Exporting ACEGI secured RMI services

[printx]

Hello,

I am trying access my beans through RMI from a command line client and use MethodSecurityInterceptor to

1. allow client connections to the service
2. allow certain users method access by role

At this point my services seem to work, but I am not asked about any credentials and can access my exported beans still without any authentication. Could some guru have a a look on the following code and give me some hint to achieve client side authentication and serverside method access by user name?





-- Exported beans --

<bean id="rmi.registry" class="org.springframework.remoting.rmi.RmiRegistryFactor yBean"/>

<!-- Exportable hello bean -->
<bean id="halloService.export" class="org.printx.remoteServices.HalloServiceImpl"/>

<!-- Export hello bean -->
<bean id="halloService.exporter" class="org.springframework.remoting.rmi.RmiServiceExporte r">
<property name="service">
<ref bean="halloService.export"/>
</property>
<property name="serviceName">
<value>HalloService</value>
</property>
<property name="serviceInterface">
<value>org.printx.remoteServices.HalloService</value>
</property>
<property name="registryPort">
<value>1099</value>
</property>
</bean>

<!-- Remote bean -->
<bean id="halloService" class="org.springframework.remoting.rmi.RmiProxyFactoryBe an">
<property name="serviceUrl">
<value>rmi&#58;//127.0.0.1&#58;1099/HalloService</value>
</property>
<property name="serviceInterface">
<value>org.printx.remoteServices.HalloService</value>
</property>
</bean>





-- Authentication code --

<bean id="memoryAuthenticationDao" class="net.sf.acegisecurity.providers.dao.memory.InMemory DaoImpl">
<property name="userMap">
<value>
bednarz=bednarz1234,ROLE_ADMIN, ROLE_TELLER
</value>
</property>
</bean>

<bean id="daoAuthenticationProvider" class="net.sf.acegisecurity.providers.dao.DaoAuthenticati onProvider">
<property name="authenticationDao">
<ref local="memoryAuthenticationDao"/>
</property>
</bean>

<bean id="authenticationManager" class="net.sf.acegisecurity.providers.ProviderManager">
<property name="providers">
<list>
<ref bean="daoAuthenticationProvider"/>
</list>
</property>
</bean>

<!-- Allows remote clients to check if a username/password is valid -->
<bean id="remoteAuthenticationManager" class="net.sf.acegisecurity.providers.rcp.RemoteAuthentic ationManagerImpl">
<property name="authenticationManager"><ref bean="authenticationManager"/></property>
</bean>

<bean id="roleVoter" class="net.sf.acegisecurity.vote.RoleVoter"/>

<bean id="accessDecisionManager" class="net.sf.acegisecurity.vote.UnanimousBased">
<property name="allowIfAllAbstainDecisions">
<value>false</value>
</property>
<property name="decisionVoters">
<list>
<ref local="roleVoter"/>
</list>
</property>
</bean>

<bean id="filterInvocationInterceptor" class="net.sf.acegisecurity.intercept.web.FilterSecurityI nterceptor">
<property name="authenticationManager"><ref bean="authenticationManager"/></property>
<property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property>
<property name="runAsManager"><ref bean="runAsManager"/></property>
<property name="objectDefinitionSource">
<value>
CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
\A/secure/super/.*\Z=ROLE_WE_DONT_HAVE
\A/secure/.*\Z=ROLE_SUPERVISOR,ROLE_TELLER
</value>
</property>
</bean>

<!-- this interceptor sets bean access security -->
<bean id="securityInterceptor" class="net.sf.acegisecurity.intercept.method.aopalliance. MethodSecurityInterceptor">
<property name="validateConfigAttributes"><value>false</value></property>
<property name="authenticationManager"><ref bean="authenticationManager"/></property>
<property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property>
<property name="runAsManager"><ref bean="runAsManager"/></property>
<property name="objectDefinitionSource">
<value>
org.printx.remoteServices.HalloService.sayFullHall o=ROLE_TELLER
org.printx.remoteServices.HalloService.saySimpleHa llo=ROLE_TELLER
</value>
</property>
</bean>

<!-- Autoproxy bean security -->
<bean id="autoProxyCreator" class="org.springframework.aop.framework.autoproxy.BeanNa meAutoProxyCreator">
<property name="interceptorNames">
<list>
<value>securityInterceptor</value>
</list>
</property>
<property name="beanNames">
<list>
<value>halloService.export</value>
</list>
</property>
</bean>





-- server.java --

AppContext.factory.getBean&#40;"autoProxyCreator"&#41;;
AppContext.factory.getBean&#40;"rmi.registry"&#41;;
AppContext.factory.getBean&#40;"halloService.exporter"&#41;;





-- client.java --

HalloService halloService = &#40;HalloService&#41; AppContext.factory.getBean&#40;"halloService"&#41;;

// this should not work &#40;I expect an exception because of missing athentication before &#41; <--------------------------------
halloService.saySimpleHallo&#40;"user","password"&#41;;





-- HalloServiceImpl.java --

public class HalloServiceImpl implements HalloService &#123;

public String sayFullHallo&#40;String user, String password&#41; &#123;
System.out.println&#40;"Remote client&#58; " + user&#41;;
return "Hallo " + user + " , your password ist&#58; " +password;
&#125;

public String saySimpleHallo&#40;String user, String password&#41; &#123;
System.out.println&#40;"Remote client&#58; " + user&#41;;
return "Hallo " + user + " , your password ist&#58; " +password;
&#125;
&#125;



Have someone a big view and can give me a more complete example? I think, that I have to export also the remoteAuthenticationManager and that MethodSecurityInterceptor is not working in my example. Can some body give my a more complete example?

Thank you very much,

Andreas Bednarz
Germany

[printx]

spring-framework-1.2.4
acegi-0.9

Andreas