[ https://jira.jboss.org/jira/browse/JBSEAM-3224?page=com.atlassian.jira.pl... ] Stefano updated JBSEAM-3224: ---------------------------- Attachment: RunAsOperation.patch The attached patch fix the problem. However Seam Space example has other issues with autologin mode because the 'authenticatedMember" variable is outjected on JpaIdentityStore.EVENT_USER_AUTHENTICATED event by the AuthenticationEvents component, while this event is not raised during an autologin. I can't figure out, at the moment, which should be the correct event to observe. In my application I use Credentials.EVENT_CREDENTIALS_UPDATE, even if it get raised more than one time for each login or autologin. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBSEAM-3224?page=com.atlassian.jira.pl... ] Stefano Travelli updated JBSEAM-3224: ------------------------------------- Description: Setting remember-me autologin mode doesn't work. To reproduce the problem: - take the Seam Space example and apply the steps described in chapter 15.3.5.1 of the reference documentation. - login with "Remember me" checked - force the autologin mechanism by deleting the JSESSIONID cookie and clicking refresh on the browser. The following exception is logged: org.jboss.seam.security.AuthorizationException: Authorization check failed for permission[seam.user,read] at org.jboss.seam.security.Identity.checkPermission(Identity.java:563) at org.jboss.seam.security.management.IdentityManager.isUserEnabled(IdentityManager.java:127) at org.jboss.seam.security.RememberMe$1.execute(RememberMe.java:282) at org.jboss.seam.security.Identity.runAs(Identity.java:711) at org.jboss.seam.security.RunAsOperation.run(RunAsOperation.java:84) at org.jboss.seam.security.RememberMe.quietLogin(RememberMe.java:278) The problem is originated from what seems to me a typo in RunAsOperation class constructor, where the 'systemOp' flag is never set to true, regardless of the value passed. public RunAsOperation(boolean systemOp) { this(); systemOp = true; } It should be: this.systemOp = systemOp; was: Setting remember-me autologin mode doesn't work. To reproduce the problem: - take the Seam Space example and apply the steps described in chapter 15.3.5.1 of the reference documentation. - login with "Remember me" set - force the autologin mechanism by deleting the JSESSIONID cookie and clicking refresh on the browser. The following exception is logged: org.jboss.seam.security.AuthorizationException: Authorization check failed for permission[seam.user,read] at org.jboss.seam.security.Identity.checkPermission(Identity.java:563) at org.jboss.seam.security.management.IdentityManager.isUserEnabled(IdentityManager.java:127) at org.jboss.seam.security.RememberMe$1.execute(RememberMe.java:282) at org.jboss.seam.security.Identity.runAs(Identity.java:711) at org.jboss.seam.security.RunAsOperation.run(RunAsOperation.java:84) at org.jboss.seam.security.RememberMe.quietLogin(RememberMe.java:278) The problem is originated from what seems to me a typo in RunAsOperation class constructor, where the 'systemOp' flag is never set to true, regardless of the value passed. public RunAsOperation(boolean systemOp) { this(); systemOp = true; } It should be: this.systemOp = systemOp; -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBSEAM-3224?page=com.atlassian.jira.pl... ] Shane Bryzak reassigned JBSEAM-3224: ------------------------------------ Assignee: Shane Bryzak -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBSEAM-3224?page=com.atlassian.jira.pl... ] Stefano Travelli commented on JBSEAM-3224: ------------------------------------------ Yes, it's fixed. I haven't implemented permission restrictions yet so Identity.checkPermission() gets called only once, however my application works fine with the changes. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira