incubator-isis-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Dan Haywood <dkhayw...@gmail.com>
Subject Re: Wicket Viewer's security: problem with custom authenticator
Date Wed, 06 Jul 2011 08:17:10 GMT
Authorization is performed by Wicket.  If you look at 
org.apache.isis.viewer.wicket.ui.pages.entity.EntityPage you'll see it 
protected by a role of "org.starobjects.wicket.roles.USER".

Therefore your 
org.apache.isis.core.commons.authentication.AuthenticationSession 
returned by your authenticator must return a session with a role whose 
string is that above (via #getRoles()).

NB: I'll raise a ticket to change that string literal to be 
"org.apache.isis.viewer.wicket.roles.USER".

Dan

On 05/07/2011 19:27, Kevin Meyer - KMZ wrote:
> Hi Dan,
>
> I recall you writing before that you've done something special with
> Wicket - which seems to be causing me some grief. As hinted at
> previously, I've written a SqlAuthenticator, which I specify via
> isis.properties, and which works with the HTML viewer.
>
> isis.authentication=objstore.dflt.saip.authentication.SqlAuthenticationManagerInstaller
>
> But on the Wicket viewer, I get a:
>
> "Access Denied
> You do not have access to the page you requested.
> Return to home page"
>
> after a successful login.
>
> Any advice?
>
> Regards,
> Kevin
>
>
> PS:
> I also notice that the (wicket form?) parser strips leading and trailing
> spaces from the login details - so my passwords that stars/end with
> spaces never matches.
>
>
>

Mime
  • Unnamed multipart/mixed (inline, None, 0 bytes)
View raw message