README.rdoc in global_session-0.9.0 vs README.rdoc in global_session-1.0.0
- old
+ new
@@ -1,15 +1,18 @@
= Introduction
-HasGlobalSession enables multiple heterogeneous Web applications to share
+GlobalSession enables multiple heterogeneous Web applications to share
session state in a cryptographically secure way, facilitating single sign-on
-and enabling easier development of large-scale distributed applications that
+and enabling easier development of distributed applications that
make use of architectural strategies such as sharding or separation of concerns.
-In other words: it lets semi-related Web apps share selected bits of session
-state.
+In other words: it glues your semi-related Web apps together so they share the
+same bits of session state. This is done by putting the session itself into
+cookies.
+== What Is It Not?
+
This plugin does not provide a complete solution for identity management. In
particular, it does not provide any of the following:
* <b>federation</b> -- aka cross-domain single sign-on -- use OpenID for that.
@@ -71,11 +74,11 @@
a controller asks for one of its attributes. The cookie's value is updated
whenever attributes change. As an optimization, the signature is only
recomputed when the metadata or signed attributes have changed; insecure
attributes can change "for free."
-Because the security properties of attributes can vary, HasGlobalSession
+Because the security properties of attributes can vary, GlobalSession
requires all _possible_ attributes to be declared up-front in the config
file. The 'attributes' section of the config file defines the _schema_
for the global session: which attributes can be used, which can be trusted
to make authorization decisions (because they are signed), and are insecure
and therefore act only as "hints" about the session.
@@ -95,17 +98,17 @@
The nodes within the domain may all be running the same Rails application,
or they may be running different codebases that represent different parts of
a distributed application. (They may also be using app frameworks other than
Rails.)
-The only constraint imposed by HasGlobalSession is that all nodes within the
+The only constraint imposed by GlobalSession is that all nodes within the
domain must have end-user-facing URLs within the same second-level DNS domain.
This is due to limitations imposed by the HTTP cookie mechanism: for privacy
reasons, cookies will only be sent to nodes within the same domain as the
node that first created them.
-For example, in my HasGlobalSession configuration file I might specify that my
+For example, in my GlobalSession configuration file I might specify that my
cookie's domain is "example.com". My app nodes at app1.example.com and
app2.example.com would be part of the global session domain, but my business
partner's application at app3.partner.com could not participate.
== Authorities and Relying Parties
@@ -136,30 +139,30 @@
* system hosted by a third party vs. system hosted internally
* e-commerce node vs. storefront node vs. admin node
== The Directory
-The Directory is a Ruby object instantiated by HasGlobalSession in order to
+The Directory is a Ruby object instantiated by GlobalSession in order to
perform lookups of public and private keys. Given an authority name (as found
in a session cookie), the Directory can find the corresponding public key.
If the local system is an authority itself, #local_authority_name will
return non-nil and #private_key will return a private key suitable for
signing session attributes.
-The Directory implementation included with HasGlobalSession uses the filesystem
+The Directory implementation included with GlobalSession uses the filesystem
as the backing store for its key pairs. Its #initialize method accepts a
filesystem path that will be searched for files containing PEM-encoded public
and private keys (the same format used by OpenSSH). This simple Directory
implementation relies on the following conventions:
* Public keys have a *.pub extension.
* Private keys have a *.key extension.
* If a node is an authority, then one (and *only* one) *.key file should exist.
* The local node's authority name is inferred from the name of the private key
file.
-When used with a Rails app, HasGlobalSession expects to find its keystore in
+When used with a Rails app, GlobalSession expects to find its keystore in
config/authorities. You can use the global_session generator to create new key
pairs. Remember never to check a *.key file into a public repository!! (*.pub
files can be checked into source control and distributed freely.)
If you wish all of the systems to stop trusting an authority, simply delete
@@ -167,10 +170,10 @@
=== Implementing Your Own Directory Provider
To replace or enhance the built-in Directory, simply create a new class that
extends Directory and put the class somewhere in your app (the lib directory
-is a good choice). In the HasGlobalSession configuration file, specify the
+is a good choice). In the GlobalSession configuration file, specify the
class name of the directory under the 'common' section, like so:
common:
integrated: true
directory: MyCoolDirectory