- Pharo-dev - lists.pharo.org

Re: [Pharo-dev] [ANN] JSONWebToken

by Denis Kudriashov

2016-07-22 10:17 GMT+02:00 Norbert Hartl <norbert(a)hartl.name>: > > A problem JWT can solve: > > In our company we have a lot of little REST servers serving some duties. > To minimize the chaos I want to have a central authentication and > authorization point. If we assume having 20 images running and we look at > typical way how authorization works: > > there is image A (Authentication), image S (Service) und client C. Client > C wants to use the service S > > 1. client C authenticates and retrieves authorization information from A > (or from S which redirects him to A) > 2. client C hands out the authorization information to S > 3. S needs to check at A if the information is valid (client C could have > modified it or generated it) > 4. S grants C access > > Taking the assumption of having 20 service images, every image would need > to get back to A in order to check authorization information. The more > services images you have the more load it will put on A. In a JWT use case > scenario the same would look like > > 1. client C authenticates and receives a JWT containing authorization > information. The token is signed by A > 2. client C hands out JWT to service S > 3. S checks the signature of A and knows that the authorization > information contained is valid. > 4. S grants C access > Thank's for explanation Norbert. Now I don't need to google about it :)

July 22, 2016

[ANN] JSONWebToken

by Norbert Hartl

Hi, thanks to the inquiry of Sven I published an implementation of JSONWebToken to smalltalkhub. It is available at http://smalltalkhub.com/#!/~NorbertHartl/JSONWebToken <http://smalltalkhub.com/#!/~NorbertHartl/JSONWebToken> For those who don't know JSONWebToken or short JWT pronounced "jot" is a token format suitable for authentication and authorization. The token consist of a header, a payload and a signature. The header defines crypto algorithms, compression and other things needed to read a token on reception. The payload is called a claim set which is basically a dictionary with well-known and custom keys. If we think about OAuth or OpenId the values contained map directly to JWT claims. For OpenID connect which is an identification mechanism on top of OAuth the usage of JWT is one of the building blocks. What are the advantages in using JWT? - it defines a header for encoding the content so it is quite flexible in the ways compression and encryption of the key is done - defines a payload which maps arbitrary keys and there is a set of well-known keys that implementations of OAuth, OpenID can understand - defines a signature that makes it easy to trust the information contained or to give the token to someone who is not trusted - token format is a single line string so it can be used e.g. in HTTP authentication headers A problem JWT can solve: In our company we have a lot of little REST servers serving some duties. To minimize the chaos I want to have a central authentication and authorization point. If we assume having 20 images running and we look at typical way how authorization works: there is image A (Authentication), image S (Service) und client C. Client C wants to use the service S 1. client C authenticates and retrieves authorization information from A (or from S which redirects him to A) 2. client C hands out the authorization information to S 3. S needs to check at A if the information is valid (client C could have modified it or generated it) 4. S grants C access Taking the assumption of having 20 service images, every image would need to get back to A in order to check authorization information. The more services images you have the more load it will put on A. In a JWT use case scenario the same would look like 1. client C authenticates and receives a JWT containing authorization information. The token is signed by A 2. client C hands out JWT to service S 3. S checks the signature of A and knows that the authorization information contained is valid. 4. S grants C access FYI, Norbert

July 22, 2016

Re: [Pharo-dev] git feature request

by Peter Uhnak

On Fri, Jul 22, 2016 at 07:19:09AM +0000, Dimitris Chloupis wrote: > I see a pull request as a way to moderate commits by people that cannot be > trusted or that are not regular contributors. No. The purpose of pull request is to discuss and review the code. Code reviews should be done whether you are regular contributor or not, because it's valuable for both the code base, and all people involved. Furthermore if you have CI properly configured, then it can execute tests on the pull request so you know the code is healthy. Of course if you work alone or have this is a fun OSS side-project, then no rules apply. Peter

July 22, 2016

Re: [Pharo-dev] git feature request

by Dimitris Chloupis

Ah yes that's the tool. Generally speaking if you plan to contribute to the repo very frequently being a contributor will allow you to commit directly since in most cases you will be familiar with the repo and know what you doing. I see a pull request as a way to moderate commits by people that cannot be trusted or that are not regular contributors. In case of a pull request it's the workflow that Peter describes but I prefer an addition step, open an issue or link your request to an issue. It make tracking pull requests easier and cleaner. On Fri, 22 Jul 2016 at 10:12, Peter Uhnak <i.uhnak(a)gmail.com> wrote: > On Fri, Jul 22, 2016 at 11:55:46AM +0800, Ben Coman wrote: > > I'm not sure what the roadmap is for git integration, but just a use case > > that occurs to me while I work "a bit with git" for the first time from > > Pharo. > > > > I install a project via a Baseline from git and makes a small > improvement. > > What is the easiest way to contribute back? I can't push back to the > > personal repo I downloaded from, so the easiest thing would be a single > > menu item to: > > 1. Fork original repository > > 2. Push current in-Image code to a new branch in that fork. > > > > Maybe even... > > 3. Issue a pull request to the original repository. > > This is indeed the idiomatic way to contribute on GitHub. > > 1. fork > 2. install _your fork_ with gitfiletree/remote git repo > 3. make an improvement (you can use master branch, since it's your repo, > but that's a detail) > 4. issue a pull request > > Maybe IceBerg (https://github.com/npasserini/iceberg) could have some > nice interface for this eventually. > > Peter > > > > > > cheers -ben > >

July 22, 2016

Re: [Pharo-dev] github-cache organisation

by Dimitris Chloupis

I don't have the problem you have, if I issue the command to redownload the zip it does so and it installs it's code fine. At least the last time I checked with my ChronosManager project to make sure everything works as expected few months ago. Also it does not change the fact that the zip is useless once extracted. On Fri, 22 Jul 2016 at 10:08, Peter Uhnak <i.uhnak(a)gmail.com> wrote: > On Fri, Jul 22, 2016 at 06:54:03AM +0000, Dimitris Chloupis wrote: > > The zip is not needed and it should be deleted after extraction cause it > > serves no role. This create a problem also because if you try to install > > agin the repo it won't redownload the zip , instead it will use the same > > zip. For me this make little sense because in the vast majority of cases > > your intention would be to download the repo version containing the > latest > > commit. There is a command to do this though. Personally I don't like > this > > behavior. > > This is a different problem: > http://forum.world.st/how-to-update-monticello-cypress-repository-downloade… > > Furthermore, deleting the file would have no effect on this, because the > relevant part is what is in the unzipped folder. > > Peter > > > On Fri, 22 Jul 2016 at 06:41, Ben Coman <btc(a)openinworld.com> wrote: > > > > > Just a general observation and first impression of installing a github > > > hosted project. > > > > > > After installing OSSubprocess from the Catalog Browser on Pharo 50760, > > > which uses repository... > > > github://marianopeck/OSSubProcess:v0.2.4/repository > > > > > > ...I see file > > > > "github--marianopeckOSSubprocessv0241266307023333901887488330764830.zip" > > > sitting next to my .image file. That would seem to dirty up that area > > > when I start to use git more often. I'd expect that file to be placed > in > > > one of the cache folders. > > > > > > cheers -ben > > > > >

July 22, 2016

Re: [Pharo-dev] git feature request

by Peter Uhnak

On Fri, Jul 22, 2016 at 11:55:46AM +0800, Ben Coman wrote: > I'm not sure what the roadmap is for git integration, but just a use case > that occurs to me while I work "a bit with git" for the first time from > Pharo. > > I install a project via a Baseline from git and makes a small improvement. > What is the easiest way to contribute back? I can't push back to the > personal repo I downloaded from, so the easiest thing would be a single > menu item to: > 1. Fork original repository > 2. Push current in-Image code to a new branch in that fork. > > Maybe even... > 3. Issue a pull request to the original repository. This is indeed the idiomatic way to contribute on GitHub. 1. fork 2. install _your fork_ with gitfiletree/remote git repo 3. make an improvement (you can use master branch, since it's your repo, but that's a detail) 4. issue a pull request Maybe IceBerg (https://github.com/npasserini/iceberg) could have some nice interface for this eventually. Peter > > cheers -ben

July 22, 2016

Re: [Pharo-dev] github-cache organisation

by Peter Uhnak

On Fri, Jul 22, 2016 at 06:54:03AM +0000, Dimitris Chloupis wrote: > The zip is not needed and it should be deleted after extraction cause it > serves no role. This create a problem also because if you try to install > agin the repo it won't redownload the zip , instead it will use the same > zip. For me this make little sense because in the vast majority of cases > your intention would be to download the repo version containing the latest > commit. There is a command to do this though. Personally I don't like this > behavior. This is a different problem: http://forum.world.st/how-to-update-monticello-cypress-repository-downloade… Furthermore, deleting the file would have no effect on this, because the relevant part is what is in the unzipped folder. Peter > On Fri, 22 Jul 2016 at 06:41, Ben Coman <btc(a)openinworld.com> wrote: > > > Just a general observation and first impression of installing a github > > hosted project. > > > > After installing OSSubprocess from the Catalog Browser on Pharo 50760, > > which uses repository... > > github://marianopeck/OSSubProcess:v0.2.4/repository > > > > ...I see file > > "github--marianopeckOSSubprocessv0241266307023333901887488330764830.zip" > > sitting next to my .image file. That would seem to dirty up that area > > when I start to use git more often. I'd expect that file to be placed in > > one of the cache folders. > > > > cheers -ben > >

July 22, 2016

Re: [Pharo-dev] github-cache organisation

by Dimitris Chloupis

The zip is not needed and it should be deleted after extraction cause it serves no role. This create a problem also because if you try to install agin the repo it won't redownload the zip , instead it will use the same zip. For me this make little sense because in the vast majority of cases your intention would be to download the repo version containing the latest commit. There is a command to do this though. Personally I don't like this behavior. On Fri, 22 Jul 2016 at 06:41, Ben Coman <btc(a)openinworld.com> wrote: > Just a general observation and first impression of installing a github > hosted project. > > After installing OSSubprocess from the Catalog Browser on Pharo 50760, > which uses repository... > github://marianopeck/OSSubProcess:v0.2.4/repository > > ...I see file > "github--marianopeckOSSubprocessv0241266307023333901887488330764830.zip" > sitting next to my .image file. That would seem to dirty up that area > when I start to use git more often. I'd expect that file to be placed in > one of the cache folders. > > cheers -ben >

July 22, 2016

Re: [Pharo-dev] git feature request

by Dimitris Chloupis

Actually you can , there was even a tool for Pharo that uses the github api to do most common git actions, github api does not need git installed because it does everything online. Alternatively you can use GitHub web GUI , you will have to be added to the repo as contributor though to have the required permissions to do commits, push and pulls , it should work also for pull requests . In the case of a pull request you won't need to be a contributor to the repo but you will have to fork it. Of course you can do that via github api, it's actually very powerful. You need git installed only to version control locally on your hard drive. But if you are fine with working online , the github api should be enough. You can learn more about it in the github website at the help section. On Fri, 22 Jul 2016 at 06:57, Ben Coman <btc(a)openinworld.com> wrote: > I'm not sure what the roadmap is for git integration, but just a use case > that occurs to me while I work "a bit with git" for the first time from > Pharo. > > I install a project via a Baseline from git and makes a small improvement. > What is the easiest way to contribute back? I can't push back to the > personal repo I downloaded from, so the easiest thing would be a single > menu item to: > 1. Fork original repository > 2. Push current in-Image code to a new branch in that fork. > > Maybe even... > 3. Issue a pull request to the original repository. > > cheers -ben >

July 22, 2016

Re: [Pharo-dev] Problem with delay waiting (OSSubprocess code) on Pharo 5.0

by Ben Coman

On Fri, Jul 22, 2016 at 4:42 AM, Mariano Martinez Peck < marianopeck(a)gmail.com> wrote: > > > On Sun, Jul 17, 2016 at 6:46 AM, Ben Coman <btc(a)openinworld.com> wrote: > > >> Do you have some test code or a test image I could run to reproduce >> the problem? >> > > > The problem is that I cannot reproduce it immediately. It takes me some > days and likely some image save and start again until I reproduce it. > Could you try How about something that invokes > > >> >> Now I have one thing for you to try. In the move of DelaySchedulerXxx >> from milliseconds to microseconds, the code for dealing with clock >> wrap-around was removed, but I wonder if it was also covering clock >> jitter as a side effect. Could you try again the SpinScheduler but >> restore this code... >> >> From handletTimerEvent... >> "Check for clock wrap-around." >> millisecondNowTick < activeDelayStartTime ifTrue: [ >> "clock wrapped" >> self saveResumptionTimes. >> self restoreResumptionTimes ]. >> activeDelayStartTime := millisecondNowTick. >> >> From runTimerEventLoop... >> Time millisecondClockValue < millisecondNowTick >> ifTrue:[ timingSemaphore signal ]. "retry" >> >> From startup... >> activeDelayStartTime := Time millisecondClockValue. >> >> > OK, I put back the code into the spin scheduler. Then I kept using > milisecond one until I finished the changes. Then I saved image and switch > to spin one: the image hungs. I cannot even interrupt it. I attach my > modifications. > Do they look correct? > I confirm that locked my image also. One change of milli to micro was missed at the bottom of runTimeEventLoop... That is... Time millisecondClockValue < microsecondNowTick to... Time microsecondClockValue < microsecondNowTick (just a case of domestic blindness) [1] :) :) cheers -ben [1] http://www.urbandictionary.com/define.php?term=domestic%20blindness P.S. A trick to debug delays is to bypass interCycleDelay by at the top of it putting... true ifTrue: [^self].

July 22, 2016