You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@deltaspike.apache.org by Осипов Алексей <os...@gmail.com> on 2016/06/08 22:53:36 UTC
Using @Secures to secure JSF page (ViewConfig)
Hello,
I'm working with type-safe view-config for my app an run in an issue
with defining security restrictions for pages.
Deltaspike documentation explains how to use @Secured annotation and
implement AccessDecisionVoter-s to define permission checks for pages.
I have a bunch of custom SecurityBindingType-s that checked via
@Secures-annotated methods and I want to use those SecurityBindingType-s
to configure permission checks on ViewConfig objects.
Example (mostly just from Deltaspike docs):
// Custom security binding annotation:
|@Retention(value = RUNTIME) @Target({TYPE, METHOD}) @Documented
@SecurityBindingType public @interface UserLoggedIn {}|
// Custom /authorizer/|
@ApplicationScoped |
|public class LoggedInAuthorizer { @Secures @UserLoggedIn public boolean
doSecuredCheck(Identity identity) throws Exception { return
identity.isLoggedIn(); } }|
// View config
@|UserLoggedIn // <- Note that I want to use |security binding
annotation here. Not a new class with @Secured
|public class MyPage implements ViewConfig||{ |
|}|
// Note: this example has only one annotation (|UserLoggedIn|) but my app has a dozen of them.
So I want to use security binding annotations for ViewConfig classes in
the same way we usually use them for beans.
The problem is that I can't find easy way to do that type of security
check declaration in Delatspike.
Obviously, I can write a AccessDecisionVoter for each custom security
binding type but I don't want to create so many classes just for view
configuration.
Also I can write an AccessDecisionVoter and list all my security binding
annotations and check them one by one. However I don't want to hardcode
the list of annotations. To high risk that somebody forgets to update
the list.
Is there better way to achieve that? Am I missing something?
||
Reference docs:
https://deltaspike.apache.org/documentation/security.html
https://deltaspike.apache.org/documentation/jsf.html
PS: I've run into that problem during migration from Seam 3. Seam
allowed to use security binding annotations in page configuration.
Best regards,
Alexei Osipov
Re: Using @Secures to secure JSF page (ViewConfig)
Posted by Осипов Алексей <os...@gmail.com>.
Ok, I've created ticket
https://issues.apache.org/jira/browse/DELTASPIKE-1172
On 09.06.2016 11:45, Gerhard Petracek wrote:
> hi alexei,
>
> it's currently not supported (intentionally).
> -> please file a jira-ticket for it and we will re-visit this topic.
>
> regards,
> gerhard
>
>
>
> 2016-06-09 0:53 GMT+02:00 \u041e\u0441\u0438\u043f\u043e\u0432 \u0410\u043b\u0435\u043a\u0441\u0435\u0439 <os...@gmail.com>:
>
>> Hello,
>>
>> I'm working with type-safe view-config for my app an run in an issue with
>> defining security restrictions for pages.
>>
>> Deltaspike documentation explains how to use @Secured annotation and
>> implement AccessDecisionVoter-s to define permission checks for pages.
>> I have a bunch of custom SecurityBindingType-s that checked via
>> @Secures-annotated methods and I want to use those SecurityBindingType-s to
>> configure permission checks on ViewConfig objects.
>>
>> Example (mostly just from Deltaspike docs):
>> // Custom security binding annotation:
>>
>> |@Retention(value = RUNTIME) @Target({TYPE, METHOD}) @Documented
>> @SecurityBindingType public @interface UserLoggedIn {}|
>>
>> // Custom /authorizer/|
>> @ApplicationScoped |
>>
>> |public class LoggedInAuthorizer { @Secures @UserLoggedIn public boolean
>> doSecuredCheck(Identity identity) throws Exception { return
>> identity.isLoggedIn(); } }|
>>
>> // View config
>> @|UserLoggedIn // <- Note that I want to use |security binding annotation
>> here. Not a new class with @Secured
>> |public class MyPage implements ViewConfig||{ |
>>
>> |}|
>> // Note: this example has only one annotation (|UserLoggedIn|) but my app
>> has a dozen of them.
>>
>> So I want to use security binding annotations for ViewConfig classes in
>> the same way we usually use them for beans.
>> The problem is that I can't find easy way to do that type of security
>> check declaration in Delatspike.
>>
>> Obviously, I can write a AccessDecisionVoter for each custom security
>> binding type but I don't want to create so many classes just for view
>> configuration.
>> Also I can write an AccessDecisionVoter and list all my security binding
>> annotations and check them one by one. However I don't want to hardcode the
>> list of annotations. To high risk that somebody forgets to update the list.
>>
>> Is there better way to achieve that? Am I missing something?
>>
>> ||
>>
>> Reference docs:
>> https://deltaspike.apache.org/documentation/security.html
>> https://deltaspike.apache.org/documentation/jsf.html
>>
>> PS: I've run into that problem during migration from Seam 3. Seam allowed
>> to use security binding annotations in page configuration.
>>
>> Best regards,
>> Alexei Osipov
>>
Re: Using @Secures to secure JSF page (ViewConfig)
Posted by Gerhard Petracek <gp...@apache.org>.
hi alexei,
it's currently not supported (intentionally).
-> please file a jira-ticket for it and we will re-visit this topic.
regards,
gerhard
2016-06-09 0:53 GMT+02:00 Осипов Алексей <os...@gmail.com>:
> Hello,
>
> I'm working with type-safe view-config for my app an run in an issue with
> defining security restrictions for pages.
>
> Deltaspike documentation explains how to use @Secured annotation and
> implement AccessDecisionVoter-s to define permission checks for pages.
> I have a bunch of custom SecurityBindingType-s that checked via
> @Secures-annotated methods and I want to use those SecurityBindingType-s to
> configure permission checks on ViewConfig objects.
>
> Example (mostly just from Deltaspike docs):
> // Custom security binding annotation:
>
> |@Retention(value = RUNTIME) @Target({TYPE, METHOD}) @Documented
> @SecurityBindingType public @interface UserLoggedIn {}|
>
> // Custom /authorizer/|
> @ApplicationScoped |
>
> |public class LoggedInAuthorizer { @Secures @UserLoggedIn public boolean
> doSecuredCheck(Identity identity) throws Exception { return
> identity.isLoggedIn(); } }|
>
> // View config
> @|UserLoggedIn // <- Note that I want to use |security binding annotation
> here. Not a new class with @Secured
> |public class MyPage implements ViewConfig||{ |
>
> |}|
> // Note: this example has only one annotation (|UserLoggedIn|) but my app
> has a dozen of them.
>
> So I want to use security binding annotations for ViewConfig classes in
> the same way we usually use them for beans.
> The problem is that I can't find easy way to do that type of security
> check declaration in Delatspike.
>
> Obviously, I can write a AccessDecisionVoter for each custom security
> binding type but I don't want to create so many classes just for view
> configuration.
> Also I can write an AccessDecisionVoter and list all my security binding
> annotations and check them one by one. However I don't want to hardcode the
> list of annotations. To high risk that somebody forgets to update the list.
>
> Is there better way to achieve that? Am I missing something?
>
> ||
>
> Reference docs:
> https://deltaspike.apache.org/documentation/security.html
> https://deltaspike.apache.org/documentation/jsf.html
>
> PS: I've run into that problem during migration from Seam 3. Seam allowed
> to use security binding annotations in page configuration.
>
> Best regards,
> Alexei Osipov
>