Yeah. There are just multiple problems with URL based authorization. It works fine for document-oriented sites, but how long ago was it when we were building those :)
Take for example the use case that you want to hide a panel - but show the rest of the page - when a user is not authorized for that panel. This is very easy to do with Wicket, either by building it in in the component, or by using an authorization strategy. An URL based approach doesn't help you here. And URL approach basically forces you to bring everything back to the URL level, including your refactoring options etc. But... like said before, it can be done if you really want it, by using page mounting or even a custom IRequestCodingStrategy and some smart thinking. Just don't expect it to be pretty :) Eelco On 11/10/06, Rik van der Kleij <[EMAIL PROTECTED]> wrote: > Hi, > > That is also the reason why Acegi and Wicket don't integrate well. > Till now I have not found a good way to secure Wicket components by > Acegi. Acegi is based on URL requests, method intercepting and > securing domain objects by ACL's. According to me you want to set > authorization on component level. Annotations is a way but I prefer > security by configuration. Maybe the only good solution is to build a > Wicket specific solution. > > Regards, > Rik > > > On 9-nov-2006, at 18:53, Eelco Hillenius wrote: > > > And if you use 2.0, you can set > > getSecuritySettings().setEnforceMounts(true), so that these mounted > > pages are only reachable using these paths. > > > > But as you got from the answers on this thread, URL based > > authorization schemes in not something we recommend for Wicket. It'll > > basically bring you back to page-level development again, whereas the > > whole point of Wicket is to provide a component based paradigm. > > > > Eelco > > > > > > On 11/9/06, Igor Vaynberg <[EMAIL PROTECTED]> wrote: > >> you can use package mounting to mount all pages in your admin > >> package to a > >> path, depends on how your classes are stored > >> > >> -igor > >> > >> > >> > >> On 11/9/06, Dmitry Kandalov <[EMAIL PROTECTED]> wrote: > >>> > >>> > >>> Erik van Oosten wrote: > >>>> > >>>> Wicket supports per component authorisation. You could take a > >>>> look at > >>>> wicket-auth-roles-example (a small project available through svn). > >>>> In this project some components (pages) are marked. The mark > >>>> indicates > >>>> which roles are required for the component. As long as the user > >>>> does not > >>>> hit those components the application runs fine. As soon as the > >>>> user does > >>>> hit such a component, the sign-in page is displayed. > >>>> > >>>> Erik. > >>>> > >>> > >>> Thanks for advice, example is good. But I have to use tomcat > >> authentication > >>> (not authorization). To make it work I have to declare > >>> <security-constraint>. > >>> -- > >>> View this message in context: > >> http://www.nabble.com/Authentication-Tomcat-%3C-%3E-Wicket- > >> tf2588672.html#a7254648 > >>> Sent from the Wicket - User mailing list archive at Nabble.com. > >>> > >>> > >>> > >> --------------------------------------------------------------------- > >> ---- > >>> Using Tomcat but need to do more? Need to support web services, > >>> security? > >>> Get stuff done quickly with pre-integrated technology to make > >>> your job > >> easier > >>> Download IBM WebSphere Application Server v.1.0.1 based on Apache > >>> Geronimo > >>> > >> http://sel.as-us.falkag.net/sel? > >> cmd=lnk&kid=120709&bid=263057&dat=121642 > >>> _______________________________________________ > >>> Wicket-user mailing list > >>> Wicket-user@lists.sourceforge.net > >>> https://lists.sourceforge.net/lists/listinfo/wicket-user > >>> > >> > >> > >> --------------------------------------------------------------------- > >> ---- > >> Using Tomcat but need to do more? Need to support web services, > >> security? > >> Get stuff done quickly with pre-integrated technology to make your > >> job > >> easier > >> Download IBM WebSphere Application Server v.1.0.1 based on Apache > >> Geronimo > >> http://sel.as-us.falkag.net/sel? > >> cmd=lnk&kid=120709&bid=263057&dat=121642 > >> > >> _______________________________________________ > >> Wicket-user mailing list > >> Wicket-user@lists.sourceforge.net > >> https://lists.sourceforge.net/lists/listinfo/wicket-user > >> > >> > >> > > > > ---------------------------------------------------------------------- > > --- > > Using Tomcat but need to do more? Need to support web services, > > security? > > Get stuff done quickly with pre-integrated technology to make your > > job easier > > Download IBM WebSphere Application Server v.1.0.1 based on Apache > > Geronimo > > http://sel.as-us.falkag.net/sel? > > cmd=lnk&kid=120709&bid=263057&dat=121642 > > _______________________________________________ > > Wicket-user mailing list > > Wicket-user@lists.sourceforge.net > > https://lists.sourceforge.net/lists/listinfo/wicket-user > > > ------------------------------------------------------------------------- > Using Tomcat but need to do more? Need to support web services, security? > Get stuff done quickly with pre-integrated technology to make your job easier > Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 > _______________________________________________ > Wicket-user mailing list > Wicket-user@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/wicket-user > ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Wicket-user mailing list Wicket-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/wicket-user
