[JBoss Seam] - Ending nested conversations
by nstoddar
I'm confused about how to end a nested conversation. (Technically, I have no problem ending the nested conversation -- it just doesn't want to resume the parent conversation where it left off.)
I have my pageflow definition set up with transitions to a page that has the <end-conversation> tag in it. Unfortunately, according to the schema, page requires the "view-id" attribute, which is where the client always gets redirected.
How am I supposed to end the conversation and let the parent take over where it left.
Part 2 of my question ---- how the heck can I confirm that my conversations are correctly nested? On the debugger page, the only conversations that have the conversation data in the "conversation context" is the non-nested conversations. The nested ones don't have it, so I can't click to see what the parent conversation ID is.
I'm pretty sure that they're properly nested since I have nested="true" in pages.xml, and it would give me an error if it tried to create a nested conversation without an active long-running conversation.
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4042517#4042517
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4042517
17 years, 4 months
[JBoss Portal] - Sharing the portal security domain with a servlet
by engela
I quite like to share the security domain of the portal with a servlet which is in the same application context as my portlets. (The task of the servlet is to generate some images on-the-fly, but it needs to know the security context as only authenticated and authorized users are allowed to view the generated images).
Looking at the description in http://wiki.jboss.org/wiki/Wiki.jsp?page=SecureAWebApplicationInJBoss I tried the following steps:
1. I moved the portal security domain from the login configuration for the portal (JBOSS_HOME/default/deploy/jboss-portal.sar/conf/data/login-config.xml) to the JBoss AS login configuration JBOSS_HOME/default/conf/login-config.xml).
<application-policy name="portal">
| <authentication>
| <login-module code="org.jboss.portal.identity.auth.IdentityLoginModule" flag="sufficient">
| <module-option name="unauthenticatedIdentity">guest</module-option>
| <module-option name="userModuleJNDIName">java:/portal/UserModule</module-option>
| <module-option name="roleModuleJNDIName">java:/portal/RoleModule</module-option>
| <module-option name="additionalRole">Authenticated</module-option>
| <module-option name="password-stacking">useFirstPass</module-option>
| </login-module>
|
| <login-module code="org.jboss.security.auth.spi.LdapExtLoginModule" flag="required" >
|
| <!-- my ldap configuration -->
|
| </login-module>
| </authentication>
| </application-policy>
2. Configured the web.xml in my application context to secure my servlet
<?xml version="1.0"?>
| <!DOCTYPE web-app PUBLIC
| "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
| "http://java.sun.com/dtd/web-app_2_3.dtd">
| <web-app>
|
| <servlet>
| <servlet-name>test</servlet-name>
| <display-name>test</display-name>
| <servlet-class>TestServlet</servlet-class>
| </servlet>
|
| <servlet-mapping>
| <servlet-name>test</servlet-name>
| <url-pattern>/test</url-pattern>
| </servlet-mapping>
|
|
| <security-constraint>
| <web-resource-collection>
| <web-resource-name>test</web-resource-name>
| <url-pattern>/test</url-pattern>
| </web-resource-collection>
| <auth-constraint>
| <role-name>myrole</role-name>
| </auth-constraint>
| </security-constraint>
|
| <security-role>
| <role-name>myrole</role-name>
| </security-role>
| <security-role>
| </web-app>
3. Configured the jboss-web.xml in my application context to point the portal security domain
<jboss-web>
| <security-domain>java:jaas/portal</security-domain>
| </jboss-web>
The view.jsp of my portlet references the servlet
<%@ taglib uri="http://java.sun.com/portlet" prefix="portlet"%>
| <%@ page isELIgnored="false"%>
|
| <portlet:defineObjects />
| <p>Test Portlet Servlet Interaction</p>
| <iframe src=?my-web-app/test? />
The servlet currently prints out the remote user name (request. getRemoteUser()) and test if the user is in role ?myrole? (request.isUserInRole(?myrole?))
With the security constraint in place I get an HTTP Status 403 - Access to the requested resource has been denied in my iframe. If I remove the security constraint that the ouput in my iframe tells me that the remote user is null and returns false for reques.isUserInRole(?myrole?).
Is it possible that a serlvet shares the same security domain as my portlets? If yes, what am I doing wrong?
Thanks,
Anette
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4042510#4042510
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4042510
17 years, 4 months