Re: [Springframework-developer] Re: [Acegisecurity-developer] Acegi Security's ContextHolder replaced by SecurityContext

[Ben A. <ben...@ac...>]

Colin Sampaleanu wrote:

> As a follow-up, from memory (it's been about a year) I believe I used 
> a custom SecureContext to also pass along some EJB related security 
> information (principal name, or the ejb run-as user) between different 
> layers along with the Acegi specific info. The app in question was a 
> mixed EJB and Spring app, using the EJB version of OSWorkflow.

Thanks for the feedback Colin. I've just checked into CVS refactorings 
which adopt the following design:

SecurityContextHolder:InheritableThreadLocal -> 
SecurityContext:Interface -> Authentication:Interface

SecurityContextHolder guarantees to never return a null SecurityContex, 
so this refactoring delivers extensibility for cases such as Colin 
mentioned whilst not requiring casting or null checking as had been the 
case with the old ContextHolder / SecureContext approach.

Cheers
Ben