It sounds like we had a fairly successful Hack Night!
Sent from my iPhone
On Aug 12, 2011, at 5:57, Shane Bryzak <sbryzak(a)redhat.com> wrote:
Thanks Marek! Either George or I will be sure to merge them in the
day or so.
On 12/08/11 18:38, Marek Schmidt wrote:
> Hi Shane!
> I have taken the liberty to make some pull requests to the Seam
> Security External module, even though not on the list of issues for
> the Night...
> I'd be glad if someone could review them...
> Marek Schmidt
> On 08/10/2011 05:28 AM, Shane Bryzak wrote:
>> Hey guys,
>> Sorry about the delay in getting this list of items to work on for the
>> next Seam Hack night - I've come down with the flu and it's hard to get
>> any work done when it feels like an elephant is sitting on your head.
>> Anyways, the two main areas I'd like us to work on for Seam Security are
>> Identity Management and ACLs/Permission Management. In the area of
>> Identity Management, there's a number of JIRA issues relating to
>> JpaIdentityStore, and I'd also like to show some love for our
>> integration with PicketLink's LDAP Identity Store too. For ACL
>> security, we are actually missing this feature altogether in Seam 3.0
>> (it existed in Seam 2) simply because I ran out of time to port it over
>> in time for the 3.0 release. For anyone that doesn't know, ACL security
>> provides you the ability to grant permissions on individual objects in
>> your application, whether they be entity beans or whatever.
>> To assist us in effectively organising who does which work, I'll give
>> each task a unique number. If you'd like to volunteer for certain
>> task/s, please do so earlier rather than later - first in first served!
>> JpaIdentityStore issues
>> 1) SEAMSECURITY-62 Using identity management to add user in group
>> prevent user to login
>> This issue has a comprehensive description and someone has
>> attached a
>> 2) SEAMSECURITY-64 Provide the capability to retrieve the actual entity
>> object when a user is created
>> We had this feature in Seam 2, however since we're now using
>> PicketLink in Seam 3 it is a little more challenging to implement this.
>> I don't have any solid ideas as yet, however it would be ideal if we
>> could fire an event for this somehow.
>> 3) SEAMSECURITY-65 Criteria queries executed by JPAIdentityStore are not
>> setup properly
>> We seem to be missing a select() call for the Criteria queries,
>> should be easy to fix this one.
>> 4) SEAMSECURITY-70 Calling RoleManager.removeRole(Roletype rt, User u,
>> Group g) throws an NPE
>> Should be an easy fix, as the reporter has included a solution.
>> 5) SEAMSECURITY-84 identity.hasRole and identity.addRole do not seem to
>> be interacting with JpaStore
>> This one might take a little detective work to reproduce. A user
>> within an application that uses Identity Management should have their
>> roles populated in Identity.roles automatically when they authenticate.
>> One thing to note is that the reporter's assertion at the end of the
>> issue description about identity.addRole() adding the role to the
>> database is incorrect - persistent roles should only be added through
>> the role manager.
>> 6) SEAMSECURITY-69
>> This one might take a little bit of analysis also - possibly the
>> cause is an unimplemented method in JpaIdentityStore.
>> LDAP Identity Store issues
>> 7) SEAMSECURITY-71 Improve LDAP integration in general
>> This one is quite a bit of work. The actual LDAP Identity Store
>> class is part of PicketLink, so we can't make any direct changes to it.
>> What we can do however, is ease the configuration process. We currently
>> have a configuration bean for JpaIdentityStore (called
>> JpaIdentityStoreConfiguration), that can be used to configure the
>> Identity Store via Seam Config. It would be nice to have an equivalent
>> class for the LDAP Identity Store. Whoever works on this task will need
>> to become familiar with the LDAP configuration in PicketLink. Any work
>> done in this area would also require documentation in the Seam Security
>> reference guide.
>> 8) Example application that demonstrates authentication via LDAP
>> This goes hand in hand with 7). I don't know if we'll have enough
>> time to implement a full example, however it would be nice to have a
>> basic functioning app that we could point people to.
>> ACL Security
>> 9) Implement PersistentPermissionResolver
>> This class has been "ported" from Seam 2, however it's currently
>> functional (I think a lot of the code may even be commented out). This
>> is an advanced task, so only volunteer for this one if you feel you're
>> up to the challenge. One of the biggest issues is how we identify
>> users. In Seam 2 this was simple, because all users were local and
>> usernames were unique. In Seam 3 however, we can now have either local
>> users or external users, thanks to OpenID and SAML authentication.
>> 10) Example app for ACL security
>> Goes with 9), we need an example application to demonstrate ACL
>> 11) SEAMSECURITY-13 Custom EntityIdentifierStrategy ignored by
>> If 9) gets done, then this issue probably needs to be addressed
>> 12) SEAMSECURITY-66 Separated API/IMPL jars do not allow compilation of
>> the SimpleAuthenticator example
>> Quite an unusual issue, which may have already been solved thanks to
>> the removal of the combined jar. Someone needs to test this and close
>> the issue if it's out of date.
>> 13) SEAMSECURITY-52 security-authorization example - IAE on logout
>> Marek has suggested that this is related to SEAMSECURITY-22, which
>> brings us to...
>> 14) SEAMSECURITY-22 Basic authentication with no security drools and no
>> picketlink defined in seam-beans.xml throws exception
>> Like 13), I think this has to do with the location of the
>> security.drl file. We should standardise the location of the
>> security.drl file, so someone needs to research the injectable resources
>> feature in Solder and determine where the best place is to put this
>> 15) SEAMSECURITY-78 Typos in documentation
>> Jozef has identified a couple of minor typos that need to be fixed.
>> 16) SEAMSECURITY-51 A readme.txt points to incorrect url of
>> security-openid-rp example
>> Martin has noticed that the URL in the readme file for this example
>> is wrong.
>> If anyone has any questions about these tasks, or any suggestions,
>> please feel free to bring them up on seam-dev.
>> seam-dev mailing list
seam-dev mailing list