Search:

Spring Security 2.0 M1 is coming out, and will solve this problem soon let's hope :)

Any news regarding this? Please help

You got it wrong! :)

UserDetailsService is NOT used for authentication.

The only role of UserDetailsService is to provide a full UserDetails for a given username. This UserDetails will THEN be...

You got it sort of wrong.

ACEGI needs a way (A UserDetailsService actually) to load a UserDetails object which contains all the details for a given user (username, password, security roles,...

Anyone that can help here? Or do I have to wait for Acegi 1.1.0? OR what? :D

My ACEGI configuration. It works through the use of Spring DefaultAdvisorAutoProxyCreator, which automagically picks up advisors in the context.

BUT, using it, forbid me to use the new <aop:xxx>...

I'm building an application using Spring and Acegi.

On the server, I have several aspects (logging, application logic interception, etc...) defined using the new AOP schema based declarations...

I've been developing a Spring J2SE desktop client-server application (rich client), using PostgreSQL/Hibernate for DAOs, RMI for services, Swing for client GUI.

We have faced the same problem:...

Anyone here that can answer me?

I've also filed a new RFE in Spring JIRA: http://opensource.atlassian.com/projects/spring/browse/SPR-2173

Just a quick suggestion: consider also RMI, it works natively with SSL (through the sun provided SslRMIClientSocketFactory and SslRMIServerSocketFactory), and RMI can be tunneled on HTTP transport...

I'm trying to setup Spring remoting using RMI and SSL.

Now, the RMIServiceExporter correctly supports custom socketFactory for both client and server sockets, and for both the registry and the...

Exactly what I meant, wow Andreas, we always come to the same solution :P Let's hope it's right heehehe

Yeah ;P



Thanks for the explanation. I will check the DIGEST authentication mechanism to see if it suits our security needs.

Otherwise we will code a properly HASH+ONE_TIME_SEED...

We plan to factor out of the controller the 'shared' services that will be need by the whole application, into proper frameworks (validation, etc...).

In the end, what is left of the framework is...

This seems like a good solution: a single login with BASIC AUTH to obtain credentials, and then the subsequent calls use the obtained credentials.

Security-wise is decent: we reduce the password...

Me too. =)



Thanks, now I can properly understand how ACEGI works, and the best way to integrate it into a rich client solution.

But my problem is that we cannot afford using SSL...

Yeah, now I got what you meant.

I was planning to use java webstart, so this shouldn't be a problem at all, since every update is instantly available to all the clients =)

A problem may only...

I want to underline something better: my choices were based upon an 'Anemic domain objects model', where the model POJOs contains only the inner validation logic, but they do not contain anything...

Fine, let's see If I can answer some of these doubts.



Failure of what? Of the client? Well, if the client is working offline, therefore the data is saved only onto the client DB, and the...

Our idea was quite simple, regarding this: since all the call to the server will be checked against the user role and relative permission, through an aspect call handled by the acegi security...

Good to know someone is handling the same problems as we are. We can join forces and find the best solution together, by speaking about the possible viable solutions, and discuss pros and versuses of...

Sort of.

I'm planning to use ACEGI ( http://www.acegisecurity.org/ ) which seems quite powerful and full-featured, and is completely integrated with Spring.

It seems to be compatible with...

Thanks Andreas, I've decided to go after the <any> mapping after all.

A little bit of uneasiness in querying polimorphicly (which will seldom be done, anyway), but a much greater flexibility in...

I have dug into the documentation and unluckily, it seems I was right.

The union-subclass mapping, as with all the *class mapping, can be used to map an entity only once, and an entity cannot...

Still have a doubt about the explicit polimorphism approach through the union-subclass mapping.

Will this allow me to have a class defined as an union-subclass for several abstract classes?
...