Return-Path: X-Original-To: apmail-deltaspike-commits-archive@www.apache.org Delivered-To: apmail-deltaspike-commits-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id CD354F68C for ; Sun, 14 Dec 2014 23:27:57 +0000 (UTC) Received: (qmail 92813 invoked by uid 500); 14 Dec 2014 23:27:57 -0000 Delivered-To: apmail-deltaspike-commits-archive@deltaspike.apache.org Received: (qmail 92730 invoked by uid 500); 14 Dec 2014 23:27:57 -0000 Mailing-List: contact commits-help@deltaspike.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@deltaspike.apache.org Delivered-To: mailing list commits@deltaspike.apache.org Received: (qmail 92654 invoked by uid 99); 14 Dec 2014 23:27:57 -0000 Received: from eris.apache.org (HELO hades.apache.org) (140.211.11.105) by apache.org (qpsmtpd/0.29) with ESMTP; Sun, 14 Dec 2014 23:27:57 +0000 Received: from hades.apache.org (localhost [127.0.0.1]) by hades.apache.org (ASF Mail Server at hades.apache.org) with ESMTP id 7C7DBAC0917 for ; Sun, 14 Dec 2014 23:27:57 +0000 (UTC) Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: svn commit: r932758 [6/7] - in /websites/staging/deltaspike/trunk/content: ./ staging/documentation/ Date: Sun, 14 Dec 2014 23:27:56 -0000 To: commits@deltaspike.apache.org From: buildbot@apache.org X-Mailer: svnmailer-1.0.9 Message-Id: <20141214232757.7C7DBAC0917@hades.apache.org> Added: websites/staging/deltaspike/trunk/content/staging/documentation/modules.html ============================================================================== --- websites/staging/deltaspike/trunk/content/staging/documentation/modules.html (added) +++ websites/staging/deltaspike/trunk/content/staging/documentation/modules.html Sun Dec 14 23:27:55 2014 @@ -0,0 +1,277 @@ + + + + + + + + +Overview of DeltaSpike Modules + + + + + + + + + + + + + + + + +
+
+
+
+

Overview of DeltaSpike Modules

+
+ +
+ +
+ +
+

DeltaSpike consists of ready-to-use modules. These include a core module and a number of optional modules for providing additional enterprise functionality to your applications. An overview of each module is provided here and for more information see the linked individual module pages.

+
+ + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Table 1. DeltaSpike Modules

Core

Required

+

For fundamental and defining DeltaSpike API and utility classes

+

Bean Validation

Optional

+

For adding CDI support in Bean Validation, enabling creation of CDI aware ConstraintValidator methods that can use business objects (EJBs, ManagedBeans) to support validation needs

+

Container Control

Optional

+

For CDI container booting and shutdown and associated context lifecycle management

+

Data

Optional

+

For an enhanced JPA experience with declarative queries, reducing boilerplate to a minimum

+

JPA

Optional

+

For transactional context and scope

+

JSF

Optional

+

For CDI integration with JSF, with type-safe view config, multi-window handling, new scopes (WindowScoped, ViewScope, ViewAccessScoped, GroupedConversationScoped) and integration with DeltaSpike “core” messages and exception handling

+

Partial-Bean

Optional

+

For implementing a generic handler to replace manual implementations of interfaces (or abstract classes)

+

Scheduler

Optional

+

For simple integration with Quartz v2 (default) or any other scheduler that supports cron-expressions for job-classes

+

Security

Optional

+

For intercept and security checking on method calls

+

Servlet

Optional

+

For integration with the Java Servlet API, enabling injection of common servlet objects and propagation of servlet events to the CDI event bus

+

Test-Control

Optional

+

For writing CDI-based tests easily

+
+
+ +
+ +
+

Copyright © 2011-2014 The Apache Software Foundation, Licensed under the Apache License, Version 2.0.

+

Apache and the Apache feather logo are trademarks of The Apache Software Foundation.

+
+ +
+ + + + \ No newline at end of file Added: websites/staging/deltaspike/trunk/content/staging/documentation/overview.html ============================================================================== --- websites/staging/deltaspike/trunk/content/staging/documentation/overview.html (added) +++ websites/staging/deltaspike/trunk/content/staging/documentation/overview.html Sun Dec 14 23:27:55 2014 @@ -0,0 +1,363 @@ + + + + + + + + +Overview of DeltaSpike + + + + + + + + + + + + + + + + +
+
+
+
+

Overview of DeltaSpike

+
+ +
+ +
+ +
+

Background

+
+
+

CDI

+
+

Java Contexts and Dependency Injection for the Java EE platform (JSR 299), abbreviated to CDI, was introduced as part of Java EE6. The core features of CDI are as follows:

+
+
+
    +
  • +

    improved stateful object lifecycles with an additional context named Conversation that encompasses a series of requests within one session and lifecycle management by the container according to well-defined contexts

    +
  • +
  • +

    dependency injection conducted in a type-safe manner, with type checking conducted at compilation time so errors are exposed earlier and debugging is easier

    +
  • +
  • +

    event notification facility for object interaction

    +
  • +
  • +

    a better approach for interceptors with annotations binding interceptors to objects and with a new interceptor named decorator that knows about individual bean attributes through inheritence and is more appropriate for use in solving business problems

    +
  • +
  • +

    a Service Provider Interface (SPI) for developing portable extensions to the CDI container

    +
  • +
+
+
+

CDI is a Java Community Process (JCP) standard. All Java EE6 compliant application servers must provide support for CDI. JBoss Weld is a reference implementation of the CDI specification and other spec-compliant implementations exist such as Apache OpenWebBeans (OWB). While CDI is a Java EE6 essential, CDI can also be used in Java SE environments with the aid of standalone CDI implementations.

+
+
+
+

Portable CDI Extensions

+
+

The CDI Service Provider Interface (SPI) is exposed to enable extension of the CDI feature set by third-parties. Portable CDI extensions extend CDI implementations and improve existing Java EE APIs by enabling integration of different technologies.

+
+
+

As set out in the CDI specification, a portable CDI extenstion may integrate with a CDI container as follows:

+
+
+
    +
  • +

    providing its own beans, interceptors and decorators to the container

    +
  • +
  • +

    injecting dependencies into its own objects using the dependency injection service

    +
  • +
  • +

    providing a context implementation for a custom scope

    +
  • +
  • +

    augmenting or overriding the annotation-based metadata with metadata from some other source

    +
  • +
+
+
+

As indicated by the name, portable CDI extensions can be used with any spec-compliant CDI implementation.

+
+
+
+
+
+

About Apache DeltaSpike

+
+
+

Apache DeltaSpike is a collection of portable CDI extensions. These ready-to-use modules enable you to integrate tested API extensions into your Java projects.

+
+
+

DeltaSpike consists of a core module and a number of optional modules for providing additional enterprise functionality to your applications. The modules include features for enhanced security with type-safe control over method invocations, integration with schedulers, injection of CDI objects into validators, and a transactional context and scope. DeltaSpike also provides boot and shutdown control over CDI containers in Java SE applications.

+
+
+

As a CDI extension, DeltaSpike must be used in conjunction with a CDI implementation and supports both JBoss Weld and Apache OpenWebBeans. DeltaSpike has been tested on a range of application servers and containers that utilize these CDI implementations, such as Apache TomEE, JBoss AS, WildFly, Oracle GlassFish, and Jetty.

+
+
+

In addition to the portable CDI extension modules, DeltaSpike provides a number of examples to show you how to use and get the most from this technology.

+
+
+
+
+

Features of DeltaSpike

+
+
+

Java EE 7 without Java EE 7!

+
+

Transactional support for non-EJB beans: The Transactional Interceptor in DeltaSpike paved the way for @Transactional in Java EE 7.

+
+
+

Injectable Servlet objects: Allows the developer to inject CDI beans on Servlets on Java EE 6/CDI 1.0 environments

+
+
+

Injectable resources: Configuration, resource bundles,…​ are easy to inject when using CDI and Apache DeltaSpike.

+
+
+

@Exclude annotation: it is possible to annotate beans which should be ignored by CDI even if they are in a CDI enabled archive on Java EE 6/CDI 1.0 environment where you cais not use @Vetoed or a veto based on ProjectStages or expressions is needed.

+
+
+

Scheduling tasks: Async processes in a non Java EE 7 environment.

+
+
+

Bean Validation integration: Allows to inject CDI beans and EJB in to Constraint-Validators.

+
+
+

BeanProvider: Access the BeanManager and CDI beans even in non managed classes like JPA-2.0 EntityListeners or Spring Beans.

+
+
+
+

JSF Improvements

+
+

Multi-window handling: Allows to manage logical windows for batches,…​ or in case of JSF it offers proper separation of browser-tabs.

+
+
+

Type-safe view-config: It allows to bind meta-data (e.g. for security) to views with a type-safe, but flexible approach. It provides a more solid navigation in case of JSF and helps a lot in the maintenance phase.

+
+
+

View-Controller: Based on type-safe view-configs view-controller annotations provide a type-safe alternative to standard-tags.

+
+
+

Injection on Converters and Validators: Allows to inject CDI beans and EJB in to JSF Converters and Validators.

+
+
+

JSF event broadcasting to CDI: Allows CDI to be notified about JSF events

+
+
+
+

Productivity Improvements

+
+

Security based on annotations: The foundation for building a robust, capable and non invasive security solution.

+
+
+

New CDI scopes: TransactionScoped, WindowScoped, ViewScoped, ViewAccess scope, Grouped conversion scope

+
+
+

Container Control and Test Control: Java SE with CDI, all with a unifying API. Start, stop, add classes to a running CDI container.

+
+
+

Data Module: An out of the box entity framework solution complete with support for container or application managed persistence contexts, as well as JDBC.

+
+
+

Decoupled Exception handling: Allows to do exception handling in one location similar to CDI Observers.

+
+
+

JMX integration: Any CDI bean can be exposed via JMX easily with one annotation.

+
+
+

Type-safe i18n messages: Localized messages are easy to use with an interface and a resource bundle, no more boilerplate and your messages now have context within the code.

+
+
+

Type-safe ProjectStages: Compared to ProjectStages in JSF, DeltaSpike provides a type-safe, but still extensible approach which can be used in CDI based applications.

+
+
+
+
+
+

Next

+
+
+

For instructions on how to start using DeltaSpike, see Configure DeltaSpike in Your Projects and Enable CDI For Your Java Environment.

+
+
+
+
+ +
+ +
+

Copyright © 2011-2014 The Apache Software Foundation, Licensed under the Apache License, Version 2.0.

+

Apache and the Apache feather logo are trademarks of The Apache Software Foundation.

+
+ +
+ + + + \ No newline at end of file Modified: websites/staging/deltaspike/trunk/content/staging/documentation/partial-bean.html ============================================================================== --- websites/staging/deltaspike/trunk/content/staging/documentation/partial-bean.html (original) +++ websites/staging/deltaspike/trunk/content/staging/documentation/partial-bean.html Sun Dec 14 23:27:55 2014 @@ -6,7 +6,7 @@ -Partial-Bean +Partial-Bean Module @@ -164,19 +164,82 @@ body {
-

Partial-Bean

+

Partial-Bean Module


-

Usage

+

Overview

+

The Partial-Bean module provides means for implementing a generic handler to replace manual implementations of interfaces (or abstract classes).

+
+
+
+
+

Configure Your Projects

+
+
+

The configuration information provided here is for Maven-based projects and it assumes that you have already declared the DeltaSpike version and DeltaSpike Core module for your projects, as detailed in Configure DeltaSpike in Your Projects. For Maven-independent projects, see Configure DeltaSpike in Maven-independent Projects.

+
+
+

Declare Partial-Bean Module Dependencies

+
+

Add the Partial-Bean module to the list of dependencies in the project pom.xml file using this code snippet:

+
+
+
+
<dependency>
+    <groupId>org.apache.deltaspike.modules</groupId>
+    <artifactId>deltaspike-partial-bean-module-api</artifactId>
+    <version>${deltaspike.version}</version>
+    <scope>compile</scope>
+</dependency>
+
+<dependency>
+    <groupId>org.apache.deltaspike.modules</groupId>
+    <artifactId>deltaspike-partial-bean-module-impl</artifactId>
+    <version>${deltaspike.version}</version>
+    <scope>runtime</scope>
+</dependency>
+
+
+
+
+
+
+

Use the Module Features

+
+
+ + + + + +
+
Important
+
+Currently CDI Interceptors cannot be used for partial-beans. +
+
+
+

@PartialBeanBinding

+

Partial beans allow you to implement a generic handler to replace manual implementations of interfaces (or abstract classes).

@@ -214,8 +277,6 @@ interface (/abstract class) to generic h

Using an abstract class as partial-bean requires javassist as an additional dependency and allows to implement some methods manually.

-
-

Attention: Currently CDI-Interceptors can’t be used for partial-beans.

Modified: websites/staging/deltaspike/trunk/content/staging/documentation/projectstage.html ============================================================================== --- websites/staging/deltaspike/trunk/content/staging/documentation/projectstage.html (original) +++ websites/staging/deltaspike/trunk/content/staging/documentation/projectstage.html Sun Dec 14 23:27:55 2014 @@ -172,9 +172,9 @@ body {
  • Introduction @@ -187,13 +187,13 @@ body {

    Project stages allow to use implementations depending on the current -environment. E.g. you can implement a bean which creates sample-data for -system tests which gets activated only in case of project-stage +environment. For example, you can implement a bean which creates sample-data for +system tests which gets activated only in case of ProjectStage SystemTest.

    -

    Besides custom project-stages it’s possible to use the following -pre-defined project-stages:

    +

    Besides custom ProjectStages it is possible to use the following +pre-defined ProjectStages:

      @@ -219,15 +219,15 @@ pre-defined project-stages:

    The core provides a pluggable and type-safe approach for using project -stages in a project (it’s also used within the framework). Furthermore, -@Exclude allows to use e.g. i mplementations annotated with -javax.enterprise.inject.Alternative for specific project-stages. -Besides the out-of-the-box project-stages it’s possible to implement -custom but type-safe project-stages which will be exposed by +stages in a project (it is also used within the framework). Furthermore, +@Exclude allows use of, for example, implementations annotated with +javax.enterprise.inject.Alternative for specific ProjectStages. +Besides the out-of-the-box ProjectStages it is possible to implement +custom but type-safe ProjectStages which will be exposed by DeltaSpike.

    -

    Resolving and using the Project-Stage:

    +

    Resolving and using the ProjectStage:

    @@ -242,13 +242,13 @@ DeltaSpike.

    Custom Project Stages

    -

    It’s possible to provide custom project stage implementations. +

    It is possible to provide custom project stage implementations. Therefore, you have to provide an implementation of the ProjectStageHolder interface. In this class you nest the custom -project-stage implementations which have to be -public static final class and it’s required to extend ProjectStage. -It’s required to provide a public static final instance even though, -you won’t use it directly.

    +ProjectStage implementations which have to be +public static final class and it is required to extend ProjectStage. +It is required to provide a public static final instance even though, +you will not use it directly.

    ProjectStageHolder for custom project stage implementations:

    @@ -287,26 +287,27 @@ customProjectStage = CustomProjectStageH
    -

    ProjectStageProducer (for 3rd party portable extensions)

    +

    ProjectStageProducer (for Third-party Portable Extensions)

    ProjectStageProducer provides the producer method which allows to -inject the current project-stage. However, in some cases it’s needed to -use project-stages also during the bootstrapping process of the CDI -container and you can’t use injection. In such cases you can use +inject the current ProjectStage. However, in some cases it is needed to +use ProjectStages also during the bootstrapping process of the CDI +container and you cais not use injection. In such cases you can use ProjectStageProducer.getInstance().getProjectStage() to resolve the -current project-stage. This helper also contains helpers for unit-tests -- e.g. #setProjectStage. However, those methods shouldn’t be needed -for users (we just need them for testing different project-stage +current ProjectStage. This helper also contains helpers for unit-tests +- e.g. #setProjectStage. However, those methods shouldis not be needed +for users (we just need them for testing different ProjectStage scenarios).

    -

    Setting the active ProjectStage

    +

    Setting the Active ProjectStage

    For setting the ProjectStage which shall get used in your application you can specify it in a few ways. The underlying mechanism used to -determine the string is the ConfigResolver. E.g.:

    +determine the string is the ConfigResolver.

    +
    Example
    -Dorg.apache.deltaspike.ProjectStage=Development
    Modified: websites/staging/deltaspike/trunk/content/staging/documentation/scheduler.html ============================================================================== --- websites/staging/deltaspike/trunk/content/staging/documentation/scheduler.html (original) +++ websites/staging/deltaspike/trunk/content/staging/documentation/scheduler.html Sun Dec 14 23:27:55 2014 @@ -169,29 +169,64 @@ body {

    -

    Intro

    +

    Overview

    -

    This module provides a simple integration with Quartz v2 (per default) -or any other scheduler which supports cron-expressions for job-classes.

    +

    The Scheduler module provides simple integration with Quartz v2 (default) or any other scheduler that supports cron-expressions for job-classes.

    -

    External Dependencies

    +

    Configure Your Projects

    -

    If you would like to use the default-integration with quartz (which is -optional), you have to add quartz 2.x.

    +

    The configuration information provided here is for Maven-based projects and it assumes that you have already declared the DeltaSpike version and DeltaSpike Core module for your projects, as detailed in Configure DeltaSpike in Your Projects. For Maven-independent projects, see Configure DeltaSpike in Maven-independent Projects.

    +
    +
    +

    1. Declare Scheduler Module Dependencies

    +
    +

    Add the Scheduler module to the list of dependencies in the project pom.xml file using this code snippet:

    +
    +
    +
    +
    <dependency>
    +    <groupId>org.apache.deltaspike.modules</groupId>
    +    <artifactId>deltaspike-scheduler-module-api</artifactId>
    +    <version>${deltaspike.version}</version>
    +    <scope>compile</scope>
    +</dependency>
    +
    +<dependency>
    +    <groupId>org.apache.deltaspike.modules</groupId>
    +    <artifactId>deltaspike-scheduler-module-impl</artifactId>
    +    <version>${deltaspike.version}</version>
    +    <scope>runtime</scope>
    +</dependency>
    +
    +
    +
    +
    +

    2. Declare External Dependencies

    +
    +

    By default, the Scheduler module looks to integrate with Quartz. If this is the scheduler you would like to use, add Quartz 2.x to the list of project dependencies using this code snippet:

    @@ -204,9 +239,12 @@ optional), you have to add quartz 2.x.
    +
    -

    @Scheduled

    +

    Use the Module Features

    +
    +

    @Scheduled

    Just annotate your Quartz-Jobs with @Scheduled and they will get picked up and passed to the scheduler automatically (during the @@ -237,10 +275,11 @@ DeltaSpike) is required. That can be con container-control module as well as {} for 'no scopes').

    -

    With 'false' for @Scheduled#onStartup it’s even possible to -schedule/install jobs dynamically - e.g.:

    +

    With 'false' for @Scheduled#onStartup, it is even possible to +schedule/install jobs dynamically.

    +
    Example
    @ApplicationScoped
     public class ProjectStageAwareSchedulerController
    @@ -276,16 +315,14 @@ schedule/install jobs dynamically - e.g.
     
    -
    -
    -

    Manual Scheduler Control

    -
    +
    +

    Manual Scheduler Control

    -

    This SPI allows to control the scheduler (or integrate any other +

    Th SPI allows to control the scheduler (or integrate any other compatible scheduler as an alternative to Quartz2)

    -

    Via std. injection like

    +

    Via standard injection like

    @@ -294,15 +331,12 @@ compatible scheduler as an alternative t
    -

    it’s possible to manually start/stop the scheduler, +

    it is possible to manually start/stop the scheduler, pause/resume/interrupt/check scheduled jobs, register jobs manually or start a job once (without registering it permanently).

    -

    Attention:

    -
    -
    -

    With some versions of Weld you have to use

    +

    Attention: To use a typed injection-point and avoid deployment failure with some versions of Weld, you must use

    @@ -327,19 +361,13 @@ start a job once (without registering it </alternatives>
    -
    -

    to use a typed injection-point. Otherwise the deployment will fail.

    -
    -
    -
    -

    Custom Scheduler

    -
    +
    +

    Custom Scheduler

    -

    It’s possible to replace the default integration with Quartz. Any other -scheduler which supports cron-expressions for job-classes can be used. -Please have a look at org.apache.deltaspike.test.scheduler.custom for -further details.

    +

    It is possible to replace the default integration with Quartz. Any scheduler that supports cron-expressions for job-classes can be used. +For more information, see http://org.apache.deltaspike.test.scheduler.custom.

    +
    Modified: websites/staging/deltaspike/trunk/content/staging/documentation/security.html ============================================================================== --- websites/staging/deltaspike/trunk/content/staging/documentation/security.html (original) +++ websites/staging/deltaspike/trunk/content/staging/documentation/security.html Sun Dec 14 23:27:55 2014 @@ -6,7 +6,7 @@ -DeltaSpike Security Module +Security Module @@ -164,43 +164,90 @@ body {
    -

    DeltaSpike Security Module

    +

    Security Module

      -
    • Hint
    • -
    • SecurityBinding for class and method invocations
    • -
    • Integrating 3rd party security frameworks +
    • Overview
    • +
    • Configure Your Projects +
    • +
    • Use the Module Features +
        +
      • SecurityBinding for Class and Method Invocations
      • +
      • Integrating Third-party Security Frameworks +
      • -
      • Making intitially requested and secured page available for redirect after login -
        -

        Hint

        +

        Overview

        +
        +
        +

        The Security module provides intercept and security checking on method calls. This module also enables integration of third-party security frameworks and custom security concepts.

        +
        +
        +
        +
        +

        Configure Your Projects

        -

        Hint: If you are using features described by this page with CDI 1.0 -(or DeltaSpike up to v1.1.0 with CDI 1.1+), you have -to enable the security interceptor in your beans.xml file:

        +

        The configuration information provided here is for Maven-based projects and it assumes that you have already declared the DeltaSpike version and DeltaSpike Core module for your projects, as detailed in Configure DeltaSpike in Your Projects. For Maven-independent projects, see Configure DeltaSpike in Maven-independent Projects.

        +
        +
        +

        1. Declare Security Module Dependencies

        +
        +

        Add the Security module to the list of dependencies in the project pom.xml file using this code snippet:

        +
        +
        +
        +
        <dependency>
        +    <groupId>org.apache.deltaspike.modules</groupId>
        +    <artifactId>deltaspike-security-module-api</artifactId>
        +    <version>${deltaspike.version}</version>
        +    <scope>compile</scope>
        +</dependency>
        +
        +<dependency>
        +    <groupId>org.apache.deltaspike.modules</groupId>
        +    <artifactId>deltaspike-security-module-impl</artifactId>
        +    <version>${deltaspike.version}</version>
        +    <scope>runtime</scope>
        +</dependency>
        +
        +
        +
        +
        +

        2. Enable the Security Interceptor

        +
        +

        For CDI 1.0 (or DeltaSpike v1.1.0 and earlier together with CDI 1.1+), you must enable the security interceptor in the project beans.xml file:

        @@ -214,25 +261,24 @@ to enable the security interceptor in yo
        +
        -

        SecurityBinding for class and method invocations

        +

        Use the Module Features

        +
        +

        SecurityBinding for Class and Method Invocations

        -

        This feature of the security module functions by intercepting method -calls, and performing a security check before invocation is allowed to -proceed.

        +

        This feature of the Security module intercepts method calls and performs a security check before invocation is allowed to proceed.

        In order to use the DeltaSpike security module, you must first have -installed the proper dependencies into your POM file. Once this is +installed the proper dependencies into the pom.xml file. Once this is complete, you may proceed to create a security parameter binding annotation. This is what we will use to add security behavior to our business classes and methods.

        -
        -

        Create the SecurityBinding:

        -
        +
        Create the SecurityBinding
        @Retention(value = RUNTIME)
         @Target({TYPE, METHOD})
        @@ -254,10 +300,8 @@ if we need to access parameter arguments
         context. Note that we may also inject other beans into the parameter
         list of our @Secures method.

        -
        -

        Create the Authorizer:

        -
        +
        Create the Authorizer
        @ApplicationScoped
         public class CustomAuthorizer
        @@ -276,10 +320,8 @@ list of our @Secures method.

        This binding annotation may be placed on the entire class (securing all methods,) or on individual methods that you wish to secure.

        -
        -

        Secure a bean method:

        -
        +
        Secure a Bean Method
        @ApplicationScoped
         public class SecuredBean1
        @@ -297,10 +339,8 @@ methods,) or on individual methods that
         in our authorizer bean by creating custom @SecurityParameterBinding
         types; this is a simple step once we have completed the work above:

        -
        -

        Create a parameter binding annotation:

        -
        +
        Create a Parameter Binding Annotation
        @Retention(value = RUNTIME)
         @Target({PARAMETER})
        @@ -315,10 +355,8 @@ types; this is a simple step once we hav
         values as arguments into our authorizer method, providing domain-level
         security in our applications:

        -
        -

        Update the Authorizer to use parameter binding:

        -
        +
        Update the Authorizer to use Parameter Binding
        @ApplicationScoped
         public class CustomAuthorizer
        @@ -335,10 +373,8 @@ security in our applications:

        Note that our business method must also be annotated.

        -
        -

        Complete the parameter binding:

        -
        +
        Complete the Parameter Binding
        @ApplicationScoped
         public class SecuredBean1
        @@ -396,10 +432,8 @@ to use a secured return value:

        Now the authorization will take place after the method invocation using the return value of the business method.

        -
        -

        Complete the parameter binding:

        -
        +
        Complete the Parameter Binding
        @ApplicationScoped
         public class SecuredBean1
        @@ -417,17 +451,15 @@ the return value of the business method.
         as part of our security authorizer!

        -
        -
        -

        Integrating 3rd party security frameworks

        -
        -

        @Secured

        +

        Integrating Third-party Security Frameworks

        +
        +

        @Secured

        @Secured is build on @SecurityBindingType and a very simple -alternative to the rest of the security module. It’s a basic hook to -integrate a custom security concept, 3rd party frameworks,…​ . It -doesn’t provide a full blown security concept like the rest of the +alternative to the rest of the security module. It is a basic hook to +integrate a custom security concept, third-party frameworks, etc. It +doesis not provide a full blown security concept like the rest of the security module, but other DeltaSpike modules ensure that the security concepts are integrated properly (e.g. correct behaviour within custom scope implementations,…​). It just allows to integrate other security @@ -440,10 +472,8 @@ a bit, because between the interceptor a approach. Therefore the basic behaviour remains the same and you can think about it like an interceptor.)

        -
        -

        Securing all intercepted methods of a CDI bean:

        -
        +
        Securing All Intercepted Methods of a CDI Bean
        //...
         @Secured(CustomAccessDecisionVoter.class)
        @@ -453,13 +483,8 @@ think about it like an interceptor.)

        }
        -
        -

        or

        -
        -
        -

        Securing specific methods:

        -
        +
        Securing Specific Methods
        //...
         public class SecuredBean
        @@ -473,8 +498,8 @@ think about it like an interceptor.)

        -
        -

        AccessDecisionVoter

        +
        +

        AccessDecisionVoter

        This interface is (besides the Secured annotation) the most important part of the concept. Both artifact types are also the only required @@ -495,16 +520,17 @@ parts:

        -

        [TODO] hint about the changed parameter/s

        +

        [TODO] tip about the changed parameter/s

        -
        -

        SecurityViolation

        +
        +

        SecurityViolation

        In case of a detected violation a SecurityViolation has to be added to the result returned by the AccessDecisionVoter.

        +

        AbstractAccessDecisionVoter

        @@ -526,19 +552,16 @@ This is a convenience class which allows }
        -
        -
        -

        @Secured and Stereotypes with custom Meta-data

        +
        +

        @Secured and Stereotypes with Custom Meta-data

        If there are multiple AccessDecisionVoter and maybe in different -constellations, it’s easier to provide an expressive CDI stereotypes for +constellations, it is easier to provide an expressive CDI stereotypes for it. Later on that also allows to change the behaviour in a central place.

        -
        -

        Stereotype support of @Secured:

        -
        +
        Stereotype Support of @Secured
        @Named
         @Admin
        @@ -556,12 +579,10 @@ place.

        -

        Furthermore, it’s possible to provide custom meta-data easily.

        -
        -
        -

        Stereotype of @Secured with custom meta-data:

        +

        Furthermore, it is possible to provide custom meta-data easily.

        +
        Stereotype of @Secured with Custom Meta-data
        @Named
         @Admin(securityLevel=3)
        @@ -594,17 +615,15 @@ place.

        -
        -
        -

        Making intitially requested and secured page available for redirect after login

        -
        +
        +

        Making Intitially Requested and Secured Page available for Redirect after Login

        DeltaSpike can be combined with pure CDI or with any other security frameworks (like PicketLink) to track the denied page and make it available after user logs in.

        -
        -

        CDI Implementation to redirect the login to the first denied page

        +
        +

        CDI Implementation to Redirect the Login to the First Denied Page

        Your LoginService will fire a custom UserLoggedInEvent

        @@ -678,8 +697,8 @@ store the denied page on your own.

        -
        - +
        +

        Once that PicketLink handles the authentication for you, you only need to store the denied page and observe PicketLink LoggedInEvent to @@ -745,10 +764,8 @@ store the denied page on your own.

        -
        -
        -

        AccessDecisionVoterContext

        -
        +
        +

        AccessDecisionVoterContext

        Because the AccessDecisionVoter can be chained, AccessDecisionVoterContext allows to get the current state as well as @@ -766,18 +783,18 @@ the results of the security check.

        getViolations() - Exposes the found violations

      • -

        getSource() - Exposes e.g. the current instance of javax.interceptor.InvocationContext in combination with @Secured used as interceptor.

        +

        getSource() - Exposes, for example, the current instance of javax.interceptor.InvocationContext in combination with @Secured used as interceptor.

      • -

        getMetaData() - Exposes the found meta-data e.g. the view-config-class if @Secured is used in combination with type-safe view-configs

        +

        getMetaData() - Exposes the found meta-data, for example the view-config-class if @Secured is used in combination with type-safe view-configs

      • getMetaDataFor(String, Class<T>) - Exposes meta-data for the given key

    -
    -

    SecurityStrategy SPI

    +
    +

    SecurityStrategy SPI

    The SecurityStrategy interface allows to provide a custom implementation which should be used for @Secured. Provide a custom @@ -785,15 +802,28 @@ implementation as bean-class in combinat @Specializes (or as global-alternative).

    -

    In case of global-alternatives an additional config needs to be added to -/META-INF/apache-deltaspike.properties - e.g.:

    +

    In case of global-alternatives an additional configuration needs to be added to +/META-INF/apache-deltaspike.properties.

    -
    -

    globalAlternatives.org.apache.deltaspike.security.spi.authorization.SecurityStrategy=mypackage.CustomSecurityStrategy

    +
    +
    Example
    +
    +
    globalAlternatives.org.apache.deltaspike.security.spi.authorization.SecurityStrategy=mypackage.CustomSecurityStrategy
    +
    +
    +
    + + + + + +
    +
    Tip
    +
    +The configuration for global-alternatives is following the pattern: +globalAlternatives.<interface-name>=<implementation-class-name> +
    -
    -

    Note: The config for global-alternatives is following the pattern: -globalAlternatives.<interface-name>=<implementation-class-name>

    Modified: websites/staging/deltaspike/trunk/content/staging/documentation/servlet.html ============================================================================== --- websites/staging/deltaspike/trunk/content/staging/documentation/servlet.html (original) +++ websites/staging/deltaspike/trunk/content/staging/documentation/servlet.html Sun Dec 14 23:27:55 2014 @@ -169,9 +169,17 @@ body {
      -
    • Configuration
    • -
    • Injectable Servlet objects +
    • Overview
    • +
    • Configure Your Projects +
    • +
    • 2. Configure Listeners and Filters
    • +
    • Use the Module Features +
      -

      Configuration

      +

      Overview

      +
      +
      +

      The Servlet module provides CDI integration with the Java Servlet API. It enables injection of common servlet objects and propagation of servlet events to the CDI event bus.

      +
      +
      +
      +
      +

      Configure Your Projects

      +
      +
      +

      The configuration information provided here is for Maven-based projects and it assumes that you have already declared the DeltaSpike version and DeltaSpike Core module for your projects, as detailed in Configure DeltaSpike in Your Projects. For Maven-independent projects, see Configure DeltaSpike in Maven-independent Projects.

      +
      +
      +

      1. Declare Servlet Module Dependencies

      +
      +

      Add the Servlet module to the list of dependencies in the project pom.xml file using this code snippet:

      +
      +
      +
      +
      <dependency>
      +    <groupId>org.apache.deltaspike.modules</groupId>
      +    <artifactId>deltaspike-servlet-module-api</artifactId>
      +    <version>${deltaspike.version}</version>
      +    <scope>compile</scope>
      +</dependency>
      +
      +<dependency>
      +    <groupId>org.apache.deltaspike.modules</groupId>
      +    <artifactId>deltaspike-servlet-module-impl</artifactId>
      +    <version>${deltaspike.version}</version>
      +    <scope>runtime</scope>
      +</dependency>
      +
      +
      +
      +
      +
      +
      +

      2. Configure Listeners and Filters

      In most cases there is no need for any additional configuration beside @@ -204,7 +253,7 @@ register the listeners and filters in yo

      • -

        Your container doesn’t support Servlet 3.0 or newer.

        +

        Your container doesis not support Servlet 3.0 or newer.

      • You have set metadata-complete=true in your web.xml.

        @@ -215,8 +264,7 @@ register the listeners and filters in yo
      -

      In these cases you will have to add the following section manually to -your web.xml:

      +

      In these cases you will have to add the following section manually to the project web.xml:

      @@ -264,8 +312,10 @@ your web.xml:

      -

      Injectable Servlet objects

      +

      Use the Module Features

      +
      +

      Injectable Servlet Objects

      The DeltaSpike Servlet module contains producers for many objects of a Servlet environment. All produces are using the special qualifier @@ -281,8 +331,8 @@ injection of some Servlet objects out of private ServletObject servletObject;

      -
      -

      ServletContext

      +
      +

      ServletContext

      The ServletContext is made available in the application scope. It can be injected into any CDI bean like this:

      @@ -294,8 +344,8 @@ be injected into any CDI bean like this:
      -
      -

      ServletRequest / HttpServletRequest

      +
      +

      ServletRequest / HttpServletRequest

      The ServletRequest is made available in the request scope. The current request can be injected into a CDI bean like this:

      @@ -316,8 +366,8 @@ request can be injected into a CDI bean
      -
      -

      ServletResponse / HttpServletResponse

      +
      +

      ServletResponse / HttpServletResponse

      The ServletResponse is made available in the request scope. The current response can be injected into a CDI bean like this:

      @@ -338,8 +388,8 @@ current response can be injected into a
      -
      -

      HttpSession

      +
      +

      HttpSession

      The HttpSession is made available in the session scope. You can inject the current session of a user into a CDI bean like this:

      @@ -355,8 +405,8 @@ the current session of a user into a CDI of a session.

      -
      -

      Principal

      +
      +

      Principal

      The Principal is made available in the request scope. The current principal can be injected into a CDI bean like this:

      @@ -373,12 +423,10 @@ principal can be injected into a CDI bea
      -
      -
      -

      Servlet event propagation

      -
      +
      +

      Servlet Event Propagation

      -

      The DeltaSpike Servlet module will propagate a number of Servlet object +

      The DeltaSpike Servlet module propagates a number of Servlet object lifecycle events to the CDI event bus. This allows regular CDI beans to observe these events and react accordingly.

      @@ -388,11 +436,11 @@ To distinguish between construction and object, DeltaSpike uses the qualifiers @Initialized and @Destroyed.

      -

      The following sections will show which concrete Servlet objects are +

      The following sections shows which concrete Servlet objects are supported and how their lifecycle can be observed.

      -
      -

      Servlet context lifecycle events

      +
      +

      Servlet Context Lifecycle Events

      The Servlet module supports initialization and destruction events for the ServletContext. These events can for example be used to detect @@ -417,7 +465,7 @@ events can be observed:

      -
      org.apache.deltaspike.servlet.impl.event.EventBridgeContextListener
      +
      org.apache.deltaspike.servlet.impl.event.EventBridgeContextListener
      @@ -426,8 +474,8 @@ also simply remove the entry for the web.xml to disable the events.

      -
      -

      Request and response lifecycle events

      +
      +

      Request and Response Lifecycle Events

      The Servlet module also supports initialization and destruction events for the HttpServletRequest and HttpServletResponse. These events can @@ -471,7 +519,7 @@ class:

      -
      org.apache.deltaspike.servlet.impl.event.EventBridgeFilter
      +
      org.apache.deltaspike.servlet.impl.event.EventBridgeFilter
      @@ -480,8 +528,8 @@ also simply remove the entry for the web.xml to disable the events.

      -
      -

      Session lifecycle events

      +
      +

      Session Lifecycle Events

      The last category of events supported by the DeltaSpike Servlet module are the lifecycle events for the user’s HTTP session. The following @@ -505,7 +553,7 @@ this event category, deactivate the foll

      -
      org.apache.deltaspike.servlet.impl.event.EventBridgeSessionListener
      +
      org.apache.deltaspike.servlet.impl.event.EventBridgeSessionListener
      @@ -515,6 +563,7 @@ your web.xml to disable the
      +