AppFuseAuthentication

This is version 1. It is not the current version, and thus it cannot be edited.
[Back to current version]   [Restore this version]

The purpose of this page is to describe what I did to integrate Acegi Security into 1.8. Hopefull you can use this to change your pre-1.8 applications to Acegi Security if you like. The nice thing about migrating to Acegi Security is your application becomes more portable and you don't have to worry about configuring your application server. Also, there weren't many code changes involved in the integration process - which proves Acegi Security works very well with all the existing code that talks to the security methods of the Servlet API (i.e. request.isUserInRole(), etc.)

Part II of this tutorial still needs to be written. It will show you how to remove Acegi Security from AppFuse and revert back to Container-Managed Authentication.

Table of Contents

• [1] Add Acegi Security JARs to your project
• [2] Create applicationContext-security.xml
• [3] Configure filters and filter-mappings
• [4] Remove web-security.xml from metadata/web
• [5] Add an "enabled" variable to the User object
• [6] Configure logging for Acegi Security
• [7] Remove setting from LoginServlet.java to prevent duplicate logins

Add Acegi Security JARs to your project [#1]

• acegi-security-0.7-SNAPSHOT.jar
• commons-codec.jar

Create applicationContext-security.xml [#2]

    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/applicationContext-*.xml</param-value>
    </context-param>

Configure filters and filter-mappings [#3]

     <filter>
        <filter-name>Acegi Authentication Processing Filter</filter-name>
        <filter-class>net.sf.acegisecurity.util.FilterToBeanProxy</filter-class>
        <init-param>
            <param-name>targetClass</param-name>
            <param-value>net.sf.acegisecurity.ui.webapp.AuthenticationProcessingFilter</param-value>
        </init-param>
    </filter>
    <filter>
        <filter-name>acegiSessionFilter</filter-name>
        <filter-class>net.sf.acegisecurity.ui.webapp.HttpSessionIntegrationFilter</filter-class>
    </filter>
    <filter>
        <filter-name>Acegi HTTP Request Security Filter</filter-name>
        <filter-class>net.sf.acegisecurity.util.FilterToBeanProxy</filter-class>
        <init-param>
            <param-name>targetClass</param-name>
            <param-value>net.sf.acegisecurity.intercept.web.SecurityEnforcementFilter</param-value>
        </init-param>
    </filter>
    <filter>
        <filter-name>acegiRemoteUserFilter</filter-name>
        <filter-class>net.sf.acegisecurity.ui.wrapper.ContextHolderAwareRequestFilter</filter-class>
    </filter>

Add filter-mappings for each of these filters. Put the following XML at the top of the metadata/web/filter-mappings.xml file:

     <filter-mapping>
        <filter-name>Acegi Authentication Processing Filter</filter-name>
        <url-pattern>/j_security_check</url-pattern>
        <!--dispatcher>REQUEST</dispatcher>
        <dispatcher>FORWARD</dispatcher-->
    </filter-mapping>
    <filter-mapping>
        <filter-name>acegiSessionFilter</filter-name>
        <url-pattern>/*</url-pattern>
        <!--dispatcher>REQUEST</dispatcher>
        <dispatcher>FORWARD</dispatcher-->
    </filter-mapping>
    <filter-mapping>
        <filter-name>Acegi HTTP Request Security Filter</filter-name>
        <url-pattern>*.html</url-pattern>
        <!--dispatcher>REQUEST</dispatcher>
        <dispatcher>FORWARD</dispatcher-->
    </filter-mapping>
    <filter-mapping>
        <filter-name>acegiRemoteUserFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

Remove web-security.xml from metadata/web [#4]

Add an "enabled" variable to the User object [#5]

Step 1. Add a "enabled" variable to the User.java class, including getters and setters. Also add this variable to the equals(), hashCode() and toString() methods.

If you're using iBATIS, you will need to add the "enabled" column to the SQL in UserSQL.xml. You will also need to add "enabled bit" as a column definition for the "app_user" table in metadata/sql/mysql-create-tables.sql.

Step 2. In your controller/page class that handles signup, enable the user before they're saved (Spring example diff):

Another thing you could do is leave them disabled and change the e-mail that's sent go to an administrator. Then the administrator can enable them and send an e-mail. The above behavior is to keep consistency with current AppFuse functionality.

Step 3. In metadata/sql/sample-data.xml, add an "enabled" <column> to the "app_user" table. This should have a <value> of "1" for all users - so they're enabled and can login.

Step 4. For all the languages/ResourceBundles your application supports, you need to add a label key to display this property on the UI. Below are the translations for the default ResourceBundles. If you're using Struts, this key should be "userForm.enabled" instead of "user.enabled".

• ApplicationResources_en.properties: user.enabled=Enabled
• ApplicationResources_es.properties: user.enabled=Permitido
• ApplicationResources_fr.properties: user.enabled=Permis
• ApplicationResources_nl.properties: user.enabled=Toegelaten
• ApplicationResources_pt_BR.properties: user.enabled=Permitido
• ApplicationResources_zh_CN.properties: user.enabled=使能

Step 5. When editing a user's record, an administrator should be able to enabled/disable a user. When a user is editing their own profile, the disabled field should be hidden, so they cannot edit it. Below are links to the CVS diffs for the various frameworks to show you what you need to change.

• Struts
• Spring MVC
• WebWork (ignore the first change in the diff, that's a mistake)
• Tapestry
• JSF

Configure logging for Acegi Security [#6]

log4j.logger.net.sf.acegisecurity=WARN

Remove setting from LoginServlet.java to prevent duplicate logins [#7]