Securing services

[Moritz Gmelin <mo...@gmx.de>]

Hi,

Securing page access with an access controller injected as a  
dispatcher in the render cycle is well described in the T5 wiki. But  
How would I secure a service method on a page?
E.G. I have a page "DocumentPage" with a method onDownload(id docID).
When the URL DocumentPage/onDownload/5 is called, the dispatcher is  
not even fired.
My Dispatcher is added like this

public void contributeMasterDispatcher(
					OrderedConfiguration<Dispatcher> configuration,
					@InjectService("AccessControlDispatcher") Dispatcher  
accessController)
	{
		configuration.add("AccessControlDispatcher", accessController,
			"before:PageRender");
	}


Adding the same dispatcher with "before:OnEvent" is not helping either.
How can I secure service access on a page?

Thanks

Moritz

Re: Securing services

[Massimo Lusetti <ml...@gmail.com>]

On Tue, Sep 9, 2008 at 10:21 AM, Hugo Palma <hu...@gmail.com> wrote:

> I've used tapestry-acegi with great success for securing both pages and
> methods:
>
> Check an example here
> http://www.localhost.nu/java/tapestry5-acegi/usage.html
>
> Another possibility, although i never actually tried it, could be to define
> your own Secured annotation and contribute a custom worker to handle it.
> Check the source of the contributeComponentClassTransformWorker method on
> the TapestryModule class to see how Tapestry does it.

The chenillekit-access module from chenillekit project serve this
purpose without external dependencies. It is built around
PageRendereRequestFilter and ComponentEventRequestFilter which, i
think, are the way to go from within tapestry5.

The module is just at the very early stage, needs code polishing,
testing and documentation but you can look at it and provide feedback
if you wish, that's would be cool. Consider it more or less as a proof
of concept.

Ciao!
-- 
Massimo
http://meridio.blogspot.com

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org

Re: Securing services

[Hugo Palma <hu...@gmail.com>]

I've used tapestry-acegi with great success for securing both pages and 
methods:

Check an example here 
http://www.localhost.nu/java/tapestry5-acegi/usage.html

Another possibility, although i never actually tried it, could be to 
define your own Secured annotation and contribute a custom worker to 
handle it.
Check the source of the contributeComponentClassTransformWorker method 
on the TapestryModule class to see how Tapestry does it.

Moritz Gmelin wrote:
> Hi,
>
> Securing page access with an access controller injected as a 
> dispatcher in the render cycle is well described in the T5 wiki. But 
> How would I secure a service method on a page?
> E.G. I have a page "DocumentPage" with a method onDownload(id docID).
> When the URL DocumentPage/onDownload/5 is called, the dispatcher is 
> not even fired.
> My Dispatcher is added like this
>
> public void contributeMasterDispatcher(
>                     OrderedConfiguration<Dispatcher> configuration,
>                     @InjectService("AccessControlDispatcher") 
> Dispatcher accessController)
>     {
>         configuration.add("AccessControlDispatcher", accessController,
>             "before:PageRender");
>     }
>
>
> Adding the same dispatcher with "before:OnEvent" is not helping either.
> How can I secure service access on a page?
>
> Thanks
>
> Moritz

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org