Scott McCrory wrote:
Ben,Version 0.7.0 introduces the final features that I believe are necessary for a broadly useful enterprise application security framework. I believe most of the code could now be considered mature, except for the newer domain object instance security capabilities. Whilst these new capabilities have only existed for between two and four months, they're potentially HIGHLY useful, well-documented, fully unit tested, and demonstrated in the Contacts sample application. I also know of several real applications where they're being used, so I expect the API to remain fairly stable.
Just curious - what's your approach towards an eventual 1.0 release? I ask because technical managers, architecture review boards, etc. can misinterpret sub-1.0 versions as unstable, whereas even Acegi 0.6 most certainly is not!
Thanks in advance,
Scott
By releasing Version 0.7.0 I hope to see the domain object instance security achieve more widespread use, so there can be appropriate confidence in a 1.0.0 release. To a lesser extent it is also intended to test the various new "minor" features added to CVS over the past few months, along with the Mavenised build system.
I do not intend to add any new major features prior to a 1.0.0 release. There are several potentially useful areas, but none are critical for most applications and the architecture enables them to be added very easily and safely:
* Remember-me functionality. There has been some design ideas put forward, but just not implemented.
* Anonymous user functionality. This should be similar to any remember-me approach. People have already implemented solutions to this requirement (see forums).
* Maintained and unit tested LDAP provider. There is something in the sandbox and contributions on the forums, but we need tests to add any to core.
* Wider support for remoting protocol automatic security propagation. We already offer RMI and HttpInvoker, which covers most Spring Rich users.
* Database-sourced ObjectDefinitionSources. Spring itself will be offering database-driven configuration (see sandbox).
* Java 5 annotation support. I am waiting to see what happens with Spring core's attributes abstraction, and then use whatever approach follows.
* AspectWerks support for domain object instance security. It's easy to do this, but I'd like a similar model to AspectJ where Spring DIs the advice.
One issue I'd appreciate some comments on is container adapter deprecation. I know some people use the JBoss container adapter (as they need to use EJB security as well), but I've not heard of any usage of the Resin, Tomcat or Jetty adapters. It seems unwise to maintain a suboptimal (non-portable) approach, especially as pre-1.0.0 we can deprecate them.
Finally, the status of the project is up for discussion. I met Rod a few days back and we briefly discussed making Acegi Security a formal Spring subproject. This, coupled with a 1.0.0+ version number, would make some people and organisations more comfortable using it. What does the community think of this idea?
Best regards Ben
------------------------------------------------------- The SF.Net email is sponsored by: Beat the post-holiday blues Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek. It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt _______________________________________________ Home: http://acegisecurity.sourceforge.net Acegisecurity-developer mailing list Acegisecurity-developer@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/acegisecurity-developer
