Have looked at the various suggested first stops. Haven't seen this issue discussed though.
I understand why authentication is re-required when the session is invalidated and that session invalidation wipes out the security credential for that user. Makes perfect sense and is probably the desired behavior for many web-apps. I have a need to have authentication credentials persist (ie. to not make users re-login) after a session is invalidated. I have implemented this in a home-grown login module using a cookie, whose expiry date I can (obviously) set. It is currently set to 12 hours which is what our users have requested (its an internal IT app). The result is basically that most users will just need to login in the morning when they get to work, then close and re-open the browser throughout the day without having to deal with the annoyance of logging in every time they open a new browser session. I am porting that app to use jboss security via the DatabaseServerLoginModule and it all works great, except for the part where I am kicking users off when the session closes. I would think that the need for security credentials to live beyond the session is a sort of common use case. Is there support for doing something like this out of the box in jboss, or is there a generally accepted approach to doing this? I was thinking if I had to do it myself I would continue to drop my cookie upon successful access to the app, then on every request, read what the system says the Principal is, and if its null (due to session having been closed) I'd re-set the credentials someway from info in the cookie. I was thinking of using ClientLoginModule for this. Before I start down that road I wanted to check if there was a better or more commonly used/supported approach. I'm using form-based, jboss 4.0.1-sp1 Thanks! View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3905336#3905336 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3905336 ------------------------------------------------------- SF.Net email is sponsored by: Tame your development challenges with Apache's Geronimo App Server. Download it for free - -and be entered to win a 42" plasma tv or your very own Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php _______________________________________________ JBoss-user mailing list JBoss-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/jboss-user
