jsf - How to handle authentication/authorization with users in a database? -

-

currently, working on web project using jsf 2.0, tomcat 7 , mongodb. have big question of how handle session management , authentication/authorization users in database.

the structure want follows: logged in users can create events , can see created events.

  • create.xhtml --> logged in users.
  • events.xhtml --> public everyone.

the basic structure i'm planning is:

  • check if page requires logged in user (e.g. create.xhtml)
  • if yes, check if user logged in
  • if user not logged in, go login.xhtml
  • if logged in, come requested page
  • keep "user logged in" information unless user clicks log out button. (there guess @sessionscoped gets play)

the question is:

  1. what less complicated way of doing this?
  2. where should use @sessionscoped annotation? in create.java or loginmanager.java?
  3. spring security looks kind of complicated issue, need it? if yes, can explain little bit of how implementation works jsf 2.0 , mongo db?

there several options. choose you. objectively weigh concrete advantages , disadvantages conform own situation.

1. use java ee provided container managed authentication

just declare <security-constraint> in web.xml refers security realm configured in servletcontainer. can webapp specify url pattern(s) should checked login and/or role(s), e.g. /secured/*, /app/*, /private/*, etc.

before java ee 8, unfortunately still need configure security real in servletcontainer-specific way. it's described in servletconainer-specific documentation. in case of tomcat 8, that's realm how-to. example, database based realm based on users/roles tables described in section "jdbcrealm".

since java ee 8, there standard api based on jsr-375.

advantages:

  • relatively quick , easy setup , use.
  • since java ee 8 there's robust , flexible standard api.

disadvantages:

  • before java ee 8, realm configuration container-specific. in java ee 8, new jsr-375 security spec should solve of jaspic.
  • before java ee 8, , there no fine grained control.
  • before java ee 8, it's spartan; no "remember me", poor error handling, no permission based restriction.

see also:

2. homegrow servlet filter

this allows more fine grained control, you're going need write code , should know/understand how should implement such filter avoid potential security holes. in jsf side, example put logged-in user session attribute sessionmap.put("user", user) , check in filter if session.getattribute("user") not null.

advantages:

  • fine grained control.
  • completely container independent.

disadvantages:

  • reinvention of wheel; new features require lot of code.
  • as starter, you're never sure if code 100% robust.

see also:

3. adapt 3rd party framework

for example, apache shiro, spring security, etc. offers more fine grained configuration options standard container managed authentication , don't need write code yourself, expect of login page , (xml) configuration of course.

advantages:

  • fine grained control.
  • completely container independent.
  • no reinvention of wheel; minimum of own code.
  • thoroughly developed , tested lot of users, 100% robust.

disadvantages:

  • some learning curve.

see also:


Comments

Post a Comment

Popular posts from this blog

Fail to load namespace Spring Security http://www.springframework.org/security/tags -

-
i have problem namespace of spring security on xhtml page. don't understand why can't load uri, , have following issue: whitelabel error page application has no explicit mapping /error, seeing fallback. tue jul 21 16:58:12 utc 2015 there unexpected error (type=not found, status=404). please need help! possible uri has been changed? best regards you using incorrect namespace url. correct url http://www.springframework.org/schema/security the error page seeing spring source website since not recognize url. try visiting http://www.springsource.org/security/tags in browser update : spring security tags used in jsp page correct tag lib declaration is: <%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>
Read more

sql - MySQL query optimization using coalesce -

-
can explain me why second query faster first? (first 1 takes around 40 seconds, second 1 less 0.1) select releases.feature_code, releases.platform_id, version, release_date, general_available, uri, filesize, display_name, feature_name.full_name, if ((select exists(select 1 release_exceptions releases.feature_code = release_exceptions.feature_code , releases.platform_id = release_exceptions.platform_id , releases.version = release_exceptions.version) = 1), 1, 0) release_exceptions releases left outer join platform using(platform_id) left outer join feature_name using(feature_code) order version desc; ~~~ query 2 ------------------ ~~~ select feature_code, version, release_date, general_available, platform_id, uri, filesize, display_name, feature_name.full_name, coalesce(release_exceptions, 0) release_exceptions mus.releases left outer join ( select distinct feature_code, version, platform_id, 1 release_exceptions mus.release_exceptions ) release_exceptions using ...
Read more

unity3d - Unity local avoidance in user created world -

-
i'm using unity3d networked multiplayer online game have large complex 3d terrain scene forest, trees, cliff, hills, mountains, bounders, etc. players can build structures sort of minecraft, , put them anywhere in scene, or move them around anytime. aside human controlled players, there automated ai players , objects animals roaming around scene following path. the problem how make these automated ai players , animals, able navigate around static , dynamic player created structures, because path follow can blocked player created structures, or other players , other ai objects, cliffs etc. have find away around them or on track if tumble down off high cliff example. so made navmesh , used navagents, takes care of static, non moving objects, how make ai players navigate around each other , dynamic structures created players can number in hundreds? i thought of adding navmeshobstacle everything, result in being attached hundreds of objects since user created structures b...
Read more