Return-Path: Delivered-To: apmail-myfaces-dev-archive@www.apache.org Received: (qmail 73341 invoked from network); 16 Aug 2006 14:20:56 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (209.237.227.199) by minotaur.apache.org with SMTP; 16 Aug 2006 14:20:56 -0000 Received: (qmail 97648 invoked by uid 500); 16 Aug 2006 14:20:54 -0000 Delivered-To: apmail-myfaces-dev-archive@myfaces.apache.org Received: (qmail 97590 invoked by uid 500); 16 Aug 2006 14:20:54 -0000 Mailing-List: contact dev-help@myfaces.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: "MyFaces Development" Delivered-To: mailing list dev@myfaces.apache.org Received: (qmail 97579 invoked by uid 99); 16 Aug 2006 14:20:54 -0000 Received: from asf.osuosl.org (HELO asf.osuosl.org) (140.211.166.49) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 16 Aug 2006 07:20:54 -0700 X-ASF-Spam-Status: No, hits=0.5 required=10.0 tests=DNS_FROM_RFC_ABUSE,HTML_MESSAGE,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (asf.osuosl.org: domain of cagatay.civici@gmail.com designates 64.233.162.194 as permitted sender) Received: from [64.233.162.194] (HELO nz-out-0102.google.com) (64.233.162.194) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 16 Aug 2006 07:20:53 -0700 Received: by nz-out-0102.google.com with SMTP id n1so112029nzf for ; Wed, 16 Aug 2006 07:20:33 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:references; b=rgkIBX3q0k8LuFDqvMmrf981GyqtZkfwTQ5qZtrqfyPZ0WW3AmUc9quZAAruGtqKJ+QUtPGiBiAEibcGLFd910bwgzytEENRjfVEl9yln1cx6sXg6+h0asUVJBLZt4QIyDnYSvCEbz6HUDWN1T4jSLGRpk3gfyMqNEHebQ/A+Fk= Received: by 10.35.49.1 with SMTP id b1mr1446174pyk; Wed, 16 Aug 2006 07:20:32 -0700 (PDT) Received: by 10.35.118.9 with HTTP; Wed, 16 Aug 2006 07:20:32 -0700 (PDT) Message-ID: <8c9d4eaa0608160720t5e48ff3em904370699579e0f1@mail.gmail.com> Date: Wed, 16 Aug 2006 17:20:32 +0300 From: "Cagatay Civici" To: "MyFaces Development" Subject: Re: s:secure In-Reply-To: <4AB9FAC47CFEC14C9EE1C88AC96EF76A0600E0@SBYEXCP03.ibt.ibtco.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_221043_5233127.1155738032616" References: <4AB9FAC47CFEC14C9EE1C88AC96EF76A0600E0@SBYEXCP03.ibt.ibtco.com> X-Virus-Checked: Checked by ClamAV on apache.org X-Spam-Rating: minotaur.apache.org 1.6.2 0/1000/N ------=_Part_221043_5233127.1155738032616 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline I've already done a similiar thing for Acegi Security Framework, Acegi-JSF users have given me nice feedbacks. So I thought a similar component could also be useful for myfaces. //components to be secured goes here Also with attributes like ifAnyGranted, ifNotGranted, disabled and etc, this guard component decides whether to render the children components or not. Disabling is also supported. If we agree on this, I'll commit it to sandbox. Just wanna hear the team's thoughts. Cagatay On 8/16/06, Kumar, Girish wrote: > > Is s:secure already written or you want to implement it ? > Can you be more clear on what s:secure does ? > > Girish > > ------------------------------ > *From:* Cagatay Civici [mailto:cagatay.civici@gmail.com] > *Sent:* Wednesday, August 16, 2006 10:08 AM > *To:* MyFaces Development > *Subject:* Re: s:secure > > Hi Mike, > > > > //components to be secured goes here > > > > > > Yes that would do the same job but my point is the user must create the > securityBean class to accomplish this. > > Also securityBean changes when a new role is added. Imagining the possible > amount of roles, the maintanence of the bean might cause problems when > things get more complex. > > My other concern is what if there are other conditions that effect the > rendered property of the panel. Then that should also be added to the > security concern like; > > #{securityBean.isManager or securityBean.isAdmin or pageBean.isLoggedIn} > > Anyway, I'm just thinking loud :) > > Cagatay > > On 8/16/06, Mike Kienenberger wrote: > > > > What's wrong with using this? > > > > > > //components to be secured goes here > > > > > > Seems a lot more flexible. > > > > On 8/16/06, Cagatay Civici < cagatay.civici@gmail.com> wrote: > > > Hi, > > > > > > What do you guys think about a security component like this; > > > > > > > > > //components to be secured goes here > > > > > > > > > Also have attributes like ifNotGranted, ifAnyGranted disable and etc. > > > > > > Do you think this should be useful? > > > > > > Regards, > > > > > > Cagatay > > > > > > > > > ************************************************************************** > This message and any attached documents contain information > which may be confidential, subject to privilege or exempt from > disclosure under applicable law. These materials are solely for > the use of the intended recipient. If you are not the intended > recipient of this transmission, you are hereby notified that any > distribution, disclosure, printing, copying, storage, modification > or the taking of any action in reliance upon this transmission is > strictly prohibited. Delivery of this message to any person other > than the intended recipient shall not compromise or waive > such confidentiality, privilege or exemption from disclosure as > to this communication. > > If you have received this communication in error, please notify > the sender immediately and delete this message from your system. > > ***************************************************************************** > ------=_Part_221043_5233127.1155738032616 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit Content-Disposition: inline I've already done a similiar thing for Acegi Security Framework, Acegi-JSF users have given me nice feedbacks.

So I thought a similar component could also be useful for myfaces.

<s:secure ifAnyGranted="manager, admin">
    //components to be secured goes here
</s:secure>

Also with attributes like ifAnyGranted, ifNotGranted, disabled and etc, this guard component decides whether to render the children components or not. Disabling is also supported.

If we agree on this, I'll commit it to sandbox. Just wanna hear the team's thoughts.

Cagatay

On 8/16/06, Kumar, Girish < Girish.Kumar@ibtco.com> wrote:
Is s:secure already written or you want to implement it ?
Can you be more clear on what s:secure does ?
 
Girish

From: Cagatay Civici [mailto:cagatay.civici@gmail.com]
Sent: Wednesday, August 16, 2006 10:08 AM
To: MyFaces Development
Subject: Re: s:secure

Hi Mike,

<h:panelGroup rendered="#{securityBean.isManager or securityBean.isAdmin }">
   //components to be secured goes here
</h:panelGroup >

Yes that would do the same job but my point is the user must create the securityBean class to accomplish this.

Also securityBean changes when a new role is added. Imagining the possible amount of roles, the maintanence of the bean might cause problems when things get more complex.

My other concern is what if there are other conditions that effect the rendered property of the panel. Then that should also be added to the security concern like;

#{securityBean.isManager or securityBean.isAdmin or pageBean.isLoggedIn}

Anyway, I'm just thinking loud :)

Cagatay

On 8/16/06, Mike Kienenberger <mkienenb@gmail.com > wrote:
What's wrong with using this?

<h:panelGroup rendered="#{securityBean.isManager or securityBean.isAdmin}">
    //components to be secured goes here
</h:panelGroup >

Seems a lot more flexible.

On 8/16/06, Cagatay Civici < cagatay.civici@gmail.com> wrote:
> Hi,
>
> What do you guys think about a security component like this;
>
> <s:secure ifAnyGranted="manager, admin">
>     //components to be secured goes here
> </s:secure>
>
> Also have attributes like ifNotGranted, ifAnyGranted disable and etc.
>
> Do you think this should be useful?
>
> Regards,
>
> Cagatay
>



**************************************************************************
This message and any attached documents contain information
which may be confidential, subject to privilege or exempt from
disclosure under applicable law. These materials are solely for
the use of the intended recipient. If you are not the intended
recipient of this transmission, you are hereby notified that any
distribution, disclosure, printing, copying, storage, modification
or the taking of any action in reliance upon this transmission is
strictly prohibited. Delivery of this message to any person other
than the intended recipient shall not compromise or waive
such confidentiality, privilege or exemption from disclosure as
to this communication.

If you have received this communication in error, please notify
the sender immediately and delete this message from your system.
*****************************************************************************

------=_Part_221043_5233127.1155738032616--