{"action":"created","issue":{"url":"https://api.github.com/repos/openremote/or-controller/issues/8","repository_url":"https://api.github.com/repos/openremote/or-controller","labels_url":"https://api.github.com/repos/openremote/or-controller/issues/8/labels{/name}","comments_url":"https://api.github.com/repos/openremote/or-controller/issues/8/comments","events_url":"https://api.github.com/repos/openremote/or-controller/issues/8/events","html_url":"https://github.com/openremote/or-controller/issues/8","id":105185963,"number":8,"title":"Basic security architecture","user":{"login":"christianbauer","id":1006685,"avatar_url":"https://avatars.githubusercontent.com/u/1006685?v=3","gravatar_id":"","url":"https://api.github.com/users/christianbauer","html_url":"https://github.com/christianbauer","followers_url":"https://api.github.com/users/christianbauer/followers","following_url":"https://api.github.com/users/christianbauer/following{/other_user}","gists_url":"https://api.github.com/users/christianbauer/gists{/gist_id}","starred_url":"https://api.github.com/users/christianbauer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/christianbauer/subscriptions","organizations_url":"https://api.github.com/users/christianbauer/orgs","repos_url":"https://api.github.com/users/christianbauer/repos","events_url":"https://api.github.com/users/christianbauer/events{/privacy}","received_events_url":"https://api.github.com/users/christianbauer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/openremote/or-controller/milestones/3","html_url":"https://github.com/openremote/or-controller/milestones/FUTURE","labels_url":"https://api.github.com/repos/openremote/or-controller/milestones/3/labels","id":1293353,"number":3,"title":"FUTURE","description":null,"creator":{"login":"christianbauer","id":1006685,"avatar_url":"https://avatars.githubusercontent.com/u/1006685?v=3","gravatar_id":"","url":"https://api.github.com/users/christianbauer","html_url":"https://github.com/christianbauer","followers_url":"https://api.github.com/users/christianbauer/followers","following_url":"https://api.github.com/users/christianbauer/following{/other_user}","gists_url":"https://api.github.com/users/christianbauer/gists{/gist_id}","starred_url":"https://api.github.com/users/christianbauer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/christianbauer/subscriptions","organizations_url":"https://api.github.com/users/christianbauer/orgs","repos_url":"https://api.github.com/users/christianbauer/repos","events_url":"https://api.github.com/users/christianbauer/events{/privacy}","received_events_url":"https://api.github.com/users/christianbauer/received_events","type":"User","site_admin":false},"open_issues":11,"closed_issues":2,"state":"open","created_at":"2015-09-07T09:04:08Z","updated_at":"2015-10-06T11:58:16Z","due_on":null,"closed_at":null},"comments":1,"created_at":"2015-09-07T09:57:09Z","updated_at":"2016-07-24T18:20:16Z","closed_at":null,"body":"*Need to build security architecture from scratch, there are currently no constraints.*\r\n\r\n# User install workflow\r\n\r\n1. Unpack the box\r\n2. Start controller application, open start page in browser (can be automatic with native integration?)\r\n3. User is prompted to register with name and password (the name can be a person or client identifier)\r\n 1. Option: User picks \"Use bookmarklet\" and drags generated bookmarklet (see http://benlog.com/2007/02/06/beamauth-two-factor-web-authentication-with-a-bookmark/) into the browser bar, clicking on it will send an HTTP basic authentication request and then redirect to the initial page\r\n 2. Option: User picks \"Use regular login\" and the browser will present the user with a regular authentication dialog, its the user's job to make a bookmark and possibly store the credentials in the browser/OS keychain\r\n\r\n# Registration\r\n\r\nAfter the first user registered, registration must no longer be possible, open registration can be re-enabled in application security configuration. The first user is the initial superuser, with all permissions.\r\n\r\n# Authentication & Authorization\r\n\r\n1. Build a local user/password hash database and a minimal role/permission system\r\n2. Integrate cloud services (which? our Beehive Keycloa)\r\n3. The professional version of OR3 could be bundled with preconfigured Keycloak service.\r\n\r\n# Transport\r\n\r\n* TLS + HTTP Basic Authentication\r\n* HTTP XSRF protection either through CORS or if that's still a problem, through double-submit of form hash in header (cookie) and body (json field)\r\n* WebSocket XSRF protection (see https://www.christian-schneider.net/CrossSiteWebSocketHijacking.html) must be enabled on WebsocketComponent with Jetty CrossOriginFilter\r\n* https://en.wikipedia.org/wiki/JSON_Web_Token\r\n* Consider \"Unlimited Strength Jurisdiction Policy\" package for the JVM and if/how we need those algorithms\r\n* Java Problems: http://web-in-security.blogspot.ca/2015/09/practical-invalid-curve-attacks.html\r\n"},"comment":{"url":"https://api.github.com/repos/openremote/or-controller/issues/comments/234792967","html_url":"https://github.com/openremote/or-controller/issues/8#issuecomment-234792967","issue_url":"https://api.github.com/repos/openremote/or-controller/issues/8","id":234792967,"user":{"login":"richturner","id":7072278,"avatar_url":"https://avatars.githubusercontent.com/u/7072278?v=3","gravatar_id":"","url":"https://api.github.com/users/richturner","html_url":"https://github.com/richturner","followers_url":"https://api.github.com/users/richturner/followers","following_url":"https://api.github.com/users/richturner/following{/other_user}","gists_url":"https://api.github.com/users/richturner/gists{/gist_id}","starred_url":"https://api.github.com/users/richturner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/richturner/subscriptions","organizations_url":"https://api.github.com/users/richturner/orgs","repos_url":"https://api.github.com/users/richturner/repos","events_url":"https://api.github.com/users/richturner/events{/privacy}","received_events_url":"https://api.github.com/users/richturner/received_events","type":"User","site_admin":false},"created_at":"2016-07-24T18:20:16Z","updated_at":"2016-07-24T18:20:16Z","body":"# Context Broker Accessibility\r\n\r\n- The manager web server needs to be accessible from the Context Broker (for context provider callbacks)\r\n- The CB runs in its' own docker container with its' own network interface so the manager web server needs to be visible from this interface"}}
{"actor":{"display_login":"richturner"}}