You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@struts.apache.org by Adam Hardy <ah...@cyberspaceroad.com> on 2004/09/25 22:24:36 UTC
Spring security vs container-managed
I haven't been contributing here for at least six months, but I hope
nobody minds if I jump right back in with a couple of questions. So
hello everybody and here goes:
I'm looking at an architecture in my latest project which incorporates
struts, EJBs, Spring and Hibernate.
Amongst other issues with this approach, I am struggling trying to work
out what the best implementation should be in the JSPs for role-based
authorisation, amongst other things. I can see only one solution which
looks really ugly.
I have got pages that are very complicated, 100% specified and not
usability-tested at all. Each page will have a crowd of controls whose
presence depends on the user's role.
What I was planning was to seperate the role-specific form controls into
another tile and use the tiles role-authorisation. However Spring
security is now the order of the day, and I can't do that anymore. (Can I?)
The suggested solution is to wrap all form controls in a Spring-based
role-manager taglib. The JSPs are ugly enough as it is so I find that
idea bad.
What would be the best approach technically? Redesigning the screens?
Insisting on CMS and not Spring? Just going along with it?
thanks
Adam
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Spring security vs container-managed
Posted by Craig McClanahan <cr...@gmail.com>.
The "role" attribute on a Tiles definition should also respect the
output from Security Filter. Indeed, this is a classic example of why
the chain of responsibility pattern (which filters implement) is so
useful ... the technology that *produces* the values returned by
getRemoteUser/getUserPrincipal/isUserInRole and the technology that
*consumes* those values (i.e. any code in Struts that uses a "role"
attribute) are totally independent of each other.
Craig
On Sun, 26 Sep 2004 23:12:15 +0200, Adam Hardy
<ah...@cyberspaceroad.com> wrote:
>
>
> On 09/26/2004 11:47 PM Craig McClanahan wrote:
> > On Sat, 25 Sep 2004 22:24:36 +0200, Adam Hardy
> > <ah...@cyberspaceroad.com> wrote:
> >>[snip]
> >>The suggested solution is to wrap all form controls in a Spring-based
> >>role-manager taglib. The JSPs are ugly enough as it is so I find that
> >>idea bad.
> >
> >
> > Isn't that pretty much the same thing that you would do if you were
> > using container managed security? Something like this:
> >
> > <logic:present role="manager">
> > ... stuff only a manager should see ...
> > </logic:present>
> >
> > I don't see anything wrong with this (the standard Struts tag doesn't
> > deal with Spring's security, but you could easily extend it to do so).
>
>
> No, I was going to use the role attribute on the tile definition in the
> tiles-defs.xml. I guess I'm being too anal trying to keep my JSPs clean
> of taglibs.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Spring security vs container-managed
Posted by Adam Hardy <ah...@cyberspaceroad.com>.
On 09/26/2004 11:47 PM Craig McClanahan wrote:
> On Sat, 25 Sep 2004 22:24:36 +0200, Adam Hardy
> <ah...@cyberspaceroad.com> wrote:
>>[snip]
>>The suggested solution is to wrap all form controls in a Spring-based
>>role-manager taglib. The JSPs are ugly enough as it is so I find that
>>idea bad.
>
>
> Isn't that pretty much the same thing that you would do if you were
> using container managed security? Something like this:
>
> <logic:present role="manager">
> ... stuff only a manager should see ...
> </logic:present>
>
> I don't see anything wrong with this (the standard Struts tag doesn't
> deal with Spring's security, but you could easily extend it to do so).
No, I was going to use the role attribute on the tile definition in the
tiles-defs.xml. I guess I'm being too anal trying to keep my JSPs clean
of taglibs.
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Spring security vs container-managed
Posted by Craig McClanahan <cr...@gmail.com>.
On Sat, 25 Sep 2004 22:24:36 +0200, Adam Hardy
<ah...@cyberspaceroad.com> wrote:
> [snip]
> The suggested solution is to wrap all form controls in a Spring-based
> role-manager taglib. The JSPs are ugly enough as it is so I find that
> idea bad.
Isn't that pretty much the same thing that you would do if you were
using container managed security? Something like this:
<logic:present role="manager">
... stuff only a manager should see ...
</logic:present>
I don't see anything wrong with this (the standard Struts tag doesn't
deal with Spring's security, but you could easily extend it to do so).
Craig
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org