10/1/2012 9:03:46 PM
done via Shiro. We store a hashed version of the api secret w/ salt.
We use SHA-2 (SHA-256) for now, but we reserve the right to change our minds.
shiro-web enforces Basic auth against most APIs (except tenants and healthcheck resources for now)
in server.
Single tenant mode is still supported: by disabling Shiro in server and/or passing null as tenant id
in API calls contexts, the DAO layer falls back to tenant record id 0.
Tenant information is passed through via TenantContext (r/o calls) and CallContext (r/w calls),
which are turned into InternalTenantContext and InternalCallContext at the DAO layer.
Internal APIs should use the internal versions of these objects but we can't at the moment
(need to extract the services APIs from the api module).
Notes:
* more work is needed to populate account_record_id and tenant_record_id correctly in some places
* we don't have the infrastructure to run different queues (notification/persistent queues) per tenant for now.
* as part of the addition of account record id and tenant record id, we populated the end date in bii for fixed items for convenience.
Signed-off-by: Pierre-Alexandre Meyer <pierre@ning.com>
|
|
|
|
|
10/1/2012 7:28:29 PM
with the rest of the system
|
|
|
9/28/2012 5:44:20 PM
(provided plugin supports it)
|
|
|
|
|
9/27/2012 6:19:31 PM
in billing state.
Signed-off-by: Pierre-Alexandre Meyer <pierre@ning.com>
|
|
|
