XACML open source framework or alternative - authorization

I'm searching for a well documented XACML3-Framework in the open source world. I tried AuthZForce and AT&T XACML. Both seems to have many features. The problem: to get them running, I have to read the source code or find test-classes. There are no examples or anything else, that helps to understand the functionality of the framework. I thought XACML is the future of authorization but at the bottom there is no real community.
Is there an XACML-alternative for ABAC-implementations or is there no other way and I must use RBAC with programmed constraints?

Regarding AuthzForce Core (Java library), you have a tutorial on the home page of the github project: Getting started; and an example of usage with a PEP in a real-world scenario. If you are missing info on something, feel free to contact us on our support mailing list. I also emphasize the fact that all Java classes have Javadoc and Javadoc artifacts are published on Maven Central with every release. You can download them manually or make sure your IDE is properly set up to automatically download them when you use Maven dependencies in your Java project.

WSO2 IS can help (opensource):
https://docs.wso2.com/display/IS510/XACML+Architecture
http://wso2.com/library/tutorials/2016/02/tutorial-how-to-enable-role-based-access-control-for-wso2-api-manager-using-xacml/
Policy handling can be done via web interface (Carbon).

Related

How do I add a mergebot to my Plastic SCM project

In Plastic SCM documentation, I saw mentions of mergebot and other automation tools and I'd like to also add them to my project.
But I know nothing about DevOps stuff and I'm wondering how to do it. I found info that I need to use webadmin for this but I struggle to set up it.
Could anyone please provide some instruction steps or link to documentation? From what I tried to search there is different info about this and it's spread among a bunch of web pages (and none of them helped me).
And BTW, are automation tools available at all in CLoud Edition? And does it matter whether I work centralized or decentralized? (I use the former option)
So I contacted Plastic SCM support and it turns out mergebot isn't available in Cloud Edition, only in Enterprise

Is it a bad idea to call phaser.min.js directly from GitHub?

As a jQuery user, I link the remote library from Google using
<script src="//ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script>
which is very clever because it's already loaded in the brower cache if the reader visited another site that did the same.
As I discover Phaser, I was hoping to see people on the web doing the same with
<script src="https://raw.githubusercontent.com/photonstorm/phaser/master/build/phaser.min.js"></script>
or any library hoster, but apparently no one does.
Is there a reason why Phaser users don't do that?
I would strongly advise against linking to the master release as it will absolutely break your games over time. Most of the 2.0.x updates have been non-API changing, but 2.1 and above will be altering some core aspects of Phaser. You should only ever link to specific versions.
For a similar service to the Google hosted APIs (of which they only host very specific libraries that they've selected) we use CDN.js, which offers the same thing. You can find details in the Phaser README or just go to http://cdnjs.com/ and search for Phaser.
There is as such no issue if you link to a specific version. But you don't want the latest build, as this can potentially break your site by making changes.
I don't know Github's policies on referencing their site like this.

Apache Isis vs JSON Presentation

I am working on building a sample web application for proof of concept - with a link of some sort on an html page consuming a restful web service via a json object and displaying the data on the web page .
Something like the Apache Isis todo maintenance version with presentation of the json representation on a web page.
I have been trying to use the JQueryMobile example of the Apache Isis (http://danhaywood.com/2012/01/20/jquerymobile-on-apache-isis-rest-api/). But, I do not have the original source code (only the war file with some online demo jar files in the lib). I could decompile the online demo jar files, but its not straight forward setting up the project in eclipse for adapting to a real life project. I searched the Isis github repo and could not find the source , no archtype like the simple wicket etc. Please, could someone help, I really need a sample app or references, with source file and or any kind of guideline on how this works end to end.
FYI - We are not considering changing the choice of technology here, Its DDD using Apache Isis. Any help will be appreciated ... Since there are not too many online tutorials or sample app on this project. Thanks.
I think you posted a similar question on my youtube channel. Just to reiterate what I said there, you might want to check out the JQueryMobile viewer that was developed by one of our "google summer of code" students last year, namely https://github.com/bhargavgolla/isisJavaScript/tree/master/isisJavaScriptViewer.
In terms of ongoing help, your best bet is subscribing to the mailing list (blank email to users-subscribe#isis.apache.org, and reply to the confirmation) then send your questions via email to users#isis.apache.org
HTH
Dan

trac rich client

My company uses trac for bug tracking, and while it works fine, I find the web interface a bit clunky, particularly when it comes to sorting and quickly switching between tickets.
Are there any rich client interfaces or maybe Eclipse plugins? I've seen the mylyn connector but that seems to just allow you to basically use the webpage within Eclipse.
There is an XML RPC plugin that you can use to interact with a Trac server using remote scripts. If there is something in particular that you want to do, you may be able to script it up with Ruby, Python, or a number of other languages. There are a number of examples on the plugin's web site: http://trac-hacks.org/wiki/XmlRpcPlugin
Have you ever looked at FatBug for Trac. It is a rich client for Trac. It has a nice snipping tool for uploading images directly into Trac and full text searching of all of the tickets in Trac. It even supports offline mode for being able to work with tickets when you do not have access to the Internet.

portlet-mvc 3.0 + maven for websphere portlet: examples?

I'm trying to develop a websphere portal portlet using java, maven and spring-portlet-mvc 3.0.2.RELEASE but so far I'm not having a lot of luck.
The problem that I'm having is that a lot of the tutorials are either outdated, incorrect, contradict eachother or a combination of all the above.
Also I have to use RAD but the tutorials also contradict eachother, logically I'd think you'd choose new portlet project, but http://www.ibm.com/developerworks/websphere/library/techarticles/0802_patil-pt1/0802_patil-pt1.html says to use a dynamic webproject.
So I was wondering if anyone had a nice example/good tutorial.
The Portlets in Action book is a very good introduction to portlets. There are a couple of chapters devoted to Spring3 portlets.
Also, for WebSphere Portal portlets it might be worth taking a look at the WebSphere Portlet Factory plugin for eclipse. It doesn't use Spring or Maven, but it makes it very easy to whip together WebSphere portlets very quickly, if you're not too concerned about how it does it.