You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@struts.apache.org by "Haulyn R. Jason" <sa...@gmail.com> on 2008/08/19 10:44:58 UTC
Authentication way: Should I interceptor or before
it render?
Hi,all
I have an Authentication problem. I use Interceptor to authenticate
actions and methods, based on different member and different role.
Everything works well.But my client can not access some resource, for
example a url, so they should not see the url. I think maybe I can
re-write <s:a> tag or using an Interceptor to check should a <s:a />tag
be rendered to the clients. I can not find any reference.
Without this way, does struts2 have it's own way to solve the problem?
Thanks!
--
Thanks!
Mobile: +086-15864011231
EMail>alk:saharabear@gmail.com
EMail&yahoo:jia_haolin@yahoo.com
Skype:saharabear
Haulyn Runner Jason
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Authentication way: Should I interceptor or before
it render?
Posted by "Haulyn R. Jason" <sa...@gmail.com>.
Dave Newton :
> --- On Tue, 8/19/08, Haulyn R. Jason wrote:
>
>> When our client login our system, I can create a List
>> contains privilege objects, it includes properties:action
>> name and namespace, without a custom tag, how can I check
>> whether this member should see the link? I mean, I do not
>> know how to do it without writing Java code.
>>
>
> I didn't say without writing a custom tag, I said without writing Java; the same functionality could be in a JSP 2.0 tag file. And I didn't say it was the *best* idea, it's just another option.
>
> It doesn't matter, but I don't really get your access scheme; personally I would have just assign a collection of roles to a user and the tag would check a user versus a role, so in pseudo-code a "guarded link" would look like:
>
> <foo:userHasRole role="admin">
> <a href="admin">Admin</a>
> </foo:userHasRole>
>
> This is only reasonable if there are a small-ish number of places this is needed, otherwise as somebody else suggested it might be better to just render a completely different page.
>
> Dave
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
>
Oh, Sorry,Dave
I know what's your meaning now.
I think I can do it like this:
1. when the member Login, I store a List<Privilege> in session scope
2. I will use Interceptor to protect my application
3. I will write a custom tag using Java, to validate whether a link
should be displayed.
4. All my page, all components are dynamic, So I need to execute some
logic in custom tags
What's your opinion?
--
Thanks!
Mobile: +086-15864011231
EMail>alk:saharabear@gmail.com
EMail&yahoo:jia_haolin@yahoo.com
Skype:saharabear
Haulyn Runner Jason
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Authentication way: Should I interceptor or before it render?
Posted by Dave Newton <ne...@yahoo.com>.
--- On Tue, 8/19/08, Haulyn R. Jason wrote:
> When our client login our system, I can create a List
> contains privilege objects, it includes properties:action
> name and namespace, without a custom tag, how can I check
> whether this member should see the link? I mean, I do not
> know how to do it without writing Java code.
I didn't say without writing a custom tag, I said without writing Java; the same functionality could be in a JSP 2.0 tag file. And I didn't say it was the *best* idea, it's just another option.
It doesn't matter, but I don't really get your access scheme; personally I would have just assign a collection of roles to a user and the tag would check a user versus a role, so in pseudo-code a "guarded link" would look like:
<foo:userHasRole role="admin">
<a href="admin">Admin</a>
</foo:userHasRole>
This is only reasonable if there are a small-ish number of places this is needed, otherwise as somebody else suggested it might be better to just render a completely different page.
Dave
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Authentication way: Should I interceptor or before
it render?
Posted by "Haulyn R. Jason" <sa...@gmail.com>.
Dave Newton :
> --- On Tue, 8/19/08, Haulyn R. Jason wrote:
>
>> And, where should I find something about how to create a
>> custom tag for struts2? I think I need to create a custom
>> tag for struts2 because I need to access the value stack.
>>
>
> I would have guessed you kept your user object in session, so there's no need to go to the value stack. If you're using JSP 2.0 you can use a tag file and wouldn't need to write any Java code at all anyway.
>
> Dave
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
>
OK,Dave
When our client login our system, I can create a List contains privilege
objects, it includes properties:action name and namespace, without a
custom tag, how can I check whether this member should see the link?
I mean, I do not know how to do it without writing Java code.
Thanks.
--
Thanks!
Mobile: +086-15864011231
EMail>alk:saharabear@gmail.com
EMail&yahoo:jia_haolin@yahoo.com
Skype:saharabear
Haulyn Runner Jason
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Authentication way: Should I interceptor or before it render?
Posted by Dave Newton <ne...@yahoo.com>.
--- On Tue, 8/19/08, Haulyn R. Jason wrote:
> And, where should I find something about how to create a
> custom tag for struts2? I think I need to create a custom
> tag for struts2 because I need to access the value stack.
I would have guessed you kept your user object in session, so there's no need to go to the value stack. If you're using JSP 2.0 you can use a tag file and wouldn't need to write any Java code at all anyway.
Dave
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Authentication way: Should I interceptor or before
it render?
Posted by "Haulyn R. Jason" <sa...@gmail.com>.
Jeromy Evans :
> Haulyn R. Jason wrote:
>
>> Hi,all
>> I have an Authentication problem. I use Interceptor to authenticate
>> actions and methods, based on different member and different role.
>> Everything works well.But my client can not access some resource, for
>> example a url, so they should not see the url. I think maybe I can
>> re-write <s:a> tag or using an Interceptor to check should a <s:a />tag
>> be rendered to the clients. I can not find any reference.
>> Without this way, does struts2 have it's own way to solve the problem?
>>
>> Thanks!
>>
>>
>>
>
> None of the struts 2 tags are aware of role. In my opinion, it's better
> to leave that consideration out of these tags as you don't want security
> checks scattered through all the tag variations.
>
> Instead customize the view using tags that render its body only if the
> user has the specified role(s).
> Either:
> - use tags from an existing library (Tiles tags can check role I think); or
> - create a custom tag that only renders the body if the principal has
> the specified role(s)
> eg.
> <security:guard role="admin">
> <s:a href="adminpage"/>
> </security:guard>
>
> Otherwise every tag needs to be modified and that leads to mistakes.
>
> *More importantly* secure the server-side first and foremost. Consider
> customization of the view based on role only as a way to improve the
> user's experience as it doesn't actually help secure your application.
>
>
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
>
Thanks,
I use Interceptor to protect my application with AOP, maybe create a
custom tag is the best choice for me. Create a role and check it.
And, where should I find something about how to create a custom tag for
struts2? I think I need to create a custom tag for struts2 because I
need to access the value stack. I can not find reference from google,
and when I read the source of IfTag, It's not easy to understand the
life cycle.
--
Thanks!
Mobile: +086-15864011231
EMail>alk:saharabear@gmail.com
EMail&yahoo:jia_haolin@yahoo.com
Skype:saharabear
贾昊林(Haulyn Runner Jason)
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Authentication way: Should I interceptor or before
it render?
Posted by Jeromy Evans <je...@blueskyminds.com.au>.
Haulyn R. Jason wrote:
> Hi,all
> I have an Authentication problem. I use Interceptor to authenticate
> actions and methods, based on different member and different role.
> Everything works well.But my client can not access some resource, for
> example a url, so they should not see the url. I think maybe I can
> re-write <s:a> tag or using an Interceptor to check should a <s:a />tag
> be rendered to the clients. I can not find any reference.
> Without this way, does struts2 have it's own way to solve the problem?
>
> Thanks!
>
>
None of the struts 2 tags are aware of role. In my opinion, it's better
to leave that consideration out of these tags as you don't want security
checks scattered through all the tag variations.
Instead customize the view using tags that render its body only if the
user has the specified role(s).
Either:
- use tags from an existing library (Tiles tags can check role I think); or
- create a custom tag that only renders the body if the principal has
the specified role(s)
eg.
<security:guard role="admin">
<s:a href="adminpage"/>
</security:guard>
Otherwise every tag needs to be modified and that leads to mistakes.
*More importantly* secure the server-side first and foremost. Consider
customization of the view based on role only as a way to improve the
user's experience as it doesn't actually help secure your application.
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Authentication way: Should I interceptor or before it render?
Posted by Wes Wannemacher <we...@wantii.com>.
Rather than rewrite s:a and s:url, why not wrap the display in an s:if
test? It might be easier to abstract a test stating "is this user
granted the appropriate authority" and just plug that into s:if
-Wes
On Tue, Aug 19, 2008 at 4:44 AM, Haulyn R. Jason <sa...@gmail.com> wrote:
> Hi,all
> I have an Authentication problem. I use Interceptor to authenticate
> actions and methods, based on different member and different role.
> Everything works well.But my client can not access some resource, for
> example a url, so they should not see the url. I think maybe I can
> re-write <s:a> tag or using an Interceptor to check should a <s:a />tag
> be rendered to the clients. I can not find any reference.
> Without this way, does struts2 have it's own way to solve the problem?
>
> Thanks!
>
> --
>
> Thanks!
>
> Mobile: +086-15864011231
> EMail>alk:saharabear@gmail.com
> EMail&yahoo:jia_haolin@yahoo.com
> Skype:saharabear
>
>
> Haulyn Runner Jason
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
--
Wesley Wannemacher
President, Head Engineer/Consultant
WanTii, Inc.
http://www.wantii.com
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org