Mailing-List: contact users-help@myfaces.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "MyFaces Discussion" <users@myfaces.apache.org>
Received-SPF: neutral (herse.apache.org: local policy)
content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Subject: RE: AW: AW: [O/T] JSF Best Practices for Authentication/Authorization
Date: Tue, 7 Nov 2006 16:35:44 +0100
Message-ID: <CDE0EAADAFFB5646B55B5A04B90AE0B5A33A67@atex01.ftisoftus.com>
Thread-Topic: AW: AW: [O/T] JSF Best Practices for
 Authentication/Authorization
Thread-Index: AccCfC25YPP6FDGTQUeiYxXz7lSAJgABgkBw
From: "Bieringer, Dominik" <DBieringer@thegoldensource.com>
To: "MyFaces Discussion" <users@myfaces.apache.org>

Hi Jeff,

Yes I've seen... I had to stop writing my reply because my train arrived
and I had to go to the bus station ;)

I will read and answer all your mails when I am on the way home today...

Dominik

-----Original Message-----
From: Jeff Bischoff [mailto:jbischoff@klkurz.com]=20
Sent: Tuesday, November 07, 2006 15:52
To: MyFaces Discussion
Subject: Re: AW: AW: [O/T] JSF Best Practices for
Authentication/Authorization

Bieringer.Dominik.nf@gmx.net wrote:
> Yes, that's correct. I am using http basic authentication, which means
that
> when a page get's rendered, the user is already authenticated and
there is
> no possiblity to re-show the login screen again, because the browser
caches
> the username and password.
>=20
> I am not able to use form based login, because there are many
applications
> accessing my page, not only browsers, and it's a lot easier for
applications
> if there is http basic authentication instead of form based
> authentication... (Just think about download managers)...
>=20

Oh yes, that makes perfect sense for you. I just wanted to make sure I=20
understood what you are doing. Of course as I read everyone's=20
descriptions, I am thinking about my own plans and I definately want to=20
use form-based authentication.

 > @SecurityGuard(TypRoles.ADMIN)
 > public AdminBean getAdminBean()
 > {
 > 	JsfSecurityManager.getCurrentInstance().check();
 > }
 >

Like I said, we haven't moved to the new Java yet. But okay, so the=20
annotation is labeling that this method should only be run by admins,=20
and it's the SecurityManager that is responsible for looking at the=20
annotation and deciding whether to continue?

Thanks for explaining!

(by the way, did you see my other reply to you yesterday?)

Regards,

Jeff Bischoff
Kenneth L Kurz & Associates, Inc.