amichair commented on PR #2744: URL: https://github.com/apache/james-project/pull/2744#issuecomment-3005210417
> * For webadmin signing the claims prior the Webadmin calls is a show stopper Just to clarify, you don't have to sign it for each call - you create a token once, or only occasionally, and then use it until it expires or the key is revoked, similar to oauth or other rest api tokens. The nice thing about it is that it also contains the user, or in the future can contain different roles, so we can add more granular authorization - a read-only token, a read-only-my-domain token, or whatever we want. I'm hoping the documentation will encourage everyone to move to tokens instead of unprotected access or static secrets or external workarounds :-) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
