[JBoss Portal] - Re: getPreferences with JSF portlet
by franco12
The problem is that the program won't pass through 'doView'
MDP_contribution_consultation.java
import javax.portlet.PortletPreferences;
| import javax.portlet.PortletSecurityException;
| import javax.portlet.RenderRequest;
| import javax.portlet.RenderResponse;
| import javax.portlet.PortletException;
| import java.io.IOException;
|
| public class MDP_contribution_consultation
| {
| String consulter="ok";
| String supprimer;
| private String init="false";
|
| protected void doView(RenderRequest request, RenderResponse response) throws PortletException, PortletSecurityException, IOException
| {
| response.setContentType("text/html");
| // StringBuffer html = new StringBuffer();
| // PrintWriter writer = response.getWriter();
| PortletPreferences prefs = request.getPreferences();
| String parameter = prefs.getValue("suppression_pref",init);
| if (parameter.equals("true"))
| {
| this.supprimer="ok";
| // html.append("<-- Contribution --><br/>");
| // html.append("<img src='/WEB-INF/images/logo.gif'/>");
| }
| else
| {
| this.supprimer="pas ok";
| // html.append("<-- Consultation --><br/>");
| }
| // response.getWriter().write(html.toString());
| // writer.close();
| }
|
| public String getConsulter()
| {
| return consulter;
| }
|
| public void setConsulter(String consulter)
| {
| this.consulter = consulter;
| }
|
| public String getSupprimer()
| {
| return supprimer;
| }
|
| public void setSupprimer(String supprimer)
| {
| this.supprimer = supprimer;
| }
| }
view.jsp
| <%@ taglib uri="http://java.sun.com/jsf/html" prefix="h" %>
| <%@ taglib uri="http://java.sun.com/jsf/core" prefix="f" %>
|
| <f:view>
| <div align="center">
| <h:panelGrid columns="3">
| <h:outputText value="NOM FICHE"/>
| <h:outputText value="CONSULTER"/>
| <h:outputText value="SUPPRIMER"/>
| <h:outputText value="fiche 1"/>
| <h:outputText value="#{MDP_contribution_consultation.consulter}"/>
| <h:outputText value="#{MDP_contribution_consultation.supprimer}"/>
| <h:outputText value="fiche 2"/>
| <h:outputText value="#{MDP_contribution_consultation.consulter}"/>
| <h:outputText value="#{MDP_contribution_consultation.supprimer}"/>
| <h:outputText value="fiche 3"/>
| <h:outputText value="#{MDP_contribution_consultation.consulter}"/>
| <h:outputText value="#{MDP_contribution_consultation.supprimer}"/>
| </h:panelGrid>
| <br/>
| </div>
| </f:view>
sorry for the multiple posts
regards
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3978510#3978510
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3978510
19 years, 8 months
[Security & JAAS/JBoss] - Re: Can't get access right from Java Client
by jaikiran
Thank you for being patient.
| StandaloneClient SecurityInterceptorOnServer SecureResource
| | | |
| | | |
| |1) doJAASlogin() | |
| | | |
| |2) invokeSecureResource() | |
| |---------------------------------------------->| |
| | | |
| | | |
| | |3)doJAASloginOnServer() |
| | | |
| | |4)if valid/authorized, let access |
| | |---------------------------------------------->|
| | |
|
|
The diagram above is just a simplified view of the entities involved, please do not go by the names.
Lets assume the following:
-------------------------
1) Only user(lets talk in terms of users instead of roles, for simplicity) "abc123" is allowed to access the secure resource
2) You are using ClientLoginModule at the standalone client programatically and UsersRolesLoginModule at the server(specified in jboss.xml) for securing the resource.
Here's the flow of what happens:
- The StandaloneClient invokes the doJAASlogin method using username "xyz"(invalid user) which uses ClientLoginModule to *populate the security info*.
- The doJAASlogin internally invokes the LoginContext's login method and this call to login succeeds even though the user is invalid. This is because you are using ClientLoginModule which does no authentication.
- After login, the StandAloneClient tries to access a secure resource on the server. It passes the security info which was created using the ClientLoginModule. This security info includes the username "xyz"(invalid user)
- At this point the Security interceptor(or whatever you call this entity) on the server comes into picture, since the resource is a secure one.
- The SecurityInterceptorOnServer will look at the jboss.xml to check the security domain to be used for authenticating the user request. In our case we have mentioned it as UsersRolesLoginModule (in our assumption #2).
- The SecurityInterceptorOnServer internally kicks off the authentication of the user request passing it the security info which was passed on by the StandAloneClient(this info includes the invalid username).
- During this process the UsersRolesLoginModule's login method is invoked. The UsersRolesLoginModule uses the username "xyz" and tries to login. But since this is not a valid user(remember as per assumption #1, valid username is "abc123"), the login fails and a SecurityException is thrown.
- Hence access to secure resource fails at this point.
This is how the flow works while accessing a secure resource.
I have tried my best to explain the flow to you. However, if you still have doubts about this, do let us know. Someone, if not me, will be able to help you out.
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3978507#3978507
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3978507
19 years, 8 months