{"action":"created","issue":{"url":"https://api.github.com/repos/apache/brooklyn-server/issues/31","repository_url":"https://api.github.com/repos/apache/brooklyn-server","labels_url":"https://api.github.com/repos/apache/brooklyn-server/issues/31/labels{/name}","comments_url":"https://api.github.com/repos/apache/brooklyn-server/issues/31/comments","events_url":"https://api.github.com/repos/apache/brooklyn-server/issues/31/events","html_url":"https://github.com/apache/brooklyn-server/pull/31","id":134576216,"number":31,"title":"JAAS LoginModule delegating to Brooklyn's SecurityProviders ","user":{"login":"neykov","id":3612111,"avatar_url":"https://avatars.githubusercontent.com/u/3612111?v=3","gravatar_id":"","url":"https://api.github.com/users/neykov","html_url":"https://github.com/neykov","followers_url":"https://api.github.com/users/neykov/followers","following_url":"https://api.github.com/users/neykov/following{/other_user}","gists_url":"https://api.github.com/users/neykov/gists{/gist_id}","starred_url":"https://api.github.com/users/neykov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/neykov/subscriptions","organizations_url":"https://api.github.com/users/neykov/orgs","repos_url":"https://api.github.com/users/neykov/repos","events_url":"https://api.github.com/users/neykov/events{/privacy}","received_events_url":"https://api.github.com/users/neykov/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-02-18T13:08:09Z","updated_at":"2016-03-07T11:32:23Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/apache/brooklyn-server/pulls/31","html_url":"https://github.com/apache/brooklyn-server/pull/31","diff_url":"https://github.com/apache/brooklyn-server/pull/31.diff","patch_url":"https://github.com/apache/brooklyn-server/pull/31.patch"},"body":"Depends on #15.\r\n\r\nAn implementation of a JAAS LoginModule, delegating to the SecurityProvider configured in brooklyn.properties. Used as the authentication mechanism for the REST API when running in Karaf.\r\nCurrently configured as a separate realm, used only for web.\r\n"},"comment":{"url":"https://api.github.com/repos/apache/brooklyn-server/issues/comments/193214382","html_url":"https://github.com/apache/brooklyn-server/pull/31#issuecomment-193214382","issue_url":"https://api.github.com/repos/apache/brooklyn-server/issues/31","id":193214382,"user":{"login":"neykov","id":3612111,"avatar_url":"https://avatars.githubusercontent.com/u/3612111?v=3","gravatar_id":"","url":"https://api.github.com/users/neykov","html_url":"https://github.com/neykov","followers_url":"https://api.github.com/users/neykov/followers","following_url":"https://api.github.com/users/neykov/following{/other_user}","gists_url":"https://api.github.com/users/neykov/gists{/gist_id}","starred_url":"https://api.github.com/users/neykov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/neykov/subscriptions","organizations_url":"https://api.github.com/users/neykov/orgs","repos_url":"https://api.github.com/users/neykov/repos","events_url":"https://api.github.com/users/neykov/events{/privacy}","received_events_url":"https://api.github.com/users/neykov/received_events","type":"User","site_admin":false},"created_at":"2016-03-07T11:32:23Z","updated_at":"2016-03-07T11:32:23Z","body":"Thanks @CMoH. Addressed pts 1 & 2.\r\nThe main purpose of the `BrooklynLoginModule` is to bring Brooklyn's `SecurityProvider` implementations to the Karaf world and allow for easier migration. Long term I'd expect that we drop it in favour of re-implementing the existing `SecurityProviders` \"the Karaf way\". As a wrapper of `SecurityProvider`s it has some limitations:\r\n  * fixed and single role\r\n  * no access to the backing store of the `SecurityProvider` implementation\r\n\r\nBecause of the first I'd be wary of using it in non-web context - the REST API supports entitlements which can limit what a user can do inside brooklyn, but if the same user is allowed to ssh into Karaf's console without any limitations then any other security measures are meaningless.\r\nThe second makes it impossible to implement the backend, which would allow for user management inside Karaf's console.\r\n"}}