You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@struts.apache.org by Betty Koon <bk...@adobe.com> on 2005/03/10 18:49:53 UTC
User Delegation with struts
> Hi all,
>
> Anyone has any good strategy or pointers for doing
> user/role delegation with struts. We are not using
> J2EE container authentication. We will have our own
> role model. I will like more fine grain control on
> turning on and off visual elements with different
> role
> information. Thanks.
>
> -Betty
Re: User Delegation with struts
Posted by Jesse Clark <je...@jesseclark.com>.
The SecurtiyFilter package
(http://sourceforge.net/projects/securityfilter/) uses a servlet filter
and allows you to still use the request.isUserInRole stuff as well. I'm
not familiar with Acegi so I'm not sure how the two stack up against
each other feature-wise, but I was able to get a working Authentication
scheme with custom defined roles up and running fairly quickly with
ServletFilter.
-Jesse
Matt Raible wrote:
> I would use the aforementioned suggestion and use a Filter with a
> RequestWrapper to mimic the request.isUserInRole stuff - then you can
> use the "role" attribute in your action-mappings, your tiles
> definitions, and with <logic:present>.
>
> This is what Acegi Security does:
>
> http://cvs.sourceforge.net/viewcvs.py/acegisecurity/acegisecurity/core/
> src/main/java/net/sf/acegisecurity/wrapper/
>
> Matt
>
> On Mar 10, 2005, at 11:09 AM, Betty Koon wrote:
>
>> Matt,
>>
>> Thanks for the info. We already have our own Authentication
>> mechanism. I
>> am just thinking about how is it to make use of current role
>> information to
>> determine what get shown on the UI. Does that mean I have to write
>> custom
>> tag lib to deal with this.
>>
>> For isUserInRole, does this only comes in handy for forwarding to an
>> Action.
>> It can't really control what gets shown on the screen right?
>>
>> -Betty
>>
>> -----Original Message-----
>> From: Matt Raible [mailto:lists@raibledesigns.com]
>> Sent: Thursday, March 10, 2005 9:55 AM
>> To: Struts Users Mailing List
>> Subject: Re: User Delegation with struts
>>
>>
>> You could look at using the Acegi Security Framework. I've used it to
>> replace J2EE container authentication in AppFuse - and didn't have to
>> change any code. Works with request.isUserInRole and all that + it
>> allows you more fine grained control on the internals.
>>
>> http://acegisecurity.sourceforge.net
>>
>> Unfortunately, it's got a bit of a learning curve - but most good
>> open-source software does. ;-)
>>
>> Matt
>>
>> On Mar 10, 2005, at 10:49 AM, Betty Koon wrote:
>>
>>>> Hi all,
>>>>
>>>> Anyone has any good strategy or pointers for doing
>>>> user/role delegation with struts. We are not using
>>>> J2EE container authentication. We will have our own
>>>> role model. I will like more fine grain control on
>>>> turning on and off visual elements with different
>>>> role
>>>> information. Thanks.
>>>>
>>>> -Betty
>>>
>>>
>>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
>> For additional commands, e-mail: user-help@struts.apache.org
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
>> For additional commands, e-mail: user-help@struts.apache.org
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: User Delegation with struts
Posted by Matt Raible <li...@raibledesigns.com>.
I would use the aforementioned suggestion and use a Filter with a
RequestWrapper to mimic the request.isUserInRole stuff - then you can
use the "role" attribute in your action-mappings, your tiles
definitions, and with <logic:present>.
This is what Acegi Security does:
http://cvs.sourceforge.net/viewcvs.py/acegisecurity/acegisecurity/core/
src/main/java/net/sf/acegisecurity/wrapper/
Matt
On Mar 10, 2005, at 11:09 AM, Betty Koon wrote:
> Matt,
>
> Thanks for the info. We already have our own Authentication
> mechanism. I
> am just thinking about how is it to make use of current role
> information to
> determine what get shown on the UI. Does that mean I have to write
> custom
> tag lib to deal with this.
>
> For isUserInRole, does this only comes in handy for forwarding to an
> Action.
> It can't really control what gets shown on the screen right?
>
> -Betty
>
> -----Original Message-----
> From: Matt Raible [mailto:lists@raibledesigns.com]
> Sent: Thursday, March 10, 2005 9:55 AM
> To: Struts Users Mailing List
> Subject: Re: User Delegation with struts
>
>
> You could look at using the Acegi Security Framework. I've used it to
> replace J2EE container authentication in AppFuse - and didn't have to
> change any code. Works with request.isUserInRole and all that + it
> allows you more fine grained control on the internals.
>
> http://acegisecurity.sourceforge.net
>
> Unfortunately, it's got a bit of a learning curve - but most good
> open-source software does. ;-)
>
> Matt
>
> On Mar 10, 2005, at 10:49 AM, Betty Koon wrote:
>
>>> Hi all,
>>>
>>> Anyone has any good strategy or pointers for doing
>>> user/role delegation with struts. We are not using
>>> J2EE container authentication. We will have our own
>>> role model. I will like more fine grain control on
>>> turning on and off visual elements with different
>>> role
>>> information. Thanks.
>>>
>>> -Betty
>>
>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
RE: User Delegation with struts
Posted by Betty Koon <bk...@adobe.com>.
Matt,
Thanks for the info. We already have our own Authentication mechanism. I
am just thinking about how is it to make use of current role information to
determine what get shown on the UI. Does that mean I have to write custom
tag lib to deal with this.
For isUserInRole, does this only comes in handy for forwarding to an Action.
It can't really control what gets shown on the screen right?
-Betty
-----Original Message-----
From: Matt Raible [mailto:lists@raibledesigns.com]
Sent: Thursday, March 10, 2005 9:55 AM
To: Struts Users Mailing List
Subject: Re: User Delegation with struts
You could look at using the Acegi Security Framework. I've used it to
replace J2EE container authentication in AppFuse - and didn't have to
change any code. Works with request.isUserInRole and all that + it
allows you more fine grained control on the internals.
http://acegisecurity.sourceforge.net
Unfortunately, it's got a bit of a learning curve - but most good
open-source software does. ;-)
Matt
On Mar 10, 2005, at 10:49 AM, Betty Koon wrote:
>> Hi all,
>>
>> Anyone has any good strategy or pointers for doing
>> user/role delegation with struts. We are not using
>> J2EE container authentication. We will have our own
>> role model. I will like more fine grain control on
>> turning on and off visual elements with different
>> role
>> information. Thanks.
>>
>> -Betty
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: User Delegation with struts
Posted by Matt Raible <li...@raibledesigns.com>.
You could look at using the Acegi Security Framework. I've used it to
replace J2EE container authentication in AppFuse - and didn't have to
change any code. Works with request.isUserInRole and all that + it
allows you more fine grained control on the internals.
http://acegisecurity.sourceforge.net
Unfortunately, it's got a bit of a learning curve - but most good
open-source software does. ;-)
Matt
On Mar 10, 2005, at 10:49 AM, Betty Koon wrote:
>> Hi all,
>>
>> Anyone has any good strategy or pointers for doing
>> user/role delegation with struts. We are not using
>> J2EE container authentication. We will have our own
>> role model. I will like more fine grain control on
>> turning on and off visual elements with different
>> role
>> information. Thanks.
>>
>> -Betty
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org