You just set up your security context as usual with spring. Define the beans you need for userDetailsService (or other authenticationProvider), saltSource, encoder, rememberMe etc. and fire up the spring security namespace config. This is described in great detail in the Spring security docs as well as database table setup.
A simple example with hierarchical roles in one hierarchy and remember me services might look like this: <?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans"; xmlns:s="http://www.springframework.org/schema/security"; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; xmlns:context="http://www.springframework.org/schema/context"; xmlns:util="http://www.springframework.org/schema/util"; xmlns:tx="http://www.springframework.org/schema/tx"; xsi:schemaLocation="http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-2.5.xsd http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-2.5.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-2.5.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd";> <!-- Security Helper --> <bean id="userDetailsService" class="org.foo.dao.impl.SecurityDaoImpl"/> <bean id="passwordEncoder" class="org.springframework.security.providers.encoding.ShaPasswordEncoder"> <property name="encodeHashAsBase64" value="true"/> </bean> <bean id="saltSource" class="org.springframework.security.providers.dao.salt.SystemWideSaltSource"> <property name="systemWideSalt" value="${system.salt}"/> </bean> <bean id="rememberMeProcessingFilter" class="org.springframework.security.ui.rememberme.RememberMeProcessingFilter"> <property name="rememberMeServices" ref="rememberMeServices"/> <property name="authenticationManager" ref="authenticationManager"/> </bean> <bean id="rememberMeServices" class="org.springframework.security.ui.rememberme.TokenBasedRememberMeServices"> <property name="userDetailsService" ref="userDetailsService"/> <property name="key" value="foo.org"/> </bean> <bean id="rememberMeAuthenticationProvider" class="org.springframework.security.providers.rememberme.RememberMeAuthenticationProvider"> <property name="key" value="foo.org"/> </bean> <s:http access-decision-manager-ref="accessDecisionManager"> <s:intercept-url pattern="/login*" filters="none"/> <s:intercept-url pattern="/**" access="ROLE_USER"/> <s:form-login login-page="/login" default-target-url="/index"/> <s:anonymous username="Anonymous" granted-authority="ROLE_ANONYMOUS"/> <s:http-basic/> <s:logout invalidate-session="true" logout-success-url="/index"/> <s:concurrent-session-control max-sessions="1"/> </s:http> <!-- Role hierarchy --> <bean id="roleHierarchy" class="org.springframework.security.userdetails.hierarchicalroles.RoleHierarchyImpl"> <property name="hierarchy"> <value> ROLE_ADMIN > ROLE_MANAGER ROLE_MANAGER > ROLE_EDITOR ROLE_EDITOR > ROLE_AUTHOR ROLE_AUTHOR > ROLE_USER ROLE_USER > ROLE_ANONYMOUS </value> </property> </bean> <bean id="roleHierarchyVoter" class="org.springframework.security.vote.RoleHierarchyVoter"> <constructor-arg ref="roleHierarchy"/> </bean> <bean id="accessDecisionManager" class="org.springframework.security.vote.UnanimousBased"> <property name="decisionVoters"> <list> <ref local="roleHierarchyVoter"/> </list> </property> </bean> <s:authentication-provider user-service-ref="userDetailsService"> <s:password-encoder ref="passwordEncoder"> <s:salt-source system-wide="${system.salt}"/> </s:password-encoder> </s:authentication-provider> <s:authentication-manager alias="authenticationManager"/> </beans> You need the passwordEncoder and saltSource beans mainly for encoding the clear text passwords entered on registering a new user or when setting new passwords. Now you only have to use the Tapestry-Spring integration and it works. The only minor problem - depending on your app - is the login and logout handling. You can make a form around the cookie cutter Spring security hooks or dice your own. You can find examples here on the mailinglist. 2009/4/22 Borut Bolčina <borut.bolc...@gmail.com> > Can you give an example? > > -Borut >
