Activity

From 06/29/2023 to 07/28/2023

07/28/2023

03:59 PM Bug #7515: FILL-IN: editing dates issues: Vladimir Tsichevski wrote:
> Yet another issue: normally pressing @?@ (question) should always reset screen value to... Vladimir Tsichevski
11:41 AM Bug #7515: FILL-IN: editing dates issues: **#9855 (FIXED)** Yet another issue:
Test program:... Vladimir Tsichevski
02:53 PM Bug #7642: Assigning SESSION:DATE-FORMAT has no effect on existing date instances: Run this program. Assume the default date format is @mdy@ (as set in @directory.xml@).... Vladimir Tsichevski
02:39 PM Bug #7642 (WIP): Assigning SESSION:DATE-FORMAT has no effect on existing date instances: Vladimir Tsichevski

07/27/2023

08:59 AM Bug #7515: FILL-IN: editing dates issues: **(FIXED)** Yet another issue: normally pressing @?@ (question) should always reset screen value to an empty string.
... Vladimir Tsichevski

07/25/2023

11:21 AM Feature #3931: single sign-on for virtual desktop mode: Now a question about
> allowed to spawn a new session
The @BrokerServerServices@ acl/net config described [[p2j:R... Galya B
11:11 AM Feature #3931: single sign-on for virtual desktop mode: The current web flow is:
@WebHandler.spawnWorker@ -> @(Web)ClientSpawner.spawn@ -> [broker for the os user is found]... Galya B
09:45 AM Feature #3931: single sign-on for virtual desktop mode: By "any authorized context", I mean a context and caller that is allowed to spawn a new session. Greg Shah
09:42 AM Feature #3931: single sign-on for virtual desktop mode: Yes, brokers need to be supported. This is just a spawning mechanism it should not really be core to the concept of ... Greg Shah
09:27 AM Feature #3931: single sign-on for virtual desktop mode: Actually that is not correct. The broker is used just for spawning a separate process, so the connection to the serve... Galya B
09:12 AM Feature #3931: single sign-on for virtual desktop mode: Brokers are currently using only certificate authentication before the server and the session is running for the whol... Galya B
11:13 AM Bug #7515: FILL-IN: editing dates issues: **ISSUE** Yet another issue: if a just open a date @FILL-IN@, place the cursor at any of the two delimiters and press... Vladimir Tsichevski

07/24/2023

03:31 PM Bug #7515: FILL-IN: editing dates issues: **ISSUE** Yet another issue:
In OE the @SCREEN-VALUE@ called for an unedited date @FILL-IN@ with unknown variable,... Vladimir Tsichevski
09:39 AM Feature #3931: single sign-on for virtual desktop mode: Just to mention, so that no unexpected surprises are found down the road: "sso hook" is a bit exaggerated for what I'... Galya B
09:35 AM Feature #3931: single sign-on for virtual desktop mode: It would be feasible to implement certificate validation + SSO with the customer hook returning the certificate to us... Greg Shah
09:22 AM Feature #3931: single sign-on for virtual desktop mode: With SSO it can't be of type @AUTH_MODE_X509_IDPW@ (except if we don't modify it), because the fwd user is dynamic (c... Galya B
09:20 AM Feature #3931: single sign-on for virtual desktop mode: I mean the connection between the FWD client process (with embedded web server) and the FWD server. Galya B
09:18 AM Feature #3931: single sign-on for virtual desktop mode: > My question is if it should be an option to enable certificate validation + SSO?
Help me understand how would it... Greg Shah
02:00 AM Feature #3931: single sign-on for virtual desktop mode: I didn't notice @AUTH_MODE_X509_IDPW@, @AUTH_MODE_X509_IDPW@ does indeed both validations, but the FWD user is either... Galya B

07/21/2023

03:07 PM Bug #7633: some trigger issues: PAUSE must not raise a trigger and no PAUSE exists when UPDATE is...: There is this test:... Constantin Asofiei
03:07 PM Bug #7633 (New): some trigger issues: PAUSE must not raise a trigger and no PAUSE exists when UPD...: Constantin Asofiei
01:00 PM Feature #3931: single sign-on for virtual desktop mode: > At the moment, as far as I understand the logic, authentication is either certificate check, or fwd users check.
... Greg Shah
11:06 AM Feature #3931: single sign-on for virtual desktop mode: What I mean is having certificate should not limit the number of associated fwd users. Isn't it good to have clients ... Galya B
11:03 AM Feature #3931: single sign-on for virtual desktop mode: At the moment, as far as I understand the logic, authentication is either certificate check, or fwd users check. If @... Galya B
10:51 AM Feature #3931: single sign-on for virtual desktop mode: r14653: @GuestAccess@ reverted. Sso connection authentication is @SecurityManager.authenticateClientWorkerSso@ client... Galya B
08:55 AM Feature #3931: single sign-on for virtual desktop mode: Greg Shah wrote:
> My references above are only discussing web clients. Of course, batch and non-web clients should... Galya B
08:49 AM Feature #3931: single sign-on for virtual desktop mode: > > > Are we moving all customers using embedded to SSO?
> >
> > Yes.
> Let me verify I understand correctly. C... Greg Shah
08:46 AM Feature #3931: single sign-on for virtual desktop mode: Greg Shah wrote:
> > Are we moving all customers using embedded to SSO?
>
> Yes.
Let me verify I understand co... Galya B
08:46 AM Feature #3931: single sign-on for virtual desktop mode: Galya B wrote:
> So batch processes will run on that server with SSO? @auth-config/plugin@ defines @GuestAccess@ use... Greg Shah
08:42 AM Feature #3931: single sign-on for virtual desktop mode: > Are we moving all customers using embedded to SSO?
Yes. We already have a hacked-up way to do this. With #3770... Greg Shah
08:40 AM Feature #3931: single sign-on for virtual desktop mode: So batch processes will run on that server with SSO? @auth-config/plugin@ defines @GuestAccess@ used by batch. Do I r... Galya B
08:39 AM Feature #3931: single sign-on for virtual desktop mode: > > * I would expect us to drop usage of @GuestAccess@ in the solution. It is a hack that is not important/is unwant... Greg Shah
08:37 AM Feature #3931: single sign-on for virtual desktop mode: To summarize embedded spawning / launching options:
1. [Old] web request to @/embedded/launch@ runs without knowing ... Galya B
08:30 AM Feature #3931: single sign-on for virtual desktop mode: Greg Shah wrote:
> So it is cleaner if we don't have an existing context and instead we should take the passed in ap... Galya B
08:28 AM Feature #3931: single sign-on for virtual desktop mode: Galya B wrote:
> Actually for rpc calls to @spawn@ thread pool is not used, because security context should be avail... Greg Shah
08:27 AM Feature #3931: single sign-on for virtual desktop mode: Greg Shah wrote:
> It sounds like you are mixing two different authenticator implementations together which may caus... Galya B
08:24 AM Feature #3931: single sign-on for virtual desktop mode: > Is there any reason why this is not a good solution?
We'll see. I will have to look at the code. It sounds lik... Greg Shah
08:23 AM Feature #3931: single sign-on for virtual desktop mode: Actually for rpc calls to @spawn@ thread pool is not used, because security context should be available. The Thread p... Galya B
08:17 AM Feature #3931: single sign-on for virtual desktop mode: > That being said, I'm still not sure what security context spawning should be executed under to be able to authenti... Greg Shah
08:10 AM Feature #3931: single sign-on for virtual desktop mode: > > * As noted in #4129, the pooling side of things is not critical right now. [...] For that reason, I'd prefer to k... Greg Shah
03:52 AM Feature #3931: single sign-on for virtual desktop mode: Greg Shah wrote:
> In regard to unifying the spawning logic and the authentication changes, I'll have to just look a... Galya B
03:50 AM Feature #3931: single sign-on for virtual desktop mode: Greg Shah wrote:
> * I would expect us to drop usage of @GuestAccess@ in the solution. It is a hack that is not imp... Galya B
03:45 AM Feature #3931: single sign-on for virtual desktop mode: Greg Shah wrote:
> * I would expect us to drop usage of @GuestAccess@ in the solution. It is a hack that is not imp... Galya B
03:31 AM Feature #3931: single sign-on for virtual desktop mode: That being said, I'm still not sure what security context spawning should be executed under to be able to authentica... Galya B
03:25 AM Feature #3931: single sign-on for virtual desktop mode: Greg Shah wrote:
> * We have one customer that plans a separate web server for their embedded environment and all th... Galya B
03:16 AM Feature #3931: single sign-on for virtual desktop mode: Greg Shah wrote:
> * As noted in #4129, the pooling side of things is not critical right now. [...] For that reason,... Galya B

07/20/2023

12:37 PM Bug #7515: FILL-IN: editing dates issues: *(FIXED)* Another issue found:
In a @character@ or @date@ @FILL-IN@:
# the cursor is in the leftmost position
... Vladimir Tsichevski
11:29 AM Feature #3931: single sign-on for virtual desktop mode: I don't have time to do a full code review.
Some quick feedback:
* As noted in #4129, the pooling side of thing... Greg Shah
11:14 AM Feature #3931: single sign-on for virtual desktop mode: > Do we have customers using brokers with web (VD / embedded)?
Not in production today but it should be supported. Greg Shah
10:38 AM Feature #3931: single sign-on for virtual desktop mode: Do we have customers using brokers with web (VD / embedded)? Galya B
10:29 AM Feature #3931: single sign-on for virtual desktop mode: Early review required on 3931a r14652 based on trunk r14637.
What was done:
* adding @/sso/gui@, @/sso/chui@ and ... Galya B

07/13/2023

10:27 AM Feature #3931: single sign-on for virtual desktop mode: Also another question: the spawn calls to the brokers run at the moment in different contexts. Embedded has this cert... Galya B
10:11 AM Feature #3931: single sign-on for virtual desktop mode: @certificates/peers@ and @private-keys@ are probably needed for the server <-> server connection auth for rpc calls, ... Galya B
10:02 AM Feature #3931: single sign-on for virtual desktop mode: Constantin Asofiei wrote:
> * connect to the FWD server and authenticate via a certificate for a FWD process account... Galya B
09:50 AM Feature #3931: single sign-on for virtual desktop mode: Constantin Asofiei wrote:
> * call into the FWD server via @WebClientLauncher.launch@, where it can specify *any OS ... Galya B
09:37 AM Feature #3931: single sign-on for virtual desktop mode: No, this is not the single reason. I forgot to mention that the embedded app (for i.e. Hotel GUI) can be ran in stan... Constantin Asofiei
09:36 AM Feature #3931: single sign-on for virtual desktop mode: Ok, here goes my proposal for lean code:
1. Expose a method from @SecurityManager@ that checks @trustedspawner/resou... Galya B
09:26 AM Feature #3931: single sign-on for virtual desktop mode: Constantin Asofiei wrote:
> > 1. Why is there a certificate specified for embedded? I still don't get that as well. ... Galya B
09:13 AM Feature #3931: single sign-on for virtual desktop mode: Galya, the point of:... Constantin Asofiei
09:07 AM Feature #3931: single sign-on for virtual desktop mode: Also:
1. Why is there a certificate specified for embedded? I still don't get that as well. Is it for the same check... Galya B
08:58 AM Feature #3931: single sign-on for virtual desktop mode: That was pseudo-code of course, but my point is that I still don't see a good reason to keep the context. Galya B
08:56 AM Feature #3931: single sign-on for virtual desktop mode: Ok, let's get it straight: @EmbeddedWebHandler@ checks if @webClient/defaultAccount@ is the same as @trustedspawner/r... Galya B
08:44 AM Feature #3931: single sign-on for virtual desktop mode: Galya B wrote:
> Constantin Asofiei wrote:
> > Galya B wrote:
> > > Directory configs under @server/default/embedd... Constantin Asofiei
08:34 AM Feature #3931: single sign-on for virtual desktop mode: Constantin Asofiei wrote:
> Galya B wrote:
> > Directory configs under @server/default/embeddedWebApp@ are all used... Galya B
08:03 AM Feature #3931: single sign-on for virtual desktop mode: Galya B wrote:
> Directory configs under @server/default/embeddedWebApp@ are all used only in @EmbeddedWebAppHandler... Constantin Asofiei
08:00 AM Feature #3931: single sign-on for virtual desktop mode: Greg Shah wrote:
> > I don't know how to feed the fwd user from @WebHandler@ @spawnWorker@ (contained in @SsoAuthent... Galya B
07:46 AM Feature #3931: single sign-on for virtual desktop mode: Directory configs under @server/default/embeddedWebApp@ are all used only in @EmbeddedWebAppHandler.AuthWorker@. That... Galya B
07:34 AM Feature #3931: single sign-on for virtual desktop mode: Enabling trusted for VD (which is currently not possible) should probably be done the same way as embedded. But the c... Galya B
07:27 AM Feature #3931: single sign-on for virtual desktop mode: Greg Shah wrote:
> I suspect we need to add another @AUTH_MODE_*@ and associated logic to bypass our own authenticat... Galya B
07:21 AM Feature #3931: single sign-on for virtual desktop mode: Very good explanation, will be helpful for everyone jumping in later on. Unfortunately I already got it figured out b... Galya B
07:03 AM Feature #3931: single sign-on for virtual desktop mode: > The auth code in @SecurityManager@ (@authenticateClientWorker@ / @authenticateLocal@) is very special and I don't f... Greg Shah
06:50 AM Feature #3931: single sign-on for virtual desktop mode: @TrustedSpawnerResource@ is not specific to embedded mode. It could be used in virtual desktop mode to avoid the PAM... Greg Shah
06:45 AM Feature #3931: single sign-on for virtual desktop mode: Some context and decision criteria:
* The reason this task is entitled "single sign-on for virtual desktop mode" i... Greg Shah
06:23 AM Feature #3931: single sign-on for virtual desktop mode: It's not nit picking, I really need to get to the bottom of it to be able to rework those to accommodate for SSO and ... Galya B
06:14 AM Feature #3931: single sign-on for virtual desktop mode: VD works with OS user / pass, they auth in PAM -> pass.
Embedded works with certificates associated with alias assoc... Galya B
06:09 AM Feature #3931: single sign-on for virtual desktop mode: Galya B wrote:
> Why do we need checks for @TrustedSpawnerResource@ ? It's very imaginary to me, we create an imagin... Constantin Asofiei
06:06 AM Feature #3931: single sign-on for virtual desktop mode: I mean obviously spawner doesn't require specific auth to call the process and it works with passwordless. If the ser... Galya B
06:04 AM Feature #3931: single sign-on for virtual desktop mode: Constantin Asofiei wrote:
> Galya B wrote:
> > I see @EmbeddedWebAppHandler@ is created by Constantin and he can ex... Galya B
06:00 AM Feature #3931: single sign-on for virtual desktop mode: Galya B wrote:
> I see @EmbeddedWebAppHandler@ is created by Constantin and he can explain us better why @AuthWorker... Constantin Asofiei
05:48 AM Feature #3931: single sign-on for virtual desktop mode: > Embedded doesn't have a default landing page, while VD has. For embedded @index.html@ where @<iframe id="embeddedP2... Greg Shah
05:47 AM Feature #3931: single sign-on for virtual desktop mode: I see @EmbeddedWebAppHandler@ is created by Constantin and he can explain us better why @AuthWorker@ exists. Galya B
05:45 AM Feature #3931: single sign-on for virtual desktop mode: Greg Shah wrote:
> > I'm trying to understand why virtual desktop runs without security context and bypasses securit... Galya B
05:42 AM Feature #3931: single sign-on for virtual desktop mode: I'm speaking only about the spawning process and the Thread with the security context doesn't do anything to my knowl... Galya B
05:42 AM Feature #3931: single sign-on for virtual desktop mode: > I'm trying to understand why virtual desktop runs without security context and bypasses security checks, while embe... Greg Shah
05:40 AM Feature #3931: single sign-on for virtual desktop mode: > I'm not sure if I've messed up something or this is how embedded is supposed to work, but when I define a startup p... Greg Shah
05:33 AM Feature #3931: single sign-on for virtual desktop mode: VD has this line @sp.bypass = !SecurityManager.getInstance().hasContext();@. Galya B
05:31 AM Feature #3931: single sign-on for virtual desktop mode: It is like the server says: Let me check my configs. ... a lot going on ... I'm all good. Now do the same as VD that ... Galya B
05:29 AM Feature #3931: single sign-on for virtual desktop mode: According to the comments in the code it seems related to @trusted@ mode, but it still doesn't make sense. Galya B
05:27 AM Feature #3931: single sign-on for virtual desktop mode: I'm trying to understand why virtual desktop runs without security context and bypasses security checks, while embedd... Galya B
05:25 AM Feature #3931: single sign-on for virtual desktop mode: > Is it... is it... the remote spawn that needs proper security context?
I don't understand the question. Securit... Greg Shah
04:37 AM Feature #3931: single sign-on for virtual desktop mode: Is it... is it... the remote spawn that needs proper security context? Galya B

07/12/2023

02:37 PM Bug #7515 (WIP): FILL-IN: editing dates issues: Vladimir Tsichevski
12:20 PM Bug #7515: FILL-IN: editing dates issues: Vladimir Tsichevski wrote:
> # Also, if the cursor was located in the rightmost position before the operation, the... Vladimir Tsichevski
07:34 AM Bug #7515: FILL-IN: editing dates issues: Please do check ChUI for each case because the ChUI rules may have differences. Also note that ChUI has a very speci... Greg Shah
07:19 AM Bug #7515: FILL-IN: editing dates issues: Vladimir Tsichevski wrote:
> In FWD selection is *not* erased.
According to the comments in the Java code, this... Vladimir Tsichevski
11:37 AM Feature #3931: single sign-on for virtual desktop mode: I'm not sure if I've messed up something or this is how embedded is supposed to work, but when I define a startup pro... Galya B
08:05 AM Feature #3931: single sign-on for virtual desktop mode: H * E * L * P
I don't understand something basic. Why does it matter what security context spawns the web client? ... Galya B
06:58 AM Feature #3931: single sign-on for virtual desktop mode: Embedded doesn't have a default landing page, while VD has. For embedded @index.html@ where @<iframe id="embeddedP2J"... Galya B

07/11/2023

05:01 PM Bug #7515: FILL-IN: editing dates issues: *(FIXED)* At least two issues when editing date with @FILL-IN@.
# When the user presses @Ctrl-A@ to select all, th... Vladimir Tsichevski
04:49 PM Bug #7515 (WIP): FILL-IN: editing dates issues: Vladimir Tsichevski
09:20 AM Feature #3931: single sign-on for virtual desktop mode: The auth code in @SecurityManager@ (@authenticateClientWorker@ / @authenticateLocal@) is very special and I don't fee... Galya B
09:05 AM Feature #4129: map web client users to OS accounts: Greg Shah wrote:
> That seems in conflict with your comment "All OS users will have to have password defined for web... Galya B
08:49 AM Feature #4129: map web client users to OS accounts: > As discussed earlier with SSO enabled both modes will have to be available for both drivers.
This is my expectio... Greg Shah
04:14 AM Feature #4129: map web client users to OS accounts: Greg Shah wrote:
> > If a new Authenticator for Virtual Desktop is introduced does it have to be integrated with all... Galya B

07/10/2023

04:33 PM Feature #4129: map web client users to OS accounts: > My question is if there can be different auth modes for different processes or it is only one for all?
Yes, it s... Greg Shah

07/07/2023

11:07 AM Feature #3931: single sign-on for virtual desktop mode: Also it's so convenient, I can already imagine the constant lack of ports if no restrictions are imposed. Galya B
09:55 AM Feature #3931: single sign-on for virtual desktop mode: If auto-login is supported and the cookie is not deleted on session completion, the redirect back to the login page w... Galya B
03:11 AM Feature #4854: origin affinity: OK, it can be made simpler. I've just tested it. A httpOnly cookie can be sent and received from @doPost@ and @doGet@... Galya B
02:47 AM Feature #4854: origin affinity: A subdomain is a more pretty solution, if the admin is in the mood to configure DNS. Galya B
02:46 AM Feature #4854: origin affinity: Hynek Cihlar wrote:
> A typical scenario is that the main site and the embedded FWD legacy app are coming from diffe... Galya B
02:34 AM Feature #4854: origin affinity: Galya B wrote:
> Hynek Cihlar wrote:
> > For plain virtual desktop this is true. However for embedded mode you can'... Hynek Cihlar
02:18 AM Feature #4854: origin affinity: Hynek Cihlar wrote:
> For plain virtual desktop this is true. However for embedded mode you can't assume anything ab... Galya B
02:17 AM Feature #4854: origin affinity: Galya B wrote:
> On the other hand browser extensions seem to be able to access @httpOnly@ cookies as well as @local... Hynek Cihlar
02:15 AM Feature #4854: origin affinity: Galya B wrote:
> Hynek Cihlar wrote:
> > It looks good. The only downside I see are the security implications stori... Hynek Cihlar
02:00 AM Feature #4854: origin affinity: On the other hand browser extensions seem to be able to access @httpOnly@ cookies as well as @localStorage@. Galya B
01:57 AM Feature #4854: origin affinity: Hynek Cihlar wrote:
> It looks good. The only downside I see are the security implications storing sensitive data in... Galya B
01:49 AM Feature #4854: origin affinity: Galya B wrote:
> Hynek Cihlar wrote:
> > For the auto login you want to store any secure access token as session co... Hynek Cihlar
01:14 AM Feature #4854: origin affinity: Constantin Asofiei wrote:
> Galya, you mean that Virtual Desktop will be run in an iframe? If so, we need to be pret... Galya B
01:12 AM Feature #4854: origin affinity: Hynek Cihlar wrote:
> For the auto login you want to store any secure access token as session cookie. But this can't... Galya B

07/06/2023

02:12 PM Feature #4854: origin affinity: Greg Shah wrote:
> > But I'm not sure how would this help with the auto login feature.
>
> I think the idea was t... Hynek Cihlar
01:26 PM Feature #4854: origin affinity: > But I'm not sure how would this help with the auto login feature.
I think the idea was that the main/parent page... Greg Shah
12:44 PM Feature #4854: origin affinity: Galya, you mean that Virtual Desktop will be run in an iframe? If so, we need to be pretty sure that the 'virtual des... Constantin Asofiei
12:31 PM Feature #4854: origin affinity: Greg Shah wrote:
> Hynek/Sergey: Do you have any thoughts?
Interesting idea. This could lead to some issues with ... Hynek Cihlar
11:24 AM Feature #4854: origin affinity: Greg Shah wrote:
> I do wonder if we have anything in the virtual desktop mode that will need to be changed to be OK... Galya B
11:18 AM Feature #4854: origin affinity: Actually there is one more: server-side storage stores all client prefs in one place, so it needs to know how to diff... Galya B
11:16 AM Feature #4854: origin affinity: Greg Shah wrote:
> On the other hand, we were already going down the server-side storage.
The only concern I have ... Galya B
11:13 AM Feature #4854: origin affinity: I have no strong objection. We use this approach already in Embedded Mode. I do wonder if we have anything in the v... Greg Shah
11:03 AM Feature #4854: origin affinity: I have one of those ideas I get smashed for having: Put login screen / web driver container in an iframe. Why?
1. Th... Galya B

07/05/2023

12:53 PM Feature #3931: single sign-on for virtual desktop mode: I'm still not sure if we need to enable SSO server-wide or just for certain clients. When SSO will be server-wide alw... Galya B
12:45 PM Feature #3931: single sign-on for virtual desktop mode: Sandbox in 3931a based on trunk 14637, commits 14638 & 14639.
What I did:
* The same login page and POST request ... Galya B
08:14 AM Feature #3931: single sign-on for virtual desktop mode: > I guess we want to make Virtual Desktop allow association of fwd users to os users without passwords with trusted s... Greg Shah
08:13 AM Feature #3931: single sign-on for virtual desktop mode: > But I'm not sure if changing the @auth-plugin@ to a new that serves the SSO flow will affect other clients that are... Greg Shah

07/04/2023

01:43 PM Feature #3931 (WIP): single sign-on for virtual desktop mode: Branch 3931a created. Galya B

07/03/2023

12:07 PM Feature #3931: single sign-on for virtual desktop mode: Basically sessions will have to be created under the fwd user associated with the login form request.
Some identif... Galya B
11:41 AM Feature #3931: single sign-on for virtual desktop mode: The @auth-plugin@ has to be changed for web, because that's where the FWD user is associated with the security contex... Galya B
11:16 AM Feature #4129: map web client users to OS accounts: > From #3770:
> >add 4GL API for authentication
I don't plan to keep this part. There is no need for the 4GL cod... Greg Shah
11:15 AM Feature #4129: map web client users to OS accounts: > As it is now, there is no user interaction / input before spawning the client process under the os user.
There i... Greg Shah
11:13 AM Feature #4129: map web client users to OS accounts: > but it will not improve on using only one os user and trustedspawner for embedded, which is in #4129#Improvements p... Greg Shah
11:09 AM Feature #4129: map web client users to OS accounts: From #3770:
>add 4GL API for authentication
>call this API before spawning
How do you know the user/pass at th... Galya B
11:07 AM Feature #4129: map web client users to OS accounts: As it is now, there is no user interaction / input before spawning the client process under the os user. Galya B
11:05 AM Feature #4129: map web client users to OS accounts: Reusing the auth back-end will make in-app users authentication consistent between both web drivers, but it will not ... Galya B
11:01 AM Feature #4129: map web client users to OS accounts: > In hotel gui isn't the embedded login an in-app login?
Not exactly. It is currently a custom integration to han... Greg Shah
10:57 AM Feature #4129: map web client users to OS accounts: I mean for embedded there is no FWD login. We'll rework the one for Virtual Desktop, but for embedded there is nothin... Galya B
10:52 AM Feature #4129: map web client users to OS accounts: In hotel gui isn't the embedded login an in-app login? Galya B
10:51 AM Feature #4129: map web client users to OS accounts: In both scenarios there will not be an in-app login. Greg Shah
10:50 AM Feature #4129: map web client users to OS accounts: Greg Shah wrote:
> Probably not since the UI requirements might be different, but we will want the same backend auth... Galya B
10:49 AM Feature #4129: map web client users to OS accounts: > Currently embedded is using only @trustedspawner@ and only one account @webClient/defaultAccount@, that's how it's ... Greg Shah
10:15 AM Feature #4129: map web client users to OS accounts: Currently embedded is using only @trustedspawner@ and only one account @webClient/defaultAccount@, that's how it's ha... Galya B
09:24 AM Feature #4129: map web client users to OS accounts: What about:... Galya B
06:03 AM Feature #4129: map web client users to OS accounts: I was finally able to follow the security context creation flow and most importantly the association with fwd user fo... Galya B

06/30/2023

12:45 PM Feature #4129: map web client users to OS accounts: I've followed the process of creating a web client and documented in [[internal-documentation:Sign-in#Virtual-Desktop... Galya B
08:56 AM Feature #4129: map web client users to OS accounts: > > Moving this stuff around is out of scope.
> Speaking of out of scope, what do you say about revamp of brokers u... Greg Shah
08:47 AM Feature #4129: map web client users to OS accounts: Greg Shah wrote:
> I don't understand this point. The requirement is to allow a login to a particular web client to... Galya B
08:47 AM Feature #4129: map web client users to OS accounts: Greg Shah wrote:
> Moving this stuff around is out of scope.
Speaking of out of scope, what do you say about revam... Galya B
08:40 AM Feature #4129: map web client users to OS accounts: > On the other hand I don't know how applicable is the case of the app storing user specific data on the broker that ... Greg Shah
08:38 AM Feature #4129: map web client users to OS accounts: > > The remote broker interface would need enhancement to provide account management features.
> It will also requir... Greg Shah
07:45 AM Feature #4129: map web client users to OS accounts: On the other hand I don't know how applicable is the case of the app storing user specific data on the broker that ne... Galya B
07:08 AM Feature #4129: map web client users to OS accounts: Greg Shah wrote:
> The remote broker interface would need enhancement to provide account management features.
It wi... Galya B
06:40 AM Feature #4129: map web client users to OS accounts: > > > I can't imagine a customer who will create FWD users for each of their app / end users.
> >
> > We have mult... Greg Shah
06:37 AM Feature #4129: map web client users to OS accounts: Galya B wrote:
> Greg Shah wrote:
> > Add/remove/edit users and groups is in the admin UI. ACL add/remove/edit is ... Greg Shah
06:36 AM Feature #4129: map web client users to OS accounts: > > 1. Should we implement a facility in our admin UI to create/delete and manage OS accounts? This probably include... Greg Shah
05:04 AM Feature #4129: map web client users to OS accounts: Greg Shah wrote:
> > I can't imagine a customer who will create FWD users for each of their app / end users.
>
> ... Galya B
04:43 AM Feature #4129: map web client users to OS accounts: Greg Shah wrote:
> Add/remove/edit users and groups is in the admin UI. ACL add/remove/edit is also in the admin UI... Galya B
03:29 AM Feature #4129: map web client users to OS accounts: Greg Shah wrote:
> 1. Should we implement a facility in our admin UI to create/delete and manage OS accounts? This ... Galya B
09:41 AM Feature #4856: web client session forking: > Now can I start the implementation? :) There is not much more to consider in the flow of #4856 and #3931. Better do... Greg Shah
09:32 AM Feature #4856: web client session forking: Now can I start the implementation? :) There is not much more to consider in the flow of #4856 and #3931. Better do a... Galya B
09:20 AM Feature #4856: web client session forking: Yes, I think that is correct. Greg Shah
09:13 AM Feature #4856: web client session forking: And if single login page is enabled and auth hook impl provided, then call the auth hook to ask for a new forked sess... Galya B
09:11 AM Feature #4856: web client session forking: To sum up the implementation details: Add button to the web driver wrapper container, click opens a new tab / new cli... Galya B
09:10 AM Feature #4856: web client session forking: > "Session forking" is somewhat too strong expression in my opinion.
I don't have a better term. We are literally... Greg Shah
09:08 AM Feature #4856: web client session forking: > Alright, so we save one OS login screen with the whole operation.
Worst case, yes. For the single signon case, ... Greg Shah
09:06 AM Feature #4856: web client session forking: "Session forking" is somewhat too strong expression in my opinion. Galya B
09:05 AM Feature #4856: web client session forking: Alright, so we save one OS login screen with the whole operation. Galya B
09:05 AM Feature #4856: web client session forking: > New client process / FWD session will open the same "entry point" 4GL process that has login.
Yes, that is OK.
... Greg Shah
09:04 AM Feature #4856: web client session forking: > Let it be js click.
>
> So, how do I determine if the customer app has login or not?
From a javascript/web cl... Greg Shah
08:59 AM Feature #4856: web client session forking: New client process / FWD session will open the same "entry point" 4GL process that has login. It needs to know it's f... Galya B
08:57 AM Feature #4856: web client session forking: Let it be js click.
So, how do I determine if the customer app has login or not? If single login page is not enabl... Galya B
08:54 AM Feature #4856: web client session forking: > > We cannot assume there is an auth server involved and if one is part of the solution it would only be hidden behi... Greg Shah
08:49 AM Feature #4856: web client session forking: Greg Shah wrote:
> I don't see why we need 4GL code involved. The idea here was to implement this forking as a buil... Galya B
08:42 AM Feature #4856: web client session forking: Greg Shah wrote:
> We cannot assume there is an auth server involved and if one is part of the solution it would onl... Galya B
08:30 AM Feature #4856: web client session forking: > May I do a POC for #4856 and #3931 in a new branch? Otherwise the sign-in tasks come to standstill.
I'm not yet ... Greg Shah
08:29 AM Feature #4856: web client session forking: > The whole thing will also require some custom 4GL method that triggers FWD actions: first on the server get the blo... Greg Shah
08:24 AM Feature #4856: web client session forking: > A new login session should be created by the auth server.
We cannot assume there is an auth server involved and... Greg Shah
07:52 AM Feature #4856: web client session forking: May I do a POC for #4856 and #3931 in a new branch? Otherwise the sign-in tasks come to standstill. Galya B
03:51 AM Feature #4856: web client session forking: The whole thing will also require some custom 4GL method that triggers FWD actions: first on the server get the blob,... Galya B
03:44 AM Feature #4856: web client session forking: Greg Shah wrote:
> Note the requirement to avoid additional authentication.
A new login session should be created b... Galya B
09:23 AM Feature #4854: origin affinity: With the server-side state, we may not implement origin affinity at all. Greg Shah
09:19 AM Feature #4854: origin affinity: If port affinity is the to-go solution, it will require licensing policy in place from the get go. Otherwise how to k... Galya B

06/29/2023

12:08 PM Feature #3931: single sign-on for virtual desktop mode: Yes, if we go that route. Let's get everything described and agreed first. Greg Shah
11:31 AM Feature #3931: single sign-on for virtual desktop mode: I want to create 4GL attr @AUTH-BLOB@, do we add it to @SESSION@ as well? Galya B
11:25 AM Feature #3931: single sign-on for virtual desktop mode: > How are hooks provided? I don't think we have dependency injection or event system built-in.
A class implementin... Greg Shah
11:24 AM Feature #3931: single sign-on for virtual desktop mode: > The auth logic, where DB queries are done, should be part of FWD server?
It would be Java code that is written b... Greg Shah
11:05 AM Feature #3931: single sign-on for virtual desktop mode: How are hooks provided? I don't think we have dependency injection or event system built-in. Galya B
10:42 AM Feature #3931: single sign-on for virtual desktop mode: The auth logic, where DB queries are done, should be part of FWD server? Galya B
10:39 AM Feature #3931: single sign-on for virtual desktop mode: > FWD hits the customer's auth server and gets response success, the fwd user and some session specific data, blob
... Greg Shah
10:35 AM Feature #3931: single sign-on for virtual desktop mode: The most simple flow would be:
1. SSO Login screen is open
2. User/pass entered
3. FWD hits the customer's auth se... Galya B
10:30 AM Feature #3931: single sign-on for virtual desktop mode: Greg Shah wrote:
> I don't see this as a separate service.
I think we speak about different things here. It's not... Galya B
10:25 AM Feature #3931: single sign-on for virtual desktop mode: > All customers requesting sso login will have to provide authentication server - 3rd party integration that we suppo... Greg Shah
10:17 AM Feature #3931: single sign-on for virtual desktop mode: Continue from #7465.
Greg Shah wrote:
> We cannot require OAuth2 as part of this interface. We are providing sup... Galya B
11:09 AM Feature #4853: implement support for reporting a device-id which is meant to identify a unique cl...: It's on hold.. Just to mention what was wrong with my idea: WebRTC changed the specification and doesn't expose the l... Galya B
08:43 AM Feature #4129: map web client users to OS accounts: > Is @config/auth-plugins/option@ the way of defining FWD user for the web process? Its value is @bogus@ in testcases... Greg Shah
08:39 AM Feature #4129: map web client users to OS accounts: Add/remove/edit users and groups is in the admin UI. ACL add/remove/edit is also in the admin UI. Groups are subjec... Greg Shah
08:23 AM Feature #4129: map web client users to OS accounts: Also the FWD user @bogus@ is listed in @subjects@ in multiple @security/acl@ resources and I don't see a way to updat... Galya B
08:17 AM Feature #4129: map web client users to OS accounts: Is @config/auth-plugins/option@ the way of defining FWD user for the web process? Its value is @bogus@ in testcases, ... Galya B

« Previous

Also available in: Atom

Project

General

Profile

FWD » Core Development » User Interface

Activity

Activity

07/28/2023

07/27/2023

07/25/2023

07/24/2023

07/21/2023

07/20/2023

07/13/2023

07/12/2023

07/11/2023

07/10/2023

07/07/2023

07/06/2023

07/05/2023

07/04/2023

07/03/2023

06/30/2023

06/29/2023