cocoon-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Ralph Goers <>
Subject Re: SSF
Date Fri, 28 Mar 2008 13:24:25 GMT
Now that I think about it, can't servlet filters be used on servlet 
services for authorization to them? I know it isn't as granular as would 
be liked but it would be good to do this.

Ralph Goers wrote:
> Authentication and authorization are two very different things. We 
> never really implemented a proper authorization scheme in the portal, 
> although I always wanted to.
> From a Cocoon perspective I could definitely see something added to 
> the pipelines to accomplish this, but frankly, I'd prefer to have 
> something like a "pipeline filter" to do it rather than using actions 
> or some of the other constructs that currently exist.
> Ralph
> Patrick Heiden wrote:
>> You are right about easyness of ServletFilter, but what if one would 
>> like to secure not just the entering, but instead also parts of 
>> operations to be in scope for Users with e.g. special Roles? There is 
>> also possibility to auth against mod_auth upfront...many many 
>> possibilities. I would prefer generic one-stop-shop. Maybe Acegi 
>> could be such a solution.
>> Grzegorz: I've just read the AOP-approach. I like the idea, but agree 
>> that a generic (configureable) solution would be nice, since such 
>> usage-scenarios could be refined to patterns (e.g. special SSF-beans, 
>> already proxied or the like). Of course, bloat something up should 
>> not be in goal-direction.
>> I am still left on my way to auth so far,
>> best greetings
>> Patrick

To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message