[JBoss Seam] - Re: Multiple Domain Quesiton
by spambob
"rjstanford" wrote : ...If they visit "http://theirsite.com/admin") though, even though to the app its a legitimate endpoint, I wish to present them with a 404 error since its not known to their URL...
I was thinking about how to do this best too for some time and I really think this is useful, not "security by obscurity", because people wont start to fiddle with something if they don't know it's there.
More generally speaking: I would like to overwrite the standard reaction upon an exception for a specific subset of a pages.
Further I would prefer to do this integrated with Seam security & fully configured in pages.xml instead of manually checking for it like Peter described.
So could we please get something like:
<page view-id="/admin/*">
| <restrict>#{s:hasRole('admin')}</restrict>
| <exception class="org.jboss.seam.security.AuthorizationException">
| <http-error error-code="404"/>
| </exception>
| </page>
One downside might be that one would get a 404 too if one is admin but calls some method that requires "superadmin" privileges. On the other hand - if the app is designed in an coherent way - this shouldn't happen because controls for which one hasn't the necessary privileges are usually not shown. Another solution might be to overwrite the exception mapping only for page access and not for the backend.
So what do you think about this & could this please be added?!
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4035465#4035465
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4035465
19 years
[News & Announcements] - JBossAS 5.0.0.Beta2 released
by rrajesh
JBoss Application Server 5.0.0.Beta2 is released and is available for download on sourceforge at
http://sourceforge.net/project/showfiles.php?group_id=22866&package_id=16...
JBoss 5.0.0.Beta2 Release Notes
This is the 2nd Beta release of the JBoss 5.0.x series for the Java EE? 5 codebase! For information on the APIs that make up Java EE 5, see Java EE APIs & Docs. A tutorial on Java EE 5 can be found here.
Please note that work on JBoss 5 is ongoing and this Beta release is by definition an unstable one that demonstrates many of the exciting new features of the JBoss Application Server. This should not be used in production evironments.
Overview
* Highlights
* Known Issues
* JBoss/Thirdparty Library Updates
* Detailed Release Notes
* Additional Docs and Help
* Licenses
* About JBoss
Highlights
JBoss 5 is the next generation of the JBoss Application Server build on top of the new JBoss Microcontainer. The JBoss Microcontainer is a lightweight container for managing POJOs, their deployment, configuration and lifecycle. It is a standalone project that replaces the famous JBoss JMX Microkernel of the 3.x and 4.x JBoss series. The Microcontainer integrates nicely with the JBoss framework for Aspect Oriented Programming, JBoss AOP. Support for JMX in JBoss 5 remains strong and MBean services written against the old Microkernel are expected to work.
JBoss5 is designed around the advanced concept of a Virtual Deployment Framework (VDF), that takes the aspect oriented design of many of the earlier JBoss containers and applies it to the deployment layer. Aspectized Deployers operate in a chain over a Virtual File System (VFS), analyze deployments and produce metadata to be used by the JBoss Microcontainer, which in turn instantiates and wires together the various pieces of a deployment, controlling their lifecycle and dependencies.
The deployments available to a server configuration are managed by the ProfileService. This replaces the directory scanner services of previous releases. In Beta2, there are two versions; a basic implementation that sits on top of server file system layout, and a repository based version that introduces a pluggable spi for the deployment content as well as admin edit overrides. The basic is the default. See the wiki page for how to configure the repository version.
Many key features of JBoss 5 are provided by integrating other standalone JBoss projects:
* JBoss EJB3 included with JBoss 5 provides the implementation of the latest revision of the Enterprise Java Beans (EJB) specification. EJB 3.0 is a deep overhaul and simplification of the EJB specification. EJB 3.0's goals are to simplify development, facilitate a test driven approach, and focus more on writing plain old java objects (POJOs) rather than coding against complex EJB APIs.
* JBoss Messaging is a high performance JMS provider in the JBoss Enterprise Middleware Stack (JEMS), included with JBoss 5 as the default messaging provider. It is also the backbone of the JBoss ESB infrastructure. JBoss Messaging is a complete rewrite of JBossMQ, which is the default JMS provider for the JBoss AS 4.x series.
* JBossCache 2.0 that comes in two flavors. A traditional tree-structured node-based cache and a PojoCache, an in-memory, transactional, and replicated cache system that allows users to operate on simple POJOs transparently without active user management of either replication or persistency aspects.
* JBossWS 2 is the web services stack for JBoss 5 providing Java EE compatible web services, JAXWS-2.0 and JAXB-2.0.
* JBoss Transactions is the default transaction manager for JBoss 5. JBoss Transactions is founded on industry proven technology and 18 year history as a leader in distributed transactions, and is one of the most interoperable implementations available.
* JBoss Web is the Web container in JBoss 5, an implementation based on Apache Tomcat that includes the Apache Portable Runtime (APR) and Tomcat native technologies to achieve scalability and performance characteristics that match and exceed the Apache Http server.
JBoss 5 includes numerous features and bug fixes, many of them carried over upstream from the 4.x codebase. See the Detailed Release Notes section for the full details.
The directory structure of JBoss 5 resembles that of the 4.x series with some notable differences:
* bin - start scripts and run.jar
* client - client jars
* docs - docs, chemas/dtds, examples
* lib - core bootstrap jars, somewhat different with the introduction of the microcontainer and breakup of jboss-common.
* server - the same server configuration dirs.
o default configuration
+ conf
# bootstrap-beans.xml - new mc kernel bootstrap configuration
# jax-ws-catalog.xml - oasis catalog driven schema/dtd namespace configuration
# jbossjta-properties.xml - new JBossTS properties
# jboss-service.xml - legacy static mbeans for compatibility
# jndi.properties - the same jndi props
# log4j.xml - the same log4j config
# login-config.xml - the same jaas login config
# props/ - the same default jaas login properties files
# standardjbosscmp-jdbc.xml - the same cmp2 config
# standardjboss.xml - the same ejb2 config
# xmdesc/ - legacy xmbean descriptors
+ deploy/ - the same deploy directory. As of Beta2 hotdeployment works for content in this directory.
+ deployers/ - new VDF deployers
# client-deployer-beans.xml - ee14 client deployer
# ear-deployer-beans.xml - ear deployers
# ejb3.deployer/ - ejb3 deployers
# ejb-deployer-beans.xml - ejb2 deployers
# jboss-aop-jboss5.deployer/ - aspect deployer
# jbossweb.deployer/ - war deployers
# jca-deployers-beans.xml - jca deployers
# jbossws.deployer - webservice deployers
# profileservice-beans.xml.bak - example repository ProfileService beans
# security-deployer-beans.xml - security aspect deployer beans
+ lib/ - the same static library jars
Library Updates
JBoss Libraries
* apache-logging version="1.1.0.jboss"
* apache-log4j version="1.2.14"
* javassist version="3.5.0.CR1"
* jaxen version="1.1-beta-10"
* jboss/aop version="2.0.0.alpha4"
* jboss/cache version="v2.0.0.BETA1"
* jboss/common-core version="v2.0.4.Alpha"
* jboss/jaxr version="1.2.0.GA"
* jboss/jbossxb version="2.0.0.CR2"
* jboss/jbossws-jboss50 version="2.0.0.DEV"
* jboss/jbossws-wsconsume-impl version="2.0.0"
* jboss/messaging version="1.2.0.SP.snapshot.aop2beta"
* jboss/microcontainer version="2.0.0.Beta3"
* jboss/jboss-vfs version="2.0.0.Beta4"
* jboss/remoting version="2.2.0.GA"
* jboss/web version="2.0.0.CR2"
* jgroups version="2.4.1"
* sun-jsf" version="1.2_04_P01"
* woodstox version="3.1.1"
Known Issues
There are several known issues in the Beta2 release.
* The VFS has been updated to return vfs* style URLs for the VirtualFile protocols to allow for consistent integration with the URL Handler api. This still needs performance tweaking. The Beta2 startup times and memory usage have both increased. This will be addressed in Beta3. There are also known memory leaks.
* A prototype of the ProfileService admin api is part of the repository base ProfileService. This provides limited support for DataSource type of deployments and is really just an internal prototype that has no admin console support. Additional editing capabilities and integration with a next gen console are targetted for Beta3.
* Hot deployment of the deploy directory contents is supported in this release. There is a known issue with redeploying an archive JBAS-4220. The workaround is to remove the deployment and then copy in the update after the scanner has undeployed the archive.
* Deployment manifest Class-Path processing has issues. Deployments relying on archive manifest Class-Path may see class loading errors.
* Nested deployments can have startup dependency issues. The VDF deployment model currently does not allow for package/deployment level ordering. If a container is relying on implicit startup ordering rather than declaring its dependencies startup/deployment problems can exist. Work to allow for deployment package ordering as well as cleaning up container dependency declaration is targetted for Beta3.
* The server testsuite is only passing about 80% of the tests. There are several issues targetted for Beta3 that need to be fixed to address the current failures.
* JACC security integration is mostly broken. The security aspects deployer still has not been adequately integrated in Beta2.
Detailed Release Notes
Bug
* [JBAS-3071] - MemoryLeak (redeployment) on EJB3
* [JBAS-3265] - Problem with empty classname in classloader
* [JBAS-3560] - shutdown.sh fails because it cannot find org/jboss/logging/Logger
* [JBAS-3571] - Bad interaction between http session passivation and buddy replication
* [JBAS-3746] - org.jboss.test.jbossmx.compliance.standard.InfoTortureTestCase.testValidAttribute failure
* [JBAS-3780] - Deploying empty file to farm directory causes ScannerThread to hang
* [JBAS-3781] - Stateful SB Instance Interceptor should not push SubjectContext if RunAsIdentity present
* [JBAS-3800] - EJBQLToSQL92Compiler should use only searchable columns with DISTINCT
* [JBAS-3825] - Fix BASIC authentication
* [JBAS-3828] - spelling mistake in xml tag
* [JBAS-3838] - ServerInfo does not check response from getThreadInfo for null
* [JBAS-3855] - org.jboss.invocation.InvocationStatistics are not serializable and cannot be queried by twiddle
* [JBAS-3860] - XAManagedConnection should implement LocalTransaction to clean up hanging LocalTransaction
* [JBAS-3867] - "java.io.IOException: Read error" when deploying wars
* [JBAS-3869] - Error deploying HASingleton service on windows
* [JBAS-3874] - Deployment of JavaEE5 application client fails if element "application-client" has attribute "id"
* [JBAS-3884] - Unexpected end of ZLIB input stream for nested JAR files
* [JBAS-3893] - REGRESION - jboss-client.jar misses MarshalledInvocation$DeclaredMethods
* [JBAS-3917] - The JMS JCA adapter's DLQMaxResent is set by default to 0, causing messages to go straight to DLQ
* [JBAS-3924] - InvlidationManager$InvlidationGroupImpl produces incorrect log4j DEBGU level setting
* [JBAS-3941] - JBossCacheService fails in start if context path contains '/'
* [JBAS-3946] - remove() called on home of a sfsb in tx must fail
* [JBAS-3947] - JConsole throws exception on connect post JBoss4.0.3SP1
* [JBAS-3956] - JACC PolicyContextHandler usage leaks ThreadLocal values
* [JBAS-3967] - EJB3 client enc contains env, J2EE 1.4 doesn't
* [JBAS-3968] - Unique node id not properly set on multiplexed channel
* [JBAS-3969] - IOException: unknown protocol: vfsfile
* [JBAS-3972] - incorrect synchronization in JmsServerSessionPool
* [JBAS-4002] - JBossWorkManager treats ExecutionContext transaction timeout as milliseconds when it should be seconds are per the API
* [JBAS-4014] - timer persistence in afterCompletion
* [JBAS-4033] - cache partition index calculation
* [JBAS-4035] - BatchReplicationClusteredSessionValve masks exceptions
* [JBAS-4041] - jboss_init_redhat.sh is incompatible with a clustered config
* [JBAS-4048] - ExternalContext needs to expand its proxy interface collection
* [JBAS-4075] - JBossCacheManager.findLocalSessions concurrency issue
* [JBAS-4086] - access to UserTransaction methods from SLSB
* [JBAS-4090] - Race condition in Connection.close() can deadlock the JBossMQ's ping thread.
* [JBAS-4116] - JRMPInvokerHA fails with a NPE when no JRMPInvoker is setup on the server
* [JBAS-4121] - Race condition in JCA Pool Filler
* [JBAS-4157] - mail-ra: endpoint deactivation doesn't cause mail checks to stop
* [JBAS-4183] - Failed to update attributes through JMX console
* [JBAS-4187] - jsp_2_1.xsd is missing
* [JBAS-4191] - ProxyFactory leaks classloader if SFSB is used
* [JBAS-4204] - Don't allow removal of durable topic subscriptions when there are active subscribers or unacknowledged messages
* [JBAS-4205] - Nested DataSource fails to deploy before ejbs
* [JBAS-4206] - HDScanner processing does not use correct TCL
* [JBAS-4212] - Missing file for tomcat-webctx server configuration
* [JBAS-4214] - Need to port EARDeployer isolation settings to JBossAppParsingDeployer
* [JBAS-4218] - Incorrect description in connector_1_0.dtd
* [JBAS-4225] - Error starting up jbossmq PersistenceManager with Sybase
* [JBAS-4226] - alternative deployment descriptor resolution fails on unix
* [JBAS-4231] - JMXOpsAccessControlFilter is Not Thread Safe
* [JBAS-4240] - SQL error in uuid-key-generator.sar jboss-service.xml against DB2 7.2
* [JBAS-4243] - build.bat does not process command line arguments correctly
* [JBAS-4278] - Timers: PreparedStatement.setNull() should be used for null arguments
* [JBAS-4291] - PeriodTestCase - wrong computation of maxDeviation
Feature Request
* [JBAS-1955] - XMBean Interceptor for InvokerAdaptorService to deal with NonSerializableExceptions
* [JBAS-3460] - Allow per-webapp configuration of useJK, snapshotMode and snapshotInterval
* [JBAS-3515] - Enable Streaming State Transfer for Cluster partition state
* [JBAS-3537] - Add a startup switch to configure a multicast port
* [JBAS-3675] - Add LockOwnerName to ThreadDump output from ServerInfo
* [JBAS-3847] - Extend EJBContext.getRollbackOnly to cover transactions which have been asynchronously rolled back
* [JBAS-3862] - Allow direct injection of target into HASingletonController
* [JBAS-3966] - Add a VersionNumber attribute on the jboss.system:type=Server mbean
* [JBAS-4047] - PooledInvokerProxy.getPooledConnection() could hold a lock for shorter period of time
* [JBAS-4055] - Hot Deploy doesn't work in JBoss 5.0.0.Beta1
* [JBAS-4106] - Allow use of classes from scoped loaders in ClusterPartition RPC calls
* [JBAS-4289] - Provide persistence_1_0.xsd and orm_1_0.xsd in $JBOSS_HOME/docs/schema
Patch
* [JBAS-2026] - Wrong placeholder ear created
* [JBAS-4115] - Improve imap/pop3 support in mail-ra.rar
Task
* [JBAS-2100] - AOP integration in JBoss5
* [JBAS-2440] - Review use of HashMap vs. Map as a type declaration in DistributedReplicantManagerImpl
* [JBAS-2617] - ej3.deployer contains too many jars
* [JBAS-2865] - Move org.jboss.naming package from server module to naming module
* [JBAS-2921] - Use JBossSerialization for serializing sessions and attributes before putting them in the cache
* [JBAS-3276] - Exception Sorter Implementations should be validated against current RDBMS documentation.
* [JBAS-3473] - Fix DistributedStateImpl.nodeRemove
* [JBAS-3726] - Introduce basic twiddle testing in the testsuite
* [JBAS-3735] - Integrate JGroups 2.4.1.SP1 in JBossAS 5
* [JBAS-3817] - Fix EJB2.1 deployments
* [JBAS-3872] - JBossCacheManager should get passivation config from WebMetaData.getPassivationConfig
* [JBAS-3908] - Upgrade jboss and thirdparty dependencies for JBoss 5.0.0.Beta2
* [JBAS-3932] - Security Deployer to manage the JACC metadata
* [JBAS-3974] - Remove versioned jars
* [JBAS-4006] - Add a test of class deserialization in HAPartitionImpl
* [JBAS-4030] - make standard containers extend IPT
* [JBAS-4062] - Remove use of JGroups Debugger from ClusterPartition
* [JBAS-4063] - Remove EVENT_TRACE from cluster module
* [JBAS-4065] - Convert HASingletonElectionPolicyTestCase to use its own Partition
* [JBAS-4144] - Remove remaining uses of the legacy ejbunit class (JUnitEJB)
* [JBAS-4147] - Include derby-plugin.jar in docs/examples/varia
* [JBAS-4161] - run.sh/.bat should not complaint when running with a JRE
* [JBAS-4162] - run.bat/.sh should allow loading native libraries from bin/native, if it exists
* [JBAS-4171] - Stabilize the testsuite
* [JBAS-4179] - Update interfaces for HASingletonEvictionPolicy
* [JBAS-4181] - If -b 0.0.0.0 is used, do not pass wildcard addresss through to JGroups
* [JBAS-4233] - JBAS Testsuite: Call super.setUp in overridden setUp methods
* [JBAS-4234] - JBAS Testsuite: getServerHost() related changes
* [JBAS-4263] - Remove JBoss version of StandardService
* [JBAS-4295] - throw a 'no transaction' exception instead of NPE
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4035457#4035457
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4035457
19 years