You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tapestry.apache.org by Franz Amador <fg...@yahoo.com> on 2008/01/21 19:59:56 UTC
T5 tapestry5-acegi salt source not overridable
It looks to me like the tapestry5-acegi module hard-codes the password salt source to be SystemWideSaltSource. I can change the system-wide salt via acegi.password.salt, but there is no corresponding acegi.salt.source property. Having a system-wide salt is better than having no salt, but it isn't as strong as having a different salt for each user. Is there a way I can put in a request for supporting a new acegi.salt.source config property? I didn't see a mailing list or issue tracker on the tapestry5-acegi site (http://www.localhost.nu/java/tapestry5-acegi/). Is here an okay place to discuss this?
Re: T5 tapestry5-acegi salt source not overridable
Posted by Robin Helgelin <lo...@gmail.com>.
On Jan 21, 2008 7:59 PM, Franz Amador <fg...@yahoo.com> wrote:
> It looks to me like the tapestry5-acegi module hard-codes the password salt source to be SystemWideSaltSource. I can change the system-wide salt via acegi.password.salt, but there is no corresponding acegi.salt.source property. Having a system-wide salt is better than having no salt, but it isn't as strong as having a different salt for each user. Is there a way I can put in a request for supporting a new acegi.salt.source config property? I didn't see a mailing list or issue tracker on the tapestry5-acegi site (http://www.localhost.nu/java/tapestry5-acegi/). Is here an okay place to discuss this?
Hi again.
I was looking at this today, and can't you just override the service
by contributing an alias? Seems to work for me.
This is from my test application AppModule.java where SaltSourceImpl
is a quick class that simply extends SystemWideSaltSource.
public static void bind(ServiceBinder binder) {
binder.bind(SaltSource.class,
SaltSourceImpl.class).withId("MySaltSource");
}
public static SaltSource buildMySaltSource() throws Exception {
SaltSourceImpl saltSource = new SaltSourceImpl();
saltSource.setSystemWideSalt("DEADBEEF");
saltSource.afterPropertiesSet();
return saltSource;
}
public static void contributeAlias(@InjectService("MySaltSource")
SaltSource saltSource,
Configuration<AliasContribution> configuration) {
configuration.add(AliasContribution.create(SaltSource.class,
saltSource));
}
Can you test and verify and I'll update the documentation.
--
regards,
Robin
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: T5 tapestry5-acegi salt source not overridable
Posted by "Thiago H. de Paula Figueiredo" <th...@gmail.com>.
Em Wed, 28 Jan 2009 13:53:57 -0300, bongosdude <bo...@gmail.com>
escreveu:
> tapestry5 does not work with T5 5.0.18. I got error messages that say
> serivice SaltSource is built twice. If I removed the buildSourceSource
> static method. The error went away.
You cannot use both at the same time. By the way, Spring Security = Acegi
2. And make sure any package is only included in the classpath once.
--
Thiago H. de Paula Figueiredo
Independent Java consultant, developer, and instructor
http://www.arsmachina.com.br/thiago
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: T5 tapestry5-acegi salt source not overridable
Posted by bongosdude <bo...@gmail.com>.
tapestry5 does not work with T5 5.0.18. I got error messages that say
serivice SaltSource is built twice. If I removed the buildSourceSource
static method. The error went away.
Also tapestry5-acegi depends on acegi old version 1.0x which hinders to
projects that integrates with SpringFramework latest version 2.5.6
-B
Robin Helgelin wrote:
>
> Hi,
>
> On Jan 21, 2008 7:59 PM, Franz Amador <fg...@yahoo.com> wrote:
>> It looks to me like the tapestry5-acegi module hard-codes the password
>> salt source to be SystemWideSaltSource. I can change the system-wide
>> salt via acegi.password.salt, but there is no corresponding
>> acegi.salt.source property. Having a system-wide salt is better than
>> having no salt, but it isn't as strong as having a different salt for
>> each user. Is there a way I can put in a request for supporting a new
>> acegi.salt.source config property? I didn't see a mailing list or issue
>> tracker on the tapestry5-acegi site
>> (http://www.localhost.nu/java/tapestry5-acegi/). Is here an okay place
>> to discuss this?
>
> Sorry, so far there haven't been a need for a mailing list of an issue
> tracker. I'll see to your idea and make it configurable. I'm currently
> lagging a few Tapestry versions due to vacation, but I'll have it
> released soon.
>
>
> --
> regards,
> Robin
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
> For additional commands, e-mail: users-help@tapestry.apache.org
>
>
>
-----
B Amigo:super:
--
View this message in context: http://www.nabble.com/T5-tapestry5-acegi-salt-source-not-overridable-tp15004004p21709743.html
Sent from the Tapestry - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: T5 tapestry5-acegi salt source not overridable
Posted by Robin Helgelin <lo...@gmail.com>.
Hi,
On Jan 21, 2008 7:59 PM, Franz Amador <fg...@yahoo.com> wrote:
> It looks to me like the tapestry5-acegi module hard-codes the password salt source to be SystemWideSaltSource. I can change the system-wide salt via acegi.password.salt, but there is no corresponding acegi.salt.source property. Having a system-wide salt is better than having no salt, but it isn't as strong as having a different salt for each user. Is there a way I can put in a request for supporting a new acegi.salt.source config property? I didn't see a mailing list or issue tracker on the tapestry5-acegi site (http://www.localhost.nu/java/tapestry5-acegi/). Is here an okay place to discuss this?
Sorry, so far there haven't been a need for a mailing list of an issue
tracker. I'll see to your idea and make it configurable. I'm currently
lagging a few Tapestry versions due to vacation, but I'll have it
released soon.
--
regards,
Robin
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org