Re: [Springframework-developer] Road map (security)

[Colin S. <col...@ex...>]

Ben Alex wrote:

>>How about declarative security, should somehow also be 
>>mentioned in the roadmap. Any ideas so far about how to go about it?
>>    
>>
>
>Thought I'd jump in here. The Acegi Security System for Spring project now
>has a home at SoureForge. I'm currently writing automated container
>integration unit tests (ie unzip a stock standard container release, install
>the security module to it, and run unit tests). CVS and a new ZIP release
>will be at SourceForge in a day or two, and anyone interested is welcome to
>participate in development.
>
>Whilst I initially wrote the above project with a view to inclusion in
>Spring, I also recognise there are no Spring-specific dependencies apart
>from standard bean context and interceptor services. As such, from a
>technical perspective security could be effectively developed in a separate
>project, or as a separate module under Spring CVS. There is no technical
>requirement in having it in Spring core. The real issue is whether from a
>marketing perspective the Spring Framework needs its very own security
>capability/project, an "official" separate security project that users are
>pointed towards, or a list of external (untested) security projects that
>claim to support Spring.
>
>It would be nice to avoid duplication of efforts on security, particularly
>given most of it involves writing adapters between the project security and
>the container's native security. Maximising the user and developer base of a
>single security project will also have obvious benefits in terms of testing,
>issue identification, support and improvement.
>
>Ben
>  
>
Ben,

Your stuff looks great. I'm probably going to try using it in our main 
app in the relatively near-term (a month or so). I _really_ appreciate 
the work you've put into it.

At the same time, due to the fact the people's security needs are so 
varied, it might be a bit preliminary to bake it into Spring itself 
without letting people use it for a while, hopefully with the idea that 
any relevant comments or issues would be raised in the process. Once 
something is part of Spring itself it's going to be much harder to make 
backwards incompatible changes, whereas with an external add-on, there 
could simply be two versions. Just IMHO...

Regards,
Colin