Raible Designs

AppFuse Light 1.8.2 Released

Matt Raible — Sun, 11 May 2008 22:16:17 -0600

AppFuse Light 1.8.2 is a bug fixes release that includes upgrades for Spring, Spring Security, Hibernate, Wicket, Tapestry and many others. In addition, Spring bean definitions were replaced with annotations (@Repository, @Service and @Controller). See the Release Notes for more information on what's changed since the last release.

AppFuse Light now offers 60 possible combinations for download:

Web Frameworks: JSF (MyFaces), Spring MVC (with Ajax, Acegi Security, JSP, FreeMarker or Velocity), Stripes, Struts 1.x, Struts 2.x, Tapestry, WebWork, Wicket
Persistence Frameworks: Hibernate, iBATIS, JDO (JPOX), OJB, Spring JDBC

Upgrading to Spring Security 2.0

Matt Raible — Thu, 17 Apr 2008 02:45:47 -0600

This evening I spent a few hours and upgraded AppFuse to use Acegi Spring Security 2.0. The upgrade was fairly straightforward:

%s/org.acegisecurity/org.springframework.security/g

Upgraded dependencies (exclusions are necessary if you're using Spring 2.5.x and don't want 2.0.x dependencies pulled in):

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-core-tiger</artifactId>
    <version>${spring.security.version}</version>
    <exclusions>
        <exclusion>
            <groupId>org.springframework</groupId>
            <artifactId>spring-core</artifactId>
        </exclusion>
        <exclusion>
            <groupId>org.springframework</groupId>
            <artifactId>spring-support</artifactId>
        </exclusion>
    </exclusions>
</dependency>
...
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-taglibs</artifactId>
    <version>${spring.security.version}</version>
    <exclusions>
        <exclusion>
            <groupId>org.springframework</groupId>
            <artifactId>spring-web</artifactId>
        </exclusion>
    </exclusions>
</dependency>

Changed taglib prefix from "authz" to "security" and change the associated taglib declaration to:
```
<%@ taglib uri="http://www.springframework.org/security/tags" 
    prefix="security" %>
```
In web.xml, I changed <filter-class> to org.springframework.web.filter.DelegatingFilterProxy. Since I didn't name my filter springSecurityFilterChain, I also had to add the following <init-param>:
```
    <init-param>
        <param-name>targetBeanName</param-name>
        <param-value>springSecurityFilterChain</param-value>
    </init-param>
```
Lastly, I modified security.xml to use the new syntax. AppFuse's security.xml went from 175 lines to 33 with the new security namespace configuration!

It's hard to believe I first looked at Acegi almost 4 years ago. At that time, I said it contained too much XML for my needs. Ben's reaction:

Seriously, the "whole lotta XML" gives you exponentially more power and flexibility than a method such as this could ever hope to provide you.

It's nice to see that Spring Security 2.0 gives you exponentially more power and flexibility without all the XML. Thanks guys!

P.S. You can also view the full changelog for this upgrade.

Update: If you're using <authz:authentication property="fullName"/> in your JSPs, you'll need to change it to <security:authentication property="principal.fullName"/>.

Acegi Security 1.0.6 and Spring Security 2.0-M1

Matt Raible — Fri, 4 Jan 2008 12:31:37 -0700

From the Acegi mailing list:

Release 1.0.6 is now available from Sourceforge:

http://sourceforge.net/project/showfiles.php?group_id=104215

This is a minor bugfix and maintenance release - the changelog can be viewed here:

http://jira.springframework.org/secure/ReleaseNote.jspa?version=10671&styleName=Text&projectId=10040

The jar files should also be available from the central maven repository.

Spring Security 2.0-M1
----------------------
This is the first milestone release of Spring Security 2.0. You can download it from:

http://static.springframework.org/downloads/nightly/milestone-download.php?project=SEC

The changelog can be found here:

http://jira.springframework.org/secure/ReleaseNote.jspa?projectId=10040&styleName=Html&version=10451

For maven users, the jars are available from the Spring milestone repository. For details on how to add this to your project, read Ben Hale's article.

I tried this release with AppFuse and all tests pass.

Spring Security 2

Matt Raible — Thu, 6 Dec 2007 15:52:34 -0700

It looks like we'll have to wait until next week to get our hands on Spring Security 2 (the next release of Acegi Security). The good news is it looks much simpler. From what I can tell, this new code is available in Acegi's SVN repository. Here's to hoping the Acegi Team writes some sort of migration guide.

Integrate AppFuse with Crowd in 5 Easy Steps

Matt Raible — Thu, 29 Nov 2007 10:33:32 -0700

The good folks at Atlassian have written a nice tutorial on Integrating Crowd with AppFuse and Acegi. Crowd is a web-based single sign-on (SSO) tool that simplifies application provisioning and identity management. We use Crowd for the AppFuse project to maintain a single user store for JIRA, Confluence, and Bamboo. It's worked awesome for us.

AppFuse Light 1.8.1 Released: includes upgrades to Spring 2.5 and Wicket 1.3

Matt Raible — Thu, 29 Nov 2007 09:28:06 -0700

AppFuse Light 1.8.1 is a bug fixes release that includes an upgrade to Spring 2.5 and Wicket 1.3 RC1. See the Release Notes for more information on what's changed since the last release.

What is AppFuse Light? Click here to find out.

AppFuse Light now offers 60 possible combinations for download:

Web Frameworks: JSF (MyFaces), Spring MVC (with Ajax, Acegi Security, JSP, FreeMarker or Velocity), Stripes, Struts 1.x, Struts 2.x, Tapestry, WebWork, Wicket
Persistence Frameworks: Hibernate, iBATIS, JDO (JPOX), OJB, Spring JDBC

If you're a developer of one of the frameworks that AppFuse Light uses - I'd love a code review to make sure I'm "up to snuff" on how to use your framework. I'm also more than willing to give commit rights if you'd like to improve the implementation of your framework.

Live demos are available at:

What's on tap for AppFuse Light 2.0? Here's what I'm hoping to do:

Drop the seldom-used persistence frameworks: JDBC, JDO and OJB.
Drop Struts 1.x and WebWork as web frameworks (replaced by Struts 2).
Support the same persistence frameworks as AppFuse: Hibernate, iBATIS and JPA.
Re-use appfuse-service, appfuse-hibernate, appfuse-ibatis and appfuse-jpa in AppFuse Light. I'll likely include the core classes (User, Role) since AppFuse Light is more "raw" than AppFuse.
Require Java 5.

Let me know if you disagree with any of these items or would like to see other enhancements.

Apache Roller, Acegi Security, LDAP and JA-SIG CAS

Matt Raible — Tue, 23 Oct 2007 01:38:40 -0600

Earlier today, I delivered my talk on Apache Roller, Acegi Security and Single Sign-on. As part of this talk, I put together a couple of tutorials you might find useful:

NOTE: These tutorials are using Roller's trunk as we found some things to simplify LDAP integration tonight.

You can download a PDF version of my presentation from my publications page.

During the presentation I did a number of demos:

Installing Roller on Tomcat
Integrating Roller with Apache Directory Server
Integration Roller with CAS
Integrating CAS with LDAP

Rather than saving the demo for the end, I did it as the first part of my presentation. This worked extremely well - especially since I didn't have to worry about running out of time.

If you're using Roller, have you integrated it with LDAP or another SSO solution? If so, is it working well for you?

AppFuse Light 1.8 Released

Matt Raible — Fri, 14 Sep 2007 11:01:46 -0600

AppFuse Light 1.8 adds CSS Framework integration, as well as support for Stripes (1.4.2) and Wicket (1.2.6). It also has significant upgrades for JSF and Tapestry; to versions 1.2 and 4.1.3 respectively. See the Release Notes for more information on what's changed since the the beta release of 1.8.

What is AppFuse Light? Click here to find out.

AppFuse Light now offers 60 possible combinations for download:

Web Frameworks: JSF (MyFaces), Spring MVC (with Ajax, Acegi Security, JSP, FreeMarker or Velocity), Stripes, Struts 1.x, Struts 2.x, Tapestry, WebWork, Wicket
Persistence Frameworks: Hibernate, iBATIS, JDO (JPOX), OJB, Spring JDBC

Live demos are available at:

Yes, I realize that 60 combinations is ridiculous. I didn't create the frameworks, I'm just integrating them so you don't have to.

Unfortunately, it's a real pain to create Maven archetypes or they'd all be as easy as mvn archetype:create. Rumor is that the archetype plugin will allow you to create-from-project in the future. When that happens, I'll make sure all the combinations are available as archetypes.

The Security Annotation Framework

Matt Raible — Thu, 24 May 2007 12:42:35 -0600

Spotted on the Acegi Security mailing list several weeks ago:

A few weeks ago, I started an open source project (Security Annotation Framework) which addresses annotation-based, instance-level access control for Spring applications. It is also based on Spring 2.0's extensible XML authoring features. You can find more info at

http://sourceforge.net/projects/safr and http://safr.sourceforge.net

The framework was created during a project in 2006 and is now available under the Apache 2.0 license. It's a generic framework focused on processing security annotations on Spring beans as well as domain objects (which typically aren't managed by a Spring application context) and can be used to enforce access decisions for domain object instances. It can be used with any authorization provider and is not specific to Acegi. However, I plan to include an example how to use the SAF with Acegi authorization soon. Furthermore, it supports inheritance of annotations from base classes and interfaces.

What do you think about SAF? Are annotations a better way of implementing ACLs on domain objects?

AppFuse Light 1.8 Beta Released

Matt Raible — Thu, 26 Apr 2007 02:23:22 -0600

AppFuse Light 1.8 Beta adds CSS Framework integration, as well as support for Stripes (1.4.2) and Wicket (1.2.6). This is a beta release so we can work out some kinks before the final release.

AppFuse Light now offers 60 possible combinations for download:

Web Frameworks: JSF (MyFaces), Spring MVC (with Ajax, Acegi Security, JSP, FreeMarker or Velocity), Stripes, Struts 1.x, Struts 2.x, Tapestry, WebWork, Wicket
Persistence Frameworks: Hibernate, iBATIS, JDO (JPOX), OJB, Spring JDBC

If you have any questions about this release, please subscribe to the AppFuse user mailing list by sending a blank e-mail to users-subscribe@appfuse.dev.java.net. You can also post questions in a forum-like fashion using Nabble: http://appfuse.org/forums.

If you're a developer of one of the frameworks that AppFuse Light uses - I'd love a code review to make sure I'm "up to snuff" on how to use your framework. I'm also more than willing to give commit rights if you'd like to improve the implementation of your framework.

Live demos are available at:

Update: Based on Martin's blog post, I've added the version numbers for Stripes and Wicket (1.4.2 and 1.2.6, respectively). While the Wicket guys recommended I use Wicket 1.3.0, I was already knee deep in 1.2.6 when I read their recommendation. If 1.3.0 really is that much better than 1.2.6, it should be a pleasure to upgrade (and a good learning experience too boot!).

Equinox (a.k.a. AppFuse Light) 1.7.1 Released!

Matt Raible — Sat, 21 Apr 2007 17:27:33 -0600

Equinox 1.7.1 contains a number of dependency updates, and not much else. This will be the last release with the Equinox name. This project is changing its name to AppFuse Light and will be referred to by that name going forward. The project will be moving its source code to http://appfuse-light.dev.java.net. The equinox.dev.java.net project will remain because Cool URIs don't change. In addition to the name change, I'd like to try to merge the AppFuse and Equinox user communities. Since the technologies are so similar, and AppFuse 2.x will use some of Equinox's Ant scripts, it makes sense to bring these projects closer together.

In AppFuse Light 1.8, I plan on adding support for Stripes and Wicket as well as integrating the CSS Framework (like AppFuse uses).

50 possible combinations are available for download:

Web Frameworks: JSF (MyFaces), Spring MVC (with Ajax, Acegi Security, JSP, FreeMarker or Velocity), Struts 1.x, Struts 2.x, Tapestry, WebWork
Persistence Frameworks: Hibernate, iBATIS, JDO (JPOX), OJB, Spring JDBC

All of the frameworks used in Equinox, as well as most of its build/test system is explained in Spring Live. Going forward, documentation will be put on the AppFuse site.

A summary of the changes in this release are below:

Removed custom JavaScript and CSS for MyFaces Tomahawk's
Dependent packages upgraded:
- Ajax4JSF 1.0.6
- Cargo 0.9
- Commons Collections 3.2
- Commons DBCP 1.2.2
- Commons Lang 2.3
- Commons Validator 1.3.1
- DWR 2.0 RC2
- FreeMarker 2.3.9
- JPOX 1.1.7
- JUnit 3.8.2
- Hibernate 3.2.1
- iBATIS 2.3.0
- MyFaces and Tomahawk 1.1.5
- Spring 2.0.4
- Spring Modules Validation 0.8
- Struts 2.0.6
- Tapestry 4.1.1
- Velocity 1.5
- Velocity Tools 1.3
- WebWork 2.2.5

For more information about installing the various options, see the README.txt file. Live demos (thanks to Contegix!) are available at:

If you have any questions, please read the comments from the 1.7 release or ask them on the AppFuse mailing list.

Acegi Security adds OpenID support to its sandbox

Matt Raible — Fri, 20 Apr 2007 11:33:17 -0600

From the Acegi Security mailing list:

Thanks to the efforts of Robin Bramley; we now have a first draft of OpenID support in the sandbox. The code is mostly as-is from when Robin submitted sent it to me. I've done all the standard jalopy formatting of the code so it blends in and has the proper file headers.

I don't know how much this will help folks developing intranet applications, but it's pretty cool for those doing otherwise. Anyone want to take a stab getting OpenID working with Roller? It uses Acegi and supports SSO, so hopefully it won't be too difficult.

See Timothy M. O'Brien's writeup as well as Ray Krueger's for more information.