You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@wicket.apache.org by Lars Vonk <la...@gmail.com> on 2009/01/21 11:07:30 UTC
wicket-auth-roles and spring security 2.x
Hi,
I am currently configuring my project to use spring-security 2.x with
wicket-auth-roles and noticed that the
http://cwiki.apache.org/WICKET/acegi-and-wicket-auth-roles.html page is
slightly out-of-date. Is it okay is I add a wicket 1.3.5 and spring security
2.x example?
Another thing I noticed is that in the example (
http://cwiki.apache.org/WICKET/acegi-and-wicket-auth-roles.html) the Spring
Security Filter is added to the web.xml. But I think this is only necessary
if you also want to protect static resources right? Or is there another
reason to add the Spring Security Filter?
Thanks in advance,
Lars
Re: wicket-auth-roles and spring security 3.x
Posted by yferahi <yf...@yahoo.com>.
Hi James,
I am trying to migrate your Wicket-advanced example to use Spring Security 3
and the Pre-authentication scheme (Letting SiteMinder do the
authentication).
Since it is in development mode, I configured a filter to mock siteMinder by
setting some headers (SM_User, SM_Role)..
I have changed the security context xml file as follow:
When I execute the application, I can see the spring security in action
(getting headers from SiteMinder -filter- and authentication,) I get to the
home page file.
However, any link I click on from the home page will take me back to the
home page..
Appreciate any insights
thanks
Youcef
<context:annotation-config />
<context:spring-configured />
<bean id="springSecurityFilterChain"
class="org.springframework.security.web.FilterChainProxy">
<security:filter-chain-map path-type="ant">
<security:filter-chain pattern="/**" filters="scpf,siteminderFilter" />
</security:filter-chain-map>
</bean>
<bean id="scpf"
class="org.springframework.security.web.context.SecurityContextPersistenceFilter">
<property name="forceEagerSessionCreation" value="true" />
</bean>
<security:global-method-security secured-annotations="enabled" />
<bean id="siteminderFilter"
class="org.springframework.security.web.authentication.preauth.RequestHeaderAuthenticationFilter">
<property name="principalRequestHeader" value="SM_USER" />
<property name="authenticationManager" ref="authenticationManager" />
<property name="authenticationDetailsSource"
ref="MyWebAuthenticationDetailsSource" />
<!-- the filter chain will not proceed when an authentication attempt
fails -->
<property name="continueFilterChainOnUnsuccessfulAuthentication"
value="false" />
</bean>
<security:authentication-manager alias="authenticationManager">
<security:authentication-provider
ref="preAuthenticatedAuthenticationProvider" />
</security:authentication-manager>
<bean id="preAuthenticatedAuthenticationProvider"
class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
<property name="preAuthenticatedUserDetailsService"
ref="preAuthenticatedUserDetailsService" />
</bean>
<bean id="preAuthenticatedUserDetailsService"
class="org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesUserDetailsService"
/>
<bean id="MyWebAuthenticationDetailsSource"
class="org.springframework.security.web.authentication.WebAuthenticationDetailsSource">
<property name="clazz"
value="wicket.common.security.siteminder.MyPreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails"
/>
</bean>
</beans>
--
View this message in context: http://apache-wicket.1842946.n4.nabble.com/wicket-auth-roles-and-spring-security-2-x-tp1844462p2719180.html
Sent from the Users forum mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@wicket.apache.org
For additional commands, e-mail: users-help@wicket.apache.org
Re: wicket-auth-roles and spring security 2.x
Posted by James Carman <jc...@carmanconsulting.com>.
On Wed, Jan 21, 2009 at 8:03 AM, Lars Vonk <la...@gmail.com> wrote:
> Hi James,
>
> Thanks for the example.
>
> I actually already have it running but was just wondering if there is any
> other reason than securing static resources, to still configure the
> org.springframework.web.filter.DelegatingFilterProxy in the web.xml. As far
> as I can reason by using the wicket-auth-roles Wicket is responsible to
> check whether or not someone is signed and not Spring Security. (The check
> is implemented in the AuthenticatedWebSession.authenticate(..) that
> delegates is to Spring Securities AuthenticationManager. ).
> I removed the filter and all still works, but I might be overlooking
> something... Any thoughts?
I only use one the HttpSessionContextIntegrationFilter in my
application. However, I copied that from a different working
application and that application actually has spring remoting in it,
so that might be why I have that in there.
>
> About the example: Beware that in your SpringSecuritySession (
> http://svn.carmanconsulting.com/public/wicket-advanced/trunk/src/main/java/com/carmanconsulting/wicket/advanced/web/common/session/SpringSecuritySession.java)
> you'll need to catch AuthenticationException. According to the contract the
> AuthenticationManager.authenticate throws an AuthenticationException when
> login fails (see javadoc of AuthenticationManager.authenticate).
Thanks for the heads-up. I think I've fixed that in a subsequent
application based on the same code. I haven't touched that example in
quite a while (I gave my advanced wicket talk last year sometime).
>
> Lars
>
> On Wed, Jan 21, 2009 at 1:35 PM, James Carman
> <jc...@carmanconsulting.com>wrote:
>
>> Lars,
>>
>> My wicket-advanced example code uses Spring security and
>> wicket-auth-roles. You can download it here:
>>
>> http://svn.carmanconsulting.com/public/wicket-advanced/trunk/
>>
>> Hope that helps.
>>
>> James
>>
>> On Wed, Jan 21, 2009 at 5:07 AM, Lars Vonk <la...@gmail.com> wrote:
>> > Hi,
>> >
>> > I am currently configuring my project to use spring-security 2.x with
>> > wicket-auth-roles and noticed that the
>> > http://cwiki.apache.org/WICKET/acegi-and-wicket-auth-roles.html page is
>> > slightly out-of-date. Is it okay is I add a wicket 1.3.5 and spring
>> security
>> > 2.x example?
>> >
>> > Another thing I noticed is that in the example (
>> > http://cwiki.apache.org/WICKET/acegi-and-wicket-auth-roles.html) the
>> Spring
>> > Security Filter is added to the web.xml. But I think this is only
>> necessary
>> > if you also want to protect static resources right? Or is there another
>> > reason to add the Spring Security Filter?
>> >
>> > Thanks in advance,
>> >
>> > Lars
>> >
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@wicket.apache.org
>> For additional commands, e-mail: users-help@wicket.apache.org
>>
>>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@wicket.apache.org
For additional commands, e-mail: users-help@wicket.apache.org
Re: wicket-auth-roles and spring security 2.x
Posted by Lars Vonk <la...@gmail.com>.
Hi James,
Thanks for the example.
I actually already have it running but was just wondering if there is any
other reason than securing static resources, to still configure the
org.springframework.web.filter.DelegatingFilterProxy in the web.xml. As far
as I can reason by using the wicket-auth-roles Wicket is responsible to
check whether or not someone is signed and not Spring Security. (The check
is implemented in the AuthenticatedWebSession.authenticate(..) that
delegates is to Spring Securities AuthenticationManager. ).
I removed the filter and all still works, but I might be overlooking
something... Any thoughts?
About the example: Beware that in your SpringSecuritySession (
http://svn.carmanconsulting.com/public/wicket-advanced/trunk/src/main/java/com/carmanconsulting/wicket/advanced/web/common/session/SpringSecuritySession.java)
you'll need to catch AuthenticationException. According to the contract the
AuthenticationManager.authenticate throws an AuthenticationException when
login fails (see javadoc of AuthenticationManager.authenticate).
Lars
On Wed, Jan 21, 2009 at 1:35 PM, James Carman
<jc...@carmanconsulting.com>wrote:
> Lars,
>
> My wicket-advanced example code uses Spring security and
> wicket-auth-roles. You can download it here:
>
> http://svn.carmanconsulting.com/public/wicket-advanced/trunk/
>
> Hope that helps.
>
> James
>
> On Wed, Jan 21, 2009 at 5:07 AM, Lars Vonk <la...@gmail.com> wrote:
> > Hi,
> >
> > I am currently configuring my project to use spring-security 2.x with
> > wicket-auth-roles and noticed that the
> > http://cwiki.apache.org/WICKET/acegi-and-wicket-auth-roles.html page is
> > slightly out-of-date. Is it okay is I add a wicket 1.3.5 and spring
> security
> > 2.x example?
> >
> > Another thing I noticed is that in the example (
> > http://cwiki.apache.org/WICKET/acegi-and-wicket-auth-roles.html) the
> Spring
> > Security Filter is added to the web.xml. But I think this is only
> necessary
> > if you also want to protect static resources right? Or is there another
> > reason to add the Spring Security Filter?
> >
> > Thanks in advance,
> >
> > Lars
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@wicket.apache.org
> For additional commands, e-mail: users-help@wicket.apache.org
>
>
Re: wicket-auth-roles and spring security 2.x
Posted by James Carman <jc...@carmanconsulting.com>.
Lars,
My wicket-advanced example code uses Spring security and
wicket-auth-roles. You can download it here:
http://svn.carmanconsulting.com/public/wicket-advanced/trunk/
Hope that helps.
James
On Wed, Jan 21, 2009 at 5:07 AM, Lars Vonk <la...@gmail.com> wrote:
> Hi,
>
> I am currently configuring my project to use spring-security 2.x with
> wicket-auth-roles and noticed that the
> http://cwiki.apache.org/WICKET/acegi-and-wicket-auth-roles.html page is
> slightly out-of-date. Is it okay is I add a wicket 1.3.5 and spring security
> 2.x example?
>
> Another thing I noticed is that in the example (
> http://cwiki.apache.org/WICKET/acegi-and-wicket-auth-roles.html) the Spring
> Security Filter is added to the web.xml. But I think this is only necessary
> if you also want to protect static resources right? Or is there another
> reason to add the Spring Security Filter?
>
> Thanks in advance,
>
> Lars
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@wicket.apache.org
For additional commands, e-mail: users-help@wicket.apache.org