struts-user mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Hermod Opstvedt <>
Subject SV: Acegi with shale and clay
Date Mon, 24 Apr 2006 15:15:15 GMT

A navigation case looks like this

			<from-outcome>whatever</from-outcome> <.... * maps
			<redirect />

As far as I know, the navigation case is always evaluated by the navigation
handler. Since you start with an action, I take you have an outcome.

Med vennlig hilsen
Hermod Opstvedt

-----Opprinnelig melding-----
Fra: Ian.Priest [] 
Sendt: 24. april 2006 15:37
Til: Struts Users Mailing List
Emne: RE: Acegi with shale and clay

The main problem with that solution is that I'd rather not have to use
redirect everywhere as it will affect performance.  

Secondly, how would I configure the navigation rule?

My current view is /welcome.html so that's easy


My navigation case outcome is dialog:secure...


But what is my to-view id? Is it the first page of the dialog?


That can't be right as my dialog starts with an action rather than a
page view...

	<dialog name="secure" start="Setup">

		<action name="Setup" method="#{secure$secure.setup}">
			<transition outcome="success" target="Page 1" />

		<view name="Page 1" viewId="/secure/page1.html">
			<transition outcome="next" target="Page 2" />


So my to-view-id would somehow have to refer to the action that starts
the dialog. Is that possible?

Athird issue here is that (I believe) DialogNavigationHandler intercepts
the outcome of dialog:secure and deals with it, so the navigation case
is never invoked anyway?


-----Original Message-----
From: [] 
Sent: 24 April 2006 12:53
Subject: RE: Acegi with shale and clay


Have you tried to define a navigation rule, and add <redirect/> to that
rule ?


-----Original Message-----
From: Ian.Priest []
Sent: Monday, April 24, 2006 1:28 PM
To: Struts Users Mailing List
Subject: Acegi with shale and clay

I'm using Shale/Clay to create an application. I'd like to protect the
app with acegi's URL protection but I don't see a way to integrate with
the response rendering.
Here's an example: (all pages are rendered via Clay full html). I have
the structure
the secure pages should only be accessable by those who have logged on
using logon.html. The secure/.. Pages are defined as a dialog called
In welcome.html i have an actionlink whose action is dialog:Secure
I configure acegi to protect urls as follows:

<bean id="filterInvocationInterceptor"
	<property name="authenticationManager">
		<ref bean="authenticationManager" />
	<property name="accessDecisionManager">
		<ref local="httpRequestAccessDecisionManager" />
	<property name="objectDefinitionSource">
	<property name="observeOncePerRequest" value="false"/> </bean>

If I now hit my application at welcome.html I'm assigned role ANONYMOUS
and all is well. However, if I click on the link to the "secure" dialog
acegi doesn't redirect me to logon.html. The request generated when I
click on the actionlink appears to be a request for /welcome.html which
acegi says it's ok to access anonymously. Shale's dialog manager then
works out that the action is dialog:Secure and causes page1 of that
dialog to render, apparently without doing either a forward or a rediect
to /secure/page1.html. (In web.xml I have the mapping to acegi as
		<filter-name>Acegi Filter Chain Proxy</filter-name>
So forwards should also fire the filter).
That means acegi never has a chance to intercept the request. (Once I'm
in the dialog on page1.html, if I click on the next button I am
redirected to the logon.html page - acegi correctly intercepts the
/secure/page1.html request that is made).

How can I intercept Shale's page building and view rendering mechanisms
to ensure that my site's urls are secured correctly?


To unsubscribe, e-mail:
For additional commands, e-mail:

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* *

This email with attachments is solely for the use of the individual or
entity to whom it is addressed. Please also be aware that the DnB NOR
Group cannot accept any payment orders or other legally binding
correspondence with customers as a part of an email. 

This email message has been virus checked by the virus programs used in
the DnB NOR Group.

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* *

To unsubscribe, e-mail:
For additional commands, e-mail:

To unsubscribe, e-mail:
For additional commands, e-mail:

To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message