Raible's Wiki

Raible Designs
Wiki Home
News
Recent Changes

AppFuse

Homepage
  - Korean
  - Chinese
  - Italian
  - Japanese

QuickStart Guide
  - Chinese
  - French
  - German
  - Italian
  - Korean
  - Portuguese
  - Spanish
  - Japanese

User Guide
  - Korean
  - Chinese

Tutorials
  - Chinese
  - German
  - Italian
  - Korean
  - Portuguese
  - Spanish

FAQ
  - Korean

Latest Downloads

Other Applications

Struts Resume
Security Example
Struts Menu

Set your name in
UserPreferences

Referenced by
...nobody




JSPWiki v2.2.33

[RSS]


Hide Menu

AppFuseSecurity
Search Wiki:
Your trail:

This is version 13. It is not the current version, and thus it cannot be edited.
[Back to current version]   [Restore this version]

AppFuse has used Container-Managed Authentication since it was first created. However, in version 1.8, this was replaced with the Acegi Security Framework for Spring. The main reasons for this can be found on raibledesigns.com.

The purpose of this page is to describe what I did to integrate Acegi Security into 1.8. Hopefull you can use this to change your pre-1.8 applications to Acegi Security if you like. The nice thing about migrating to Acegi Security is your application becomes more portable and you don't have to worry about configuring your application server. Also, there weren't many code changes involved in the integration process - which proves Acegi Security works very well with all the existing code that talks to the security methods of the Servlet API (i.e. request.isUserInRole(), etc.)

Part II of this tutorial shows you how to remove Acegi Security from AppFuse and revert back to Container-Managed Authentication.

NOTE: This tutorial is in progress - please don't use it until this message is gone.

Table of Contents

  • [1] Add Acegi Security JARs to your project
  • [2] Create applicationContext-security.xml
  • [3] Configure filters and filter-mappings
  • [4] Remove web-security.xml from metadata/web
  • [5] Add an "enabled" variable to the User object
  • [6] Configure logging for Acegi Security
  • [7] Remove setting from LoginServlet.java to prevent duplicate logins

Add Acegi Security JARs to your project [#1]

Download the following two JARs and put them in the lib/spring-1.1.3 directory of your project. If you're on an older version of Spring, that shouldn't matter. The Acegi Security JAR listed below contains a patch that allows you to easily exclude URLs. Before the 1.8 release, I hope to fix this so you don't need a patched version.

Create applicationContext-security.xml [#2]

Download applicationContext-security.xml and put it in your web/WEB-INF directory. Make sure your metadata/web/web-settings.xml file loads this file as part of the ContextLoaderListener. For AppFuse 1.7+, this should look as follows: 
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/applicationContext-*.xml</param-value>
    </context-param>

Configure filters and filter-mappings [#3]

Remove web-security.xml from metadata/web [#4]

Add an "enabled" variable to the User object [#5]

  • Enable user as part of Signup Process
  • Add "enabled" column to the sample-data.xml and enable all users
  • Add key for enabled label to view and ResourceBundles

Configure logging for Acegi Security [#6]

Remove setting from LoginServlet.java to prevent duplicate logins [#7]


Go to top   More info...   Attach file...
This particular version was published on 06-Nov-2006 13:52:43 MST by MattRaible.