it's probably the preferred deployment for some apps (the main way to spawn we... Galya B

07:17 AM Feature #4854: origin affinity

> @UserKeyValueStorage@ is not supposed to have 4GL interface, right?
Incorrect. See #4517.
> In FWD which one... Greg Shah

07:12 AM Feature #4854: origin affinity

> did I get this right?
Yes. There is also the [[p2j:Reverse Proxy]] case which adds complications. Greg Shah

07:04 AM Feature #4854: origin affinity

And a slightly unrelated question:
From @PreferencesFactory@ javadoc:
> @Preferences.userRoot()@ returns the user... Galya B

06:03 AM Feature #4854: origin affinity

@UserKeyValueStorage@ is not supposed to have 4GL interface, right? Galya B

05:46 AM Feature #4854: origin affinity

Actually remote hosts (different IPs) are an issue for @localStorage@ in general. Galya B

05:07 AM Feature #4854: origin affinity

There is an important limitation to working with domains. You need to know beforehand what domain / subdomain is mapp... Galya B

06/14/2023

02:32 PM Feature #4854: origin affinity

> If the stored data is not considered privacy-sensitive or exposing information that needs authorization, then the s... Greg Shah

06:13 AM Feature #4854: origin affinity

That being said, I actually remember that @localStorage@ data is readable by everyone with access to the device, it's... Galya B

06:07 AM Feature #4854: origin affinity

But before going too far with this task, let me ask the most important question: What type of data do we expect to be... Galya B

06:02 AM Feature #4854: origin affinity

Greg Shah wrote:
> > Then User @gbb@ is always redirected to its dedicated subdomain @https://e83aed3ddf.users.websi... Galya B

06/13/2023

08:33 AM Feature #4854: origin affinity

> > The number of users in these pools is going to be limited. The average pool side will be between 5 and 25 users.... Greg Shah

08:32 AM Feature #4854: origin affinity

> Enabling @*.users.website.com@ in the DNS to point to the FWD server's host.
Yes, with the proper Jetty config,... Greg Shah

08:06 AM Feature #4854: origin affinity

Greg Shah wrote:
> The number of users in these pools is going to be limited. The average pool side will be between... Galya B

08:03 AM Feature #4854: origin affinity

Greg Shah wrote:
> A DNS subdomain implies a dedicated IP address. Are you suggesting allocating an IP address and ... Galya B

07:42 AM Feature #4854: origin affinity

> I think I saw somewhere a task that was about reworking the spawning of new web clients as separate Jetty instances... Greg Shah

07:41 AM Feature #4854: origin affinity

> The max range of ports can be 49152-65535 (~16k).
Are you talking about the port number for the browser's sessio... Greg Shah

07:14 AM Feature #4854: origin affinity

I think I saw somewhere a task that was about reworking the spawning of new web clients as separate Jetty instances. ... Galya B

07:12 AM Feature #4854: origin affinity

The max range of ports can be 49152-65535 (~16k). This is the max number of concurrent sessions currently. When each ... Galya B

08:06 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

> Does it mean a browser instance at this point should be distinguishable?
Yes.
> If the UUID is unique for eac... Greg Shah

05:31 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

> This would be unique across all browser instances that connect to the same FWD server.
Does it mean a @browser ... Galya B

06/12/2023

01:01 PM Feature #4853 (WIP): implement support for reporting a device-id which is meant to identify a uni...

Galya B

06/09/2023

12:10 PM Feature #3931: single sign-on for virtual desktop mode

> Is mapping end-users to OS accounts in a manual way even possible? I guess the customer systems support sign-up and... Greg Shah

11:59 AM Feature #3931: single sign-on for virtual desktop mode

Another one to verify I got right: Are temp users used only to authenticate @NativeSecureConnection@ before the serve... Galya B

11:15 AM Feature #3931: single sign-on for virtual desktop mode

I'm not sure if I got this right: Is the spawner running as admin to allow spawning client processes with any other u... Galya B

11:11 AM Feature #3931: single sign-on for virtual desktop mode

Also is it an option to consider the possible implications of running multiple end-users with the same OS user or jus... Galya B

11:10 AM Feature #3931: single sign-on for virtual desktop mode

The question about the amount of end-users is also related to the OS user pooling implementation. If the pooling can'... Galya B

10:56 AM Feature #3931: single sign-on for virtual desktop mode

Is mapping end-users to OS accounts in a manual way even possible? I guess the customer systems support sign-up and d... Galya B