how to implement custom authentaction-manager in spring webflow

answered 2010-10-25 00:14:56 +0800

iantsai
2755 ● 1

Is there any part that you have problem while integrate the Spring Web Flow with ZK?

link publish delete flag offensive edit

answered 2010-10-25 01:34:59 +0800

abhishekv5
54 ● 2

Hi Iantsai,

No I am not facing any issue till now while integrating spring webflow with zk, the only thing is how do I use authentication manager to authenticate using hibernate. I have one login page which is bind with bean and saperate service file. and the database have one role field.

I want to authenticate user with this role.

Thanks

link publish delete flag offensive edit

answered 2010-10-25 02:17:47 +0800

iantsai
2755 ● 1

Have you ever tried your Spring Security part of code using a simple Java web project?

Maybe you can post your Error stack trace here to let us know what's going on.

link publish delete flag offensive edit

answered 2010-10-25 23:32:57 +0800

abhishekv5
54 ● 2

Hi,

Yes I tried, and it works, but I want to use my user bean and service for authentication,

I tried to use authentication, by defining <secured attribute="some ROLE"> but it always through me to login page which i define like this

<security:http auto-config="true">
<security:form-login login-page="/spring/login" login-processing-url="/spring/loginProcess" default-target-url="/spring/main" authentication-failure-url="/spring/login?login_error=1" />
<security:logout logout-url="/spring/logout" logout-success-url="/spring/logoutSuccess" />
</security:http>

And I want to know few things like,

1) we provide <secured attribute="some ROLE"> which is hard coded role, what it means. is there any way to use it dynamically.

2) We are using security manager like
<security:authentication-provider>
<security:password-encoder hash="md5" />
<security:user-service>
<security:user name="keith" password="417c7382b16c395bc25b5da1398cf076" authorities="ROLE_USER, ROLE_SUPERVISOR" />
<security:user name="erwin" password="12430911a8af075c6f41c6976af22b09" authorities="ROLE_USER, ROLE_SUPERVISOR" />
<security:user name="jeremy" password="57c6cbff0d421449be820763f03139eb" authorities="ROLE_USER" />
<security:user name="scott" password="942f2339bf50796de535a384f0d1af3e" authorities="ROLE_USER" />
</security:user-service>
</security:authentication-provider>

where user name, password and authorities are hard coded.

link publish delete flag offensive edit

answered 2010-10-25 23:56:36 +0800

ashishd

1972 ● 6

Hi abhishekv5,
For this you will have to implement UserDetailsService interface. Please refer to Spring Security reference, Spring Security forums or Spring Security book to find out more about how to implement it.

link publish delete flag offensive edit

answered 2010-10-26 02:32:12 +0800

terrytornado

9393 ● 3 ● 7 ● 16
http://www.oxitec.de/

updated 2010-10-26 02:33:27 +0800

Like ashishd say, you must implement the UserDetailService.
In Zksample2 are codes on where you can have a look about this. We named this class 'PolicyManager.java'.

Writing custom UserDetailsService
link

        . . .

	<!-- ====================================================== -->
	<!--     We define the kind of authentification with a      -->
	<!--           so called authentication-provider            -->
	<!--        We use the DAO authenticationProvider.          -->
	<!--     We coded out a custom UserDetailServiceImpl.       -->
	<!--     So we have our users stored in a DB we use         -->
	<!--     our own user-service class and point to her.       -->
	<!-- ====================================================== -->
	<authentication-manager alias="authenticationManager">
		<authentication-provider user-service-ref="myUserDetailsService">
		</authentication-provider>
	</authentication-manager>

	<!-- ====================================================== -->
	<!--           The Implementation of the Interface          -->
	<!--           UserDetailService for the logged in          -->
	<!--                    user and his rights                 -->
	<!-- ====================================================== -->
	<beans:bean id="myUserDetailsService" class="de.forsthaus.policy.model.PolicyManager">
		<beans:property name="userService" ref="userService" />
	</beans:bean>
        . . .

best
Stephan

link publish delete flag offensive edit

answered 2010-10-26 05:29:25 +0800

abhishekv5
54 ● 2

Hi Terrytornado,

I am getting an error while setting the authentication manager,

Error is : "cvc-complex-type.2.1: Element 'security:authentication-manager' must have no character or element information item , because the
type's content type is empty."

My security configuration file is :

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:zksp="http://www.zkoss.org/2008/zkspring"
xsi:schemaLocation="
http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-2.0.2.xsd
http://www.zkoss.org/2008/zkspring
http://www.zkoss.org/2008/zkspring/zkspring.xsd">

<security:http auto-config="true">
<security:form-login login-page="/spring/login" login-processing-url="/spring/loginProcess" default-target-url="/spring/onebox" authentication-failure-url="/spring/login?login_error=1" />
<security:logout logout-url="/spring/logout" logout-success-url="/spring/logoutSuccess" />
</security:http>
<zksp:zk-event login-template-close-delay="5">

<zksp:form-login login-page="/spring/loginPopup" authentication-failure-url="/spring/loginPopup?login_error=1"
width="597px" height="451px"/>
</zksp:zk-event>


<security:authentication-provider>
<security:password-encoder hash="md5" />
<security:user-service>
<security:user name="keith" password="417c7382b16c395bc25b5da1398cf076" authorities="ROLE_USER, ROLE_SUPERVISOR" />
<security:user name="erwin" password="12430911a8af075c6f41c6976af22b09" authorities="ROLE_USER, ROLE_SUPERVISOR" />
<security:user name="jeremy" password="57c6cbff0d421449be820763f03139eb" authorities="ROLE_USER" />
<security:user name="scott" password="942f2339bf50796de535a384f0d1af3e" authorities="ROLE_USER" />
</security:user-service>
</security:authentication-provider>

</beans>

link publish delete flag offensive edit

answered 2010-10-26 07:05:12 +0800

terrytornado

9393 ● 3 ● 7 ● 16
http://www.oxitec.de/

you must read first the spring-security docu.

I think that your <security:authentication-provider> must stand in a <security:authentication-manager> tag.

best
Stephan

PS: Please use the [ c o d e ] your code samples between here [/ c o d e ] tag for posting formatted codes.

link publish delete flag offensive edit

answered 2010-10-26 07:21:37 +0800

abhishekv5
54 ● 2

Hi Terrytornado,

Yes you are absolutely right, the <security:authentication-provider> comes under the <security:authentication-manager> tag,
but in my security xml file, whenever I tried to add <security:authentication-provider> tag under <security:authentication-manager>,
it gives me an error.
"cvc-complex-type.2.1: Element 'security:authentication-manager' must have no character or element information item , because the
type's content type is empty."