Acegi Security Framework’s mission statement is; “To provide comprehensive security services for The Spring Framework” as stated in acegisecurity.org. In our project we are using JSF-Spring-Hibernate and lately for the security issues, we made the obvious choice Acegi Framework. Acegi has very nice features like securing HTTP Requests, spring method calls and domain object instance security. My first encounter with Acegi was a presentation given by Kenan Sevindik, he showed a demo featuring http requests, spring method calls, testing and securing components on a page by acegi’s jsp tags.
Acegi uses a structure like this when securing components on a page;
<authz:authorize ifAllGranted=”ROLE_SUPERVISOR”>
Components that are only visible to the users that satisfy the requirements here…
</authz:authorize>
This tag library has the following attributes ifAllGranted, ifAnyGranted and ifNotGranted, what it does is controlling the components within the tag body and does not render if the user’s role does not satisy the requirements.
And another one to display user info;
<authz:authentication operation=”username”/>
Although these tags may work with JSF, we need pure jsf components for acegi in our project (for value binding and etc.) that will play nicely with JSF lifecycle so I’ve implemented “acegi-jsf” custom components. Instead of Acegi’s authz taglib, the name is acegijsf, the tag names and attributes are the same. More will come in the next release(hopefully).
ACEGI-JSF AUTHORIZATION
<acegijsf:authorize ifAllGranted=”ROLE_SUPERVISOR,ROLE_ADMIN”>
Components that are only visible to the users that satisfy the requirements here…
</acegijsf:authorize>
The attribute names are same both in jsp tag and the jsf component. You just give a role list seperated with a comma(Whitespaces omitted). All of these attributes can be binded to a value using EL.
ifAllGranted = User must be in all of the roles
ifAnyGranted = User must be in any of the roles
ifNotGranted = None of the roles must be granted for the user
This component does not render the secured children components if the user does not satisfy the granting requirements given with the attributes.
ACEGI-JSF AUTHENTICATION
<acegijsf:authentication operation=”username”/>
This component does what the acegi’ authentication tag does and outputs user info.
HOW TO USE
You just need to add the following taglib in order to use the acegi-jsf components in your pages;
You also need to define the “SecurityContextHolderAwareRequestFilter” to your filter chain. (This dependency will be fixed in version 1.2)
<%@taglib uri=”http://sourceforge.net/projects/jsf-comp/acegijsf” prefix=”acegijsf”%>
SECURING STATIC HTML
This component library is designed to secure the jsf components. However controlling static html is also possible using f:verbatim. Html code must be surrounded by an f:verbatim tag. Important thing is “not to add the jsf components to the body of the verbatim tag”. Due to the content-interweaving problem of jsf and jsp, this will cause errors. Good news is that, it is fixed in JSF 1.2.
DOWNLOAD
You can find both of the distribution and the source of the component library at jsf-comp. As I mentioned in my previous entry, it is an alternative sandbox of myfaces. In addition I’ve created an example web application demonstrating the integration of jsf, spring, acegi and usage of the acegi-jsf components.
