RE : [Springframework-developer] Authentication and authorization

[JP P. <jp....@ti...>]

Hi Juergen,

I used the J2EE authentication with JDBC repository, checking in the
front of ServletController if the user was logged in without having his
data in session to put them.
But I will not continue to use this method. I have also thinked on the
filter method but not on HandlerAdapter. The two methods seem be the
more practical, but regardless of the chosen method, what URL can be
only reached by logged users or having a certain role has to be
extracted from the code and put in a file description (or SGBD?).
Perhaps in the ApplicationContext.xml or a specific file? If we would
use regular expressions, will we have to use external libs like ORO?

Regards,
Jean-Pierre


> -----Message d'origine-----
> De : spr...@li...=20
> [mailto:spr...@li...]
>  De la part de j=FCrgen h=F6ller [werk3AT]
> Envoy=E9 : lundi 2 juin 2003 13:53
> =C0 : spr...@li...
> Objet : RE: [Springframework-developer] Authentication and=20
> authorization
>=20
>=20
> Rod, everyone,
>=20
> I've just analyzed existing Spring mechanisms for=20
> authorization checks.
>=20
> Let's assume a simple login case: An application uses a=20
> LoginController mapped to "/login", displaying a login form,=20
> performing custom authentication in its performSubmit=20
> implementation, and redirecting to some main menu on=20
> successful submit. In the course of the latter, it adds an=20
> attribute representing the current user's settings to the=20
> session, maybe even just a "loggedIn" with value Boolean.TRUE=20
> to mark the session as logged in. A pseudo example using=20
> AbstractFormController (of course, SimpleFormController would=20
> fit too, not leveraging successView though):
> ......