Return-Path: Delivered-To: apmail-incubator-shiro-user-archive@www.apache.org Received: (qmail 91859 invoked from network); 20 Jan 2010 21:12:14 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.3) by minotaur.apache.org with SMTP; 20 Jan 2010 21:12:14 -0000 Received: (qmail 56794 invoked by uid 500); 20 Jan 2010 21:12:14 -0000 Delivered-To: apmail-incubator-shiro-user-archive@incubator.apache.org Received: (qmail 56779 invoked by uid 500); 20 Jan 2010 21:12:14 -0000 Mailing-List: contact shiro-user-help@incubator.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: shiro-user@incubator.apache.org Delivered-To: mailing list shiro-user@incubator.apache.org Received: (qmail 56770 invoked by uid 99); 20 Jan 2010 21:12:14 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 20 Jan 2010 21:12:14 +0000 X-ASF-Spam-Status: No, hits=2.2 required=10.0 tests=HTML_MESSAGE,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: domain of yowzator@gmail.com designates 209.85.160.41 as permitted sender) Received: from [209.85.160.41] (HELO mail-pw0-f41.google.com) (209.85.160.41) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 20 Jan 2010 21:12:05 +0000 Received: by pwj4 with SMTP id 4so3678223pwj.20 for ; Wed, 20 Jan 2010 13:11:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :date:message-id:subject:from:to:content-type; bh=nv1HSfriJRAuNJat9zr8gWMheLR/CtfD/4uGcc9us0Q=; b=DpAlQ14gkG8AgtnhWaDbBhSiN6yxCwqBEj4mEYkYcbN5eIL8mHBlrmNI2+Qhh4RyOm /6GfuqHTHHeuU0qvwfBH10fRaOYTTrxsU5cUVxjZcYwat3/41hKTDA5Uiqp0PKMPC+T2 Q/46c0+jNSWt+YK+nEJFJxj3LMkWBcj5q1jhM= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; b=CcWZNr1JaXUWQtA3fkpcaK7fLTn3383ztXqTAljbQoO2AHYSHvVRchngLliU52NCaf v2HzG8SV4HO7g8ccgl4wEOYp/HXCtIYppE+0mOHgH7RDPl+mAeNgL0cCbZNdd88m+Fw6 VYeQ1EuhPx1n+AAVLa7F32Y9tJyM6QUxIE73k= MIME-Version: 1.0 Received: by 10.142.6.32 with SMTP id 32mr360952wff.6.1264021905426; Wed, 20 Jan 2010 13:11:45 -0800 (PST) In-Reply-To: References: <95773c800911290140m669dc1dbt11fc46f429e5a305@mail.gmail.com> <1259775887625-4101151.post@n2.nabble.com> Date: Wed, 20 Jan 2010 13:11:45 -0800 Message-ID: <95773c801001201311j75fd38f0mf2bd4ec709189d17@mail.gmail.com> Subject: Re: Integration with RESTful framework From: Tauren Mills To: shiro-user@incubator.apache.org Content-Type: multipart/alternative; boundary=00504502acada949de047d9f08c7 --00504502acada949de047d9f08c7 Content-Type: text/plain; charset=ISO-8859-1 Hi Brian, Thanks for your response. I'm getting back to this after dealing with other higher priority stuff first. Your approach sounds perfect. I'm using a permissions based model as well, so mapping GET to read, etc. will work well. I'm glad to hear you will share your code with Shiro and look forward to it being integrated. However, I'm unable to view it because the link that you posted in the other thread requires authentication. How can I gain access to it? https://svn.sonatype.org/spice/trunk/plexus-security/security-system/src/main/java/org/sonatype/security/web/filter/authz/HttpVerbMappingAuthorizationFilter.java Also, I have a few questions for you regarding your implementation. How does your system know which user is requesting a REST resource? Does a user login, receive a shiro cookie, and then hit a RESTful url, and that cookie is used to know which user it is? Or are you doing something else? Thanks, Tauren On Wed, Dec 2, 2009 at 10:52 AM, Brian Demers wrote: > For Nexus what we did is we mapped the request method to a permission, so > GET == read. > so the permission looks something like: something:read. > > There is a similar post in the archive: > > http://markmail.org/message/spd4esrpyzskfjfs#query:Declaratively%20Defining%20Authorization%20Rules+page:1+mid:phoffgneifvd4l7p+state:results > > > > On Wed, Dec 2, 2009 at 12:44 PM, lev wrote: > >> >> Hi Tauren, >> >> I am also doing same thing, if you can be in my contact it will be great, >> we >> can help each other htink it out. >> >> Regards, >> >> >> Tauren Mills-3 wrote: >> > >> > I have an application built with spring, hibernate, shiro, wicket, and >> > jquery. I'm looking to add a RESTful framework to the mix, such as >> jersey >> > or >> > restlet. >> > >> > Although the main UI is built and managed using Wicket, there will be >> > several jQuery components embedded in the UI that need to send and >> receive >> > JSON data via RESTful web services. These same web services will also >> be >> > used by iPhone and Android applications, as well as other potential >> > clients. >> > >> > When a user logs into my application, they are authenticated by shiro >> and >> > get a cookie. This cookie is used to identify them for all future >> > requests >> > so that the application knows what features and data they are authorized >> > to >> > see. Most users use the remember me feature and rarely have to log in >> > again. >> > >> > My hope is that the RESTful service will automatically use that same >> > authentication cookie so that the web services only serve appropriate >> data >> > for that user. Also, the plan is for the mobile apps (iphone/android) >> to >> > have a UI for username/password and that it will then authenticate via a >> > web >> > service call and get a cookie to use on subsequent requests as well. >> > >> > I'm hoping someone can confirm that this approach will work, or advise >> me >> > on >> > other approaches before I move forward. >> > >> > Thanks! >> > Tauren >> > >> > >> >> -- >> View this message in context: >> http://n2.nabble.com/Integration-with-RESTful-framework-tp4082288p4101151.html >> Sent from the Shiro User mailing list archive at Nabble.com. >> > > --00504502acada949de047d9f08c7 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Hi Brian,

Thanks for your response. =A0I'm getting b= ack to this after dealing with other higher priority stuff first.

Your approach sounds perfect. =A0I'm using a permission= s based model as well, so mapping GET to read, etc. will work well.

I'm glad to hear you will share your code with Shir= o and look forward to it being integrated. =A0However,=A0I'm unable to = view it because the link that you posted in the other thread requires authe= ntication. =A0How can I gain access to it?
https://= svn.sonatype.org/spice/trunk/plexus-security/security-system/src/main/java/= org/sonatype/security/web/filter/authz/HttpVerbMappingAuthorizationFilter.j= ava

Also, I have a few questions for you regar= ding your implementation. =A0How does your system know which user is reques= ting a REST resource? =A0Does a user login, receive a shiro cookie, and the= n hit a RESTful url, and that cookie is used to know which user it is? =A0O= r are you doing something else? =A0

Thanks,
Tauren




On Wed, Dec 2, 2009 at 10:52 AM, Bria= n Demers <br= ian.demers@gmail.com> wrote:
For Nexus what we did is we mapped the requ= est method to a permission, so GET =3D=3D read.
so the permission looks = something like: something:read.

There is a similar post in the archive:
http:= //markmail.org/message/spd4esrpyzskfjfs#query:Declaratively%20Defining%20Au= thorization%20Rules+page:1+mid:phoffgneifvd4l7p+state:results



On Wed, Dec 2, 2009 at 12:44 PM, lev <dilraj.singh@amdocs.com> wrote:

Hi Tauren,

I am also doing same thing, if you can be in my contact it will be great, w= e
can help each other htink it out.

Regards,


Tauren Mills-3 wrote:
>
> I have an application built with spring, hibernate, shiro, wicket, and=
> jquery. I'm looking to add a RESTful framework to the mix, such as= jersey
> or
> restlet.
>
> Although the main UI is built and managed using Wicket, there will be<= br> > several jQuery components embedded in the UI that need to send and rec= eive
> JSON data via RESTful web services. =A0These same web services will al= so be
> used by iPhone and Android applications, as well as other potential > clients.
>
> When a user logs into my application, they are authenticated by shiro = and
> get a cookie. =A0This cookie is used to identify them for all future > requests
> so that the application knows what features and data they are authoriz= ed
> to
> see. =A0Most users use the remember me feature and rarely have to log = in
> again.
>
> My hope is that the RESTful service will automatically use that same > authentication cookie so that the web services only serve appropriate = data
> for that user. =A0Also, the plan is for the mobile apps (iphone/androi= d) to
> have a UI for username/password and that it will then authenticate via= a
> web
> service call and get a cookie to use on subsequent requests as well. >
> I'm hoping someone can confirm that this approach will work, or ad= vise me
> on
> other approaches before I move forward.
>
> Thanks!
> Tauren
>
>

--
View this message in context: http://n2.n= abble.com/Integration-with-RESTful-framework-tp4082288p4101151.html
Sent from the Shiro User mailing list archive a= t Nabble.com.


--00504502acada949de047d9f08c7--