Raible's Wiki

Raible Designs
Wiki Home
News
Recent Changes

AppFuse

Homepage
  - Korean
  - Chinese
  - Italian
  - Japanese

QuickStart Guide
  - Chinese
  - French
  - German
  - Italian
  - Korean
  - Portuguese
  - Spanish
  - Japanese

User Guide
  - Korean
  - Chinese

Tutorials
  - Chinese
  - German
  - Italian
  - Korean
  - Portuguese
  - Spanish

FAQ
  - Korean

Latest Downloads

Other Applications

Struts Resume
Security Example
Struts Menu

Set your name in
UserPreferences


Referenced by
AppFuseSecurity
AppFuseSecurityMetho...
AppFuseSecuritySetti...




JSPWiki v2.2.33

[RSS]


Hide Menu

AppFuseAuthentication


Difference between version 13 and version 12:

At line 5 changed 1 line.
Part II of this tutorial __still needs to be written__. It will show you how to remove Acegi Security from AppFuse and revert back to Container-Managed Authentication.
<a href="#PartII">Part II</a> of this tutorial shows you how to remove Acegi Security from AppFuse and revert back to Container-Managed Authentication (CMA). However, this might not be a necessary step if you want to use CMA because Acegi Security has a number of [Container Adapters|http://acegisecurity.sourceforge.net/docbook/acegi.html#security-container-adapters] available.
At line 7 changed 9 lines.
!Table of Contents
* [1] Add Acegi Security JARs to your project
* [2] Create applicationContext-security.xml
* [3] Configure filters and filter-mappings
* [4] Remove web-security.xml from metadata/web
* [5] Add an "enabled" variable to the User object (optional)
* [6] Configure logging for Acegi Security
* [7] Remove setting from LoginServlet.java to prevent duplicate logins
* [8] Add code to logout.jsp so logout succeeds
<div class="note" style="margin: 10px; background-color: #fcc">__WARNING:__ It's likely that AppFuse will use more of Acegi Security features (i.e. Remember Me and Password Encryption) in 1.9+. Therefore, the instructions in Part II only apply to AppFuse 1.8.</div>
At line 17 changed 1 line.
!!Add Acegi Security JARs to your project [#1]
!Table of Contents - Part I
* [1.1] Add Acegi Security JARs to your project
* [1.2] Create applicationContext-security.xml
* [1.3] Configure filter and its filter-mapping
* [1.4] Remove web-security.xml from metadata/web
* [1.5] Add an "enabled" variable to the User object (optional)
* [1.6] Configure logging for Acegi Security
* [1.7] Remove setting from LoginServlet.java to prevent duplicate logins
* [1.8] Add code to logout.jsp so logout succeeds
!Table of Contents - Part II
* [2.1] Remove Acegi Security files from your project
* [2.2] Remove filter and its filter-mapping
* [2.3] Add web-security.xml to metadata/web
* [2.4] Add logic to detect disabled users (optional)
* [2.5] Remove Acegi Security's logging settings (optional)
* [2.6] Add code to LoginServlet.java to prevent duplicate logins
!!Add Acegi Security JARs to your project [#1.1]
At line 23 changed 1 line.
!!Create applicationContext-security.xml [#2]
!!Create applicationContext-security.xml [#1.2]
At line 32 changed 1 line.
!!Configure filters and filter-mappings [#3]
!!Configure filters and filter-mappings [#1.3]
At line 55 changed 1 line.
!!Remove web-security.xml from metadata/web [#4]
!!Remove web-security.xml from metadata/web [#1.4]
At line 58 changed 1 line.
!!Add an "enabled" variable to the User object [#5]
!!Add an "enabled" variable to the User object [#1.5]
At line 118 changed 1 line.
!!Configure logging for Acegi Security [#6]
!!Configure logging for Acegi Security [#1.6]
At line 125 changed 1 line.
!!Remove setting from LoginServlet.java to prevent duplicate logins [#7]
!!Remove setting from LoginServlet.java to prevent duplicate logins [#1.7]
At line 167 added 59 lines.
----
!Removing Acegi and reverting to CMA
!!Remove Acegi Security files from your project [#2.1]
The first step in reverting back to CMA is removing Acegi-specific files. Delete ''acegi-security-*.jar'' and ''commons-codec.jar'' from __lib/spring-*__ and ''applicationContext-security.xml'' from __web/WEB-INF__.
!!Remove securityFilter and its filter-mapping [#2.2]
Modify __metadata/web/filters.xml__ to remove the "securityFilter" definition and its associated mapping from __metadata/web/filter-mappings.xml__.
!!Add web-security.xml to metadata/web [#2.3]
[Download the old web-security.xml file|https://appfuse.dev.java.net/source/browse/*checkout*/appfuse/metadata/web/Attic/web-security.xml?content-type=text%2Fplain] from AppFuse CVS's Attic and put it in your __metadata/web__ directory.
!!Add logic to detect disabled users (optional) [#2.4]
As part of integrating Acegi Security, an option to disable users was added to the User Profile screen. If you'd like to honor this feature in your application after removing Acegi Security, you can do so by modifying ''ActionFilter.java'' in the __src/web/org/appfuse/webapp/filter__ directory.
[{Java2HmtlPlugin
UserManager mgr = (UserManager) ctx.getBean("userManager");
user = mgr.getUser(username);
if (user.getEnabled() == Boolean.FALSE) {
response.sendRedirect(request.getContextPath() + "/logout.jsp?error=true");
return;
}
session.setAttribute(Constants.USER_KEY, user);
}]
!!Remove Acegi Security's logging settings (optional) [#2.5]
The following lines can be removed from ''web/WEB-INF/classes/log4j.properties'' since they'll no longer be relevant. However, leaving them in won't hurt anything.
{{{
log4j.logger.net.sf.acegisecurity=WARN
log4j.logger.net.sf.acegisecurity.intercept.event.LoggerListener=WARN
}}}
!!Add code to LoginServlet.java to prevent duplicate logins [#2.6]
In LoginServet.java, add the following ''if statement'' at the beginning of the execute method. This prevents duplicate logins that can occur with CMA.
[{Java2HtmlPlugin
// if user is already authenticated, it means they probably bookmarked
// or typed in the URL to login.jsp directly, route them to the main
// menu is this is the case
if (request.getRemoteUser() != null) {
if (log.isDebugEnabled()) {
log.debug("User '" + request.getRemoteUser() +
"' already logged in, routing to mainMenu");
}
response.sendRedirect(request.getContextPath() + "/mainMenu.html");
return;
}
}]
----
Issues or problems with these instructions? If so, please send your questions to [users-AT-appfuse.dev.java.net|mailto:[email protected]?subject=AppFuse Authentication Problems].

Back to AppFuseAuthentication, or to the Page History.