Enabling SSL in Struts 2

[Craig Swift <Cr...@Sun.COM>]

Hello,

I was wondering what is the best way to enable SSL connections in Struts 
2? In Struts 1 we would use the secure tiles plugin but I'm unsure if 
that's still an option and if it's the best one. Any information would 
be appreciated since I couldn't find the subject in the guides or the 
FAQ. Thanks!

Craig

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org

Re: Enabling SSL in Struts 2

[Petit Pas De Lune <pe...@gmail.com>]

If you want a good security framework, just use Acegi Security for Spring :
http://www.acegisecurity.org/

Just configure a channelProcessingFilter as follow :

web.xml (put Acegi filter before struts2 one)
...
    <filter>
        <filter-name>Acegi Filter Chain Proxy</filter-name>
        <filter-class>org.acegisecurity.util.FilterToBeanProxy
</filter-class>
        <init-param>
            <param-name>targetClass</param-name>
            <param-value>org.acegisecurity.util.FilterChainProxy
</param-value>
        </init-param>
    </filter>

    <filter>
        <filter-name>Acegi Channel Processing Proxy</filter-name>
        <filter-class>org.acegisecurity.util.FilterToBeanProxy
</filter-class>
        <init-param>
            <param-name>targetClass</param-name>
            <param-value>
org.acegisecurity.securechannel.ChannelProcessingFilter</param-value>
        </init-param>
    </filter>
...
STRUTS2 Filter
...
    <filter-mapping>
      <filter-name>Acegi Filter Chain Proxy</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>
    <filter-mapping>

    <filter-mapping>
      <filter-name>Acegi Channel Processing Proxy</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>

applicationContext.xml
...
    <bean id="filterChainProxy" class="
org.acegisecurity.util.FilterChainProxy">
        <property name="filterInvocationDefinitionSource">
            <value>
                CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
                PATTERN_TYPE_APACHE_ANT
                /**=channelProcessingFilter
            </value>
        </property>
    </bean>
...
    <bean id="channelProcessingFilter" class="
org.acegisecurity.securechannel.ChannelProcessingFilter">
        <property name="channelDecisionManager">
            <ref bean="channelDecisionManager"/>
        </property>
        <property name="filterInvocationDefinitionSource">
            <value>
                CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
                \A/secure/.*\Z=REQUIRES_SECURE_CHANNEL
                \A.*\Z=REQUIRES_INSECURE_CHANNEL
            </value>
        </property>
    </bean>
    <bean id="channelDecisionManager" class="
org.acegisecurity.securechannel.ChannelDecisionManagerImpl">
        <property name="channelProcessors">
            <list>
                <ref bean="secureChannelProcessor"/>
                <ref bean="insecureChannelProcessor"/>
            </list>
        </property>
    </bean>
    <bean id="secureChannelProcessor" class="
org.acegisecurity.securechannel.SecureChannelProcessor"/>
    <bean id="insecureChannelProcessor" class="
org.acegisecurity.securechannel.InsecureChannelProcessor"/>
...

Acegi provides authentication, authorization, instance-based access control,
channel security and human user detection capabilities.
JCaptcha and Jasypt make good coworkers.

PPDL

On 5/5/07, Craig Swift <Cr...@sun.com> wrote:
>
> Hello,
>
> I was wondering what is the best way to enable SSL connections in Struts
> 2? In Struts 1 we would use the secure tiles plugin but I'm unsure if
> that's still an option and if it's the best one. Any information would
> be appreciated since I couldn't find the subject in the guides or the
> FAQ. Thanks!
>
> Craig
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>