Re: [appfuse-user] Method-level web service security for Users

2007-10-23 Thread Matt Raible
You could try changing Acegi to read the URLs-to-roles definition from your database, making it more dynamic: http://jnassef.blogspot.com/2007/07/dynamic-roles-management-in-acegi.html Matt On 10/23/07, George.Francis <[EMAIL PROTECTED]> wrote: > > Aha, > Is there any way to reload the security.

Re: [appfuse-user] Method-level web service security for Users

2007-10-23 Thread George.Francis
Aha, Is there any way to reload the security.xml at runtime? The reason I ask is becase without that ability, if I went down the route of mapping ws-operations to Roles in security.xml it would be impossible to apply changes to this mapping without a restart of the web application? mraible wr

Re: [appfuse-user] Method-level web service security for Users

2007-10-22 Thread Matt Raible
You can enter them in sample-data.xml for testing and default-data.xml for production. After adding them to the database, you should be able to add them in security.xml. Matt On 10/22/07, George.Francis <[EMAIL PROTECTED]> wrote: > > That's good - can you give me a bit of direction on how to defi

Re: [appfuse-user] Method-level web service security for Users

2007-10-22 Thread George.Francis
That's good - can you give me a bit of direction on how to define new Roles? mraible wrote: > > The first option seems like the easiest solution to me. > > Matt > > On 10/22/07, George.Francis <[EMAIL PROTECTED]> wrote: >> >> I noticed that the methodSecurityInterceptor bean in security.xml h

Re: [appfuse-user] Method-level web service security for Users

2007-10-22 Thread Matt Raible
The first option seems like the easiest solution to me. Matt On 10/22/07, George.Francis <[EMAIL PROTECTED]> wrote: > > I noticed that the methodSecurityInterceptor bean in security.xml has : > > org.appfuse.service.UserManager.getUsers=ROLE_ADMIN >

[appfuse-user] Method-level web service security for Users

2007-10-22 Thread George.Francis
I noticed that the methodSecurityInterceptor bean in security.xml has : org.appfuse.service.UserManager.getUsers=ROLE_ADMIN org.appfuse.service.UserManager.removeUser=ROLE_ADMIN Which would seem to apply role-based security at the webse