For deployments to JBoss AS7 is it still expected that the old way of associating a security domain with a deployment / individual components will be followed? i.e. Specifying the<security-domain> element in the deployment descriptors or using the SecurityDomain annotation on specific beans.

Has there been any consideration regarding assigning a security domain as part of the actual deployment process i.e. deploy this archive and use domain X.

Regards, Darran Lofthouse. _______________________________________________ jboss-as7-dev mailing list jboss-as7-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/jboss-as7-dev

On 06/10/2011 05:03 PM, Marcus Moyses wrote: >> i.e. Specifying the<security-domain> element in the deployment >> descriptors or using the SecurityDomain annotation on specific beans. > Yes, the<security-domain> element is still used, at least in WARs. I > think it should be used for EARs as well. > There is SecurityDomain annotation in the PicketBox project but it has > never been used for EJB3s. I think we should start using it to avoid > having 2 different annotations. Customers get confused with that. >> Has there been any consideration regarding assigning a security domain >> as part of the actual deployment process i.e. deploy this archive and >> use domain X. Is there any plan to use this annotation with servlets?

Using a common annotation sounds good but a down side is that the annotation shares the package with a set of other annotations we do not support - users my inadvertently think these are supported as well. Regards, Darran Lofthouse. On 06/10/2011 05:09 PM, Marcus Moyses wrote: > I think it would be a good idea to use the same annotation for servlets > too. > If the EJB3 team is ok with using PB's annotation I can take a look at > integration it with servlets > > On 06/10/2011 01:06 PM, Darran Lofthouse wrote: >> On 06/10/2011 05:03 PM, Marcus Moyses wrote: >>>> i.e. Specifying the<security-domain> element in the deployment >>>> descriptors or using the SecurityDomain annotation on specific beans. >>> Yes, the<security-domain> element is still used, at least in WARs. I >>> think it should be used for EARs as well. >>> There is SecurityDomain annotation in the PicketBox project but it has >>> never been used for EJB3s. I think we should start using it to avoid >>> having 2 different annotations. Customers get confused with that. >>>> Has there been any consideration regarding assigning a security >>>> domain >>>> as part of the actual deployment process i.e. deploy this archive and >>>> use domain X. >> >> Is there any plan to use this annotation with servlets? >

I think it would be a good idea to use the same annotation for servlets too. If the EJB3 team is ok with using PB's annotation I can take a look at integration it with servlets

Furthermore, isn't the security for web, based on url-pattern and _not_ per servlet class? For example the same servlet class might be mapped to two different url-patterns and only one url-pattern might be secured. In such cases having a @SecurityDomain on a servlet class won't work, isn't it?

For deployments to JBoss AS7 is it still expected that the old way of associating a security domain with a deployment / individual components will be followed? i.e. Specifying the<security-domain> element in the deployment descriptors or using the SecurityDomain annotation on specific beans. Has there been any consideration regarding assigning a security domain as part of the actual deployment process i.e. deploy this archive and use domain X.

Regards, Darran Lofthouse. _______________________________________________ jboss-as7-dev mailing list jboss-as7-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/jboss-as7-dev