RE: [Acegisecurity-developer] CVS changes + Preparing for 0.51

2004-05-23 Thread Ben Alex
is it possible to upload 0.51, once released, to ibiblio for maven builds. I looked at Maven integration a few months back, but put it off due to a lack of time. Is anyone out there willing to write a Maven build file for Acegi Security? Ben

RE: [Acegisecurity-developer] CVS changes + Preparing for 0.51

2004-05-23 Thread Ben Alex
Documentation generation is about the only thing I can think of. Just to put it up on iBiblio requires only the jar file produced by the ant build, you don't need Maven for that... OK, will we be uploading as per http://maven.apache.org/repository-upload.html? In that case, what do we put

RE: [Acegisecurity-developer] Standards-based Access Control (XACML, RBAC)

2004-05-26 Thread Ben Alex
have you considered providing XACML and RBAC support in Acegi? I did look at similar standards during the design phase of Acegi. Not all of them, but certainly quite a few. I ended up going with a solution that would fit our internal needs but be reasonably extensible/pluggable. I'd certainly

[Acegisecurity-developer] Acegi Security - new release 0.51

2004-06-06 Thread Ben Alex
Dear Spring Community I'm pleased to announce the Acegi Security System for Spring release 0.51 is now available from http://acegisecurity.sourceforge.net. The project provides comprehensive security services for The Spring Framework. FEATURES: * It is ready NOW * Easy to use and deploy

[Acegisecurity-developer] RE: Uploading acegisecurity to Maven repository

2004-06-07 Thread Ben Alex
Hi Carlos Hi Ben, I'd like to know if you agree with the uploading of acegisecurity jars to maven repository at ibiblio.org so they are available in maven automatic dependency management system. If you agree I'll make the upload request for you and you only need to check

RE: [Acegisecurity-developer] DaoAuthenticationProvider doesn't work with passwordEncoder in 0.51

2004-06-08 Thread Ben Alex
Thanks for the fast fix! Hmmm, I'm a bit disappointed, because I wanted to propose you the same fix. I have made it, rebuilded my acegi-security.jar, placed it into container, tried to run it and it doesn't help :(( I'm still a Java rookie. :-/ (just a note to our GUI thread: my GUI is

[Acegisecurity-developer] Maven Build in CVS

2004-06-08 Thread Ben Alex
Thanks to Carlos Sanchez for providing an initial Maven build file. I've just checked it into CVS along with some required changes to library names. Would others running from CVS please check if this works. As previously stated, I haven't used Maven before. It seems to build the main JAR

RE: [Acegisecurity-developer] URL redirection when session expires

2004-06-09 Thread Ben Alex
Hi Shishir I think ignoreRedirectUrl is good idea. Enhancing on that, would it make sense to have a property type attribute , which will have a key URL and the URL that needs to be redirected to. If the existing URL ends with any one of the above, then redirect to the valid url as

Re: [Acegisecurity-developer] User private members

2004-06-22 Thread Ben Alex
Randy Thornton wrote: I have provided my own AuthenticationDao implementation for my users and groups. I have my own user and group implementation that have data other than username, password, and capabilities. It would be nice if I could subclass off of User instead of having to create a new

Re: [Acegisecurity-developer] Re: User private members

2004-06-23 Thread Ben Alex
Randy Thornton wrote: I am using hibernate to save my user objects. It needs public getters and setters and also a default constructor. Obviously I have worked around all this, but it would be much nicer to subclass. Thanks Hi Ryan Ah, Hibernate. To date I've had classes relying on User

Re: [Acegisecurity-developer] javadocs online

2004-06-24 Thread Ben Alex
Scott Evans wrote: I wonder if you might consider putting the current release's javadocs up on the project's home page? I'd like to place a link directly to it in the javadocs for the application that I am using acegi in.

Re: [Acegisecurity-developer] How do I avoid the IE redirect warning dialog?

2004-06-25 Thread Ben Alex
Joseph Schmoley wrote: Ok Ben, I understand now. Except for one minor point... It's exactly the other way around from what you suggest. The problem isn't from HTTP to HTTPS, it's from HTTPS to HTTP. So I'd have to write a JavaScriptRetryWithHttpEntryPoint.java and wire it in. I'll go ahead

Re: [Acegisecurity-developer] Authentication callback?

2004-06-29 Thread Ben Alex
Joseph Schmoley wrote: Where in the Acegi framework can I plug in a piece of code to be called upon successful Authentication? I need a couple of things to be placed onto the session after a user has been successfully authenticated into our system. I took a look at

Re: [Acegisecurity-developer] CasAuthenticationProvider taking advantage of custom Authentication object?

2004-07-12 Thread Ben Alex
Mike Youngstrom wrote: Maybe I'm missing something but it appears that the only CAS and AuthenticationDao integration point is in the DaoCasAuthoritiesPopulator in getAuthorities method where it appears to only load the user in order to get the authorities(). Maybe I should ask my question this

[Acegisecurity-developer] Re: Acegi Security

2004-07-13 Thread Ben Alex
Hi Mark [EMAIL PROTECTED] wrote: Ben, I have been a Spring user for sometime now and am starting to investigate Acegi Security. I am having trouble replying to the developer-list subscription so I thought that I would email you directly if you do not mind this once. My reply to the subscription

Re: [Acegisecurity-developer] Is Authentication not really Serializable?

2004-07-13 Thread Ben Alex
Hi Shishir Shishir K. Singh wrote: Same goes for forcePrincipalAsString. There is already an isForcePrincipalAsString() method. -Original Message- From: Shishir K. Singh Sent: Tuesday, July 13, 2004 10:15 AM To: '[EMAIL PROTECTED]' Subject: RE: [Acegisecurity-developer] Is

Re: [Acegisecurity-developer] is there support for Hibernate?

2004-07-13 Thread Ben Alex
Indra Gunawan wrote: Hi all, I want to implement the security authentication using Hibernate? But seems that I can't find one class that support it should I extends from HibernateDaoSupport class of Spring framework and implements AuthenticationDao ? or do I miss the support class ? TIA Indra

Re: [Acegisecurity-developer] Followup: Why am I getting extra requests with Sitemesh?

2004-07-14 Thread Ben Alex
Patrick Burleson wrote: On Wed, 14 Jul 2004 08:24:25 +1000, Ben Alex [EMAIL PROTECTED] wrote: I'm just wondering why Acegi Security fails on the second pass. Your earlier email mentioned a null gets put into the SecureContext, but I'm not sure how or why you're seeing this. A debug-level log

Re: [Acegisecurity-developer] Followup: Why am I getting extra requests with Sitemesh?

2004-07-15 Thread Ben Alex
Travis wrote: Patrick and Ben, This patch fixed the BEA issues I had with my application as well as the sample contacts application. Thanks! Travis Travis, I'm pleased this fixed your problem. Patrick, thanks very much for your patch and help. I've applied it to CVS HEAD. Thanks again

Re: [Acegisecurity-developer] Newbie Questions...

2004-07-15 Thread Ben Alex
[EMAIL PROTECTED] wrote: Ben, I had to force Basic authentication by modifying the BasicProcessingFilter class so that the doFilter method sets the header field is set to Basic if header is null. I know this is ugly, but the SOAP client (Flash component) is not sending this value when the

Re: [Acegisecurity-developer] Newbie Questions...

2004-07-15 Thread Ben Alex
[EMAIL PROTECTED] wrote: Ben, You were right. It was a problem with my securityEnforcementFilter bean configuration. I see it now. Once I changed to the basicProcessingFilterEntryPoint bean reference it worked. I also needed your great explaination about SOAP authorization. I will be giving a

Re: [Acegisecurity-developer] Write a rule overriding a less specific one, allowing any user to call a specific url

2004-07-18 Thread Ben Alex
Carlos Sanchez wrote: Hi, My question is: can I write a rule in filter security interceptor so an URL doesn't need to have a role (needed to override a less specific one)? e.g. in the following bean I want that all *.do except populateDatabase.do need ROLE_USER. populateDatabase.do can be called

Re: [Acegisecurity-developer] Should spring-mock.jar be added to lib/ ?

2004-07-21 Thread Ben Alex
Francois Beausoleil wrote: Hello all, Ben, I'd like to add Spring's spring-mock.jar to lib/spring. I need MockPageContext for testing new code in AuthorizeTag. This would be a testing dependency only. Hi Francois Go for it. Best regards Ben

Re: [Acegisecurity-developer] Suggestions for changes to AbstractProcessingFilter

2004-07-21 Thread Ben Alex
Hi Wesley Thanks for the contribution. Wesley Hall wrote: Hi Ben, I have made some changes to the attached classes... AbstractProcessingFilter - authenticationServiceFailureUrl - AuthenticationServiceException authenticationCredentialCheckFailureUrl -

[Acegisecurity-developer] Instance based security

2004-07-22 Thread Ben Alex
Andy Depue wrote: Has any thought been given to adding instance based security support to Acegi? This seems to be a common requirement. There are so many ways of approaching instant-level security, as touched on by the other replies to this thread. The major issues are where to get the

Re: [Acegisecurity-developer] Correct understanding

2004-07-23 Thread Ben Alex
[EMAIL PROTECTED] wrote: I have a couple of fundamental questions. 1. it looks like the Adapter for the specific container e.g. net.sf.acegisecurity.adapters.catalina.CatalinaAcegiUserRealm will use whatever provider is setup in Acegi. And the main purpose of this is: that applications can

Re: [Acegisecurity-developer] JAAS integration

2004-07-25 Thread Ben Alex
[EMAIL PROTECTED] wrote: Hi, Ive been successfully using Acegi for a couple of months (web application), with a setup that includes the DaoAuthenticationProvider and my own user database. Congratulations to all members of the project for the simplicity of the solution. Now im facing a new

Re: [Acegisecurity-developer] Instance based security

2004-07-29 Thread Ben Alex
March, Andres wrote: I agree with your assessment Ben. Had many of those thoughts myself as I was pondering our situation. In the end we went with VOTERS DETECT OBJECT AS PARAMETER AND QUERY ACL OBJECT. Seems like the best choice for us since we only want to deny or allow access not mutate or

Re: [Acegisecurity-developer] help

2004-07-29 Thread Ben Alex
Sunil Arora wrote: My CAS server is on other system, where as the application which is using Acegi is on another system. After authenticating the user from CAS on another system Acegi is not validating the ticket issue by CAS server, If I share same certificate its giving the following error:

Re: [Acegisecurity-developer] Instance based security

2004-07-30 Thread Ben Alex
March, Andres wrote: I need to implement this anyway, so if you can wait I would be glad to help out. But I won't need to start this effort for awhile. It might be better for you do this until I get comfortable with the code. I am eager to contribute but I have non-instance based security to

Re: [Acegisecurity-developer] Instance based security

2004-07-31 Thread Ben Alex
March, Andres wrote: 3 more things: - I sync'd to cvs and don't see your changes. Got the JAAS ones though. Welcome to SourceForge. AFAIK they have a timed synchronisation from the developer CVS servers to the anonymous access ones. So give it a few hours (I received the commit messages to

Re: [Acegisecurity-developer] Instance based security

2004-07-31 Thread Ben Alex
March, Andres wrote: Ahh, I see now. This is like a permission type. I debated this idea here but could not find a use for it. I could not see how it would add info to what the permission meant. It seems that the recipient, accessed object, and mask conveyed everything I need to. I was

[Acegisecurity-developer] Petclinic RCP

2004-08-01 Thread Ben Alex
Hi everyone I've just checked in some improvements to Petclinic RCP, which I'd appreciate your feedback on. There are now two versions. PetclinicStandalone.java loads the embedded database edition. PetclinicClientServer.java uses remoting protocols to access

[Acegisecurity-developer] Re: AccessDeniedException

2004-08-02 Thread Ben Alex
[EMAIL PROTECTED] wrote: Ben, I am still having problems getting messages to the forum... Anyways, here is my latest issue if you could please put it into the forum ,and maybe give advise ;). --- I am having a problem when using basic authentication and my own

[Acegisecurity-developer] Preparing for 0.6 release

2004-08-04 Thread Ben Alex
Hi everyone Today I upgraded Acegi Security CVS to Spring 1.1 RC 1 JARs and the integration tests system has shown no incompatibilities. It's almost time to release version 0.6: - Unit tests and container integration tests pass - The upgrade-05-06.txt file is complete - Unit test coverage is

Re: [Acegisecurity-developer] Re: AccessDeniedException

2004-08-04 Thread Ben Alex
[EMAIL PROTECTED] wrote: Ben, *Still having trouble submitting to the forum / keeps bouncing back...* Thanks for your reply. First, you were right about my HibernateDAO. It was not using the same credentials as the in-memory representation. In fact the user that I was pulling back did not have

Re: [Acegisecurity-developer] Best place to enforce password policies?

2004-08-04 Thread Ben Alex
Andy Depue wrote: I've implemented security in my web application using Acegi security. I'm in the process now of implementing a very simple password policy (basically, the administrator has the ability to set a flag on the user to force them to change their password the next time they log

Re: [Acegisecurity-developer] Preparing for 0.6 release

2004-08-04 Thread Ben Alex
March, Andres wrote: I am still wondering about the usage of the acl stuff. I see in your test how the GrantedAuthorityEffectiveAclsResolver can be used directly but would it be worthwhile to provide a voter that can perform acl authorization? I will be writing one in about 3 weeks but I am sure

Re: [Acegisecurity-developer] Change authentication details / password

2004-08-05 Thread Ben Alex
Peter Leschev wrote: I'm looking at using acegi with Tapestry for a web application that I'm working on - From initial evaluation, Acegi looks very impressive. I understand that AuthenticationProcessingFilter can be used to integrate with an HTML form for user login, which is easy, but how

[Acegisecurity-developer] Acegi Security - new release 0.6

2004-08-08 Thread Ben Alex
Dear Spring Community I'm pleased to announce the Acegi Security System for Spring release 0.6 is now available from http://acegisecurity.sourceforge.net. The project provides comprehensive security services for The Spring Framework. FEATURES: * It is ready NOW * Easy to use and deploy (includes a

Re: [Acegisecurity-developer] Bug in net.sf.acegisecurity.providers.dao.cache.EhCacheBasedUserCache

2004-08-09 Thread Ben Alex
Karel Miarka wrote: Hi Ben, with the new release some of my integration test stopped to work with NullPointerException in EhCacheBasedUserCache - the cache variable was null. (Suprisingly it was working when deployed under Tomcat.) I have studied the code and than tried to add this line into

[Acegisecurity-developer] Stand up and be counted

2004-08-11 Thread Ben Alex
Dear Acegi Security users If you're using CAS, you might like to assist Andrew Petro (who maintains CAS itself) with the following. If you do reply to Andrew, I'd appreciate it if you'd cc: me so I too can see where CAS is being used along with Acegi Security. We should think about doing

Re: [Acegisecurity-developer] hibernate compatability ( blah blah blah )

2004-08-11 Thread Ben Alex
bryan wrote: Then my methods that are in the orderService class can call systemUserHolder.getSystemUser.getId() and do searches for example where the user is only allowed to see financial data for a certain region. I am very much new to Spring so if I'm completely off the mark here feel free

Re: [Acegisecurity-developer] AuthByAdaptors and SecurityContext

2004-08-11 Thread Ben Alex
Sean Radford wrote: Hi, If one is authenticating using JAAS to create an AuthByAdaptor Authentication object (e.g. using JBossAcegiLoginModule), how do you then get the SecureContext populated when not using a web-layer - and thus not able to use an IntegrationFilter such as the

[Acegisecurity-developer] Acegi Security - support forum

2004-08-12 Thread Ben Alex
Hi everyone Colin has kindly setup a forum for Acegi Security support at http://forum.springframework.org. Would end users please use this channel for future support. Best regards Ben --- SF.Net email is sponsored by Shop4tech.com-Lowest

Re: [Acegisecurity-developer] missing BadCredentials AuthenticationEvents

2004-08-12 Thread Ben Alex
Karel Miarka wrote: Ben, Another issue connected to logging. In my log file reappears Authentication success record with details: null. I think that for the first time a user logs in the details are filled by IP, but later on when the user expires from user cache and is obtained again from DAO

Re: [Acegisecurity-developer] BasicAclProvider

2004-08-15 Thread Ben Alex
March, Andres wrote: I was trying to set the defaultAclObjectIdentityClass in the application context but am having trouble. Maybe this is because the property is a class. Not sure how to define that bean property in the xml. Is there some other way you recommend setting the

Re: [Acegisecurity-developer] hibernate compatability ( blah blah blah )

2004-08-16 Thread Ben Alex
administrator wrote: Thanks Ben, What I'm trying to do on a functional level is quite straightforward. The application that I am writing is intended for the real estate business. In this business a sales agent will only be able to view/edit properties that he/she has been assigned/brought into

Re: [Acegisecurity-developer] hibernate compatability ( blah blah blah )

2004-08-17 Thread Ben Alex
Oliver Hutchison wrote: Using hibernate it is possible to do the following ( pseudo code ) SalesPerson salesPerson = hibernate.find( SalesPerson as salesperson where salesperson.id = 1); Why not just use the username (which should be unique) to lookup the SalesPerson? SalesPerson

Re: [Acegisecurity-developer] (no subject)

2004-08-17 Thread Ben Alex
[EMAIL PROTECTED] wrote: Hello ! I am new to this framework, I have changed the default queries in net.sf.acegisecurity.providers.dao.jdbc.jdbcDaoImpl, and now I want to compile the project again. I guess it should be a simple task to use ant build but It seems that with the distribution file

Re: [Acegisecurity-developer] sample.contact Application Authorization question??

2004-08-19 Thread Ben Alex
[EMAIL PROTECTED] wrote: Hello All ! I am trying to use my Database with Sample contact application. I have added few roles and users in my database and also have subclasses JdbcDaoImpl to authenticate from database. I have added a user with ROLE_SUPERVISOR and a ROLE_ABC. i have also changed my

Re: [Acegisecurity-developer] removeCache in UserDetails

2004-08-19 Thread Ben Alex
Shishir K. Singh wrote: I was wondering if the method public void removeUserFromCache(String username) { cache.remove(username); } In EhCacheBasedUserCache can be made implement able i.e moved to UserCache interface. Hi Shishir Done. Now in CVS HEAD. Ben

Re: [Acegisecurity-developer] Re: Remember me functionality via cookie

2004-08-25 Thread Ben Alex
Piotr Maj wrote: Could you give me more precise date of this discuss or direct link to it? Mailman at sourceforge is not for human beings ;-) The new JDBC DAO implementation will ideally support password changing, remember me functionality, lost password support, account lockout (via a listener)

Re: [Acegisecurity-developer] Problems when trying to deploy contacts.war on JRun

2004-08-31 Thread Ben Alex
Shishir K. Singh wrote: Ben, Even if I use ContextLoaderServlet, won't the filters get created before ContextLoaderListener. In that case, the init of the filters will be called even before the Spring context is available and thus, the WebApplicationContextUtils.getRequiredWebApplicationContext

Re: [Acegisecurity-developer] Sample.contact Context null problem

2004-08-31 Thread Ben Alex
[EMAIL PROTECTED] wrote: If you have \A/secure/.*\Z=ROLE_SUPERVISOR,ROLE_TELLER in I want to get rid of this line in filterInvocationInterceptor. If ROLE_ABC is included in this line, then things work out smoothly, but then it means that in future If I will be adding a new role in descriptor I

Re: [Acegisecurity-developer] Authz taglibs for freemarker

2004-09-02 Thread Ben Alex
Shishir K. Singh wrote: Ben, Is there any work going on to port the authorization taglibs to freemarker tags ? Thanks Shishir Not as far as I know. Besides, doesn't everyone use Velocity these days? ;-) Ben --- This SF.Net email is sponsored

[Acegisecurity-developer] SecurityEnforcementFilter always executing, even if for login page

2004-09-02 Thread Ben Alex
Karel Miarka wrote: Ben, You are completely right, but my filter solves one important problem regarding Tapestry: The current SecurityEnforcementFilter doens't allow the login page to be at the same place as the protected pages and because in Tapestry all the pages are accessed using

[Acegisecurity-developer] Sandbox LDAP

2004-09-10 Thread Ben Alex
Hi everyone I've just added a sandbox directory for unsupported and in-development code as per other Spring projects. Currently it contains an LDAP authentication DAO, thanks to Karel Miarka and Daniel Miller. Please feel free to use the sandbox if you want to try things out. Of course,

Re: [Acegisecurity-developer] Custom login form

2004-09-16 Thread Ben Alex
Andy Depue wrote: I'm looking at the spring rich client security package (org.springframework.richclient.security). I would like to customize the login form to include an additional field, but it looks the form fields are hardcoded. I guess at the moment I have to create my own LoginForm and

Re: [Acegisecurity-developer] Release 0.61

2004-09-23 Thread Ben Alex
Scott McCrory wrote: No objections - release early and release often... But are you sure it's just a 0.61 release? I'd recommend 0.7, as most non-programmers (and some bit twiddlers too) consider anything prior to 1.0 not mature enough for production, and I think Acegi is a lot further along

Re: [Acegisecurity-developer] ACEGI and Spring Application Context

2004-09-29 Thread Ben Alex
Guy Tuberson wrote: Hi, Please bare with me I'm new to Hibernate, Spring and Acegi. I'm using ACEGI to provide the Security framework for my Web Application and I'm having some issues with my Junit tests. I'm trying to load the Spring Application Context in a JUnit test and I'm getting the

[Acegisecurity-developer] AspectJ support now in CVS

2004-10-18 Thread Ben Alex
Hi everyone I've just committed experimental AspectJ support to CVS HEAD, which is documented in the reference guide. The key benefit is domain object instances can be created outside the bean container and still receive full security interception. Refactoring of the AOP Alliance

Re: [Acegisecurity-developer] Acegi + SSO + custom GrantedAuthority

2004-11-04 Thread Ben Alex
Amad Fida wrote: Thanks Ben, so would suggest rich client security packakge as starting point? Amad I tend to approach things based on the most risky part of the project first. That way you discover the constraints it will impose on the easier parts of the project, and can have more

Re: [Acegisecurity-developer] The Maven Shuffle

2004-11-10 Thread Ben Alex
Ray Krueger wrote: Are we done moving all the files around? Is it safe to commit? Hi Ray Yes, go for it. For the record (we'll put this in a readme when the Maven changes are absolutely finalised): *** CONFIGURATION *** - From the project root directory use maven multiproject:artifact to

[Acegisecurity-developer] New features now in CVS

2004-11-14 Thread Ben Alex
Hi everyone I've just committed a (potentially very useful) new feature to Acegi Security. After secure object invocation allows you to throw an AccessDeniedException or modify the Object returned from your secure object invocation. There's a new package, net.sf.acegisecurity.afterinvocation,

Re: [Acegisecurity-developer] New features now in CVS

2004-11-15 Thread Ben Alex
Tim Kettering wrote: Like say, if I made a method call to return all items in the database between dates A and B. I would need to run the security check on the collection after the data load to ensure that only the allowed objects are loaded. It sure can. The filtering takes place when a

[Acegisecurity-developer] Re: AbstractProcessingFilter

2004-11-16 Thread Ben Alex
Shishir K. Singh wrote: Hi Ben, Tried posting this on [EMAIL PROTECTED] but for some reason it's bouncing back. Therefore sending directly to you. I have not tested it out, but my understanding after going through the contacts sample for cas authorization is that when the authentication fails

Re: [Acegisecurity-developer] how to build with maven

2004-11-17 Thread Ben Alex
Patrick Burleson wrote: Peng, What sort of error did you receive? Can you send it along? Also, what version of Maven to do you have installed? Hi Peng This will probably work for you: cd $ACEGISECURITY_ROOT (wherever that is on your system) maven multiproject:install (this will put the JARs

Re: [Acegisecurity-developer] The Maven Shuffle

2004-11-17 Thread Ben Alex
Ray Krueger wrote: Ok was just working on getting my stuff commited. I see the .java file in the old location src/net and in core/src/main... What do I do? heh Hi Ray I think you might need to do a CVS update again, as the old /src directory is completely gone these days. From

Re: [Acegisecurity-developer] approaches in security checking for fetching collections

2004-11-29 Thread Ben Alex
Tim Kettering wrote: Hi all, I've been working on incorporating acegi with our project, and with the useful addition of the after invocation stuff that ben added recently, this will help with methods that need to return a collection of objects, each of which need to be inspected for security

Re: [Acegisecurity-developer] Work to Propogate Security Context across Remote Hessian calls?

2004-12-20 Thread Ben Alex
Seth Ladd wrote: Hello, Has anyone done any work to propogate the security context across remote hessian calls? It seems very straight forward, and wanted to see if previous work had been done. Thanks very much, Seth Hi Seth No, it's not yet done. I was hoping we could automate it so that at

Re: [Acegisecurity-developer] ACL Assistance and Questions

2004-12-23 Thread Ben Alex
Matthew E.Porter wrote: Greetings. I am looking for some guidance on the ACL system and how to integrate it into our application. Furthermore, I plan to get the second article out for Javalobby within the next week or two. Any help is appreciated. In our application, we define domains (i.e.

[Acegisecurity-developer] Preparing for 0.7.0

2004-12-23 Thread Ben Alex
Hi everyone I am happy to report that Ant has now been officially removed from CVS (along with /lib/*.jar). The Maven build is now performing well, and the web site at http://acegisecurity.sourceforge.net has been expanded to include Maven-specific instructions. The only outstanding issue is

Re: [Acegisecurity-developer] Preparing for 0.7.0

2004-12-25 Thread Ben Alex
Please checkout again from CVS. The reported problem has been fixed. Ray, you were right: it was related to Maven group names. acegisecurity is the correct group name for all artifacts. Best regards Ben --- SF email is sponsored by - The IT

Re: [Acegisecurity-developer] Preparing for 0.7.0

2004-12-29 Thread Ben Alex
Aaron Tang wrote: Figure 4: After Invocation Implementation in section 1.8.1 should be Figure 5 and others in turn :) Thanks Aaron, I've fixed this and made other documentation updates. Ben --- The SF.Net email is sponsored by: Beat the

Re: [Acegisecurity-developer] MSc Thesis on middle tier security

2004-12-30 Thread Ben Alex
Vladimir Horev wrote: Hello list! I'm planning to write a MSc thesis on the subject of business tier security. My idea was to take part of some open source project (acegi) and develop some component that I could use in my thesis. Could you recommend me something on that? regards, Vladimir Hi

Re: [Acegisecurity-developer] Roadmap towards Aceg Security official 1.0.0 release

2004-12-30 Thread Ben Alex
Sergio Berna wrote: I have added ExpirationDetails as a separate interface to keep backwards compatibility with existing code that implementes UserDetails. Hi Sergio Good to see backward compatibility is a priority, particular in such a sensitive (ie commonly-deployed and extended) area as

Re: [Acegisecurity-developer] MSc Thesis on middle tier security

2004-12-31 Thread Ben Alex
Sergio Berna wrote: Andy, I agree that filtering the method response is a fascinating area. The only problem I have always found on filtering a method response is that it doesn't scale properly when performance is an issue. I'm particularly thinking on Collections here, where the full collection

Re: [Acegisecurity-developer] Re: [Springframework-developer] Roadmap towards Aceg Security official 1.0.0 release

2004-12-31 Thread Ben Alex
Matt Raible wrote: Using container-managed authentication usually only requires a handful of lines in web.xml and a few more in a server-specific deployment descriptor. This makes me wonder if there's a simpler way to configure Acegi (consolidating filters?). Or maybe defaults can be set in

Re: [Acegisecurity-developer] Roadmap towards Aceg Security official 1.0.0 release

2005-01-02 Thread Ben Alex
Ben Alex wrote: For the small minority of people who have chosen NOT to extend User (which goes against our recommendations, but there are legitimate scenarios such as having a domain object that already represents the user), I don't think adding two methods to their implementation is going

Re: [Acegisecurity-developer] Re: [Springframework-user] Acegi Security - new release 0.7.0

2005-01-21 Thread Ben Alex
Ricardo Marin Matinata wrote: Hi, I (think) you are right about the use of AutoIntegrationFilter. Oops, sorry for the oversight. I've just updated CVS, which Monkey Machine uses for an automatic daily build and publish to SF. Best regards Ben

Re: [Acegisecurity-developer] Reducing the number of filters needed in web.xml

2005-01-23 Thread Ben Alex
bryan ( [EMAIL PROTECTED]) wrote: bean id=filterChain class=net.sf.acegisecurity.FilterChain property name=filters value channelProcessingFilter=/* authenticationProcessingFilter=/* basicProcessingFilter=/* sessionIntegrationFilter=/*

Re: [Acegisecurity-developer] Acegi jars at ibiblio

2005-01-23 Thread Ben Alex
Carlos Sanchez wrote: Hi, I've uploaded all acegi artifacts at http://acegisecurity.sourceforge.net/maven/acegisecurity/ (jars, poms and licenses) to ibiblio. Now they're available http://www.ibiblio.org/maven/acegisecurity Carlos, just re the licenses, I'm not sure of what's normal but I

Re: [Acegisecurity-developer] Reducing the number of filters needed in web.xml

2005-01-24 Thread Ben Alex
Ray Krueger wrote: I like the idea as well, my only question is (and I've been wondering this for a while), why do we target the class and not the bean name? init-param param-nametargetClass/param-name param-valuenet.sf.acegisecurity.FilterChain/param-value /init-param Instead of... init-param

Re: [Acegisecurity-developer] Reducing the number of filters needed in web.xml

2005-01-26 Thread Ben Alex
Carlos Sanchez wrote: About the syntax, I looked at map, that would suit here, but Spring application context don't allow beans as keys, maybe a lack of functionality? Just use a custom PropertyEditor that works at a String level. The PropertyEditor would identify name/value pairs, and create

Re: [Acegisecurity-developer] method invocation not guarded when SecurityConfiguration forgotten

2005-01-27 Thread Ben Alex
Joost de Vries wrote: Hi, I'm using acegi to guard the security of our service layer pretty much exactly like the BankManager sample. The annotations declare the authorisations. /** * @@SecurityConfig(ROLE_SUPERVISOR) * @@SecurityConfig(RUN_AS_SERVER) */ public void

Re: [Acegisecurity-developer] Proposed change to JaasAuthenticationCallbackHandler

2005-01-30 Thread Ben Alex
Ray Krueger wrote: This is a concurrency issue. The quick fix is to wrap those two calls in a synchronized block. The real fix is to drop the setAuthentication method and modify the handle method to be handle(Callback, Authentication). As it is a contract change I wanted to check with the team

Re: [Acegisecurity-developer] Where to find retroweaver-1.0fcs.jar?

2005-02-04 Thread Ben Alex
Seth Ladd wrote: Hello, I'm trying to build acegi with maven, and now it's time to find and download retroweaver-1.0fcs.jar. Unfortunately, ibiblio doesn't have it, and only version 1.1 is available from sourceforge (or so it seems). Google also doesn't know about it. Does anyone have a tip

Re: [Acegisecurity-developer] Adding getUserPrincipal to ContextHolderAwareRequestWrapper

2005-02-04 Thread Ben Alex
Seth Ladd wrote: Seth Ladd wrote: Hello, I'd like to propose we add getUserPrincipal to ContextHolderAwareRequestWrapper. We can return the Authentication, which itself is a Principal. I just checked in something similar to CVS, with consistent handling of nulls and a unit test. Best regards

Re: [Acegisecurity-developer] ACL and BeforeInvocationProvider ?

2005-02-05 Thread Ben Alex
jw wrote: wouldn't it be nice to have a BeforeInvocation - security mechanism, for example to set some User-specific filter properties in a hibernate Query object, so only a specific set of domainobjects is fetched by the database AfterInvocation can only filter-out objects after all are

[Acegisecurity-developer] Re: acegi filters and RequestDispatcher include

2005-02-10 Thread Ben Alex
Hi Sanjiv We don't use OncePerRequestFilter as it subclasses GenericFilterBean, which unfortunately is designed for Filters that are wired by web.xml. The property setting this class performs I suspect would conflict with Acegi Security Filters, which are wired directly in the IoC container

Re: [Acegisecurity-developer] Informative servlet responses and the AuthenticationEntryPoint

2005-02-12 Thread Ben Alex
Ray Krueger wrote: I spoke with Ben off-list on IM. We'd like some more input on this before I commit all the changes... These are the two overall changes, copy and paste from my notes. Added AuthenticationException to the commence method signature of the AutenticationEntryPoint. The best example

Re: [Acegisecurity-developer] Bug in Contacts Sample App

2005-02-15 Thread Ben Alex
Matt Raible wrote: I couldn't seem to find a issue tracker for Acegi Security - I'd be happy to enter this there. acegi-security-sample-contacts-filter.war on OS X (10.3.8) with Tomcat 5.5.7 and Acegi Security 0.7: Adding log4j-1.2.8.jar to WEB-INF/lib fixes the problem. Hi Matt Thanks for

Re: [Acegisecurity-developer] LDAP DAO and Samba+LDAP

2005-02-17 Thread Ben Alex
Robert r. Sanders wrote: I have a basic OpenLDAP server setup which Samba 2 is authenticating against. My understanding is that Samba 2 is fairly picky about the LDAP scheme it uses, so I don't want to mess with this. The current LdapPasswordAuthenticationDao assumes that the user will be

Re: [Acegisecurity-developer] Reducing the number of filters needed in web.xml

2005-02-20 Thread Ben Alex
Robert r. Sanders wrote: While I don't have a huge amount of spare time, I would be glad to look over any list of tasks you have and see if I could fit any of them in. I tried to look on the sourceforge site and see if there were any bug/feature lists but couldn't find any. Hi Robert Given

Re: [Acegisecurity-developer] Reducing the number of filters needed in web.xml

2005-02-20 Thread Ben Alex
Dmitriy Kopylenko wrote: Ben, how about start using JIRA for Acegi release/issue management? I could create a project for JIRA in Spring JIRA installation. Would it be appropriate, taking into consideration that Acegi is not the official Spring subproject? Dmitriy. Thanks for the offer, but

Re: [Acegisecurity-developer] LDAP PasswordDao

2005-02-21 Thread Ben Alex
Scott Battaglia wrote: Robert, There's an official JIRA issue in Spring for the LDAP support. Not sure what's going to happen with it though. I'd like to see it in Spring though ;-) We have a duplicate of them in the CAS CVS tree only because they aren't in the Spring CVS tree anywhere and we

Re: [Acegisecurity-developer] ws-security filter

2005-02-21 Thread Ben Alex
Mason, Ross wrote: Has anyone written a ws-security filter for acegi? Not that I'm aware of. Ben --- SF email is sponsored by - The IT Product Guide Read honest candid reviews on hundreds of IT Products from real users. Discover which

[Acegisecurity-developer] Digest Authentication (more secure than Basic Auth) is now in CVS

2005-02-21 Thread Ben Alex
I think the subject line says it all. :-) Best regards Ben --- SF email is sponsored by - The IT Product Guide Read honest candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start

Re: [Acegisecurity-developer] Digest Authentication (more secure than Basic Auth) is now in CVS

2005-02-21 Thread Ben Alex
Ray Krueger wrote: Hey! Where's the HttpInvokerRequestExecutor for it! :P I'm making jokes (and no, I'm not gonna write it ha!) Although I may write the Basic Auth CommonsHttpInvokerRequestExecutor Unfortunately I just ran out of time - the unit tests took as long to write as the actual

  1   2   3   4   >