JAAS security with Open Liberty

未关闭
  • 哪里不对？
#3,359 3 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
25/100
Issue 类型
文档
描述清晰度
基本清楚
活跃度
停滞
技术栈
java
领域
cloud, documentation, security

调研方向

首先，将 KC Authentication 主题中列出的 JAAS 部分与现有的 OL Authentication 主题进行比较，并与 Ajay 和 security SME 讨论其用途和范围。如果认为有必要，请创建一个连贯的 Open Liberty 主题，涵盖相关的 JAAS 内容，限制高级细节，并将所有指导都定位于云/容器化环境中的使用。

由索引模型根据 Issue 内容生成。

描述

content design needed medium priority

From discussion with Alasdair when reviewing KC.

The KC Authentication topic contains a bunch of randomly-organised sections about different authentication-related things. Several of them relate to JAAS (Java SE security) but they're spread around without a coherent flow.

Talk with Ajay about whether it's useful info for us to provide or whether that info is covered by the short paragraph and links to elsewhere that are in the [OL Authentication topic]https://www.openliberty.io/docs/latest/authentication.html#_jaas_authentication) already.

If he thinks it's necessary, and there's enough info needed that it's worth a whole topic, create a single OL docs topic about JAAS security that pulls together the information from the following sections of the KC Authentication topic:

  • JAAS configuration
  • JAAS login modules
  • Callback handler - don't do a lot on this because it's quite internal and advanced use cases - callback handler is called by login module to get info needed (eg a username and pw prompt put up on screen) but, in reality, because this is server-side it often doesn't results in human interaction; human interaction is generally designed around client-side stuff.
  • Pluggable authentication
  • Proxy login module
  • Hash table login module
  • Identity assertion - this one is something that a user raised an RFE about fairly recently because they wanted to log in people using just a user ID and no password (I think). But, it's an advanced use case and Alasdair doesn't know how much we need to talk about it - would need to ask the security team to provide solid use cases of when it would be needed (in a cloud/containerised context). As for everything in this list, check it's useful to more than just a handful of people in highly specialised contexts.

You'll need to understand a bit about each of these things to work out how to organise them and structure the topic. It's possible that there are other bits of info that would need adding to make it all make sense. In general, make sure that the security SME can explain how each of these things is relevant in a cloud/containerised context - it must be framed like that in the OL docs.

主要语言
没有语言数据
星标
14
派生
58
平均合并
1 小时
30 天内合并 PR
25

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

OpenLiberty/docs 的其他 Issue

查看 OpenLiberty/docs 的全部 Issue

相似的 Issue

更多 Cloud Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。