[jbossseam-issues] [JBoss JIRA] Commented: (JBSEAM-967) JBoss Seam - Support authentication from a realm (on Tomcat)

[Bradley Smith (JIRA)]

    [ http://jira.jboss.com/jira/browse/JBSEAM-967?page=comments#action_12383419 ] 
            
Bradley Smith commented on JBSEAM-967:
--------------------------------------

One more comment, when I change Identity, I'm still required to create an authenticator, so now, with a changed Identity, I have to maintain code in two classes - both the Identity and the authenticator.  Currently I only have an authenticator to main.  Isn't it also trivial to add an attribute to the Identity's configuration that 'turns on' this behavior in Identity?

e.g.:

<security:identity authenticate-method="#{ssoAuthenticator.authenticate}"/   obtainUserFromRequest="true">

P.S. - After having created an authenticator with loads the roles into Identity, I'm less interested in delegating the hasRole() call to the servlet request, because I would like to take advantage of the EL stuff (e.g. #{s:hasRole('aummaint')} ).

Thanks

> JBoss Seam - Support authentication from a realm (on Tomcat)
> ------------------------------------------------------------
>
>                 Key: JBSEAM-967
>                 URL: http://jira.jboss.com/jira/browse/JBSEAM-967
>             Project: JBoss Seam
>          Issue Type: Feature Request
>          Components: Security
>            Reporter: Bradley Smith
>         Assigned To: Shane Bryzak
>
> Please see discussion in the JBoss forum reference.
> The idea is to allow the Seam Identity (security) component to get the Principal from the HttpServletRequest and to delegate the hasRole() calls to the HttpServletRequest as well.  This is because, in my case, Tomcat has already forced the user to authenticate if necessary and the authentication, authorization information is available in the container's HttpServletRequest impl.
> Principal userPrincipal = httpServletRequest.getUserPrincipal();
> boolean hasRole(String roleName) {
>   return httpServletRequest.isUserInRole(roleName);
> }
> public String getUsername() {
>    return httpServletRequest.getRemoteUser();
> }
> public boolean isLoggedIn() {
>   return httpServletRequest.getUserPrincipal() != null;
> }

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira