Scott McCrory wrote:
>Ben,
> Just curious - what's your approach towards an eventual 1.0 release? I
>ask because technical managers, architecture review boards, etc. can
>misinterpret sub-1.0 versions as unstable, whereas even Acegi 0.6 most
>certainly is not!
> Thanks in advance,
> Scott
>
>
>
Version 0.7.0 introduces the final features that I believe are necessary
for a broadly useful enterprise application security framework. I
believe most of the code could now be considered mature, except for the
newer domain object instance security capabilities. Whilst these new
capabilities have only existed for between two and four months, they're
potentially HIGHLY useful, well-documented, fully unit tested, and
demonstrated in the Contacts sample application. I also know of several
real applications where they're being used, so I expect the API to
remain fairly stable.
By releasing Version 0.7.0 I hope to see the domain object instance
security achieve more widespread use, so there can be appropriate
confidence in a 1.0.0 release. To a lesser extent it is also intended to
test the various new "minor" features added to CVS over the past few
months, along with the Mavenised build system.
I do not intend to add any new major features prior to a 1.0.0 release.
There are several potentially useful areas, but none are critical for
most applications and the architecture enables them to be added very
easily and safely:
* Remember-me functionality. There has been some design ideas put
forward, but just not implemented.
* Anonymous user functionality. This should be similar to any
remember-me approach. People have already implemented solutions to this
requirement (see forums).
* Maintained and unit tested LDAP provider. There is something in the
sandbox and contributions on the forums, but we need tests to add any to
core.
* Wider support for remoting protocol automatic security propagation. We
already offer RMI and HttpInvoker, which covers most Spring Rich users.
* Database-sourced ObjectDefinitionSources. Spring itself will be
offering database-driven configuration (see sandbox).
* Java 5 annotation support. I am waiting to see what happens with
Spring core's attributes abstraction, and then use whatever approach
follows.
* AspectWerks support for domain object instance security. It's easy to
do this, but I'd like a similar model to AspectJ where Spring DIs the
advice.
One issue I'd appreciate some comments on is container adapter
deprecation. I know some people use the JBoss container adapter (as they
need to use EJB security as well), but I've not heard of any usage of
the Resin, Tomcat or Jetty adapters. It seems unwise to maintain a
suboptimal (non-portable) approach, especially as pre-1.0.0 we can
deprecate them.
Finally, the status of the project is up for discussion. I met Rod a few
days back and we briefly discussed making Acegi Security a formal Spring
subproject. This, coupled with a 1.0.0+ version number, would make some
people and organisations more comfortable using it. What does the
community think of this idea?
Best regards
Ben
|
