FWD » Core Development » User Interface

07/13/2023

10:27 AM Feature #3931: single sign-on for virtual desktop mode

Also another question: the spawn calls to the brokers run at the moment in different contexts. Embedded has this cert... Galya B

10:11 AM Feature #3931: single sign-on for virtual desktop mode

@certificates/peers@ and @private-keys@ are probably needed for the server <-> server connection auth for rpc calls, ... Galya B

10:02 AM Feature #3931: single sign-on for virtual desktop mode

Constantin Asofiei wrote:
> * connect to the FWD server and authenticate via a certificate for a FWD process account... Galya B

09:50 AM Feature #3931: single sign-on for virtual desktop mode

Constantin Asofiei wrote:
> * call into the FWD server via @WebClientLauncher.launch@, where it can specify *any OS ... Galya B

09:37 AM Feature #3931: single sign-on for virtual desktop mode

No, this is not the single reason. I forgot to mention that the embedded app (for i.e. Hotel GUI) can be ran in stan... Constantin Asofiei

09:36 AM Feature #3931: single sign-on for virtual desktop mode

Ok, here goes my proposal for lean code:
1. Expose a method from @SecurityManager@ that checks @trustedspawner/resou... Galya B

09:26 AM Feature #3931: single sign-on for virtual desktop mode

Constantin Asofiei wrote:
> > 1. Why is there a certificate specified for embedded? I still don't get that as well. ... Galya B

09:13 AM Feature #3931: single sign-on for virtual desktop mode

Galya, the point of:... Constantin Asofiei

09:07 AM Feature #3931: single sign-on for virtual desktop mode

Also:
1. Why is there a certificate specified for embedded? I still don't get that as well. Is it for the same check... Galya B

08:58 AM Feature #3931: single sign-on for virtual desktop mode

That was pseudo-code of course, but my point is that I still don't see a good reason to keep the context. Galya B

08:56 AM Feature #3931: single sign-on for virtual desktop mode

Ok, let's get it straight: @EmbeddedWebHandler@ checks if @webClient/defaultAccount@ is the same as @trustedspawner/r... Galya B

08:44 AM Feature #3931: single sign-on for virtual desktop mode

Galya B wrote:
> Constantin Asofiei wrote:
> > Galya B wrote:
> > > Directory configs under @server/default/embedd... Constantin Asofiei

08:34 AM Feature #3931: single sign-on for virtual desktop mode

Constantin Asofiei wrote:
> Galya B wrote:
> > Directory configs under @server/default/embeddedWebApp@ are all used... Galya B

08:03 AM Feature #3931: single sign-on for virtual desktop mode

Galya B wrote:
> Directory configs under @server/default/embeddedWebApp@ are all used only in @EmbeddedWebAppHandler... Constantin Asofiei

08:00 AM Feature #3931: single sign-on for virtual desktop mode

Greg Shah wrote:
> > I don't know how to feed the fwd user from @WebHandler@ @spawnWorker@ (contained in @SsoAuthent... Galya B

07:46 AM Feature #3931: single sign-on for virtual desktop mode

Directory configs under @server/default/embeddedWebApp@ are all used only in @EmbeddedWebAppHandler.AuthWorker@. That... Galya B

07:34 AM Feature #3931: single sign-on for virtual desktop mode

Enabling trusted for VD (which is currently not possible) should probably be done the same way as embedded. But the c... Galya B

07:27 AM Feature #3931: single sign-on for virtual desktop mode

Greg Shah wrote:
> I suspect we need to add another @AUTH_MODE_*@ and associated logic to bypass our own authenticat... Galya B

07:21 AM Feature #3931: single sign-on for virtual desktop mode

Very good explanation, will be helpful for everyone jumping in later on. Unfortunately I already got it figured out b... Galya B

07:03 AM Feature #3931: single sign-on for virtual desktop mode

> The auth code in @SecurityManager@ (@authenticateClientWorker@ / @authenticateLocal@) is very special and I don't f... Greg Shah

06:50 AM Feature #3931: single sign-on for virtual desktop mode

@TrustedSpawnerResource@ is not specific to embedded mode. It could be used in virtual desktop mode to avoid the PAM... Greg Shah

06:45 AM Feature #3931: single sign-on for virtual desktop mode

Some context and decision criteria:
* The reason this task is entitled "single sign-on for virtual desktop mode" i... Greg Shah

06:23 AM Feature #3931: single sign-on for virtual desktop mode

It's not nit picking, I really need to get to the bottom of it to be able to rework those to accommodate for SSO and ... Galya B

06:14 AM Feature #3931: single sign-on for virtual desktop mode

VD works with OS user / pass, they auth in PAM -> pass.
Embedded works with certificates associated with alias assoc... Galya B

06:09 AM Feature #3931: single sign-on for virtual desktop mode

Galya B wrote:
> Why do we need checks for @TrustedSpawnerResource@ ? It's very imaginary to me, we create an imagin... Constantin Asofiei

06:06 AM Feature #3931: single sign-on for virtual desktop mode

I mean obviously spawner doesn't require specific auth to call the process and it works with passwordless. If the ser... Galya B

06:04 AM Feature #3931: single sign-on for virtual desktop mode

Constantin Asofiei wrote:
> Galya B wrote:
> > I see @EmbeddedWebAppHandler@ is created by Constantin and he can ex... Galya B

06:00 AM Feature #3931: single sign-on for virtual desktop mode

Galya B wrote:
> I see @EmbeddedWebAppHandler@ is created by Constantin and he can explain us better why @AuthWorker... Constantin Asofiei

05:48 AM Feature #3931: single sign-on for virtual desktop mode

> Embedded doesn't have a default landing page, while VD has. For embedded @index.html@ where @<iframe id="embeddedP2... Greg Shah

05:47 AM Feature #3931: single sign-on for virtual desktop mode

I see @EmbeddedWebAppHandler@ is created by Constantin and he can explain us better why @AuthWorker@ exists. Galya B

05:45 AM Feature #3931: single sign-on for virtual desktop mode

Greg Shah wrote:
> > I'm trying to understand why virtual desktop runs without security context and bypasses securit... Galya B

05:42 AM Feature #3931: single sign-on for virtual desktop mode

I'm speaking only about the spawning process and the Thread with the security context doesn't do anything to my knowl... Galya B

05:42 AM Feature #3931: single sign-on for virtual desktop mode

> I'm trying to understand why virtual desktop runs without security context and bypasses security checks, while embe... Greg Shah

05:40 AM Feature #3931: single sign-on for virtual desktop mode

> I'm not sure if I've messed up something or this is how embedded is supposed to work, but when I define a startup p... Greg Shah

05:33 AM Feature #3931: single sign-on for virtual desktop mode

VD has this line @sp.bypass = !SecurityManager.getInstance().hasContext();@. Galya B

05:31 AM Feature #3931: single sign-on for virtual desktop mode

It is like the server says: Let me check my configs. ... a lot going on ... I'm all good. Now do the same as VD that ... Galya B

05:29 AM Feature #3931: single sign-on for virtual desktop mode

According to the comments in the code it seems related to @trusted@ mode, but it still doesn't make sense. Galya B

05:27 AM Feature #3931: single sign-on for virtual desktop mode

I'm trying to understand why virtual desktop runs without security context and bypasses security checks, while embedd... Galya B

05:25 AM Feature #3931: single sign-on for virtual desktop mode

> Is it... is it... the remote spawn that needs proper security context?
I don't understand the question. Securit... Greg Shah

04:37 AM Feature #3931: single sign-on for virtual desktop mode

Is it... is it... the remote spawn that needs proper security context? Galya B

07/12/2023

02:37 PM Bug #7515 (WIP): FILL-IN: editing dates issues

Vladimir Tsichevski

12:20 PM Bug #7515: FILL-IN: editing dates issues

Vladimir Tsichevski wrote:
> # Also, if the cursor was located in the rightmost position before the operation, the... Vladimir Tsichevski

07:34 AM Bug #7515: FILL-IN: editing dates issues

Please do check ChUI for each case because the ChUI rules may have differences. Also note that ChUI has a very speci... Greg Shah

07:19 AM Bug #7515: FILL-IN: editing dates issues

Vladimir Tsichevski wrote:
> In FWD selection is *not* erased.
According to the comments in the Java code, this... Vladimir Tsichevski

11:37 AM Feature #3931: single sign-on for virtual desktop mode

I'm not sure if I've messed up something or this is how embedded is supposed to work, but when I define a startup pro... Galya B

08:05 AM Feature #3931: single sign-on for virtual desktop mode

H * E * L * P
I don't understand something basic. Why does it matter what security context spawns the web client? ... Galya B

06:58 AM Feature #3931: single sign-on for virtual desktop mode

Embedded doesn't have a default landing page, while VD has. For embedded @index.html@ where @<iframe id="embeddedP2J"... Galya B

07/11/2023

05:01 PM Bug #7515: FILL-IN: editing dates issues

*(FIXED)* At least two issues when editing date with @FILL-IN@.
# When the user presses @Ctrl-A@ to select all, th... Vladimir Tsichevski

04:49 PM Bug #7515 (WIP): FILL-IN: editing dates issues

Vladimir Tsichevski

09:20 AM Feature #3931: single sign-on for virtual desktop mode

The auth code in @SecurityManager@ (@authenticateClientWorker@ / @authenticateLocal@) is very special and I don't fee... Galya B

09:05 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> That seems in conflict with your comment "All OS users will have to have password defined for web... Galya B

08:49 AM Feature #4129: map web client users to OS accounts

> As discussed earlier with SSO enabled both modes will have to be available for both drivers.
This is my expectio... Greg Shah

04:14 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> > If a new Authenticator for Virtual Desktop is introduced does it have to be integrated with all... Galya B

07/10/2023

04:33 PM Feature #4129: map web client users to OS accounts

> My question is if there can be different auth modes for different processes or it is only one for all?
Yes, it s... Greg Shah

07/07/2023

11:07 AM Feature #3931: single sign-on for virtual desktop mode

Also it's so convenient, I can already imagine the constant lack of ports if no restrictions are imposed. Galya B

09:55 AM Feature #3931: single sign-on for virtual desktop mode

If auto-login is supported and the cookie is not deleted on session completion, the redirect back to the login page w... Galya B

03:11 AM Feature #4854: origin affinity

OK, it can be made simpler. I've just tested it. A httpOnly cookie can be sent and received from @doPost@ and @doGet@... Galya B

02:47 AM Feature #4854: origin affinity

A subdomain is a more pretty solution, if the admin is in the mood to configure DNS. Galya B

02:46 AM Feature #4854: origin affinity

Hynek Cihlar wrote:
> A typical scenario is that the main site and the embedded FWD legacy app are coming from diffe... Galya B

02:34 AM Feature #4854: origin affinity

Galya B wrote:
> Hynek Cihlar wrote:
> > For plain virtual desktop this is true. However for embedded mode you can'... Hynek Cihlar

02:18 AM Feature #4854: origin affinity

Hynek Cihlar wrote:
> For plain virtual desktop this is true. However for embedded mode you can't assume anything ab... Galya B

02:17 AM Feature #4854: origin affinity

Galya B wrote:
> On the other hand browser extensions seem to be able to access @httpOnly@ cookies as well as @local... Hynek Cihlar

02:15 AM Feature #4854: origin affinity

Galya B wrote:
> Hynek Cihlar wrote:
> > It looks good. The only downside I see are the security implications stori... Hynek Cihlar

02:00 AM Feature #4854: origin affinity

On the other hand browser extensions seem to be able to access @httpOnly@ cookies as well as @localStorage@. Galya B

01:57 AM Feature #4854: origin affinity

Hynek Cihlar wrote:
> It looks good. The only downside I see are the security implications storing sensitive data in... Galya B

01:49 AM Feature #4854: origin affinity

Galya B wrote:
> Hynek Cihlar wrote:
> > For the auto login you want to store any secure access token as session co... Hynek Cihlar

01:14 AM Feature #4854: origin affinity

Constantin Asofiei wrote:
> Galya, you mean that Virtual Desktop will be run in an iframe? If so, we need to be pret... Galya B

01:12 AM Feature #4854: origin affinity

Hynek Cihlar wrote:
> For the auto login you want to store any secure access token as session cookie. But this can't... Galya B

07/06/2023

02:12 PM Feature #4854: origin affinity

Greg Shah wrote:
> > But I'm not sure how would this help with the auto login feature.
>
> I think the idea was t... Hynek Cihlar

01:26 PM Feature #4854: origin affinity

> But I'm not sure how would this help with the auto login feature.
I think the idea was that the main/parent page... Greg Shah

12:44 PM Feature #4854: origin affinity

Galya, you mean that Virtual Desktop will be run in an iframe? If so, we need to be pretty sure that the 'virtual des... Constantin Asofiei

12:31 PM Feature #4854: origin affinity

Greg Shah wrote:
> Hynek/Sergey: Do you have any thoughts?
Interesting idea. This could lead to some issues with ... Hynek Cihlar

11:24 AM Feature #4854: origin affinity

Greg Shah wrote:
> I do wonder if we have anything in the virtual desktop mode that will need to be changed to be OK... Galya B

11:18 AM Feature #4854: origin affinity

Actually there is one more: server-side storage stores all client prefs in one place, so it needs to know how to diff... Galya B

11:16 AM Feature #4854: origin affinity

Greg Shah wrote:
> On the other hand, we were already going down the server-side storage.
The only concern I have ... Galya B

11:13 AM Feature #4854: origin affinity

I have no strong objection. We use this approach already in Embedded Mode. I do wonder if we have anything in the v... Greg Shah

11:03 AM Feature #4854: origin affinity

I have one of those ideas I get smashed for having: Put login screen / web driver container in an iframe. Why?
1. Th... Galya B

07/05/2023

12:53 PM Feature #3931: single sign-on for virtual desktop mode

I'm still not sure if we need to enable SSO server-wide or just for certain clients. When SSO will be server-wide alw... Galya B

12:45 PM Feature #3931: single sign-on for virtual desktop mode

Sandbox in 3931a based on trunk 14637, commits 14638 & 14639.
What I did:
* The same login page and POST request ... Galya B

08:14 AM Feature #3931: single sign-on for virtual desktop mode

> I guess we want to make Virtual Desktop allow association of fwd users to os users without passwords with trusted s... Greg Shah

08:13 AM Feature #3931: single sign-on for virtual desktop mode

> But I'm not sure if changing the @auth-plugin@ to a new that serves the SSO flow will affect other clients that are... Greg Shah

07/04/2023

01:43 PM Feature #3931 (WIP): single sign-on for virtual desktop mode

Branch 3931a created. Galya B

07/03/2023

12:07 PM Feature #3931: single sign-on for virtual desktop mode

Basically sessions will have to be created under the fwd user associated with the login form request.
Some identif... Galya B

11:41 AM Feature #3931: single sign-on for virtual desktop mode

The @auth-plugin@ has to be changed for web, because that's where the FWD user is associated with the security contex... Galya B

11:16 AM Feature #4129: map web client users to OS accounts

> From #3770:
> >add 4GL API for authentication
I don't plan to keep this part. There is no need for the 4GL cod... Greg Shah

11:15 AM Feature #4129: map web client users to OS accounts

> As it is now, there is no user interaction / input before spawning the client process under the os user.
There i... Greg Shah

11:13 AM Feature #4129: map web client users to OS accounts

> but it will not improve on using only one os user and trustedspawner for embedded, which is in #4129#Improvements p... Greg Shah

11:09 AM Feature #4129: map web client users to OS accounts

From #3770:
>add 4GL API for authentication
>call this API before spawning
How do you know the user/pass at th... Galya B

11:07 AM Feature #4129: map web client users to OS accounts

As it is now, there is no user interaction / input before spawning the client process under the os user. Galya B

11:05 AM Feature #4129: map web client users to OS accounts

Reusing the auth back-end will make in-app users authentication consistent between both web drivers, but it will not ... Galya B

11:01 AM Feature #4129: map web client users to OS accounts

> In hotel gui isn't the embedded login an in-app login?
Not exactly. It is currently a custom integration to han... Greg Shah

10:57 AM Feature #4129: map web client users to OS accounts

I mean for embedded there is no FWD login. We'll rework the one for Virtual Desktop, but for embedded there is nothin... Galya B

10:52 AM Feature #4129: map web client users to OS accounts

In hotel gui isn't the embedded login an in-app login? Galya B

10:51 AM Feature #4129: map web client users to OS accounts

In both scenarios there will not be an in-app login. Greg Shah

10:50 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> Probably not since the UI requirements might be different, but we will want the same backend auth... Galya B

10:49 AM Feature #4129: map web client users to OS accounts

> Currently embedded is using only @trustedspawner@ and only one account @webClient/defaultAccount@, that's how it's ... Greg Shah

10:15 AM Feature #4129: map web client users to OS accounts

Currently embedded is using only @trustedspawner@ and only one account @webClient/defaultAccount@, that's how it's ha... Galya B

09:24 AM Feature #4129: map web client users to OS accounts

What about:... Galya B

06:03 AM Feature #4129: map web client users to OS accounts

I was finally able to follow the security context creation flow and most importantly the association with fwd user fo... Galya B

06/30/2023

12:45 PM Feature #4129: map web client users to OS accounts

I've followed the process of creating a web client and documented in [[internal-documentation:Sign-in#Virtual-Desktop... Galya B

08:56 AM Feature #4129: map web client users to OS accounts

> > Moving this stuff around is out of scope.
> Speaking of out of scope, what do you say about revamp of brokers u... Greg Shah

08:47 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> I don't understand this point. The requirement is to allow a login to a particular web client to... Galya B

08:47 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> Moving this stuff around is out of scope.
Speaking of out of scope, what do you say about revam... Galya B

08:40 AM Feature #4129: map web client users to OS accounts

> On the other hand I don't know how applicable is the case of the app storing user specific data on the broker that ... Greg Shah

08:38 AM Feature #4129: map web client users to OS accounts

> > The remote broker interface would need enhancement to provide account management features.
> It will also requir... Greg Shah

07:45 AM Feature #4129: map web client users to OS accounts

On the other hand I don't know how applicable is the case of the app storing user specific data on the broker that ne... Galya B

07:08 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> The remote broker interface would need enhancement to provide account management features.
It wi... Galya B

06:40 AM Feature #4129: map web client users to OS accounts

> > > I can't imagine a customer who will create FWD users for each of their app / end users.
> >
> > We have mult... Greg Shah

06:37 AM Feature #4129: map web client users to OS accounts

Galya B wrote:
> Greg Shah wrote:
> > Add/remove/edit users and groups is in the admin UI. ACL add/remove/edit is ... Greg Shah

06:36 AM Feature #4129: map web client users to OS accounts

> > 1. Should we implement a facility in our admin UI to create/delete and manage OS accounts? This probably include... Greg Shah

05:04 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> > I can't imagine a customer who will create FWD users for each of their app / end users.
>
> ... Galya B

04:43 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> Add/remove/edit users and groups is in the admin UI. ACL add/remove/edit is also in the admin UI... Galya B

03:29 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> 1. Should we implement a facility in our admin UI to create/delete and manage OS accounts? This ... Galya B

09:41 AM Feature #4856: web client session forking

> Now can I start the implementation? :) There is not much more to consider in the flow of #4856 and #3931. Better do... Greg Shah

09:32 AM Feature #4856: web client session forking

Now can I start the implementation? :) There is not much more to consider in the flow of #4856 and #3931. Better do a... Galya B

09:20 AM Feature #4856: web client session forking

Yes, I think that is correct. Greg Shah

09:13 AM Feature #4856: web client session forking

And if single login page is enabled and auth hook impl provided, then call the auth hook to ask for a new forked sess... Galya B

09:11 AM Feature #4856: web client session forking

To sum up the implementation details: Add button to the web driver wrapper container, click opens a new tab / new cli... Galya B

09:10 AM Feature #4856: web client session forking

> "Session forking" is somewhat too strong expression in my opinion.
I don't have a better term. We are literally... Greg Shah

09:08 AM Feature #4856: web client session forking

> Alright, so we save one OS login screen with the whole operation.
Worst case, yes. For the single signon case, ... Greg Shah

09:06 AM Feature #4856: web client session forking

"Session forking" is somewhat too strong expression in my opinion. Galya B

09:05 AM Feature #4856: web client session forking

Alright, so we save one OS login screen with the whole operation. Galya B

09:05 AM Feature #4856: web client session forking

> New client process / FWD session will open the same "entry point" 4GL process that has login.
Yes, that is OK.
... Greg Shah

09:04 AM Feature #4856: web client session forking

> Let it be js click.
>
> So, how do I determine if the customer app has login or not?
From a javascript/web cl... Greg Shah

08:59 AM Feature #4856: web client session forking

New client process / FWD session will open the same "entry point" 4GL process that has login. It needs to know it's f... Galya B

08:57 AM Feature #4856: web client session forking

Let it be js click.
So, how do I determine if the customer app has login or not? If single login page is not enabl... Galya B

08:54 AM Feature #4856: web client session forking

> > We cannot assume there is an auth server involved and if one is part of the solution it would only be hidden behi... Greg Shah

08:49 AM Feature #4856: web client session forking

Greg Shah wrote:
> I don't see why we need 4GL code involved. The idea here was to implement this forking as a buil... Galya B

08:42 AM Feature #4856: web client session forking

Greg Shah wrote:
> We cannot assume there is an auth server involved and if one is part of the solution it would onl... Galya B

08:30 AM Feature #4856: web client session forking

> May I do a POC for #4856 and #3931 in a new branch? Otherwise the sign-in tasks come to standstill.
I'm not yet ... Greg Shah

08:29 AM Feature #4856: web client session forking

> The whole thing will also require some custom 4GL method that triggers FWD actions: first on the server get the blo... Greg Shah

08:24 AM Feature #4856: web client session forking

> A new login session should be created by the auth server.
We cannot assume there is an auth server involved and... Greg Shah

07:52 AM Feature #4856: web client session forking

May I do a POC for #4856 and #3931 in a new branch? Otherwise the sign-in tasks come to standstill. Galya B

03:51 AM Feature #4856: web client session forking

The whole thing will also require some custom 4GL method that triggers FWD actions: first on the server get the blob,... Galya B

03:44 AM Feature #4856: web client session forking

Greg Shah wrote:
> Note the requirement to avoid additional authentication.
A new login session should be created b... Galya B

09:23 AM Feature #4854: origin affinity

With the server-side state, we may not implement origin affinity at all. Greg Shah

09:19 AM Feature #4854: origin affinity

If port affinity is the to-go solution, it will require licensing policy in place from the get go. Otherwise how to k... Galya B

06/29/2023

12:08 PM Feature #3931: single sign-on for virtual desktop mode

Yes, if we go that route. Let's get everything described and agreed first. Greg Shah

11:31 AM Feature #3931: single sign-on for virtual desktop mode

I want to create 4GL attr @AUTH-BLOB@, do we add it to @SESSION@ as well? Galya B

11:25 AM Feature #3931: single sign-on for virtual desktop mode

> How are hooks provided? I don't think we have dependency injection or event system built-in.
A class implementin... Greg Shah

11:24 AM Feature #3931: single sign-on for virtual desktop mode

> The auth logic, where DB queries are done, should be part of FWD server?
It would be Java code that is written b... Greg Shah

11:05 AM Feature #3931: single sign-on for virtual desktop mode

How are hooks provided? I don't think we have dependency injection or event system built-in. Galya B

10:42 AM Feature #3931: single sign-on for virtual desktop mode

The auth logic, where DB queries are done, should be part of FWD server? Galya B

10:39 AM Feature #3931: single sign-on for virtual desktop mode

> FWD hits the customer's auth server and gets response success, the fwd user and some session specific data, blob
... Greg Shah

10:35 AM Feature #3931: single sign-on for virtual desktop mode

The most simple flow would be:
1. SSO Login screen is open
2. User/pass entered
3. FWD hits the customer's auth se... Galya B

10:30 AM Feature #3931: single sign-on for virtual desktop mode

Greg Shah wrote:
> I don't see this as a separate service.
I think we speak about different things here. It's not... Galya B

10:25 AM Feature #3931: single sign-on for virtual desktop mode

> All customers requesting sso login will have to provide authentication server - 3rd party integration that we suppo... Greg Shah

10:17 AM Feature #3931: single sign-on for virtual desktop mode

Continue from #7465.
Greg Shah wrote:
> We cannot require OAuth2 as part of this interface. We are providing sup... Galya B

11:09 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

It's on hold.. Just to mention what was wrong with my idea: WebRTC changed the specification and doesn't expose the l... Galya B

08:43 AM Feature #4129: map web client users to OS accounts

> Is @config/auth-plugins/option@ the way of defining FWD user for the web process? Its value is @bogus@ in testcases... Greg Shah

08:39 AM Feature #4129: map web client users to OS accounts

Add/remove/edit users and groups is in the admin UI. ACL add/remove/edit is also in the admin UI. Groups are subjec... Greg Shah

08:23 AM Feature #4129: map web client users to OS accounts

Also the FWD user @bogus@ is listed in @subjects@ in multiple @security/acl@ resources and I don't see a way to updat... Galya B

08:17 AM Feature #4129: map web client users to OS accounts

Is @config/auth-plugins/option@ the way of defining FWD user for the web process? Its value is @bogus@ in testcases, ... Galya B

06/28/2023

09:34 AM Feature #4853 (Hold): implement support for reporting a device-id which is meant to identify a un...

Greg Shah

09:31 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

I would love to indicate I'm pausing it. Unfortunately this is not an option in the Status field. Galya B

09:30 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

I appreciate it. Please pause work on this specific task. Greg Shah

09:12 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

Greg Shah wrote:
> Anything behind a NAT firewall will not expose the local IP at the TCP/IP level.
NAT is exactl... Galya B

09:03 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

> so they definitely will know about the host ip in the local network as well
Actually, I'm not so sure that is th... Greg Shah

08:49 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

@WebRTC@ is the only way to find more network details in the browser. If we don't rely on network details (host / ip)... Galya B

08:46 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

The problem is that I don't know enough about networks and network related code, so I'm not completely sure how the p... Galya B

08:40 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

The idea of a device-id is that it is stable and associated with the system on which the browser runs. The "local IP... Greg Shah

08:39 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

I was originally expecting the local IP to be the host IP and it probably is, when the protocol is used outside the b... Galya B

08:21 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

Greg Shah wrote:
> 2 tabs will have different "local IP" as will tabs in 2 different browser instances, correct?
... Galya B

08:21 AM Feature #4853 (WIP): implement support for reporting a device-id which is meant to identify a uni...

Greg Shah

08:20 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

> Without WebRTC local IP we can't differentiate between web users behind a proxy using standard machines with the sa... Greg Shah

06:23 AM Feature #4853 (Review): implement support for reporting a device-id which is meant to identify a ...

Galya B

06:14 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

Without WebRTC local IP we can't differentiate between web users behind a proxy using standard machines with the same... Galya B

06:04 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...

Client preferences will not be related to this id, but to the FWD user and will be applied after login / web client s... Galya B

06/26/2023

03:49 PM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> FWD doesn't know anything about @user_client.xml@. What are you referencing here?
True. But t... Roger Borrello

03:37 PM Feature #4129: map web client users to OS accounts

FWD doesn't know anything about @user_client.xml@. What are you referencing here? Greg Shah

03:22 PM Feature #4129: map web client users to OS accounts

> 1. Should we implement a facility in our admin UI to create/delete and manage OS accounts? This probably includes ... Roger Borrello

01:29 PM Feature #4129: map web client users to OS accounts

> > The FWD user is unique enough.
> I can't imagine a customer who will create FWD users for each of their app / en... Greg Shah

12:07 PM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> The FWD user is unique enough.
I can't imagine a customer who will create FWD users for each of ... Galya B

11:31 AM Feature #4129: map web client users to OS accounts

> Just throwing a random idea here: If on successful login the app returns a unique id for the user instead of userna... Greg Shah

11:28 AM Feature #4129: map web client users to OS accounts

Galya B wrote:
> Greg Shah wrote:
> > If we assume that FWD really doesn't care about the app user
>
> > the ma... Greg Shah

09:42 AM Feature #4129: map web client users to OS accounts

Adding a few more details to the random idea above: Instead of creating multiple fwd users in the admin panel with th... Galya B

09:23 AM Feature #4129: map web client users to OS accounts

Just throwing a random idea here: If on successful login the app returns a unique id for the user instead of username... Galya B

04:23 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> If we assume that FWD really doesn't care about the app user
> the mapping of a given FWD acc... Galya B

11:53 AM Feature #4856: web client session forking

> Opening manually multiple browser windows in the same browser instance should fulfill the requirement.
The resul... Greg Shah

04:23 AM Feature #4856: web client session forking

Opening manually multiple browser windows in the same browser instance should fulfill the requirement. The identifier... Galya B

04:33 AM Feature #4854: origin affinity

As discussed earlier client-side web storage can't be persistent, because @localStorage@ relies on the host name, whi... Galya B

06/23/2023

11:37 AM Feature #4129: map web client users to OS accounts

> I thought the task is to map app-users to os-users in directory.xml, so this is somewhat different from what I got.... Greg Shah

10:47 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> We don't need the app user. The hook can return the FWD user that corresponds to the app user th... Galya B

10:39 AM Feature #4129: map web client users to OS accounts

> > We have no plan to store things in-memory.
>
> If there are any plans I don't know of, please share the direct... Greg Shah

10:38 AM Feature #4129: map web client users to OS accounts

> > Not that I know of. We have no plan to store things in-memory.
> How do you find the mapping of the app user wh... Greg Shah

10:30 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> We have no plan to store things in-memory.
If there are any plans I don't know of, please shar... Galya B

10:08 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> Not that I know of. We have no plan to store things in-memory.
How do you find the mapping of t... Galya B

10:05 AM Feature #4129: map web client users to OS accounts

> Is the argument about in-memory data structure not valid?
Not that I know of. We have no plan to store things i... Greg Shah

10:02 AM Feature #4129: map web client users to OS accounts

Is the argument about in-memory data structure not valid? Galya B

06:19 AM Feature #4129: map web client users to OS accounts

> > Do we need to store information about the app users?
> No, nothing other than knowing what FWD user and OS user ... Greg Shah

01:43 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> > If we cleanup after each user, do we really need 1:1?
>
> I'm not sure what you mean by cle... Galya B

01:30 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> It would be a natural approach to store some amount of this mapping information in the FWD accoun... Galya B

06/22/2023

03:57 PM Feature #4129: map web client users to OS accounts

> If we cleanup after each user, do we really need 1:1?
I'm not sure what you mean by cleanup, but I suspect the ... Greg Shah

06/21/2023

06:31 AM Feature #4129: map web client users to OS accounts

Greg Shah wrote:
> I also don't see exactly how we would implement a one-to-one mapping, which is the most common ca... Galya B

06/20/2023

05:02 PM Feature #4129: map web client users to OS accounts

> Before starting I need to have the directory.xml structure approved:
It is not fully clear the purpose of the @a... Greg Shah

07:30 AM Feature #4129: map web client users to OS accounts

Before starting I need to have the directory.xml structure approved:... Galya B

06/16/2023

03:26 PM Feature #4517: optionally back the 4GL features for Registry access with the user-specific offlin...

Galya B wrote:
> What class implements the global 4GL methods accessing the Windows registry store?
To the conver... Greg Shah

07:22 AM Feature #4517: optionally back the 4GL features for Registry access with the user-specific offlin...

!preferences.png! Galya B

06:24 AM Feature #4517: optionally back the 4GL features for Registry access with the user-specific offlin...

To sum it up: This FWD persistent storage should be used:
1. On non-Windows operating system for global environment ... Galya B

05:38 AM Feature #4517: optionally back the 4GL features for Registry access with the user-specific offlin...

What class implements the global 4GL methods accessing the Windows registry store? Galya B

10:04 AM Feature #3931: single sign-on for virtual desktop mode

Sorry for asking multiple times. Just want to make sure the old comments are not related, since it's quite important.... Galya B

10:03 AM Feature #3931: single sign-on for virtual desktop mode

We would implement the login outselves and just call the hook which is non-interactive code implemented by the custom... Greg Shah

10:02 AM Feature #3931: single sign-on for virtual desktop mode

I agree that the new login code is NOT 4GL code. That is what I meant in #3931-46 when I said "This hook will not be... Greg Shah

09:50 AM Feature #3931: single sign-on for virtual desktop mode

Greg Shah wrote:
> > For #3770-81, the simplest way is to provide a directory-configured auth hook which checks the ... Galya B

09:45 AM Feature #3931: single sign-on for virtual desktop mode

As part of moving to this approach, they will modify the application to bypass their normal 4GL login. We will only ... Greg Shah

09:33 AM Feature #3931: single sign-on for virtual desktop mode

Greg Shah wrote:
> This hook will not be 4GL code.
I mean their login page being 4GL will have to live a complete C... Galya B

09:29 AM Feature #3931: single sign-on for virtual desktop mode

> If the login screen is 4GL app controlled by the customer, how do we manage different sessions? We'll need a dedica... Greg Shah

08:29 AM Feature #3931: single sign-on for virtual desktop mode

4GL app needs OS user. OS user is determined after app login. App login needs 4GL app. And we have an infinite loop. Galya B

08:26 AM Feature #3931: single sign-on for virtual desktop mode

If the login screen is 4GL app controlled by the customer, how do we manage different sessions? We'll need a dedicate... Galya B

09:22 AM Feature #4129: map web client users to OS accounts

> OS users will have their passwords in directory encrypted like for @admin@ user.
I'm not sure this is needed in... Greg Shah

09:17 AM Feature #4129: map web client users to OS accounts

> What is FWD user? I understand the admin has access to the admin login and temp accounts are used for @NativeSecure... Greg Shah

08:38 AM Feature #4129: map web client users to OS accounts

OS users will have their passwords in directory encrypted like for @admin@ user. But I can't recall do we expect the ... Galya B

04:20 AM Feature #4129: map web client users to OS accounts

What is FWD user? I understand the admin has access to the admin login and temp accounts are used for @NativeSecureCo... Galya B

06:52 AM Feature #4854: origin affinity

We can swap the actual implementation at any time if any inconvenience is found, still using the Java interface @java... Galya B

06:45 AM Feature #4854: origin affinity

I think @java.util.prefs.Preferences@ may be a good enough generic solution for all clients. I'll just have to figure... Galya B

06:41 AM Feature #4854: origin affinity

@UserKeyValueStorage@ is an abstract class that implements @KeyValueStorage@ interface and follows the idea to store ... Sergey Ivanovskiy

06/15/2023

12:10 PM Feature #4854: origin affinity

> Actually if @UserKeyValueStorage@ is meant to be used only through 4GL methods, then its handling can happen on the... Greg Shah

10:11 AM Feature #4854: origin affinity

Actually if @UserKeyValueStorage@ is meant to be used only through 4GL methods, then its handling can happen on the F... Galya B

10:01 AM Feature #4854: origin affinity

Greg Shah wrote:
> * We have host + port affinity.
If in-app user is allocated port, this port can't be used for an... Galya B

09:58 AM Feature #4854: origin affinity

Greg Shah wrote:
> * Port affinity doesn't work when multiple brokers are in use.
This will write off some deployme... Galya B

09:54 AM Feature #4854: origin affinity

I'm having one ground breaking idea running in the background in my brain for a while... I'll try to flesh it out. Pe... Galya B

09:26 AM Feature #4854: origin affinity

> Originally the task intended to solve the problem of making ports stable for end-users. But there is another variab... Greg Shah

09:22 AM Feature #4854: origin affinity

Greg Shah wrote:
> * Increased points of failure.
> * Slower.
Well, having the client traffic go through an embedd... Galya B

09:19 AM Feature #4854: origin affinity

Originally the task intended to solve the problem of making ports stable for end-users. But there is another variable... Galya B

09:13 AM Feature #4854: origin affinity

The complications that are added by reverse proxy:
* More complex configuration.
* Increased points of failure.
... Greg Shah

09:09 AM Feature #4854: origin affinity

The problem with remote spawns is that it's probably the preferred deployment for some apps (the main way to spawn we... Galya B

07:17 AM Feature #4854: origin affinity

> @UserKeyValueStorage@ is not supposed to have 4GL interface, right?
Incorrect. See #4517.
> In FWD which one... Greg Shah

07:12 AM Feature #4854: origin affinity

> did I get this right?
Yes. There is also the [[p2j:Reverse Proxy]] case which adds complications. Greg Shah

07:04 AM Feature #4854: origin affinity

And a slightly unrelated question:
From @PreferencesFactory@ javadoc:
> @Preferences.userRoot()@ returns the user... Galya B

06:03 AM Feature #4854: origin affinity

@UserKeyValueStorage@ is not supposed to have 4GL interface, right? Galya B

05:46 AM Feature #4854: origin affinity

Actually remote hosts (different IPs) are an issue for @localStorage@ in general. Galya B

05:07 AM Feature #4854: origin affinity

There is an important limitation to working with domains. You need to know beforehand what domain / subdomain is mapp... Galya B

06/14/2023

02:32 PM Feature #4854: origin affinity

> If the stored data is not considered privacy-sensitive or exposing information that needs authorization, then the s... Greg Shah

06:13 AM Feature #4854: origin affinity

That being said, I actually remember that @localStorage@ data is readable by everyone with access to the device, it's... Galya B

06:07 AM Feature #4854: origin affinity

But before going too far with this task, let me ask the most important question: What type of data do we expect to be... Galya B

06:02 AM Feature #4854: origin affinity

Greg Shah wrote:
> > Then User @gbb@ is always redirected to its dedicated subdomain @https://e83aed3ddf.users.websi... Galya B