[jbossseam-issues] [JBoss JIRA] Commented: (JBSEAM-967) JBoss Seam - Support authentication from a realm (on Tomcat)
[ http://jira.jboss.com/jira/browse/JBSEAM-967?page=comments#action_12383418 ]
Bradley Smith commented on JBSEAM-967:
--------------------------------------
I'll give it a try, but I'm somewhat reluctant to take the approach of extending
the Identity class.
First, is extending a Seam component class a recommended pattern / best practice? The
approach of creating an authenticator seems better / cleaner. If I do extend Identity,
how do I make my Identity impl THE identity component for my Seam applications (what
changes in the class annotations)?
Second, in the past, I've modified things like SeamTest, only to see SeamTest get
completely refactored and thus break my changes. Such changes in the class I extend
basically result in my having to solve the problem N times - once for each change in the
class's API. Most recently, going from Seam 1.2.1 to Seam 2.0, some annotations got
moved to new packages with no support for the old packages, isn't it just as trivial
to leave a version of the old annotations in their original packages along with some kind
of deprecation warning? What's the guarantee that Identity isn't going to get a
similar refactoring in methods or packaging?
Thanks
JBoss Seam - Support authentication from a realm (on Tomcat)
------------------------------------------------------------
Key: JBSEAM-967
URL: http://jira.jboss.com/jira/browse/JBSEAM-967
Project: JBoss Seam
Issue Type: Feature Request
Components: Security
Reporter: Bradley Smith
Assigned To: Shane Bryzak
Please see discussion in the JBoss forum reference.
The idea is to allow the Seam Identity (security) component to get the Principal from the
HttpServletRequest and to delegate the hasRole() calls to the HttpServletRequest as well.
This is because, in my case, Tomcat has already forced the user to authenticate if
necessary and the authentication, authorization information is available in the
container's HttpServletRequest impl.
Principal userPrincipal = httpServletRequest.getUserPrincipal();
boolean hasRole(String roleName) {
return httpServletRequest.isUserInRole(roleName);
}
public String getUsername() {
return httpServletRequest.getRemoteUser();
}
public boolean isLoggedIn() {
return httpServletRequest.getUserPrincipal() != null;
}
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira