From jsecurity-user-return-jfarmer@example.com Mon Feb 02 14:59:39 2009 Return-Path: <jsecurity-user-return-jfarmer@example.com> Delivered-To: jfarmer@example.com Received: (qmail 3179 invoked from network); 2 Feb 2009 14:59:39 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur.apache.org with SMTP; 2 Feb 2009 14:59:39 -0000 Received: (qmail 70608 invoked by uid 500); 2 Feb 2009 14:59:39 -0000 Delivered-To: jfarmer@example.com Received: (qmail 70593 invoked by uid 500); 2 Feb 2009 14:59:39 -0000 Mailing-List: contact jfarmer@example.com; run by ezmlm Precedence: bulk List-Help: <mailto:jfarmer@example.com> List-Unsubscribe: <mailto:jfarmer@example.com> List-Post: <mailto:jfarmer@example.com> List-Id: <jsecurity-user.incubator.apache.org> Reply-To: jfarmer@example.com Delivered-To: mailing list jfarmer@example.com Received: (qmail 70583 invoked by uid 99); 2 Feb 2009 14:59:39 -0000 Received: from nike.apache.org (HELO nike.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 02 Feb 2009 06:59:39 -0800 X-ASF-Spam-Status: No, hits=0.2 required=10.0 tests=SPF_HELO_PASS,SPF_PASS,WHOIS_MYPRIVREG X-Spam-Check-By: apache.org Received-SPF: pass (nike.apache.org: domain of jfarmer@example.com designates 83.161.120.155 as permitted sender) Received: from [83.161.120.155] (HELO kuber.nabble.com) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 02 Feb 2009 14:59:30 +0000 Received: from tervel.nabble.com ([83.161.120.155]) by kuber.nabble.com with esmtp (Exim 4.63) (envelope-from <jfarmer@example.com>) id 1LU0GS-0003iB-QK for jfarmer@example.com; Mon, 02 Feb 2009 06:59:08 -0800 Message-ID: <jfarmer@example.com> Date: Mon, 2 Feb 2009 06:59:08 -0800 (PST) From: Csaba Nemeth <jfarmer@example.com> To: jfarmer@example.com Subject: Re: jsecurity under jdk14 In-Reply-To: <jfarmer@example.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Nabble-From: jfarmer@example.com References: <jfarmer@example.com> <jfarmer@example.com> <jfarmer@example.com> <jfarmer@example.com> X-Virus-Checked: Checked by ClamAV on apache.org I quickly tested the sample web application under tomcat 5.0.30 and java 1.4.2. I had to make the following changes: The configuration classes use 1.5 api class - java.util.Scanner, I had to eliminate the use of this class. The default cache manager - based on hashtable - didn't seem to work under 1.4 - while it works fine under 1.6 - I configured the application to use EhCache. The sample web application worked as expected after these changes. I go ahead and raise a JIRA issue for the configuration classes that need to be changed in order to get it working under 1.4 Les Hazlewood-2 wrote: > > Hi Csaba, > > For now, we still do support 1.3 and 1.4. We haven't as a team made the > decision to leave them behind, so they are still supposed to be supported. > > So, if you find something that needs to be fixed to ensure it works with > RetroWeaver and 1.4, please open a Jira issue so it is identified. If we > can fix it, we will :) > > Cheers, > > Les > > On Fri, Jan 30, 2009 at 10:42 AM, Csaba Nemeth > <jfarmer@example.com>wrote: > >> Hi, >> >> well alright, it is too bad as jsecurity looks very good so far. >> >> Unfortunately some companies are still using older servers and they still >> need changes, enhancements to existing applications. >> >> Seems like I have to look into other options. >> Any suggestions for 1.4? >> >> Thanks, >> Csaba >> >> >> --- On Fri, 1/30/09, Les Hazlewood <jfarmer@example.com> wrote: >> >> > From: Les Hazlewood <jfarmer@example.com> >> > Subject: Re: jsecurity under jdk14 >> > To: jfarmer@example.com, jfarmer@example.com >> > Received: Friday, January 30, 2009, 10:10 AM >> > Hi Csaba, >> > >> > We haven't discussed really about 1.3 and 1.4 >> > capability. In fact, although >> > I'm afraid you won't be happy about this, I was >> > going to ask the rest of the >> > JSecurity dev team if we should only focus on 1.5+ from now >> > on. >> > >> > 1.5 already begun its end-of-life phase a while ago and 1.3 >> > and 1.4 are >> > already decommissioned by Sun. I don't know that it >> > would be worth our >> > effort to continually check for 1.3/1.4 compatibility when >> > probably 99% of >> > our uses are 1.5+. >> > >> > My estimation could be incorrect of course. I'm open >> > to feedback from >> > others if we should continue to support 1.4 and below... >> > >> > If you are able to identify what parts of the API fail, >> > then maybe we might >> > be able to revert some code to be compatible. But I >> > don't know if it would >> > be worth it or not when there is already a lot of work to >> > be done for >> > JSecurity 1.0 :/ >> > >> > Thanks for the feedback. How do others feel? >> > >> > Cheers, >> > >> > Les >> > >> > On Fri, Jan 30, 2009 at 9:48 AM, Csaba Nemeth >> > <jfarmer@example.com> wrote: >> > >> > > Hello, >> > > >> > > I am testing jsecurity for a project that is based on >> > jdk14. >> > > I was happy to see while the code is jdk15, it uses >> > retroweaver for earlier >> > > jdks. >> > > >> > > The only problem I found is that while the classes are >> > jdk14 compatible, >> > > the api used is not. >> > > >> > > For example, running a simple example under jdk14 uses >> > the >> > > TextConfigurationRealm - which uses the >> > java.util.Scanner - java 1.5 api. >> > > >> > > Are there any plans on using 1.4 api only? >> > > Is it still the plan that jsecurity is going to work >> > under 1.4 and 1.3? >> > > >> > > Thank you, >> > > Csaba >> > > >> > > >> > > >> > __________________________________________________________________ >> > > Instant Messaging, free SMS, sharing photos and >> > more... Try the new Yahoo! >> > > Canada Messenger at >> > http://ca.beta.messenger.yahoo.com/ >> > > >> >> >> __________________________________________________________________ >> Instant Messaging, free SMS, sharing photos and more... Try the new >> Yahoo! >> Canada Messenger at http://ca.beta.messenger.yahoo.com/ >> > > -- View this message in context: http://n2.nabble.com/jsecurity-under-jdk14-tp2245121p2258310.html Sent from the JSecurity User mailing list jfarmer@example.com. From jsecurity-user-return-jfarmer@example.com Mon Feb 02 15:03:23 2009 Return-Path: <jsecurity-user-return-jfarmer@example.com> Delivered-To: jfarmer@example.com Received: (qmail 19166 invoked from network); 2 Feb 2009 15:03:23 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur.apache.org with SMTP; 2 Feb 2009 15:03:23 -0000 Received: (qmail 74326 invoked by uid 500); 2 Feb 2009 15:03:23 -0000 Delivered-To: jfarmer@example.com Received: (qmail 74280 invoked by uid 500); 2 Feb 2009 15:03:23 -0000 Mailing-List: contact jfarmer@example.com; run by ezmlm Precedence: bulk List-Help: <mailto:jfarmer@example.com> List-Unsubscribe: <mailto:jfarmer@example.com> List-Post: <mailto:jfarmer@example.com> List-Id: <jsecurity-user.incubator.apache.org> Reply-To: jfarmer@example.com Delivered-To: mailing list jfarmer@example.com Received: (qmail 74271 invoked by uid 99); 2 Feb 2009 15:03:23 -0000 Received: from athena.apache.org (HELO athena.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 02 Feb 2009 07:03:23 -0800 X-ASF-Spam-Status: No, hits=3.6 required=10.0 tests=HTML_MESSAGE,SPF_NEUTRAL,WHOIS_MYPRIVREG X-Spam-Check-By: apache.org Received-SPF: neutral (athena.apache.org: local policy) Received: from [83.161.120.155] (HELO el-out-1112.google.com) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 02 Feb 2009 15:03:15 +0000 Received: by el-out-1112.google.com with SMTP id z25so1029351ele.18 for <jfarmer@example.com>; Mon, 02 Feb 2009 07:02:53 -0800 (PST) MIME-Version: 1.0 Sender: jfarmer@example.com Received: by 83.161.120.155 with SMTP id h2mr2649130agb.38.1233586972916; Mon, 02 Feb 2009 07:02:52 -0800 (PST) In-Reply-To: <jfarmer@example.com> References: <jfarmer@example.com> <jfarmer@example.com> <jfarmer@example.com> <jfarmer@example.com> <jfarmer@example.com> Date: Mon, 2 Feb 2009 10:02:52 -0500 X-Google-Sender-Auth: e1b609f31fcce014 Message-ID: <jfarmer@example.com> Subject: Re: jsecurity under jdk14 From: Les Hazlewood <jfarmer@example.com> To: jfarmer@example.com Content-Type: multipart/alternative; boundary=00163616413b51fc380461f0d911 X-Virus-Checked: Checked by ClamAV on apache.org --00163616413b51fc380461f0d911 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Sounds good - thanks! On Mon, Feb 2, 2009 at 9:59 AM, Csaba Nemeth <jfarmer@example.com> wrote: > > I quickly tested the sample web application under tomcat 5.0.30 and java > 1.4.2. > > I had to make the following changes: > > The configuration classes use 1.5 api class - java.util.Scanner, I had to > eliminate the use of this class. > > The default cache manager - based on hashtable - didn't seem to work under > 1.4 - while it works fine under 1.6 - I configured the application to use > EhCache. > > The sample web application worked as expected after these changes. > > I go ahead and raise a JIRA issue for the configuration classes that need > to > be changed in order to get it working under 1.4 > > > Les Hazlewood-2 wrote: > > > > Hi Csaba, > > > > For now, we still do support 1.3 and 1.4. We haven't as a team made the > > decision to leave them behind, so they are still supposed to be > supported. > > > > So, if you find something that needs to be fixed to ensure it works with > > RetroWeaver and 1.4, please open a Jira issue so it is identified. If we > > can fix it, we will :) > > > > Cheers, > > > > Les > > > > On Fri, Jan 30, 2009 at 10:42 AM, Csaba Nemeth > > <jfarmer@example.com>wrote: > > > >> Hi, > >> > >> well alright, it is too bad as jsecurity looks very good so far. > >> > >> Unfortunately some companies are still using older servers and they > still > >> need changes, enhancements to existing applications. > >> > >> Seems like I have to look into other options. > >> Any suggestions for 1.4? > >> > >> Thanks, > >> Csaba > >> > >> > >> --- On Fri, 1/30/09, Les Hazlewood <jfarmer@example.com> wrote: > >> > >> > From: Les Hazlewood <jfarmer@example.com> > >> > Subject: Re: jsecurity under jdk14 > >> > To: jfarmer@example.com, jfarmer@example.com > >> > Received: Friday, January 30, 2009, 10:10 AM > >> > Hi Csaba, > >> > > >> > We haven't discussed really about 1.3 and 1.4 > >> > capability. In fact, although > >> > I'm afraid you won't be happy about this, I was > >> > going to ask the rest of the > >> > JSecurity dev team if we should only focus on 1.5+ from now > >> > on. > >> > > >> > 1.5 already begun its end-of-life phase a while ago and 1.3 > >> > and 1.4 are > >> > already decommissioned by Sun. I don't know that it > >> > would be worth our > >> > effort to continually check for 1.3/1.4 compatibility when > >> > probably 99% of > >> > our uses are 1.5+. > >> > > >> > My estimation could be incorrect of course. I'm open > >> > to feedback from > >> > others if we should continue to support 1.4 and below... > >> > > >> > If you are able to identify what parts of the API fail, > >> > then maybe we might > >> > be able to revert some code to be compatible. But I > >> > don't know if it would > >> > be worth it or not when there is already a lot of work to > >> > be done for > >> > JSecurity 1.0 :/ > >> > > >> > Thanks for the feedback. How do others feel? > >> > > >> > Cheers, > >> > > >> > Les > >> > > >> > On Fri, Jan 30, 2009 at 9:48 AM, Csaba Nemeth > >> > <jfarmer@example.com> wrote: > >> > > >> > > Hello, > >> > > > >> > > I am testing jsecurity for a project that is based on > >> > jdk14. > >> > > I was happy to see while the code is jdk15, it uses > >> > retroweaver for earlier > >> > > jdks. > >> > > > >> > > The only problem I found is that while the classes are > >> > jdk14 compatible, > >> > > the api used is not. > >> > > > >> > > For example, running a simple example under jdk14 uses > >> > the > >> > > TextConfigurationRealm - which uses the > >> > java.util.Scanner - java 1.5 api. > >> > > > >> > > Are there any plans on using 1.4 api only? > >> > > Is it still the plan that jsecurity is going to work > >> > under 1.4 and 1.3? > >> > > > >> > > Thank you, > >> > > Csaba > >> > > > >> > > > >> > > > >> > __________________________________________________________________ > >> > > Instant Messaging, free SMS, sharing photos and > >> > more... Try the new Yahoo! > >> > > Canada Messenger at > >> > http://ca.beta.messenger.yahoo.com/ > >> > > > >> > >> > >> __________________________________________________________________ > >> Instant Messaging, free SMS, sharing photos and more... Try the new > >> Yahoo! > >> Canada Messenger at http://ca.beta.messenger.yahoo.com/ > >> > > > > > > -- > View this message in context: > http://n2.nabble.com/jsecurity-under-jdk14-tp2245121p2258310.html > Sent from the JSecurity User mailing list jfarmer@example.com. > > --00163616413b51fc380461f0d911 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Sounds good - thanks!<br><br><div class=3D"gmail_quote">On Mon, Feb 2, 2009= at 9:59 AM, Csaba Nemeth <span dir=3D"ltr">&lt;<a href=3D"mailto:csaba_nem= jfarmer@example.com">jfarmer@example.com</a>&gt;</span> wrote:<br><blockquote cl= ass=3D"gmail_quote" style=3D"border-left: 1px solid rgb(204, 204, 204); mar= gin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> <br> I quickly tested the sample web application under tomcat 5.0.30 and java<br= > 1.4.2.<br> <br> I had to make the following changes:<br> <br> The configuration classes use 1.5 api class - java.util.Scanner, I had to<b= r> eliminate the use of this class.<br> <br> The default cache manager - based on hashtable - didn&#39;t seem to work un= der<br> 1.4 - while it works fine under 1.6 - I configured the application to use<b= r> EhCache.<br> <br> The sample web application worked as expected after these changes.<br> <br> I go ahead and raise a JIRA issue for the configuration classes that need t= o<br> be changed in order to get it working under 1.4<br> <div><div></div><div class=3D"Wj3C7c"><br> <br> Les Hazlewood-2 wrote:<br> &gt;<br> &gt; Hi Csaba,<br> &gt;<br> &gt; For now, we still do support 1.3 and 1.4. &nbsp;We haven&#39;t as a te= am made the<br> &gt; decision to leave them behind, so they are still supposed to be suppor= ted.<br> &gt;<br> &gt; So, if you find something that needs to be fixed to ensure it works wi= th<br> &gt; RetroWeaver and 1.4, please open a Jira issue so it is identified. &nb= sp;If we<br> &gt; can fix it, we will :)<br> &gt;<br> &gt; Cheers,<br> &gt;<br> &gt; Les<br> &gt;<br> &gt; On Fri, Jan 30, 2009 at 10:42 AM, Csaba Nemeth<br> &gt; &lt;<a href=3D"mailto:jfarmer@example.com">jfarmer@example.com</a>= &gt;wrote:<br> &gt;<br> &gt;&gt; Hi,<br> &gt;&gt;<br> &gt;&gt; well alright, it is too bad as jsecurity looks very good so far.<b= r> &gt;&gt;<br> &gt;&gt; Unfortunately some companies are still using older servers and the= y still<br> &gt;&gt; need changes, enhancements to existing applications.<br> &gt;&gt;<br> &gt;&gt; Seems like I have to look into other options.<br> &gt;&gt; Any suggestions for 1.4?<br> &gt;&gt;<br> &gt;&gt; Thanks,<br> &gt;&gt; Csaba<br> &gt;&gt;<br> &gt;&gt;<br> &gt;&gt; --- On Fri, 1/30/09, Les Hazlewood &lt;<a href=3D"mailto:lhazlewoo= jfarmer@example.com">jfarmer@example.com</a>&gt; wrote:<br> &gt;&gt;<br> &gt;&gt; &gt; From: Les Hazlewood &lt;<a href=3D"mailto:jfarmer@example.com= rg">jfarmer@example.com</a>&gt;<br> &gt;&gt; &gt; Subject: Re: jsecurity under jdk14<br> &gt;&gt; &gt; To: <a href=3D"mailto:jfarmer@example.com">js= jfarmer@example.com</a>, <a href=3D"mailto:csaba_nemeth@yahoo= .ca">jfarmer@example.com</a><br> &gt;&gt; &gt; Received: Friday, January 30, 2009, 10:10 AM<br> &gt;&gt; &gt; Hi Csaba,<br> &gt;&gt; &gt;<br> &gt;&gt; &gt; We haven&#39;t discussed really about 1.3 and 1.4<br> &gt;&gt; &gt; capability. &nbsp;In fact, although<br> &gt;&gt; &gt; I&#39;m afraid you won&#39;t be happy about this, I was<br> &gt;&gt; &gt; going to ask the rest of the<br> &gt;&gt; &gt; JSecurity dev team if we should only focus on 1.5+ from now<b= r> &gt;&gt; &gt; on.<br> &gt;&gt; &gt;<br> &gt;&gt; &gt; 1.5 already begun its end-of-life phase a while ago and 1.3<b= r> &gt;&gt; &gt; and 1.4 are<br> &gt;&gt; &gt; already decommissioned by Sun. &nbsp;I don&#39;t know that it= <br> &gt;&gt; &gt; would be worth our<br> &gt;&gt; &gt; effort to continually check for 1.3/1.4 compatibility when<br= > &gt;&gt; &gt; probably 99% of<br> &gt;&gt; &gt; our uses are 1.5+.<br> &gt;&gt; &gt;<br> &gt;&gt; &gt; My estimation could be incorrect of course. &nbsp;I&#39;m ope= n<br> &gt;&gt; &gt; to feedback from<br> &gt;&gt; &gt; others if we should continue to support 1.4 and below...<br> &gt;&gt; &gt;<br> &gt;&gt; &gt; If you are able to identify what parts of the API fail,<br> &gt;&gt; &gt; then maybe we might<br> &gt;&gt; &gt; be able to revert some code to be compatible. &nbsp;But I<br> &gt;&gt; &gt; don&#39;t know if it would<br> &gt;&gt; &gt; be worth it or not when there is already a lot of work to<br> &gt;&gt; &gt; be done for<br> &gt;&gt; &gt; JSecurity 1.0 :/<br> &gt;&gt; &gt;<br> &gt;&gt; &gt; Thanks for the feedback. &nbsp;How do others feel?<br> &gt;&gt; &gt;<br> &gt;&gt; &gt; Cheers,<br> &gt;&gt; &gt;<br> &gt;&gt; &gt; Les<br> &gt;&gt; &gt;<br> &gt;&gt; &gt; On Fri, Jan 30, 2009 at 9:48 AM, Csaba Nemeth<br> &gt;&gt; &gt; &lt;<a href=3D"mailto:jfarmer@example.com">csaba_nemeth@yah= oo.ca</a>&gt; wrote:<br> &gt;&gt; &gt;<br> &gt;&gt; &gt; &gt; Hello,<br> &gt;&gt; &gt; &gt;<br> &gt;&gt; &gt; &gt; I am testing jsecurity for a project that is based on<br= > &gt;&gt; &gt; jdk14.<br> &gt;&gt; &gt; &gt; I was happy to see while the code is jdk15, it uses<br> &gt;&gt; &gt; retroweaver for earlier<br> &gt;&gt; &gt; &gt; jdks.<br> &gt;&gt; &gt; &gt;<br> &gt;&gt; &gt; &gt; The only problem I found is that while the classes are<b= r> &gt;&gt; &gt; jdk14 compatible,<br> &gt;&gt; &gt; &gt; the api used is not.<br> &gt;&gt; &gt; &gt;<br> &gt;&gt; &gt; &gt; For example, running a simple example under jdk14 uses<b= r> &gt;&gt; &gt; the<br> &gt;&gt; &gt; &gt; TextConfigurationRealm - which uses the<br> &gt;&gt; &gt; java.util.Scanner - java 1.5 api.<br> &gt;&gt; &gt; &gt;<br> &gt;&gt; &gt; &gt; Are there any plans on using 1.4 api only?<br> &gt;&gt; &gt; &gt; Is it still the plan that jsecurity is going to work<br> &gt;&gt; &gt; under 1.4 and 1.3?<br> &gt;&gt; &gt; &gt;<br> &gt;&gt; &gt; &gt; Thank you,<br> &gt;&gt; &gt; &gt; Csaba<br> &gt;&gt; &gt; &gt;<br> &gt;&gt; &gt; &gt;<br> &gt;&gt; &gt; &gt;<br> &gt;&gt; &gt; _____________________________________________________________= _____<br> &gt;&gt; &gt; &gt; Instant Messaging, free SMS, sharing photos and<br> &gt;&gt; &gt; more... Try the new Yahoo!<br> &gt;&gt; &gt; &gt; Canada Messenger at<br> &gt;&gt; &gt; <a href=3D"http://ca.beta.messenger.yahoo.com/" target=3D"_bl= ank">http://ca.beta.messenger.yahoo.com/</a><br> &gt;&gt; &gt; &gt;<br> &gt;&gt;<br> &gt;&gt;<br> &gt;&gt; &nbsp; &nbsp; &nbsp;______________________________________________= ____________________<br> &gt;&gt; Instant Messaging, free SMS, sharing photos and more... Try the ne= w<br> &gt;&gt; Yahoo!<br> &gt;&gt; Canada Messenger at <a href=3D"http://ca.beta.messenger.yahoo.com/= " target=3D"_blank">http://ca.beta.messenger.yahoo.com/</a><br> &gt;&gt;<br> &gt;<br> &gt;<br> <br> </div></div><font color=3D"#888888">--<br> View this message in context: <a href=3D"http://n2.nabble.com/jsecurity-und= er-jdk14-tp2245121p2258310.html" target=3D"_blank">http://n2.nabble.com/jse= curity-under-jdk14-tp2245121p2258310.html</a><br> Sent from the JSecurity User mailing list jfarmer@example.com.<br> <br> </font></blockquote></div><br> --00163616413b51fc380461f0d911-- From jsecurity-user-return-jfarmer@example.com Mon Feb 02 22:05:29 2009 Return-Path: <jsecurity-user-return-jfarmer@example.com> Delivered-To: jfarmer@example.com Received: (qmail 91005 invoked from network); 2 Feb 2009 22:05:29 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur.apache.org with SMTP; 2 Feb 2009 22:05:29 -0000 Received: (qmail 7725 invoked by uid 500); 2 Feb 2009 22:05:29 -0000 Delivered-To: jfarmer@example.com Received: (qmail 7718 invoked by uid 500); 2 Feb 2009 22:05:29 -0000 Mailing-List: contact jfarmer@example.com; run by ezmlm Precedence: bulk List-Help: <mailto:jfarmer@example.com> List-Unsubscribe: <mailto:jfarmer@example.com> List-Post: <mailto:jfarmer@example.com> List-Id: <jsecurity-user.incubator.apache.org> Reply-To: jfarmer@example.com Delivered-To: mailing list jfarmer@example.com Received: (qmail 7709 invoked by uid 99); 2 Feb 2009 22:05:29 -0000 Received: from athena.apache.org (HELO athena.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 02 Feb 2009 14:05:29 -0800 X-ASF-Spam-Status: No, hits=0.2 required=10.0 tests=SPF_HELO_PASS,SPF_PASS,WHOIS_MYPRIVREG X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: domain of jfarmer@example.com designates 83.161.120.155 as permitted sender) Received: from [83.161.120.155] (HELO kuber.nabble.com) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 02 Feb 2009 22:05:22 +0000 Received: from tervel.nabble.com ([83.161.120.155]) by kuber.nabble.com with esmtp (Exim 4.63) (envelope-from <jfarmer@example.com>) id 1LU6ub-0000Px-81 for jfarmer@example.com; Mon, 02 Feb 2009 14:05:01 -0800 Message-ID: <jfarmer@example.com> Date: Mon, 2 Feb 2009 14:05:01 -0800 (PST) From: Csaba Nemeth <jfarmer@example.com> To: jfarmer@example.com Subject: rememberme doesn't work in sample web application MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Nabble-From: jfarmer@example.com X-Virus-Checked: Checked by ClamAV on apache.org As it looks like the sample web application should work with remember-me functionality by default. Here is what I try: I click login I select remember-me checkbox, enter username/password and successfully login I can visit the 'account' page I restart browser and visit home page, it looks like I am still logged in when I try to access the 'account' page I am given a login page as if I wasn't logged in. Am I missing something? Shouldn't this work out of the box? I tried with 9.0 final and 1.0 snapshot - both work the same way. Thanks, Csaba -- View this message in context: http://n2.nabble.com/rememberme-doesn%27t-work-in-sample-web-application-tp2260537p2260537.html Sent from the JSecurity User mailing list jfarmer@example.com. From jsecurity-user-return-jfarmer@example.com Mon Feb 02 22:15:10 2009 Return-Path: <jsecurity-user-return-jfarmer@example.com> Delivered-To: jfarmer@example.com Received: (qmail 96221 invoked from network); 2 Feb 2009 22:15:09 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur.apache.org with SMTP; 2 Feb 2009 22:15:09 -0000 Received: (qmail 19081 invoked by uid 500); 2 Feb 2009 22:15:09 -0000 Delivered-To: jfarmer@example.com Received: (qmail 19068 invoked by uid 500); 2 Feb 2009 22:15:09 -0000 Mailing-List: contact jfarmer@example.com; run by ezmlm Precedence: bulk List-Help: <mailto:jfarmer@example.com> List-Unsubscribe: <mailto:jfarmer@example.com> List-Post: <mailto:jfarmer@example.com> List-Id: <jsecurity-user.incubator.apache.org> Reply-To: jfarmer@example.com Delivered-To: mailing list jfarmer@example.com Received: (qmail 19059 invoked by uid 99); 2 Feb 2009 22:15:09 -0000 Received: from athena.apache.org (HELO athena.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 02 Feb 2009 14:15:09 -0800 X-ASF-Spam-Status: No, hits=3.6 required=10.0 tests=HTML_MESSAGE,SPF_NEUTRAL,WHOIS_MYPRIVREG X-Spam-Check-By: apache.org Received-SPF: neutral (athena.apache.org: local policy) Received: from [83.161.120.155] (HELO yw-out-1718.google.com) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 02 Feb 2009 22:15:02 +0000 Received: by yw-out-1718.google.com with SMTP id 5so628034ywr.0 for <jfarmer@example.com>; Mon, 02 Feb 2009 14:14:40 -0800 (PST) MIME-Version: 1.0 Sender: jfarmer@example.com Received: by 83.161.120.155 with SMTP id e4mr3033387age.113.1233612880241; Mon, 02 Feb 2009 14:14:40 -0800 (PST) In-Reply-To: <jfarmer@example.com> References: <jfarmer@example.com> Date: Mon, 2 Feb 2009 17:14:40 -0500 X-Google-Sender-Auth: 668ff3baa8a02112 Message-ID: <jfarmer@example.com> Subject: Re: rememberme doesn't work in sample web application From: Les Hazlewood <jfarmer@example.com> To: jfarmer@example.com Content-Type: multipart/alternative; boundary=001636283b548464220461f6e1e7 X-Virus-Checked: Checked by ClamAV on apache.org --001636283b548464220461f6e1e7 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Hi Csaba, It did work prior to 9.0 final, but there were some changes/moves with all the sample applications that might cause it to fail. There is currently a Jira issue to ensure that all sample apps run successfully, as a sanity check, before releasing 1.0. Of course, we'd love to have any contributions you might have that point out where something is failing! I'm very appreciative of any feedback you may have. Best, Les On Mon, Feb 2, 2009 at 5:05 PM, Csaba Nemeth <jfarmer@example.com> wrote: > > As it looks like the sample web application should work with remember-me > functionality by default. > > Here is what I try: > I click login > I select remember-me checkbox, enter username/password and successfully > login > I can visit the 'account' page > I restart browser and visit home page, it looks like I am still logged in > when I try to access the 'account' page I am given a login page as if I > wasn't logged in. > > Am I missing something? > Shouldn't this work out of the box? > > I tried with 9.0 final and 1.0 snapshot - both work the same way. > > Thanks, > Csaba > -- > View this message in context: > http://n2.nabble.com/rememberme-doesn%27t-work-in-sample-web-application-tp2260537p2260537.html > Sent from the JSecurity User mailing list jfarmer@example.com. > > --001636283b548464220461f6e1e7 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi Csaba,<br><br>It did work prior to 9.0 final, but there were some change= s/moves with all the sample applications that might cause it to fail.&nbsp;= There is currently a Jira issue to ensure that all sample apps run success= fully, as a sanity check, before releasing 1.0.<br> <br>Of course, we&#39;d love to have any contributions you might have that = point out where something is failing!&nbsp; I&#39;m very appreciative of an= y feedback you may have.<br><br>Best,<br><br>Les<br><br><div class=3D"gmail= _quote"> On Mon, Feb 2, 2009 at 5:05 PM, Csaba Nemeth <span dir=3D"ltr">&lt;<a href= =3D"mailto:jfarmer@example.com">jfarmer@example.com</a>&gt;</span> wrot= e:<br><blockquote class=3D"gmail_quote" style=3D"border-left: 1px solid rgb= (204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> <br> As it looks like the sample web application should work with remember-me<br= > functionality by default.<br> <br> Here is what I try:<br> &nbsp;I click login<br> &nbsp;I select remember-me checkbox, enter username/password and successful= ly<br> login<br> &nbsp;I can visit the &#39;account&#39; page<br> &nbsp;I restart browser and visit home page, it looks like I am still logge= d in<br> &nbsp;when I try to access the &#39;account&#39; page I am given a login pa= ge as if I<br> wasn&#39;t logged in.<br> <br> Am I missing something?<br> Shouldn&#39;t this work out of the box?<br> <br> I tried with 9.0 final and 1.0 snapshot - both work the same way.<br> <br> Thanks,<br> Csaba<br> <font color=3D"#888888">--<br> View this message in context: <a href=3D"http://n2.nabble.com/rememberme-do= esn%27t-work-in-sample-web-application-tp2260537p2260537.html" target=3D"_b= lank">http://n2.nabble.com/rememberme-doesn%27t-work-in-sample-web-applicat= ion-tp2260537p2260537.html</a><br> Sent from the JSecurity User mailing list jfarmer@example.com.<br> <br> </font></blockquote></div><br> --001636283b548464220461f6e1e7-- From jsecurity-user-return-jfarmer@example.com Tue Feb 03 15:20:24 2009 Return-Path: <jsecurity-user-return-jfarmer@example.com> Delivered-To: jfarmer@example.com Received: (qmail 66942 invoked from network); 3 Feb 2009 15:20:24 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur.apache.org with SMTP; 3 Feb 2009 15:20:24 -0000 Received: (qmail 66235 invoked by uid 500); 3 Feb 2009 15:20:24 -0000 Delivered-To: jfarmer@example.com Received: (qmail 66221 invoked by uid 500); 3 Feb 2009 15:20:24 -0000 Mailing-List: contact jfarmer@example.com; run by ezmlm Precedence: bulk List-Help: <mailto:jfarmer@example.com> List-Unsubscribe: <mailto:jfarmer@example.com> List-Post: <mailto:jfarmer@example.com> List-Id: <jsecurity-user.incubator.apache.org> Reply-To: jfarmer@example.com Delivered-To: mailing list jfarmer@example.com Received: (qmail 66212 invoked by uid 99); 3 Feb 2009 15:20:24 -0000 Received: from athena.apache.org (HELO athena.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 03 Feb 2009 07:20:24 -0800 X-ASF-Spam-Status: No, hits=0.2 required=10.0 tests=SPF_HELO_PASS,SPF_PASS,WHOIS_MYPRIVREG X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: domain of jfarmer@example.com designates 83.161.120.155 as permitted sender) Received: from [83.161.120.155] (HELO kuber.nabble.com) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 03 Feb 2009 15:20:16 +0000 Received: from tervel.nabble.com ([83.161.120.155]) by kuber.nabble.com with esmtp (Exim 4.63) (envelope-from <jfarmer@example.com>) id 1LUN47-0001JR-Tq for jfarmer@example.com; Tue, 03 Feb 2009 07:19:55 -0800 Message-ID: <jfarmer@example.com> Date: Tue, 3 Feb 2009 07:19:55 -0800 (PST) From: Csaba Nemeth <jfarmer@example.com> To: jfarmer@example.com Subject: Re: rememberme doesn't work in sample web application In-Reply-To: <jfarmer@example.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Nabble-From: jfarmer@example.com References: <jfarmer@example.com> <jfarmer@example.com> X-Virus-Checked: Checked by ClamAV on apache.org Hi Les, I debugged the filter and rememberme manager. Probably I misunderstand something. Should the rememberme manager recreate the subject as authenticated user, or just validate the cookie content, recreate the subject with roles, but not mark it as authenticated? The information what the home page displays suggests that the user is valid (logged in) on server side - as it shows the username and roles. But than again it is a sample application. So the change needed in the sample app is to show the username in the login window that was displayed during a non-authenticated acccess to the protected 'account' page with a valid principal in the session, and perhaps display on the home page that the subject is not authenticated? Thanks, Csaba Les Hazlewood-2 wrote: > > Hi Csaba, > > It did work prior to 9.0 final, but there were some changes/moves with all > the sample applications that might cause it to fail. There is currently a > Jira issue to ensure that all sample apps run successfully, as a sanity > check, before releasing 1.0. > > Of course, we'd love to have any contributions you might have that point > out > where something is failing! I'm very appreciative of any feedback you may > have. > > Best, > > Les > > On Mon, Feb 2, 2009 at 5:05 PM, Csaba Nemeth <jfarmer@example.com> > wrote: > >> >> As it looks like the sample web application should work with remember-me >> functionality by default. >> >> Here is what I try: >> I click login >> I select remember-me checkbox, enter username/password and successfully >> login >> I can visit the 'account' page >> I restart browser and visit home page, it looks like I am still logged >> in >> when I try to access the 'account' page I am given a login page as if I >> wasn't logged in. >> >> Am I missing something? >> Shouldn't this work out of the box? >> >> I tried with 9.0 final and 1.0 snapshot - both work the same way. >> >> Thanks, >> Csaba >> -- >> View this message in context: >> http://n2.nabble.com/rememberme-doesn%27t-work-in-sample-web-application-tp2260537p2260537.html >> Sent from the JSecurity User mailing list jfarmer@example.com. >> >> > > -- View this message in context: http://n2.nabble.com/rememberme-doesn%27t-work-in-sample-web-application-tp2260537p2263828.html Sent from the JSecurity User mailing list jfarmer@example.com. From jsecurity-user-return-jfarmer@example.com Tue Feb 03 17:17:57 2009 Return-Path: <jsecurity-user-return-jfarmer@example.com> Delivered-To: jfarmer@example.com Received: (qmail 26234 invoked from network); 3 Feb 2009 17:17:57 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur.apache.org with SMTP; 3 Feb 2009 17:17:57 -0000 Received: (qmail 96927 invoked by uid 500); 3 Feb 2009 17:17:57 -0000 Delivered-To: jfarmer@example.com Received: (qmail 96916 invoked by uid 500); 3 Feb 2009 17:17:57 -0000 Mailing-List: contact jfarmer@example.com; run by ezmlm Precedence: bulk List-Help: <mailto:jfarmer@example.com> List-Unsubscribe: <mailto:jfarmer@example.com> List-Post: <mailto:jfarmer@example.com> List-Id: <jsecurity-user.incubator.apache.org> Reply-To: jfarmer@example.com Delivered-To: mailing list jfarmer@example.com Received: (qmail 96907 invoked by uid 99); 3 Feb 2009 17:17:57 -0000 Received: from athena.apache.org (HELO athena.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 03 Feb 2009 09:17:57 -0800 X-ASF-Spam-Status: No, hits=0.2 required=10.0 tests=SPF_HELO_PASS,SPF_PASS,WHOIS_MYPRIVREG X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: domain of jfarmer@example.com designates 83.161.120.155 as permitted sender) Received: from [83.161.120.155] (HELO kuber.nabble.com) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 03 Feb 2009 17:17:49 +0000 Received: from tervel.nabble.com ([83.161.120.155]) by kuber.nabble.com with esmtp (Exim 4.63) (envelope-from <jfarmer@example.com>) id 1LUOtt-0007Om-31 for jfarmer@example.com; Tue, 03 Feb 2009 09:17:29 -0800 Message-ID: <jfarmer@example.com> Date: Tue, 3 Feb 2009 09:17:29 -0800 (PST) From: jvreeker <jfarmer@example.com> To: jfarmer@example.com Subject: using CXF with JSecurity MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Nabble-From: jfarmer@example.com X-Virus-Checked: Checked by ClamAV on apache.org Hi, I have a tomcat server, with spring using cxf to enable the soap calls. So I have a soap call login. when I call securityManager.getSubject() I get always the same subject back. I though it was because I am using org.jsecurity.mgt.DefaultSecurityManager. So I tried DefaultWebSecurityManager but then I am getting errors. No ServletRequest found in ThreadContext. Make sure WebUtils.bind() is being called. But in the first option if I use getSubject().GetSession it returns different sessions. should I then use SessionManager and the correct sessionID. Is this the correct way? Thanks, Jelle -- View this message in context: http://n2.nabble.com/using-CXF-with-JSecurity-tp2264471p2264471.html Sent from the JSecurity User mailing list jfarmer@example.com. From jsecurity-user-return-jfarmer@example.com Tue Feb 03 17:36:21 2009 Return-Path: <jsecurity-user-return-jfarmer@example.com> Delivered-To: jfarmer@example.com Received: (qmail 38784 invoked from network); 3 Feb 2009 17:36:21 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur.apache.org with SMTP; 3 Feb 2009 17:36:21 -0000 Received: (qmail 32915 invoked by uid 500); 3 Feb 2009 17:36:21 -0000 Delivered-To: jfarmer@example.com Received: (qmail 32905 invoked by uid 500); 3 Feb 2009 17:36:21 -0000 Mailing-List: contact jfarmer@example.com; run by ezmlm Precedence: bulk List-Help: <mailto:jfarmer@example.com> List-Unsubscribe: <mailto:jfarmer@example.com> List-Post: <mailto:jfarmer@example.com> List-Id: <jsecurity-user.incubator.apache.org> Reply-To: jfarmer@example.com Delivered-To: mailing list jfarmer@example.com Received: (qmail 32894 invoked by uid 99); 3 Feb 2009 17:36:21 -0000 Received: from nike.apache.org (HELO nike.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 03 Feb 2009 09:36:21 -0800 X-ASF-Spam-Status: No, hits=3.6 required=10.0 tests=HTML_MESSAGE,SPF_NEUTRAL,WHOIS_MYPRIVREG X-Spam-Check-By: apache.org Received-SPF: neutral (nike.apache.org: local policy) Received: from [83.161.120.155] (HELO yw-out-1718.google.com) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 03 Feb 2009 17:36:12 +0000 Received: by yw-out-1718.google.com with SMTP id 5so772088ywr.0 for <jfarmer@example.com>; Tue, 03 Feb 2009 09:35:50 -0800 (PST) MIME-Version: 1.0 Sender: jfarmer@example.com Received: by 83.161.120.155 with SMTP id a13mr690303agc.70.1233682549784; Tue, 03 Feb 2009 09:35:49 -0800 (PST) In-Reply-To: <jfarmer@example.com> References: <jfarmer@example.com> Date: Tue, 3 Feb 2009 12:35:49 -0500 X-Google-Sender-Auth: ecec7bbb9c04519a Message-ID: <jfarmer@example.com> Subject: Re: using CXF with JSecurity From: Les Hazlewood <jfarmer@example.com> To: jfarmer@example.com Content-Type: multipart/alternative; boundary=001636283694253fcc0462071a67 X-Virus-Checked: Checked by ClamAV on apache.org --001636283694253fcc0462071a67 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Hi Jelle, The appropriate set-up for a web-enabled application is to use the JSecurityFilter in web.xml. It will set up a DefaultWebSecurityManager and do Request binding automatically: http://www.jsecurity.org/api/org/jsecurity/web/servlet/JSecurityFilter.html After the filter is defined, just do this anywhere in code: SecurityUtils.getSubject(); You shouldn't interact with the SecurityManager directly unless you're programming infrastructure/framework code. Check out the sample web application in the jsecurity distribution and look at its web.xml file and applicationContext.xml file. It shows you how to configure Realms and other things in Spring which will then be accessible to the jfarmer@example.com. Cheers, Les On Tue, Feb 3, 2009 at 12:17 PM, jvreeker <jfarmer@example.com> wrote: > > Hi, > > I have a tomcat server, with spring using cxf to enable the soap calls. > > So I have a soap call login. when I call securityManager.getSubject() I get > always the same subject back. > I though it was because I am using > org.jsecurity.mgt.DefaultSecurityManager. > > So I tried DefaultWebSecurityManager but then I am getting errors. > No ServletRequest found in ThreadContext. Make sure WebUtils.bind() is > being > called. > > But in the first option if I use getSubject().GetSession it returns > different sessions. > should I then use SessionManager and the correct sessionID. > > Is this the correct way? > Thanks, > Jelle > -- > View this message in context: > http://n2.nabble.com/using-CXF-with-JSecurity-tp2264471p2264471.html > Sent from the JSecurity User mailing list jfarmer@example.com. > > --001636283694253fcc0462071a67 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi Jelle,<br><br>The appropriate set-up for a web-enabled application is to= use the JSecurityFilter in web.xml.&nbsp; It will set up a DefaultWebSecur= ityManager and do Request binding automatically:<br><br><a href=3D"http://w= ww.jsecurity.org/api/org/jsecurity/web/servlet/JSecurityFilter.html">http:/= /www.jsecurity.org/api/org/jsecurity/web/servlet/JSecurityFilter.html</a><b= r> <br>After the filter is defined, just do this anywhere in code:<br><br>Secu= rityUtils.getSubject();<br><br>You shouldn&#39;t interact with the Security= Manager directly unless you&#39;re programming infrastructure/framework cod= e.<br> <br>Check out the sample web application in the jsecurity distribution and = look at its web.xml file and applicationContext.xml file.&nbsp; It shows yo= u how to configure Realms and other things in Spring which will then be acc= essible to the jfarmer@example.com.<br> <br>Cheers,<br><br>Les<br><br><div class=3D"gmail_quote">On Tue, Feb 3, 200= 9 at 12:17 PM, jvreeker <span dir=3D"ltr">&lt;<a href=3D"mailto:jvreeker@va= ngennep.nl">jfarmer@example.com</a>&gt;</span> wrote:<br><blockquote clas= s=3D"gmail_quote" style=3D"border-left: 1px solid rgb(204, 204, 204); margi= n: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> <br> Hi,<br> <br> I have a tomcat server, with spring using cxf to enable the soap calls.<br> <br> So I have a soap call login. when I call securityManager.getSubject() I get= <br> always the same subject back.<br> I though it was because I am using org.jsecurity.mgt.DefaultSecurityManager= .<br> <br> So I tried DefaultWebSecurityManager but then I am getting errors.<br> No ServletRequest found in ThreadContext. Make sure WebUtils.bind() is bein= g<br> called.<br> <br> But in the first option if I use getSubject().GetSession it returns<br> different sessions.<br> should I then use SessionManager and the correct sessionID.<br> <br> Is this the correct way?<br> Thanks,<br> Jelle<br> <font color=3D"#888888">--<br> View this message in context: <a href=3D"http://n2.nabble.com/using-CXF-wit= h-JSecurity-tp2264471p2264471.html" target=3D"_blank">http://n2.nabble.com/= using-CXF-with-JSecurity-tp2264471p2264471.html</a><br> Sent from the JSecurity User mailing list jfarmer@example.com.<br> <br> </font></blockquote></div><br> --001636283694253fcc0462071a67-- From jsecurity-user-return-jfarmer@example.com Tue Feb 03 17:44:25 2009 Return-Path: <jsecurity-user-return-jfarmer@example.com> Delivered-To: jfarmer@example.com Received: (qmail 45094 invoked from network); 3 Feb 2009 17:44:25 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur.apache.org with SMTP; 3 Feb 2009 17:44:25 -0000 Received: (qmail 47201 invoked by uid 500); 3 Feb 2009 17:44:25 -0000 Delivered-To: jfarmer@example.com Received: (qmail 47191 invoked by uid 500); 3 Feb 2009 17:44:25 -0000 Mailing-List: contact jfarmer@example.com; run by ezmlm Precedence: bulk List-Help: <mailto:jfarmer@example.com> List-Unsubscribe: <mailto:jfarmer@example.com> List-Post: <mailto:jfarmer@example.com> List-Id: <jsecurity-user.incubator.apache.org> Reply-To: jfarmer@example.com Delivered-To: mailing list jfarmer@example.com Received: (qmail 47182 invoked by uid 99); 3 Feb 2009 17:44:25 -0000 Received: from athena.apache.org (HELO athena.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 03 Feb 2009 09:44:25 -0800 X-ASF-Spam-Status: No, hits=3.6 required=10.0 tests=HTML_MESSAGE,SPF_NEUTRAL,WHOIS_MYPRIVREG X-Spam-Check-By: apache.org Received-SPF: neutral (athena.apache.org: local policy) Received: from [83.161.120.155] (HELO yx-out-1718.google.com) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 03 Feb 2009 17:44:17 +0000 Received: by yx-out-1718.google.com with SMTP id 36so772345yxh.0 for <jfarmer@example.com>; Tue, 03 Feb 2009 09:43:54 -0800 (PST) MIME-Version: 1.0 Sender: jfarmer@example.com Received: by 83.161.120.155 with SMTP id n5mr3577615aga.68.1233683034508; Tue, 03 Feb 2009 09:43:54 -0800 (PST) In-Reply-To: <jfarmer@example.com> References: <jfarmer@example.com> <jfarmer@example.com> <jfarmer@example.com> Date: Tue, 3 Feb 2009 12:43:54 -0500 X-Google-Sender-Auth: d58bec2fc149b898 Message-ID: <jfarmer@example.com> Subject: Re: rememberme doesn't work in sample web application From: Les Hazlewood <jfarmer@example.com> To: jfarmer@example.com Content-Type: multipart/alternative; boundary=0016361e7e7c098f7b046207375f X-Virus-Checked: Checked by ClamAV on apache.org --0016361e7e7c098f7b046207375f Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Hi Csaba, The RemberMeManager will _not_ mark a Subject as authenticated. Authentication is the act of proving you are who you say you are. When a user is remembered, the system has a good idea who the user is, but this is not actual proof. Please see this for an explanation of why: http://www.jsecurity.org/api/org/jsecurity/authc/RememberMeAuthenticationToken.html So you can be 'remembered', but not authenticated. Authentication state is only retained during the session when they actually authenticated. If that session is stopped or expired, so is their authentication status. The JavaDoc above should explain why you should still see your name and have roles and permission access, but still be required to log in if you try to access a 'security sensitive' part of the application. I hope that helps :) Cheers, Les On Tue, Feb 3, 2009 at 10:19 AM, Csaba Nemeth <jfarmer@example.com> wrote: > > Hi Les, > > I debugged the filter and rememberme manager. > Probably I misunderstand something. > > Should the rememberme manager recreate the subject as authenticated user, > or > just validate the cookie content, recreate the subject with roles, but not > mark it as authenticated? > > The information what the home page displays suggests that the user is valid > (logged in) on server side - as it shows the username and roles. But than > again it is a sample application. > > So the change needed in the sample app is to show the username in the login > window that was displayed during a non-authenticated acccess to the > protected 'account' page with a valid principal in the session, and perhaps > display on the home page that the subject is not authenticated? > > Thanks, > Csaba > > > Les Hazlewood-2 wrote: > > > > Hi Csaba, > > > > It did work prior to 9.0 final, but there were some changes/moves with > all > > the sample applications that might cause it to fail. There is currently > a > > Jira issue to ensure that all sample apps run successfully, as a sanity > > check, before releasing 1.0. > > > > Of course, we'd love to have any contributions you might have that point > > out > > where something is failing! I'm very appreciative of any feedback you > may > > have. > > > > Best, > > > > Les > > > > On Mon, Feb 2, 2009 at 5:05 PM, Csaba Nemeth <jfarmer@example.com> > > wrote: > > > >> > >> As it looks like the sample web application should work with remember-me > >> functionality by default. > >> > >> Here is what I try: > >> I click login > >> I select remember-me checkbox, enter username/password and successfully > >> login > >> I can visit the 'account' page > >> I restart browser and visit home page, it looks like I am still logged > >> in > >> when I try to access the 'account' page I am given a login page as if I > >> wasn't logged in. > >> > >> Am I missing something? > >> Shouldn't this work out of the box? > >> > >> I tried with 9.0 final and 1.0 snapshot - both work the same way. > >> > >> Thanks, > >> Csaba > >> -- > >> View this message in context: > >> > http://n2.nabble.com/rememberme-doesn%27t-work-in-sample-web-application-tp2260537p2260537.html > >> Sent from the JSecurity User mailing list jfarmer@example.com. > >> > >> > > > > > > -- > View this message in context: > http://n2.nabble.com/rememberme-doesn%27t-work-in-sample-web-application-tp2260537p2263828.html > Sent from the JSecurity User mailing list jfarmer@example.com. > > --0016361e7e7c098f7b046207375f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi Csaba,<br><br>The RemberMeManager will _not_ mark a Subject as authentic= ated.&nbsp; Authentication is the act of proving you are who you say you ar= e.&nbsp; When a user is remembered, the system has a good idea who the user= is, but this is not actual proof.<br> <br>Please see this for an explanation of why:<br><br><a href=3D"http://www= .jsecurity.org/api/org/jsecurity/authc/RememberMeAuthenticationToken.html">= http://www.jsecurity.org/api/org/jsecurity/authc/RememberMeAuthenticationTo= ken.html</a><br> <br>So you can be &#39;remembered&#39;, but not authenticated.&nbsp; Authen= tication state is only retained during the session when they actually authe= nticated.&nbsp; If that session is stopped or expired, so is their authenti= cation status.<br> <br>The JavaDoc above should explain why you should still see your name and= have roles and permission access, but still be required to log in if you t= ry to access a &#39;security sensitive&#39; part of the application.<br> <br>I hope that helps :)<br><br>Cheers,<br><br>Les<br><br><div class=3D"gma= il_quote">On Tue, Feb 3, 2009 at 10:19 AM, Csaba Nemeth <span dir=3D"ltr">&= lt;<a href=3D"mailto:jfarmer@example.com">jfarmer@example.com</a>&gt;</= span> wrote:<br> <blockquote class=3D"gmail_quote" style=3D"border-left: 1px solid rgb(204, = 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><br> Hi Les,<br> <br> I debugged the filter and rememberme manager.<br> Probably I misunderstand something.<br> <br> Should the rememberme manager recreate the subject as authenticated user, o= r<br> just validate the cookie content, recreate the subject with roles, but not<= br> mark it as authenticated?<br> <br> The information what the home page displays suggests that the user is valid= <br> (logged in) on server side - as it shows the username and roles. But than<b= r> again it is a sample application.<br> <br> So the change needed in the sample app is to show the username in the login= <br> window that was displayed during a non-authenticated acccess to the<br> protected &#39;account&#39; page with a valid principal in the session, and= perhaps<br> display on the home page that the subject is not authenticated?<br> <br> Thanks,<br> Csaba<br> <div><div></div><div class=3D"Wj3C7c"><br> <br> Les Hazlewood-2 wrote:<br> &gt;<br> &gt; Hi Csaba,<br> &gt;<br> &gt; It did work prior to 9.0 final, but there were some changes/moves with= all<br> &gt; the sample applications that might cause it to fail. &nbsp;There is cu= rrently a<br> &gt; Jira issue to ensure that all sample apps run successfully, as a sanit= y<br> &gt; check, before releasing 1.0.<br> &gt;<br> &gt; Of course, we&#39;d love to have any contributions you might have that= point<br> &gt; out<br> &gt; where something is failing! &nbsp;I&#39;m very appreciative of any fee= dback you may<br> &gt; have.<br> &gt;<br> &gt; Best,<br> &gt;<br> &gt; Les<br> &gt;<br> &gt; On Mon, Feb 2, 2009 at 5:05 PM, Csaba Nemeth &lt;<a href=3D"mailto:csa= jfarmer@example.com">jfarmer@example.com</a>&gt;<br> &gt; wrote:<br> &gt;<br> &gt;&gt;<br> &gt;&gt; As it looks like the sample web application should work with remem= ber-me<br> &gt;&gt; functionality by default.<br> &gt;&gt;<br> &gt;&gt; Here is what I try:<br> &gt;&gt; &nbsp;I click login<br> &gt;&gt; &nbsp;I select remember-me checkbox, enter username/password and s= uccessfully<br> &gt;&gt; login<br> &gt;&gt; &nbsp;I can visit the &#39;account&#39; page<br> &gt;&gt; &nbsp;I restart browser and visit home page, it looks like I am st= ill logged<br> &gt;&gt; in<br> &gt;&gt; &nbsp;when I try to access the &#39;account&#39; page I am given a= login page as if I<br> &gt;&gt; wasn&#39;t logged in.<br> &gt;&gt;<br> &gt;&gt; Am I missing something?<br> &gt;&gt; Shouldn&#39;t this work out of the box?<br> &gt;&gt;<br> &gt;&gt; I tried with 9.0 final and 1.0 snapshot - both work the same way.<= br> &gt;&gt;<br> &gt;&gt; Thanks,<br> &gt;&gt; Csaba<br> &gt;&gt; --<br> &gt;&gt; View this message in context:<br> &gt;&gt; <a href=3D"http://n2.nabble.com/rememberme-doesn%27t-work-in-sampl= e-web-application-tp2260537p2260537.html" target=3D"_blank">http://n2.nabbl= e.com/rememberme-doesn%27t-work-in-sample-web-application-tp2260537p2260537= .html</a><br> &gt;&gt; Sent from the JSecurity User mailing list jfarmer@example.com.<b= r> &gt;&gt;<br> &gt;&gt;<br> &gt;<br> &gt;<br> <br> </div></div><font color=3D"#888888">--<br> View this message in context: <a href=3D"http://n2.nabble.com/rememberme-do= esn%27t-work-in-sample-web-application-tp2260537p2263828.html" target=3D"_b= lank">http://n2.nabble.com/rememberme-doesn%27t-work-in-sample-web-applicat= ion-tp2260537p2263828.html</a><br> </font><div><div></div><div class=3D"Wj3C7c">Sent from the JSecurity User m= ailing list jfarmer@example.com.<br> <br> </div></div></blockquote></div><br> --0016361e7e7c098f7b046207375f-- From jsecurity-user-return-jfarmer@example.com Wed Feb 04 17:07:43 2009 Return-Path: <jsecurity-user-return-jfarmer@example.com> Delivered-To: jfarmer@example.com Received: (qmail 62480 invoked from network); 4 Feb 2009 17:07:43 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur.apache.org with SMTP; 4 Feb 2009 17:07:43 -0000 Received: (qmail 65341 invoked by uid 500); 4 Feb 2009 17:07:42 -0000 Delivered-To: jfarmer@example.com Received: (qmail 65306 invoked by uid 500); 4 Feb 2009 17:07:42 -0000 Mailing-List: contact jfarmer@example.com; run by ezmlm Precedence: bulk List-Help: <mailto:jfarmer@example.com> List-Unsubscribe: <mailto:jfarmer@example.com> List-Post: <mailto:jfarmer@example.com> List-Id: <jsecurity-user.incubator.apache.org> Reply-To: jfarmer@example.com Delivered-To: mailing list jfarmer@example.com Received: (qmail 65280 invoked by uid 99); 4 Feb 2009 17:07:42 -0000 Received: from nike.apache.org (HELO nike.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 04 Feb 2009 09:07:42 -0800 X-ASF-Spam-Status: No, hits=0.2 required=10.0 tests=SPF_HELO_PASS,SPF_PASS,WHOIS_MYPRIVREG X-Spam-Check-By: apache.org Received-SPF: pass (nike.apache.org: domain of jfarmer@example.com designates 83.161.120.155 as permitted sender) Received: from [83.161.120.155] (HELO kuber.nabble.com) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 04 Feb 2009 17:07:33 +0000 Received: from tervel.nabble.com ([83.161.120.155]) by kuber.nabble.com with esmtp (Exim 4.63) (envelope-from <jfarmer@example.com>) id 1LUlDU-0003zl-Ux for jfarmer@example.com; Wed, 04 Feb 2009 09:07:12 -0800 Message-ID: <jfarmer@example.com> Date: Wed, 4 Feb 2009 09:07:12 -0800 (PST) From: jvreeker <jfarmer@example.com> To: jfarmer@example.com Subject: Re: using CXF with JSecurity In-Reply-To: <jfarmer@example.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Nabble-From: jfarmer@example.com References: <jfarmer@example.com> <jfarmer@example.com> X-Virus-Checked: Checked by ClamAV on apache.org Hi Les, So I build in the JSecurityFilter, but If I use SecurityUtils.getSubject().getSession() I still get different sessions. I am need the same session, because if I am logged in I use the function setAttribute. TRACE org.jsecurity.session.mgt.DefaultSessionManager - Creating session for originating host [/83.161.120.155] Why is it still creating new sessions.? Jelle Les Hazlewood-2 wrote: > > Hi Jelle, > > The appropriate set-up for a web-enabled application is to use the > JSecurityFilter in web.xml. It will set up a DefaultWebSecurityManager > and > do Request binding automatically: > > http://www.jsecurity.org/api/org/jsecurity/web/servlet/JSecurityFilter.html > > After the filter is defined, just do this anywhere in code: > > SecurityUtils.getSubject(); > > You shouldn't interact with the SecurityManager directly unless you're > programming infrastructure/framework code. > > Check out the sample web application in the jsecurity distribution and > look > at its web.xml file and applicationContext.xml file. It shows you how to > configure Realms and other things in Spring which will then be accessible > to > the jfarmer@example.com. > > Cheers, > > Les > > On Tue, Feb 3, 2009 at 12:17 PM, jvreeker <jfarmer@example.com> wrote: > >> >> Hi, >> >> I have a tomcat server, with spring using cxf to enable the soap calls. >> >> So I have a soap call login. when I call securityManager.getSubject() I >> get >> always the same subject back. >> I though it was because I am using >> org.jsecurity.mgt.DefaultSecurityManager. >> >> So I tried DefaultWebSecurityManager but then I am getting errors. >> No ServletRequest found in ThreadContext. Make sure WebUtils.bind() is >> being >> called. >> >> But in the first option if I use getSubject().GetSession it returns >> different sessions. >> should I then use SessionManager and the correct sessionID. >> >> Is this the correct way? >> Thanks, >> Jelle >> -- >> View this message in context: >> http://n2.nabble.com/using-CXF-with-JSecurity-tp2264471p2264471.html >> Sent from the JSecurity User mailing list jfarmer@example.com. >> >> > > -- View this message in context: http://n2.nabble.com/using-CXF-with-JSecurity-tp2264471p2270012.html Sent from the JSecurity User mailing list jfarmer@example.com. From jsecurity-user-return-jfarmer@example.com Wed Feb 04 17:15:06 2009 Return-Path: <jsecurity-user-return-jfarmer@example.com> Delivered-To: jfarmer@example.com Received: (qmail 65904 invoked from network); 4 Feb 2009 17:15:06 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur.apache.org with SMTP; 4 Feb 2009 17:15:06 -0000 Received: (qmail 76949 invoked by uid 500); 4 Feb 2009 17:15:05 -0000 Delivered-To: jfarmer@example.com Received: (qmail 76939 invoked by uid 500); 4 Feb 2009 17:15:05 -0000 Mailing-List: contact jfarmer@example.com; run by ezmlm Precedence: bulk List-Help: <mailto:jfarmer@example.com> List-Unsubscribe: <mailto:jfarmer@example.com> List-Post: <mailto:jfarmer@example.com> List-Id: <jsecurity-user.incubator.apache.org> Reply-To: jfarmer@example.com Delivered-To: mailing list jfarmer@example.com Received: (qmail 76930 invoked by uid 99); 4 Feb 2009 17:15:05 -0000 Received: from athena.apache.org (HELO athena.apache.org) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 04 Feb 2009 09:15:05 -0800 X-ASF-Spam-Status: No, hits=3.6 required=10.0 tests=HTML_MESSAGE,NORMAL_HTTP_TO_IP,SPF_NEUTRAL,WHOIS_MYPRIVREG X-Spam-Check-By: apache.org Received-SPF: neutral (athena.apache.org: local policy) Received: from [83.161.120.155] (HELO yw-out-1718.google.com) (83.161.120.155) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 04 Feb 2009 17:14:57 +0000 Received: by yw-out-1718.google.com with SMTP id 5so997294ywr.0 for <jfarmer@example.com>; Wed, 04 Feb 2009 09:14:36 -0800 (PST) MIME-Version: 1.0 Sender: jfarmer@example.com Received: by 83.161.120.155 with SMTP id y7mr2349739agb.59.1233767676327; Wed, 04 Feb 2009 09:14:36 -0800 (PST) In-Reply-To: <jfarmer@example.com> References: <jfarmer@example.com> <jfarmer@example.com> <jfarmer@example.com> Date: Wed, 4 Feb 2009 12:14:36 -0500 X-Google-Sender-Auth: 269666367f25430b Message-ID: <jfarmer@example.com> Subject: Re: using CXF with JSecurity From: Les Hazlewood <jfarmer@example.com> To: jfarmer@example.com Content-Type: multipart/alternative; boundary=0016362834ee1535f904621aecaf X-Virus-Checked: Checked by ClamAV on apache.org --0016362834ee1535f904621aecaf Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Can we see the relevant parts of your web.xml and Spring xml configuration? Its hard to say without it... On Wed, Feb 4, 2009 at 12:07 PM, jvreeker <jfarmer@example.com> wrote: > > Hi Les, > > So I build in the JSecurityFilter, but If I use > SecurityUtils.getSubject().getSession() I still get different sessions. I > am > need the same session, because if I am logged in I use the function > setAttribute. > TRACE org.jsecurity.session.mgt.DefaultSessionManager - Creating session > for originating host [/83.161.120.155] > > Why is it still creating new sessions.? > > Jelle > > > Les Hazlewood-2 wrote: > > > > Hi Jelle, > > > > The appropriate set-up for a web-enabled application is to use the > > JSecurityFilter in web.xml. It will set up a DefaultWebSecurityManager > > and > > do Request binding automatically: > > > > > http://www.jsecurity.org/api/org/jsecurity/web/servlet/JSecurityFilter.html > > > > After the filter is defined, just do this anywhere in code: > > > > SecurityUtils.getSubject(); > > >
{'source': 'Apache Software Foundation Public Mail Archives'}