Hi Pavel

While it is indeed the case there are many authentication options against the target, I wonder how many options are there when we are talking about the HTTP proxies ? I've only ever used a name and password :-).

Does anyone know if a scheme other than Basic has ever been used in practice for Proxy-Authentication ?

Thanks, Sergey

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Proxy-Authenticate 
On 26/05/17 07:06, Pavel Bucek wrote:

Hi Sergey, Andy, Dennis, all,

it would definitely make sense, but there are always issues when you need to provide credentials.

Since JAX-RS client is generally an object, which should be retained for a "long time", it doesn't make sense to have credentials stored within it (you can access multiple resources (targets) with it and they could have different security requirements. So we would need to introduce something like credentials provider / store, which would return credentials per request (based on host, port, path, ...).

Then there are multiple authentication mechanisms - which ones should we support? Basic and Digest are no-brainers, but should we have it in the API? It is already very simple to implement those using request filters. Then, when we start with security, OAuth users will start to request OAuth support (which makes perfect sense and I'd like to see it on the client), but that's completely different set of APIs...

I mean - as I mentioned - I'd be all for introducing better security support for the client. But it feels like "just another security api"; ideally, we'd just integrate with something which is already available, unfortunately that's not the case. Look around for other clients from Java EE. Supporting any security (other than certificate based / https) is rare. I would hope that separate security spec would provide guidance and ideally an API to integrate with, but that did not happen yet.

As I don't like to use the phrase "sorry, it's already too late", it almost seems that it is appropriate here.

Best regards,
Pavel

On 25/05/2017 23:48, Sergey Beryozkin wrote:

Hi Andy, Pavel

Would it make sense to consider extending the security related part of the API a bit ?
It already has some methods for setting up HTTPS the portable way.

Cheers, Sergey
On 25/05/17 22:35, Andy McCright wrote:

Hi Pavel,

 

The java properties will specify proxy host/port for the entire JVM.  Some of my customers are using JAX-RS clients in hybrid cloud environments where they may need a proxy server to access certain endpoints but not others - so they really need a per-client solution.  We can provide that per-client solution with a vendor-specific property, but then it is no longer portable.

 

I'm fine if we want to push this out to the next rev of JAX-RS though.  I think it is an important issue, but not worth holding up the spec's release.

 

Thanks,

 

Andy 

J. Andrew McCright
IBM WebSphere Development
+1 507 253 7448
TL 553-7448
andymc@...

 

 

----- Original message -----
From: "Pavel Bucek" <pavel.bucek@...>
Sent by: jaxrs-spec@javaee.groups.io
To: jaxrs-spec@javaee.groups.io
Cc:
Subject: Re: [jaxrs] Built-in proxy support in Client API?
Date: Thu, May 25, 2017 3:08 PM
 

Hi Andy, Dennis,

proxy port and proxy host can be already be defined by java property (http.proxyHost and http.proxyPort).

I'm not sure whether we can add proxy auth schemes at this point - if we'd start talking about security, wouldn't make sense to add auth support for standard client invocations?

Regards,
Pavel

 

On 25/05/2017 20:36, Andy McCright wrote:

Yeah, I think that makes sense.  So maybe instead of new methods on the Client/ClientBuilder we could add the following properties to Client:

 

public static final String PROXY_HOST_PROPERTY = "javax.ws.rs.client.http.proxy.host";

public static final String PROXY_PORT_PROPERTY = "javax.ws.rs.client.http.proxy.port";

public static final String PROXY_BASIC_AUTH_USERNAME_PROPERTY = "javax.ws.rs.client.http.proxy.auth.username";

public static final String PROXY_BASIC_AUTH_PASSWORD_PROPERTY = "javax.ws.rs.client.http.proxy.auth.password";

 

 

Assuming we have consensus, do we want to add this as part of Dennis's pull request[1], or should I create a new one?

 

Thanks,

 

Andy

 

[1] https://github.com/jax-rs/api/pull/555/files

 

J. Andrew McCright
IBM WebSphere Development
+1 507 253 7448
TL 553-7448
andymc@...

 

 

----- Original message -----
From: "Dennis Kieselhorst" <deki@...>
Sent by: jaxrs-spec@javaee.groups.io
To: jaxrs-spec@javaee.groups.io
Cc:
Subject: Re: [jaxrs] Built-in proxy support in Client API?
Date: Mon, May 22, 2017 2:01 AM
 

Hi Pavel,

I don't want to hijack the topic, I'm just saying that we can handle both cases in a common way.

Regards
Dennis