Re: Way to implement access control

2009-08-25 Thread Sebastian Hennebrueder
There is an advantage of the Filter over the Dispatcher. The filter is a nested chain, delegating to the next chain from within the code. It's like a normal servlet filter. My security filter stores the user of the session into a thread local and after the request, cleans up the thread local aga

Re: Way to implement access control

2009-08-20 Thread Ulrich Stärk
In Tapestry, Request abstracts away from either a HttpServletRequest or a PortletRequest (not implemented yet). So to make your application work in both a Portlet and a Servlet context, you have to use the Request. But since you have to get hold of the HttpServletRequest you are nevertheless st

Re: Way to implement access control

2009-08-20 Thread Andrey Larionov
It's not a hack, but RequestFilters services Request not an HttpServletRequest. On Thu, Aug 20, 2009 at 19:15, Thiago H. de Paula Figueiredo wrote: > Em Thu, 20 Aug 2009 11:54:02 -0300, Andrey Larionov > escreveu: > >> Thanks. I decide to try HttpServletRequestFilter, couse injecting >> HttpServl

Re: Way to implement access control

2009-08-20 Thread Thiago H. de Paula Figueiredo
Em Thu, 20 Aug 2009 11:54:02 -0300, Andrey Larionov escreveu: Thanks. I decide to try HttpServletRequestFilter, couse injecting HttpServletRequest in Dispatcher or RequestFilter looks like a hack. I don't consider it a hack (injecting services into services is absolutely normal in Tapestr

Re: Way to implement access control

2009-08-20 Thread Thiago H. de Paula Figueiredo
Em Thu, 20 Aug 2009 11:47:46 -0300, Ulrich Stärk escreveu: Dispatchers are invoked *after* RequestFilters contributed to the RequestHandler pipeline. Oops. I stand corrected. :) -- Thiago H. de Paula Figueiredo Independent Java consultant, developer, and instructor http://www.arsmachina.c

Re: Way to implement access control

2009-08-20 Thread Andrey Larionov
Thanks. I decide to try HttpServletRequestFilter, couse injecting HttpServletRequest in Dispatcher or RequestFilter looks like a hack. If i fail i'll try other ways. On Thu, Aug 20, 2009 at 18:47, Ulrich Stärk wrote: > On 20.08.2009 16:37 schrieb Thiago H. de Paula Figueiredo: >> >> Em Thu, 20 Aug

Re: Way to implement access control

2009-08-20 Thread Ulrich Stärk
On 20.08.2009 16:37 schrieb Thiago H. de Paula Figueiredo: Em Thu, 20 Aug 2009 11:33:48 -0300, Andrey Larionov escreveu: So in my case i should contribute HttpServletRequestFilter? Am i right? If using a RequestFilter, it should be contributed to RequestHandler. If using a Dispatcher, it s

Re: Way to implement access control

2009-08-20 Thread Thiago H. de Paula Figueiredo
Em Thu, 20 Aug 2009 11:33:48 -0300, Andrey Larionov escreveu: So in my case i should contribute HttpServletRequestFilter? Am i right? If using a RequestFilter, it should be contributed to RequestHandler. If using a Dispatcher, it should be contributed to MasterDispatcher. A good place t

Re: Way to implement access control

2009-08-20 Thread Thiago H. de Paula Figueiredo
Em Thu, 20 Aug 2009 11:19:05 -0300, Andrey Larionov escreveu: My problem is what in Dispatcher or RequestFilter passed an Request instance which not provide getRemoteAddr. You can inject HttpServletRequest on your Dispatcher or RequestFilter. In this case, I would use a Dispatcher. -- T

Re: Way to implement access control

2009-08-20 Thread Andrey Larionov
So in my case i should contribute HttpServletRequestFilter? Am i right? On Thu, Aug 20, 2009 at 18:26, Ulrich Stärk wrote: > It's all about what gets called when. See here [1] for an overv - To unsubscribe, e-mail: users-unsubscr

Re: Way to implement access control

2009-08-20 Thread Ulrich Stärk
It's all about what gets called when. See here [1] for an overview. Uli [1] http://uli.spielviel.de/~uli/tapestry_request_processing.png On 20.08.2009 16:19 schrieb Andrey Larionov: My problem is what in Dispatcher or RequestFilter passed an Request instance which not provide getRemoteAddr. An

Re: Way to implement access control

2009-08-20 Thread Andrey Larionov
My problem is what in Dispatcher or RequestFilter passed an Request instance which not provide getRemoteAddr. And what is difference beetween Dispatcher and RequestFilter? Thanks On Thu, Aug 20, 2009 at 18:06, Thiago H. de Paula Figueiredo wrote: > Em Thu, 20 Aug 2009 10:55:20 -0300, Andrey Larion

Re: Way to implement access control

2009-08-20 Thread Thiago H. de Paula Figueiredo
Em Thu, 20 Aug 2009 10:55:20 -0300, Andrey Larionov escreveu: Acegi/Spring is too complicated for my needs :( The IP is need to validate cookie on federated ID server. If user change those IP then validation fail and he represented as guest. The wiki shows how to implement it using a Dispat

Re: Way to implement access control

2009-08-20 Thread Andrey Larionov
Acegi/Spring is too complicated for my needs :( The IP is need to validate cookie on federated ID server. If user change those IP then validation fail and he represented as guest. On Thu, Aug 20, 2009 at 17:48, Sebastian Hennebrueder wrote: > Andrey Larionov schrieb: >> >> I try to implement feder

Re: Way to implement access control

2009-08-20 Thread Sebastian Hennebrueder
Andrey Larionov schrieb: I try to implement federated authorization. I decide to create RequestFilter which gets cookie value and validate it using federated server. If validation successful it recives an username and populates SSO object describes user identity and places in ApplicationState. If