Questions about Different Context Paths based on page inheritance

[Eric Gulatee <er...@gmail.com>]

All,


We have developed an application which spans both authenticated and
unauthenticated users.
We have secured the authenticated part of the application using wicket auth
roles.
This would be good enough, however, we need to get SSO working between two
different application
servers & their respective applications..

Both servers have been configured to accept SSO tokens, however in order to
do this, you need to protect the URLs.
This is achieved by using security contraints in the web.xml.  (There is
another mechanisms but this is the most standard/straightforward)

We'd like to be able to have different CONTEXT ROOT / CONTEXT PATH depending
on the page type.
This context path should remain even after
CryptedUrlWebRequestCodingStrategy is applied.
In addition, some of our pages are bookmarkable, other are not (Steps in a
wizard).

So what we'd like would be something like this:

ROOT/protected/
ROOT/unprotected/

or

ROOT/            (Unprotected stuff here)
ROOT/protected/


Here are the options as I see them.

-    2 Wicket Applications both with different context roots.

Pros:    Easy
Cons:    Unsure.
    Depending on packaging, may be able to achieve session sharing.
    Protected pages would point to unprotected pages in different
application.  Needs exploration to impact.


-    Create a custom IRequestCodingStrategy which prepends a different
contextRoot depending on page class type
    However, we are currently using CryptedUrlWebRequestCodingStrategy, so
would need to create a custom
    CryptedUrlWebRequestCodingStrategy which 'keeps' our context root
unencrypted.


-    I looked at using a custom
IRequestTargetUrlCodingStrategy/IMountableRequestTargetUrlCodingStrategy
    Along the lines of MixedParamUrlCodingStrategy.

    However, this would seemingly mean mounting the pages, which won't work
in all cases (Or so I believe)
    since some of the pages shouldn't be bookmarkable

So, anyone have any experiences they would be willing to share?  Any
thoughts or suggestions?

Cheers,
Eric Gulatee