Raible's Wiki: AppFuseAuthentication

At line 3 changed 1 line.

The purpose of this page is to describe what I did to integrate Acegi Security into 1.8. Hopefull you can use this to change your pre-1.8 applications to Acegi Security if you like. The nice thing about migrating to Acegi Security is your application becomes more portable and you don't have to worry about configuring your application server. Also, there weren't many code changes involved in the integration process - which proves Acegi Security works very well with all the existing code that talks to the security methods of the Servlet API (i.e. request.isUserInRole(), etc.)

The purpose of this page is to describe what we did to integrate Acegi Security into 1.8. Hopefully you can use this to change your pre-1.8 applications to Acegi Security if you like. The nice thing about migrating to Acegi Security is your application becomes more portable and you don't have to worry about configuring your application server. Also, there weren't many code changes involved in the integration process - which proves Acegi Security works very well with all the existing code that talks to the security methods of the Servlet API (i.e. request.isUserInRole(), etc.)

At line 5 changed 1 line.

Part II of this tutorial __still needs to be written__. It will show you how to remove Acegi Security from AppFuse and revert back to Container-Managed Authentication.

<a href="#part2">Part II</a> of this tutorial shows you how to remove Acegi Security from AppFuse and revert back to Container-Managed Authentication (CMA). However, this might not be a necessary step if you want to use CMA because Acegi Security has a number of [Container Adapters|http://acegisecurity.sourceforge.net/docbook/acegi.html#security-container-adapters] available.

At line 7 changed 9 lines.

!Table of Contents

* [1] Add Acegi Security JARs to your project

* [2] Create applicationContext-security.xml

* [3] Configure filters and filter-mappings

* [4] Remove web-security.xml from metadata/web

* [5] Add an "enabled" variable to the User object (optional)

* [6] Configure logging for Acegi Security

* [7] Remove setting from LoginServlet.java to prevent duplicate logins

* [8] Add code to LoginFilter so logout succeeds

<div class="note" style="background-color: #fcc">__WARNING:__ It's likely that AppFuse will use more of Acegi Security features (i.e. Remember Me and Password Encryption) in 1.9+. Therefore, the instructions in Part II only apply to AppFuse 1.8.</div>

At line 9 added 12 lines.

!Table of Contents - Part I

* [1.1|1] Add Acegi Security JARs to your project

* [1.2|2] Create applicationContext-security.xml

* [1.3|3] Configure filter and its filter-mapping

* [1.4|4] Remove web-security.xml from metadata/web

* [1.5|5] Add an "enabled" variable to the User object (optional)

* [1.6|6] Configure logging for Acegi Security

* [1.7|7] Remove setting from LoginServlet.java to prevent duplicate logins

* [1.8|8] Add code to logout.jsp so logout succeeds

At line 20 changed 2 lines.

* [acegi-security-0.8.1-SNAPSHOT.jar|https://appfuse.dev.java.net/source/browse/*checkout*/appfuse/lib/spring-1.1.5/acegi-security-0.8.1-SNAPSHOT.jar]

* [commons-codec.jar|https://appfuse.dev.java.net/source/browse/*checkout*/appfuse/lib/spring-1.1.5/commons-codec.jar]

* [acegi-security-0.8.2.jar|https://appfuse.dev.java.net/source/browse/*checkout*/appfuse/lib/spring-1.2/acegi-security-0.8.2.jar]

* [commons-codec.jar|https://appfuse.dev.java.net/source/browse/*checkout*/appfuse/lib/spring-1.2/commons-codec.jar]

At line 24 changed 1 line.

Download [applicationContext-security.xml|https://appfuse.dev.java.net/source/browse/appfuse/web/WEB-INF/applicationContext-security.xml] and put it in your web/WEB-INF directory. Make sure your metadata/web/web-settings.xml file loads this file as part of the ContextLoaderListener. For AppFuse 1.7+, this should look as follows:

Download [applicationContext-security.xml|https://appfuse.dev.java.net/source/browse/*checkout*/appfuse/web/WEB-INF/applicationContext-security.xml] and put it in your web/WEB-INF directory. Make sure your metadata/web/web-settings.xml file loads this file as part of the ContextLoaderListener. For AppFuse 1.7+, this should look as follows:

At line 76 added 1 line.

At line 128 added 1 line.

log4j.logger.net.sf.acegisecurity.intercept.event.LoggerListener=WARN

At line 145 changed 2 lines.

!!Add code to LoginFilter to logout succeeds [#8]

In ''src/web/org/appfuse/webapp/filter/LoginFilter.java'', add code to set Acegi's Context to null. Invalidating the session should work, but I was unable to get this to work. [Here's the diff|https://appfuse.dev.java.net/source/browse/appfuse/src/web/org/appfuse/webapp/filter/LoginFilter.java?r1=1.11&r2=1.12] to show you where to make this change.

!!Add code to logout.jsp sp logout succeeds [#8]

In ''web/logout.jsp'', add code to invalidate the session (before the redirect). Invalidating the session in ''LoginFilter.java'' should work, but [it doesn't|http://forum.springframework.org/viewtopic.php?p=16882#16882].

At line 154 added 4 lines.

{{{<% session.invalidate(); %>

<c:redirect url="/mainMenu.html"/>}}}

At line 163 added 73 lines.

----

<h2 style="background-color: white; border: 0; margin-left: 0">Part II - Removing Acegi and reverting to CMA</h2>

Use the instructions below to change your AppFuse 1.8 application to use CMA. We don't expect many folks will need to do this, but more documentation is better than less. ;-)

!Table of Contents - Part II

* [2.1|20] Remove Acegi Security files from your project

* [2.2|21] Remove filter and its filter-mapping

* [2.3|22] Add web-security.xml to metadata/web

* [2.4|23] Add logic to detect disabled users (optional)

* [2.5|24] Remove Acegi Security's logging settings (optional)

* [2.6|25] Add code to LoginServlet.java to prevent duplicate logins

!!Remove Acegi Security files from your project [#20]

The first step in reverting back to CMA is removing Acegi-specific files. Delete ''acegi-security-*.jar'' and ''commons-codec.jar'' from __lib/spring-*__ and ''applicationContext-security.xml'' from __web/WEB-INF__.

!!Remove securityFilter and its filter-mapping [#21]

Modify __metadata/web/filters.xml__ to remove the "securityFilter" definition and its associated mapping from __metadata/web/filter-mappings.xml__.

!!Add web-security.xml to metadata/web [#23]

[Download the old web-security.xml file|https://appfuse.dev.java.net/source/browse/*checkout*/appfuse/metadata/web/Attic/web-security.xml?content-type=text%2Fplain] from AppFuse CVS's Attic and put it in your __metadata/web__ directory.

!!Add logic to detect disabled users (optional) [#24]

As part of integrating Acegi Security, an option to disable users was added to the User Profile screen. If you'd like to honor this feature in your application after removing Acegi Security, you can do so by modifying ''ActionFilter.java'' in the __src/web/org/appfuse/webapp/filter__ directory.

[{Java2HtmlPlugin

UserManager mgr = (UserManager) ctx.getBean("userManager");

user = mgr.getUser(username);

if (user.getEnabled() == Boolean.FALSE) {

request.getSession().invalidate();

response.sendRedirect(request.getContextPath() + "/loginError.jsp");

return;

}

session.setAttribute(Constants.USER_KEY, user);

}]

!!Remove Acegi Security's logging settings (optional) [#25]

The following lines can be removed from ''web/WEB-INF/classes/log4j.properties'' since they'll no longer be relevant. However, leaving them in won't hurt anything.

{{{

log4j.logger.net.sf.acegisecurity=WARN

log4j.logger.net.sf.acegisecurity.intercept.event.LoggerListener=WARN

}}}

!!Add code to LoginServlet.java to prevent duplicate logins [#26]

In LoginServet.java, add the following ''if statement'' at the beginning of the execute method. This prevents duplicate logins that can occur with CMA.

[{Java2HtmlPlugin

// if user is already authenticated, it means they probably bookmarked

// or typed in the URL to login.jsp directly, route them to the main

// menu is this is the case

if (request.getRemoteUser() != null) {

if (log.isDebugEnabled()) {

log.debug("User '" + request.getRemoteUser() +

"' already logged in, routing to mainMenu");

}

response.sendRedirect(request.getContextPath() + "/mainMenu.html");

return;

}

}]

''Issues or problems with these instructions? If so, please send your questions to [users-AT-appfuse.dev.java.net|mailto:[email protected]?subject=AppFuse Authentication Problems].''

Raible's Wiki

AppFuse

Other Applications

AppFuseAuthentication