Hi Dante,
Am 09.01.2015 um 02:05 schrieb
da...@lorenso.com:
> I've been spending time designing a web client that can interact with a
> small hardware appliance using WAMP protocol, but thus far, most of the
> work is simply design and not a lot of coding. We are almost ready to
> move into coding phase, but I still have a few details that need work
> before I am entirely confident in the architecture. First, I have a few
> questions about security, performance, and licensing maybe you can help
> me clear up.
Sure, will try.
>
> For this project, all "clients" are just web browsers using Autobahn|JS
> to connect to a WAMP "router/service". The "server" is an application
> running on the device hardware that must be lightweight, speak the WAMP
> protocol, and implement pub/sub and req/rep patterns for the purpose of
> working with Autobahn|JS and reducing the amount of client-side library
> development that must be done. This project is mostly just
Ok.
> client/server in the sense that:
>
> - client = Caller, Subscriber
> - server = Callee, Publisher
>
> Because of this model, I don't think I really need the Dealer/Broker
> patterns but you may convince me otherwise.
If you need PubSub, then you need a broker.
It's a different questions where that brokers runs, and how it is
structured compared to your app code (subscriber).
A broker might be:
- a separate OS process external to your app code process (the subscriber)
- running inside the same OS process that runs your app code (the
subscriber code), but still logically separated from the app code
In both cases, you do have a broker.
>
> The "server" component will need to use custom C/C++ libraries to
> execute functions specific to the hardware of the device, but need not
> necessarily route procedure calls between clients. Since all procedures
> are to be executed on the server side only, the clients will not need to
> 'register' any procedures. Clients will simply subscribe to topics and
> call procedures. Meanwhile, the "server" component will be the only
> part that can publish events and will process and respond to procedures.
You seem to have a quite restricted set of functionality/requirements -
_today_. I am not sure it is wise to assume those will stay like this
forever, and then deliberately cripple the underlying foundation - for
what gain?
>
> 1) security:
>
> I'd like to have an 'authenticate' method that is first called by the
> client application to initialize ACL permissions for the TCP/Websocket
> session. That means taking a username/password and responding with
> success or failure. This would be implemented with a simple call to
> something like:
>
> com.domain.auth.authenticate (string username, string password) -->
> [int result, string error_message]
Implementing authentication at the RPC level is the wrong approach. WAMP
has authentication at the beginning of WAMP session built right into the
protocol.
https://github.com/tavendo/WAMP/blob/master/spec/advanced.md#wamp-challenge-response-authentication
This is supported by AutobahnJS and Crossbar.io for example.
>
> My question is, can the WAMP router or internal client functions get
> access to the Session_ID for purpose of tracking session information
> associated with this connection? In a web PHP/Apache model, after
> authenticating a user, we would normally set a $_SESSION['auth_id'] =
> 1234 value that can be accessed and referenced on subsequent page calls.
> This $_SESSION data can be stored server-side in either files, mysql
> database, or memcached, etc. Is there comparable session-level variable
> storage with WAMP routers?
This is an internal implementation detail within routers not exposed to
apps. But see above how to do authentication.
E.g. the way you do authentication using Crossbar.io with custom app
code is by "doing dynamic authentication":
http://crossbar.io/docs/WAMP-CRA-Authentication/
You write a regular WAMP component that will then authenticate _other_
components.
In the former, you can do anthing you like: authenticate against "Foobar
Auth DB" whatevr.
>
> If the WAMP spec doesn't want to worry about storage of session data,
> that's fine with me, we can implement our own session storage using
> files, memcached, or mysql, etc but in order to tap into that storage
> data, we need at least access to a 'session id' value. Again in the PHP
> web model, this is managed by setting an HTTP cookie to track the
> session id between page requests.
You can access session IDs in any WAMP exposed procedure or event
handler via the "details" (Caller Details, Publisher Details) if the
router and client libs used supports this feature from the WAMP Advanced
Profile, which is the case e.g. for AutobahnXXX and Crossbar.io.
>
> If the "server" component of my project is broken into 2 parts (a router
> and a backend client), then the simple diagram looks as follows:
>
> backend client(Cpp) <-----> WAMP router <---> front-end client/gui (Js)
>
> But from that design, it looks like there will be a TCP connection from
> the WAMP router to the front-end client/gui where I would expect a
> "session id" to be bound ... and that would be a different TCP
> connection from the one between the WAMP router and the backend client.
WAMP session IDs are not "bound" to a point-to-point WAMP transport like
TCP, but the WAMP session.
> So, if all my procedures are implemented by the backend client, how
> does the backend client track the session associated with the front-end
> client that is making the actual calls and how do I implement ACL
> security on my procedure calls? I don't want to have to pass a token to
See above. Then, authorization of WAMP procedure calls, publication,
subscription is there already.
E.g. Crossbar.io supports both "static authorization" and "dynamic
authorization". The former has fixed permissions configured via config,
the latter allows you to hook up custom authorization procedures into
Crossbar.io
http://crossbar.io/docs/Authorization/
> every procedure call when the session tracking, ideally, would be
> transparent and embedded in the transport layer itself.
>
> 2) performance:
>
> The hardware we are using is minimal low-power chips and ram. We have a
In general, for performance on small devices, here are benchmarks on the
RaspberryPi:
http://tavendo.com/blog/post/autobahn-pi-benchmark/
> very basic and stripped down Linux running, but there is no apt or yum
> packaging. I'd prefer to use as few packages as possible with the least
What exactly is the device? Something like Intel Edison?
> amount of LOC possible in order to implement the server-side WAMP
> router/service. I don't even think I should *have* to separate the WAMP
> router from the actual server-side procedure implementations (in other
> words, I don't really want to have to create a separate backend client
> and router process). What I'm imagining would be all client procedures
Why?
> somehow built into the router itself and have the router's functionality
> crippled so that it no longer serves the full roles of broker or dealer.
No. I don't think "crippling" is the right approach.
>
> Similarly, I'd like to have just 1 daemon process running on the
> hardware that listens on a port and executes all called procedures
> internally where the only daemon process can be as lightweight as
> possible and preferably written in C/C++. I know Crossbar exists, and
> there is an Autobahn|Cpp client, but is there a skeleton C/C++ WAMP
> Router implementation that can be modded similar to the service I intend
> to create? It doesn't seem like the WAMP API is terribly complex, so
FWIW, WAMP is a protocol, not an API.
> perhaps there is a project similar to Thruway/PHP but for C/C++? I'd
There is no C++ router (currently). But I think Emile is working on one.
However: what you describe above ("crippled") is nothing we would
encourage. In fact, we wouldn't allow a "crippled router" to claim to be
a "WAMP router". This is to protect the integrity of the WAMP ecosystem.
> like to avoid having to add a new language dependency (like Python) and
> external libraries just for this project because device storage is
> already limited enough as it is and for the next reason, we want to
> limit our dependency on 3rd party libraries as much as reasonably possible.
>
> 3) licensing:
>
> If we intend to sell the hardware appliance and license the software,
> the WAMP protocol, Autobahn|JS, and possibly WAMP router implementation
> are created and licensed with the purpose of allowing that?
All our stuff is open-source, under Apache license (AutobahnXXX) and
AGPL (Crossbar.io) and Creative Commons (WAMP Spec).
Of course you can use this in a commercial, closed-source project. Since
app code is only "linked" with Apache licensed libs (AutobahnXXX), your
proprietory, closed code can stay like this (no "infection"). If you
modify Crossbar.io _itself_, then you will need to comply to the terms
set forth in AGPL.
The only thing we will not allow is to use the trademark "WAMP" for
stuff that actually isn't WAMP - because it's crippled. That would hurt
the ecosystem.
Note that we didn't had to enforce this up to now - in all (very few)
cases where people wanted to "cripple", a technical discussion in the
end was convincing enough. I really want to stress this: I want to
convince, not force.
However, that being said, if you don't like the core WAMP design, which
includes paradigms like "routers for decoupling" and "no app code in
routers", then WAMP probably isn't for you.
I usually go to any length of discussion convincing people WAMP is great
and the WAMP principles make sense - but I won't support crippling WAMP
just to win users.
Cheers,
/Tobias
>
> -- Dante
>
>
>
> --
> You received this message because you are subscribed to the Google
> Groups "WAMP" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to
wampws+un...@googlegroups.com
> <mailto:
wampws+un...@googlegroups.com>.
> To post to this group, send email to
wam...@googlegroups.com
> <mailto:
wam...@googlegroups.com>.
> Visit this group at
http://groups.google.com/group/wampws.
> To view this discussion on the web visit
>
https://groups.google.com/d/msgid/wampws/d2dd1780-f153-4761-8bbd-9dedf6ecb648%40googlegroups.com
> <
https://groups.google.com/d/msgid/wampws/d2dd1780-f153-4761-8bbd-9dedf6ecb648%40googlegroups.com?utm_medium=email&utm_source=footer>.
> For more options, visit
https://groups.google.com/d/optout.