You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@isis.apache.org by da...@apache.org on 2019/01/06 17:22:50 UTC
[23/51] [partial] isis-site git commit: ISIS-1899: updates site for
1.17.0
http://git-wip-us.apache.org/repos/asf/isis-site/blob/1685fcc5/content/guides/ugsec/ugsec.html
----------------------------------------------------------------------
diff --git a/content/guides/ugsec/ugsec.html b/content/guides/ugsec/ugsec.html
index 242b7d4..3ca39a2 100644
--- a/content/guides/ugsec/ugsec.html
+++ b/content/guides/ugsec/ugsec.html
@@ -244,7 +244,7 @@ table.CodeRay td.code>pre{padding:0}
</div>
</form>
</div>
- <p class="nav navbar-text navbar-right small">v1.16.2</p>
+ <p class="nav navbar-text navbar-right small">v1.17.0</p>
</div>
</div>
</nav>
@@ -345,7 +345,7 @@ table.CodeRay td.code>pre{padding:0}
<p>Shiro also ships with an implementation of an LDAP-based realm; LDAP is often used to manage user/passwords and corresponding user groups. Apache Isis in turn extends this with its <code>IsisLdapRealm</code>, which provides more flexibility for both group/role and role/permissions management.</p>
</div>
<div class="paragraph">
- <p>In addition, the (non-ASF) <a href="http://platform.incode.org" target="_blank">Incode Platform</a> modules provides the security module, which also provides an implementation of the Shiro <code>Realm</code> API. However, the security module also represents users, roles and permissions as domain objects, allowing them to be administered through Apache Isis itself. Moreover, the security module can optionally delegate password management to a subsidiary (delegate) realm (usually LDAP as discussed above).</p>
+ <p>In addition, the (non-ASF) <a href="http://platform.incode.org" target="_blank" rel="noopener">Incode Platform</a> modules provides the security module, which also provides an implementation of the Shiro <code>Realm</code> API. However, the security module also represents users, roles and permissions as domain objects, allowing them to be administered through Apache Isis itself. Moreover, the security module can optionally delegate password management to a subsidiary (delegate) realm (usually LDAP as discussed above).</p>
</div>
<div class="paragraph">
<p>In addition to Apache Isis' Shiro-based implementation of its authentication and authorization APIs, Isis also provides a "bypass" implementation, useful for quick-n-dirty prototyping when you want to in effect disable (bypass) security completely.</p>
@@ -363,7 +363,7 @@ table.CodeRay td.code>pre{padding:0}
<p>A further aspect of security is auditing: recording what data was modified by which user.</p>
</div>
<div class="paragraph">
- <p>Apache Isis provides the <a href="../rgsvc/rgsvc.html#_rgsvc_application-layer-api_InteractionContext"><code>InteractionContext</code></a> can be used to track the actions being invoked, and the <a href="../rgsvc/rgsvc.html#_rgsvc_persistence-layer-spi_AuditerService"><code>AuditerService</code></a> captures what data was modified as a result (auditing). When <code>Interaction</code>s are persisted (eg by way of (non-ASF) <a href="http://platform.incode.org" target="_blank">Incode Platform</a>'s publishmq module) this provides excellent traceability. The (non-ASF) <a href="http://platform.incode.org" target="_blank">Incode Platform</a>'s audit module provides an implementation of the <code>AuditerService</code>.</p>
+ <p>Apache Isis provides the <a href="../rgsvc/rgsvc.html#_rgsvc_application-layer-api_InteractionContext"><code>InteractionContext</code></a> can be used to track the actions being invoked, and the <a href="../rgsvc/rgsvc.html#_rgsvc_persistence-layer-spi_AuditerService"><code>AuditerService</code></a> captures what data was modified as a result (auditing). When <code>Interaction</code>s are persisted (eg by way of (non-ASF) <a href="http://platform.incode.org" target="_blank" rel="noopener">Incode Platform</a>'s publishmq module) this provides excellent traceability. The (non-ASF) <a href="http://platform.incode.org" target="_blank" rel="noopener">Incode Platform</a>'s audit module provides an implementation of the <code>AuditerService</code>.</p>
</div>
<div class="paragraph">
<p>For <a href="../rgsvc/rgsvc.html#_rgsvc_application-layer-spi_CommandService"><code>CommandService</code></a> can be also be used to capture actions.</p>
@@ -497,7 +497,7 @@ table.CodeRay td.code>pre{padding:0}
</div>
</div>
<div class="sect2">
- <h3 id="__code_web_inf_shiro_ini_code">2.4. <code>WEB-INF/shiro.ini</code></h3>
+ <h3 id="_code_web_inf_shiro_ini_code">2.4. <code>WEB-INF/shiro.ini</code></h3>
<div class="paragraph">
<p>The <code>shiro.ini</code> file is used to specify the realm(s) that Shiro will delegate to:</p>
</div>
@@ -591,7 +591,7 @@ table.CodeRay td.code>pre{padding:0}
<p>The format of these is described below.</p>
</div>
<div class="sect4">
- <h5 id="__code_users_code_section"><code>[users]</code> section</h5>
+ <h5 id="_code_users_code_section"><code>[users]</code> section</h5>
<div class="paragraph">
<p>This section lists users, passwords and their roles.</p>
</div>
@@ -610,7 +610,7 @@ bob = pass, user_role, self-install_role</code></pre>
</div>
</div>
<div class="sect4">
- <h5 id="__code_roles_code_section"><code>[roles]</code> section</h5>
+ <h5 id="_code_roles_code_section"><code>[roles]</code> section</h5>
<div class="paragraph">
<p>This section lists roles and their corresponding permissions.</p>
</div>
@@ -963,10 +963,10 @@ admin_role = *</code></pre>
</ul>
</div>
<div class="paragraph">
- <p>The (non-ASF) <a href="http://platform.incode.org" target="_blank">Incode Platform</a>'s security module provides a complete security subdomain for users, roles, permissions; all are persisted as domain entities.</p>
+ <p>The (non-ASF) <a href="http://platform.incode.org" target="_blank" rel="noopener">Incode Platform</a>'s security module provides a complete security subdomain for users, roles, permissions; all are persisted as domain entities.</p>
</div>
<div class="paragraph">
- <p>What that means, of course, that they can also be administered through your Isis application. Moreover, the set of permissions (to features) is derived completely from your application’s metamodel; in essence the permissions are "type-safe".</p>
+ <p>What that means, of course, that they can also be administered through your Apache Isis application. Moreover, the set of permissions (to features) is derived completely from your application’s metamodel; in essence the permissions are "type-safe".</p>
</div>
<div class="paragraph">
<p>In order to play along, the module includes a Shiro realm, which fits in as follows:</p>
@@ -1022,7 +1022,7 @@ admin_role = *</code></pre>
<td class="icon"> <i class="fa icon-warning" title="Warning"></i> </td>
<td class="content">
<div class="paragraph">
- <p>If you are happy to use a database then we strongly recommend you use the (non-ASF) <a href="http://platform.incode.org" target="_blank">Incode Platform</a>'s security module instead of a vanilla JDBC; it is far more sophisticated and moreover gives you the ability to administer the system from within your Isis application.</p>
+ <p>If you are happy to use a database then we strongly recommend you use the (non-ASF) <a href="http://platform.incode.org" target="_blank" rel="noopener">Incode Platform</a>'s security module instead of a vanilla JDBC; it is far more sophisticated and moreover gives you the ability to administer the system from within your Apache Isis application.</p>
</div> </td>
</tr>
</tbody>
@@ -1552,7 +1552,7 @@ securityManager.cacheManager = $memoryCacheManager</code></pre>
<p>Still, on very rare occasion you may have a need, in which case you can either use Apache Isis' <code>UserService</code> API or you can reach further down the stack and use the JEE Servlet API.</p>
</div>
<div class="sect2">
- <h3 id="__code_userservice_code_api">6.1. <code>UserService</code> API</h3>
+ <h3 id="_code_userservice_code_api">6.1. <code>UserService</code> API</h3>
<div class="paragraph">
<p>The <a href="../rgsvc/rgsvc.html#_rgsvc_core-domain-api_UserService"><code>UserService</code></a> service exposes the following API:</p>
</div>
@@ -1587,7 +1587,7 @@ securityManager.cacheManager = $memoryCacheManager</code></pre>
<div class="sect2">
<h3 id="_servlet_api">6.2. Servlet API</h3>
<div class="paragraph">
- <p>On occasion you may find it necessary to reach below Apache Isis and to the underlying servlet API. For example, the (non-ASF) <a href="http://platform.incode.org" target="_blank">Incode Platform</a>'s togglz module (non-ASF) has a requirement to do this in order to expose its embedded togglz web console. (</p>
+ <p>On occasion you may find it necessary to reach below Apache Isis and to the underlying servlet API. For example, the (non-ASF) <a href="http://platform.incode.org" target="_blank" rel="noopener">Incode Platform</a>'s togglz module (non-ASF) has a requirement to do this in order to expose its embedded togglz web console. (</p>
</div>
<div class="admonitionblock tip">
<table>
@@ -1596,7 +1596,7 @@ securityManager.cacheManager = $memoryCacheManager</code></pre>
<td class="icon"> <i class="fa icon-tip" title="Tip"></i> </td>
<td class="content">
<div class="paragraph">
- <p>If you do need to access the servlet API and are running within the context of Wicket viewer, the (non-ASF) <a href="http://platform.incode.org" target="_blank">Incode Platform</a>'s servletapi module can provide access to the <code>HttpServletRequest</code>, <code>HttpServletResponse</code> and <code>ServletContext</code>.</p>
+ <p>If you do need to access the servlet API and are running within the context of Wicket viewer, the (non-ASF) <a href="http://platform.incode.org" target="_blank" rel="noopener">Incode Platform</a>'s servletapi module can provide access to the <code>HttpServletRequest</code>, <code>HttpServletResponse</code> and <code>ServletContext</code>.</p>
</div> </td>
</tr>
</tbody>
@@ -1709,7 +1709,7 @@ securityManager.cacheManager = $memoryCacheManager</code></pre>
<p>User registration is only available if the <a href="../rgsvc/rgsvc.html#_rgsvc_persistence-layer-spi_UserRegistrationService"><code>UserRegistrationService</code></a> is configured; this is used by the framework to actually create new instances of the user as accessed by the corresponding (Shiro) realm.</p>
</div>
<div class="paragraph">
- <p>Because Shiro realms are pluggable, the Apache Isis framework does not provide default implementations of this service. However, if you are using the (non-ASF) <a href="http://platform.incode.org" target="_blank">Incode Platform</a>'s security module, then this module <em>does</em> provide an implementation (that, as you might expect, creates new "user" domain entities).</p>
+ <p>Because Shiro realms are pluggable, the Apache Isis framework does not provide default implementations of this service. However, if you are using the (non-ASF) <a href="http://platform.incode.org" target="_blank" rel="noopener">Incode Platform</a>'s security module, then this module <em>does</em> provide an implementation (that, as you might expect, creates new "user" domain entities).</p>
</div>
<div class="paragraph">
<p>If you are using an LDAP realm and want to enable user-self registration then you’ll need to write your own implementation of this service.</p>