August 2008 - seam-commits - Jboss List Archives

Seam SVN: r8701 - in trunk/examples/wiki/src: main/org/jboss/seam/wiki/core/action and 1 other directory.

by seam-commits＠lists.jboss.org

Author: christian.bauer(a)jboss.com Date: 2008-08-15 07:05:25 -0400 (Fri, 15 Aug 2008) New Revision: 8701 Modified: trunk/examples/wiki/src/etc/META-INF/components-dev.xml trunk/examples/wiki/src/etc/META-INF/components-prod.xml trunk/examples/wiki/src/main/org/jboss/seam/wiki/core/action/WikiIdentity.java Log: Minor fixes Modified: trunk/examples/wiki/src/etc/META-INF/components-dev.xml =================================================================== --- trunk/examples/wiki/src/etc/META-INF/components-dev.xml 2008-08-15 10:38:23 UTC (rev 8700) +++ trunk/examples/wiki/src/etc/META-INF/components-dev.xml 2008-08-15 11:05:25 UTC (rev 8701) @@ -43,8 +43,7 @@   - <core:init debug="false" - disabled-interceptors="org.jboss.seam.persistence.ManagedEntityIdentityInterceptor"/> + <core:init debug="false"/>  <persistence:entity-manager-factory name="wikiEntityManagerFactory" @@ -69,22 +68,4 @@ </property> </component> -  - - </components> Modified: trunk/examples/wiki/src/etc/META-INF/components-prod.xml =================================================================== --- trunk/examples/wiki/src/etc/META-INF/components-prod.xml 2008-08-15 10:38:23 UTC (rev 8700) +++ trunk/examples/wiki/src/etc/META-INF/components-prod.xml 2008-08-15 11:05:25 UTC (rev 8701) @@ -41,8 +41,7 @@   - <core:init debug="false" - disabled-interceptors="org.jboss.seam.persistence.ManagedEntityIdentityInterceptor"/> + <core:init debug="false"/>  <persistence:entity-manager-factory name="wikiEntityManagerFactory" Modified: trunk/examples/wiki/src/main/org/jboss/seam/wiki/core/action/WikiIdentity.java =================================================================== --- trunk/examples/wiki/src/main/org/jboss/seam/wiki/core/action/WikiIdentity.java 2008-08-15 10:38:23 UTC (rev 8700) +++ trunk/examples/wiki/src/main/org/jboss/seam/wiki/core/action/WikiIdentity.java 2008-08-15 11:05:25 UTC (rev 8701) @@ -8,16 +8,14 @@ import org.jboss.seam.Component; import org.jboss.seam.ScopeType; -import org.jboss.seam.annotations.AutoCreate; -import org.jboss.seam.annotations.Install; import static org.jboss.seam.annotations.Install.APPLICATION; -import org.jboss.seam.annotations.Name; -import org.jboss.seam.annotations.Scope; +import org.jboss.seam.annotations.*; import org.jboss.seam.annotations.intercept.BypassInterceptors; import org.jboss.seam.core.Events; import org.jboss.seam.security.AuthorizationException; import org.jboss.seam.security.Identity; import org.jboss.seam.wiki.core.model.*; +import org.jboss.seam.wiki.core.model.Role; /** * Need this until Drools fixes bugs and becomes usable/debuggable. @@ -28,6 +26,7 @@ @BypassInterceptors @Install(precedence=APPLICATION) @AutoCreate +@Startup public class WikiIdentity extends Identity { private User currentUser;

15 years, 9 months

1
0
0 / 0

Seam SVN: r8700 - trunk/doc/Seam_Reference_Guide/en-US.

by seam-commits＠lists.jboss.org

Author: shane.bryzak(a)jboss.com Date: 2008-08-15 06:38:23 -0400 (Fri, 15 Aug 2008) New Revision: 8700 Modified: trunk/doc/Seam_Reference_Guide/en-US/Security.xml Log: minor Modified: trunk/doc/Seam_Reference_Guide/en-US/Security.xml =================================================================== --- trunk/doc/Seam_Reference_Guide/en-US/Security.xml 2008-08-15 10:24:31 UTC (rev 8699) +++ trunk/doc/Seam_Reference_Guide/en-US/Security.xml 2008-08-15 10:38:23 UTC (rev 8700) @@ -4888,15 +4888,9 @@ <para> Sometimes it might be necessary to extend the Identity component if your application has - special security requirements. For example, users might be required to authenticate using - a Company or Department ID, along with their usual username and password. If permission-based - security is required then RuleBasedIdentity should be extended, otherwise Identity should be - extended. - </para> - - <para> - The following example shows an extended Identity component with an additional - <literal>companyCode</literal> field. The install precendence of <literal>APPLICATION</literal> + special security requirements. The following example (contrived, as credentials would normally + be handled by the <literal>Credentials</literal> component instead) shows an extended Identity + component with an additional <literal>companyCode</literal> field. The install precendence of <literal>APPLICATION</literal> ensures that this extended Identity gets installed in preference to the built-in Identity. </para> @@ -4929,49 +4923,13 @@ } }]]></programlisting> - <para> - Note that an <literal>Identity</literal> component must be marked <literal>@Startup</literal>, so - that it is available immediately after the <literal>SESSION</literal> context begins. - </para> + <warning> + Note that an <literal>Identity</literal> component must be marked <literal>@Startup</literal>, so + that it is available immediately after the <literal>SESSION</literal> context begins. + Failing to do this may render certain Seam functionality inoperable in your application. + </warning> + </sect1> - - - <sect1> - <title>Seam-gen and Identity Management</title> - - <para> - When creating a new project using seam-gen (see <xref linkend="gettingstarted"/>), by default the - <literal>IdentityManager</literal> will be configured with a <literal>JPAIdentityStore</literal> - and a <literal>UserAccount</literal> implementation will be generated as part of the new project. - In addition to this, the project will include the following user management screens, allowing - new users to be created, roles assigned, etc: - </para> - - <mediaobject> - <imageobject role="fo"> - <imagedata fileref="images/security-usermanager1.png" align="center"/> - </imageobject> - <imageobject role="html"> - <imagedata fileref="images/security-usermanager1.png" align="center"/> - </imageobject> - </mediaobject> - - <para> - The user detail screen: - </para> - - <mediaobject> - <imageobject role="fo"> - <imagedata fileref="images/security-usermanager2.png" align="center"/> - </imageobject> - <imageobject role="html"> - <imagedata fileref="images/security-usermanager2.png" align="center"/> - </imageobject> - </mediaobject> - - - </sect1> - </chapter>

15 years, 9 months

1
0
0 / 0

Seam SVN: r8699 - trunk/src/main/org/jboss/seam/web.

by seam-commits＠lists.jboss.org

Author: shane.bryzak(a)jboss.com Date: 2008-08-15 06:24:31 -0400 (Fri, 15 Aug 2008) New Revision: 8699 Modified: trunk/src/main/org/jboss/seam/web/AuthenticationFilter.java Log: throw exception if identity is null Modified: trunk/src/main/org/jboss/seam/web/AuthenticationFilter.java =================================================================== --- trunk/src/main/org/jboss/seam/web/AuthenticationFilter.java 2008-08-15 10:19:27 UTC (rev 8698) +++ trunk/src/main/org/jboss/seam/web/AuthenticationFilter.java 2008-08-15 10:24:31 UTC (rev 8699) @@ -132,6 +132,12 @@ { Context ctx = new SessionContext( new ServletRequestSessionMap(request) ); Identity identity = (Identity) ctx.get(Identity.class); + + if (identity == null) + { + throw new ServletException("Identity not found - please ensure that the Identity component is created on startup."); + } + Credentials credentials = (Credentials) ctx.get(Credentials.class); boolean requireAuth = false; @@ -151,16 +157,9 @@ username = token.substring(0, delim); password = token.substring(delim + 1); } - - if (!Strings.isEmpty(username) && !Strings.isEmpty(password)) - { - // Force session creation if we've received credentials in the request - request.getSession(true); - } // Only reauthenticate if username doesn't match Identity.username and user isn't authenticated - if (credentials != null && !username.equals(credentials.getUsername()) || - (identity != null && !identity.isLoggedIn())) + if (!username.equals(credentials.getUsername()) || !identity.isLoggedIn()) { try { @@ -175,7 +174,7 @@ } } - if (identity != null && !identity.isLoggedIn() && credentials != null && !credentials.isSet()) + if (!identity.isLoggedIn() && !credentials.isSet()) { requireAuth = true; } @@ -193,7 +192,7 @@ requireAuth = true; } - if ((requireAuth && (identity != null && !identity.isLoggedIn())) || identity == null) + if ((requireAuth && !identity.isLoggedIn())) { response.addHeader("WWW-Authenticate", "Basic realm=\"" + realm + "\""); response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Not authorized"); @@ -206,6 +205,12 @@ { Context ctx = new SessionContext( new ServletRequestSessionMap(request) ); Identity identity = (Identity) ctx.get(Identity.class); + + if (identity == null) + { + throw new ServletException("Identity not found - please ensure that the Identity component is created on startup."); + } + Credentials credentials = (Credentials) ctx.get(Credentials.class); boolean requireAuth = false; @@ -213,10 +218,7 @@ String header = request.getHeader("Authorization"); if (header != null && header.startsWith("Digest ")) - { - // Force session creation if we've received credentials in the request - request.getSession(true); - + { String section212response = header.substring(7); String[] headerEntries = section212response.split(","); @@ -261,7 +263,7 @@ } } - if (identity != null && !identity.isLoggedIn() && credentials != null && !credentials.isSet()) + if (!identity.isLoggedIn() && !credentials.isSet()) { requireAuth = true; } @@ -279,7 +281,7 @@ requireAuth = true; } - if ((requireAuth && (identity != null && !identity.isLoggedIn())) || identity == null) + if ((requireAuth && !identity.isLoggedIn())) { long expiryTime = System.currentTimeMillis() + (nonceValiditySeconds * 1000);

15 years, 9 months

1
0
0 / 0

Seam SVN: r8698 - trunk/doc/Seam_Reference_Guide/en-US.

by seam-commits＠lists.jboss.org

Author: christian.bauer(a)jboss.com Date: 2008-08-15 06:19:27 -0400 (Fri, 15 Aug 2008) New Revision: 8698 Modified: trunk/doc/Seam_Reference_Guide/en-US/Security.xml Log: Document @Startup requirement for custom Identity component Modified: trunk/doc/Seam_Reference_Guide/en-US/Security.xml =================================================================== --- trunk/doc/Seam_Reference_Guide/en-US/Security.xml 2008-08-15 09:55:49 UTC (rev 8697) +++ trunk/doc/Seam_Reference_Guide/en-US/Security.xml 2008-08-15 10:19:27 UTC (rev 8698) @@ -4929,6 +4929,11 @@ } }]]></programlisting> + <para> + Note that an <literal>Identity</literal> component must be marked <literal>@Startup</literal>, so + that it is available immediately after the <literal>SESSION</literal> context begins. + </para> + </sect1>

15 years, 9 months

1
0
0 / 0

Seam SVN: r8697 - trunk/src/main/org/jboss/seam/security/permission.

by seam-commits＠lists.jboss.org

Author: shane.bryzak(a)jboss.com Date: 2008-08-15 05:55:49 -0400 (Fri, 15 Aug 2008) New Revision: 8697 Modified: trunk/src/main/org/jboss/seam/security/permission/PersistentPermissionResolver.java trunk/src/main/org/jboss/seam/security/permission/RuleBasedPermissionResolver.java Log: these should be BUILT_IN, not FRAMEWORK Modified: trunk/src/main/org/jboss/seam/security/permission/PersistentPermissionResolver.java =================================================================== --- trunk/src/main/org/jboss/seam/security/permission/PersistentPermissionResolver.java 2008-08-15 09:25:22 UTC (rev 8696) +++ trunk/src/main/org/jboss/seam/security/permission/PersistentPermissionResolver.java 2008-08-15 09:55:49 UTC (rev 8697) @@ -1,7 +1,7 @@ package org.jboss.seam.security.permission; import static org.jboss.seam.ScopeType.APPLICATION; -import static org.jboss.seam.annotations.Install.FRAMEWORK; +import static org.jboss.seam.annotations.Install.BUILT_IN; import java.io.Serializable; import java.util.Iterator; @@ -31,7 +31,7 @@ @Name("org.jboss.seam.security.persistentPermissionResolver") @Scope(APPLICATION) @BypassInterceptors -@Install(precedence=FRAMEWORK) +@Install(precedence=BUILT_IN) @Startup public class PersistentPermissionResolver implements PermissionResolver, Serializable { Modified: trunk/src/main/org/jboss/seam/security/permission/RuleBasedPermissionResolver.java =================================================================== --- trunk/src/main/org/jboss/seam/security/permission/RuleBasedPermissionResolver.java 2008-08-15 09:25:22 UTC (rev 8696) +++ trunk/src/main/org/jboss/seam/security/permission/RuleBasedPermissionResolver.java 2008-08-15 09:55:49 UTC (rev 8697) @@ -1,7 +1,7 @@ package org.jboss.seam.security.permission; import static org.jboss.seam.ScopeType.SESSION; -import static org.jboss.seam.annotations.Install.FRAMEWORK; +import static org.jboss.seam.annotations.Install.BUILT_IN; import java.io.Serializable; import java.security.Principal; @@ -41,7 +41,7 @@ @Name("org.jboss.seam.security.ruleBasedPermissionResolver") @Scope(SESSION) @BypassInterceptors -@Install(precedence=FRAMEWORK, classDependencies="org.drools.WorkingMemory") +@Install(precedence=BUILT_IN, classDependencies="org.drools.WorkingMemory") @Startup public class RuleBasedPermissionResolver implements PermissionResolver, Serializable {

15 years, 9 months

1
0
0 / 0

Seam SVN: r8696 - trunk/src/main/org/jboss/seam/web.

by seam-commits＠lists.jboss.org

Author: shane.bryzak(a)jboss.com Date: 2008-08-15 05:25:22 -0400 (Fri, 15 Aug 2008) New Revision: 8696 Modified: trunk/src/main/org/jboss/seam/web/AuthenticationFilter.java Log: force session creation when credentials are passed in the initial request Modified: trunk/src/main/org/jboss/seam/web/AuthenticationFilter.java =================================================================== --- trunk/src/main/org/jboss/seam/web/AuthenticationFilter.java 2008-08-15 08:53:19 UTC (rev 8695) +++ trunk/src/main/org/jboss/seam/web/AuthenticationFilter.java 2008-08-15 09:25:22 UTC (rev 8696) @@ -33,6 +33,7 @@ import org.jboss.seam.servlet.ContextualHttpServletRequest; import org.jboss.seam.servlet.ServletRequestSessionMap; import org.jboss.seam.util.Base64; +import org.jboss.seam.util.Strings; /** * Seam Servlet Filter supporting HTTP Basic and Digest authentication. Some code @@ -150,6 +151,12 @@ username = token.substring(0, delim); password = token.substring(delim + 1); } + + if (!Strings.isEmpty(username) && !Strings.isEmpty(password)) + { + // Force session creation if we've received credentials in the request + request.getSession(true); + } // Only reauthenticate if username doesn't match Identity.username and user isn't authenticated if (credentials != null && !username.equals(credentials.getUsername()) || @@ -207,6 +214,9 @@ String header = request.getHeader("Authorization"); if (header != null && header.startsWith("Digest ")) { + // Force session creation if we've received credentials in the request + request.getSession(true); + String section212response = header.substring(7); String[] headerEntries = section212response.split(",");

15 years, 9 months

1
0
0 / 0

Seam SVN: r8695 - trunk/src/main/org/jboss/seam/web.

by seam-commits＠lists.jboss.org

Author: shane.bryzak(a)jboss.com Date: 2008-08-15 04:53:19 -0400 (Fri, 15 Aug 2008) New Revision: 8695 Modified: trunk/src/main/org/jboss/seam/web/AuthenticationFilter.java Log: JBSEAM-3109 Modified: trunk/src/main/org/jboss/seam/web/AuthenticationFilter.java =================================================================== --- trunk/src/main/org/jboss/seam/web/AuthenticationFilter.java 2008-08-15 08:40:05 UTC (rev 8694) +++ trunk/src/main/org/jboss/seam/web/AuthenticationFilter.java 2008-08-15 08:53:19 UTC (rev 8695) @@ -152,7 +152,8 @@ } // Only reauthenticate if username doesn't match Identity.username and user isn't authenticated - if (!username.equals(credentials.getUsername()) || !identity.isLoggedIn()) + if (credentials != null && !username.equals(credentials.getUsername()) || + (identity != null && !identity.isLoggedIn())) { try { @@ -167,7 +168,7 @@ } } - if (!identity.isLoggedIn() && !credentials.isSet()) + if (identity != null && !identity.isLoggedIn() && credentials != null && !credentials.isSet()) { requireAuth = true; } @@ -185,7 +186,7 @@ requireAuth = true; } - if (requireAuth && !identity.isLoggedIn()) + if ((requireAuth && (identity != null && !identity.isLoggedIn())) || identity == null) { response.addHeader("WWW-Authenticate", "Basic realm=\"" + realm + "\""); response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Not authorized"); @@ -250,7 +251,7 @@ } } - if (!identity.isLoggedIn() && !credentials.isSet()) + if (identity != null && !identity.isLoggedIn() && credentials != null && !credentials.isSet()) { requireAuth = true; } @@ -268,7 +269,7 @@ requireAuth = true; } - if (requireAuth && !identity.isLoggedIn()) + if ((requireAuth && (identity != null && !identity.isLoggedIn())) || identity == null) { long expiryTime = System.currentTimeMillis() + (nonceValiditySeconds * 1000);

15 years, 9 months

1
0
0 / 0

Seam SVN: r8694 - trunk/doc/Seam_Reference_Guide/en-US.

by seam-commits＠lists.jboss.org

Author: christian.bauer(a)jboss.com Date: 2008-08-15 04:40:05 -0400 (Fri, 15 Aug 2008) New Revision: 8694 Modified: trunk/doc/Seam_Reference_Guide/en-US/Configuration.xml Log: Documented new filter pattern matching Modified: trunk/doc/Seam_Reference_Guide/en-US/Configuration.xml =================================================================== --- trunk/doc/Seam_Reference_Guide/en-US/Configuration.xml 2008-08-15 08:33:28 UTC (rev 8693) +++ trunk/doc/Seam_Reference_Guide/en-US/Configuration.xml 2008-08-15 08:40:05 UTC (rev 8694) @@ -136,8 +136,7 @@ <para> <literal>regex-url-pattern</literal> — Used to specify which requests are filtered, the default is all requests. <literal>regex-url-pattern</literal> is a true regular expression - match for request path. It's worth noting when composing the regular expression that the request path does not contain - the server or request context path. + match for request path. </para> </listitem> <listitem> @@ -147,6 +146,12 @@ </listitem> </itemizedlist> + <para> + Note that the patterns are matched against the URI path of the request (see + <literal>HttpServletRequest.getURIPath()</literal>) and that the name of the servlet context is + removed before matching. + </para> + <para> Adding the master filter enables the following built-in filters. </para> <sect3>

15 years, 9 months

1
0
0 / 0

Seam SVN: r8693 - trunk/src/main/org/jboss/seam/web.

by seam-commits＠lists.jboss.org

Author: christian.bauer(a)jboss.com Date: 2008-08-15 04:33:28 -0400 (Fri, 15 Aug 2008) New Revision: 8693 Modified: trunk/src/main/org/jboss/seam/web/AbstractFilter.java Log: Arrgh Modified: trunk/src/main/org/jboss/seam/web/AbstractFilter.java =================================================================== --- trunk/src/main/org/jboss/seam/web/AbstractFilter.java 2008-08-15 08:04:58 UTC (rev 8692) +++ trunk/src/main/org/jboss/seam/web/AbstractFilter.java 2008-08-15 08:33:28 UTC (rev 8693) @@ -99,7 +99,7 @@ } HttpServletRequest httpRequest = (HttpServletRequest)request; - String path = httpRequest.getRequestURI().replaceFirst(httpRequest.getServletPath(), ""); + String path = httpRequest.getRequestURI().replaceFirst(httpRequest.getContextPath(), ""); String urlPattern = getUrlPattern(); Pattern regexPattern = getPattern(); if (urlPattern != null)

15 years, 9 months

1
0
0 / 0

Seam SVN: r8692 - trunk/src/main/org/jboss/seam/web.

by seam-commits＠lists.jboss.org

Author: christian.bauer(a)jboss.com Date: 2008-08-15 04:04:58 -0400 (Fri, 15 Aug 2008) New Revision: 8692 Modified: trunk/src/main/org/jboss/seam/web/AbstractFilter.java Log: Fixed NPE Modified: trunk/src/main/org/jboss/seam/web/AbstractFilter.java =================================================================== --- trunk/src/main/org/jboss/seam/web/AbstractFilter.java 2008-08-15 07:23:25 UTC (rev 8691) +++ trunk/src/main/org/jboss/seam/web/AbstractFilter.java 2008-08-15 08:04:58 UTC (rev 8692) @@ -97,8 +97,9 @@ { return true; } - - String path = ((HttpServletRequest) request).getRequestURI().replaceFirst(servletContext.getContextPath(), ""); + + HttpServletRequest httpRequest = (HttpServletRequest)request; + String path = httpRequest.getRequestURI().replaceFirst(httpRequest.getServletPath(), ""); String urlPattern = getUrlPattern(); Pattern regexPattern = getPattern(); if (urlPattern != null)

15 years, 9 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

seam-commits August 2008