...
A new Wicket project is currently in the works. You can read more about it on http://wicketstuff.org/confluence/display/STUFFWIKI/Wicket-Security. Please investigate whether it will suite suit your needs better.
For those still wanting to use Spring Security, there is an howto on getting Swarm working with Spring Security http://wicketstuff.org/confluence/display/STUFFWIKI/Swarm+and+Acegi+HowTo
...
Code Block |
---|
|
<?xml version="1.0" encoding="ISO-8859-1"?>
<web-app xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
version="2.4">
<filter>
<filter-name>spring.securityFilterChain<name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
<init-param>
<param-name>targetBeanName</param-name>
<param-value>springSecurityFilterChain</param-value>
</init-param>
</filter>
<filter>
<filter-name>wicket.filter</filter-name>
<filter-class>org.apache.wicket.protocol.http.WicketFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>spring.securityFilterChain<name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>wicket.filter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
</web-app>
|
It is important to add springSecurityFilterChain mapping higher in code than the Wicket filter mappin. Wicket filter is only passing filter call down by filter chain if it is unable to handle request itself.
Spring security version 3 and wicket 1.4Adding the spring.securityFilterChain is only necessary if you also want to secure static resources.
Code Block |
---|
| xml |
---|
| xml |
---|
title | spring-context.xml |
---|
|
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans
<web-app xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://wwwjava.springframeworksun.orgcom/xml/schemans/beansj2ee http://wwwjava.springframeworksun.orgcom/xml/schemans/beansj2ee/springweb-beans-app_2_4.5.xsd"
version="2.4">
<display-name>example</display-name>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/applicationContext-security.xml</param-value>
</context-param>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<filter>
<filter-name>wicket.example</filter-name>
<filter-class>org.apache.wicket.protocol.http.WicketFilter</filter-class>
<init-param>
<param-name>applicationClassName</param-name>
<param-value>org.wicket.example.WicketApplication
</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>wicket.example</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
</web-app>
|
Spring 2 context
Code Block |
---|
| xml |
---|
| xml |
---|
title | spring-context.xml |
---|
|
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">
<bean id="myApplication" class="com.foo.bar.MyApplication" />
<bean id="filterChainProxy" class="org.springframework.security.util.FilterChainProxy">
<property name="filterInvocationDefinitionSource">
<value>
CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">
<bean id="myApplication" class="com.foo.bar.MyApplication" />
PATTERN_TYPE_APACHE_ANT
<bean id="filterChainProxy" class="org.springframework.security.util.FilterChainProxy">
<property /**=httpSessionContextIntegrationFiltername="filterInvocationDefinitionSource">
</value><value>
</property>
</bean>
CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
<bean id="httpSessionContextIntegrationFilter"
PATTERN_TYPE_APACHE_ANT
/**=httpSessionContextIntegrationFilter
</value>
</property>
</bean>
<bean id="httpSessionContextIntegrationFilter"
class="org.springframework.security.context.HttpSessionContextIntegrationFilter">
<property name="allowSessionCreation" value="false"/>
</bean>
<security:authentication-provider>
provider alias="authenticationManager">
<security:user-service>
<security:user password="admin" name="admin" authorities="ROLE_ADMIN" />
</security:user-service>
</security:authentication-provider>
</beans>
|
The only filter we need defined from Acegi is the HttpSessionContextIntegrationFilter. This filter will ensure that the SecurityContext is transported to and from the HttpSession onto the Thread context. All authorization is delegated to the wicket-auth-roles module which uses Annotations (@AuthorizeInstantiation).
Using the authentication-provider XML element we register an AuthenticationManager in the Spring context. In this case we use a simple in-memory user service using the user-service element.
Wicket setup
WebSession
Spring 3 context
Code Block |
---|
| xml |
---|
| xml |
---|
1 | applicationContext-security.xml |
---|
|
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
<security:http create-session="never" auto-config="true" >
<security:remember-me/>
<security:intercept-url pattern="/**"/>
</security:http>
<security:authentication-manager alias="authenticationManager">
<security:authentication-provider>
<!-- TODO change this to reference our real user service -->
<security:user-service>
<security:user name="admin" password="admin"
authorities="ROLE_ADMIN, ROLE_USER" />
<security:user name="user" password="user"
authorities="ROLE_USER" />
</security:user-service>
</security:authentication-provider>
</security:authentication-manager>
<security:global-method-security secured-annotations="enabled" />
</beans>
|
The only filter we need defined from Acegi is the HttpSessionContextIntegrationFilter. This filter will ensure that the SecurityContext is transported to and from the HttpSession onto the Thread context. All authorization is delegated to the wicket-auth-roles module which uses Annotations (@AuthorizeInstantiation).
Using the authentication-provider XML element we register an AuthenticationManager in the Spring context. In this case we use a simple in-memory user service using the user-service element.
Wicket setup
WebSession
Code Block |
---|
tile | MyAuthenticatedWebSession |
---|
|
public class MyAuthenticatedWebSession extends AuthenticatedWebSession {
private static final Logger logger = Logger.getLogger(MyAuthenticatedWebSession.class);
@SpringBean(name="authenticationManager")
private AuthenticationManager authenticationManager;
public MyAuthenticatedWebSession(Request request) {
super(request);
injectDependencies();
ensureDependenciesNotNull();
}
private void ensureDependenciesNotNull() {
if (authenticationManager == null) {
throw new IllegalStateException("AdminSession requires an authenticationManager.");
}
}
private void injectDependencies() {
InjectorHolder.getInjector().inject(this);
}
@Override
public boolean authenticate(String username, String password) {
boolean authenticated = false;
try {
Authentication authentication = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(username, password));
SecurityContextHolder.getContext().setAuthentication(authentication);
authenticated = authentication.isAuthenticated();
} catch (AuthenticationException e) {
logger.warn(format("User '%s' failed to login. Reason: %s", username, e.getMessage()));
authenticated = false |
Code Block |
---|
tile | MyAuthenticatedWebSession |
---|
|
public class MyAuthenticatedWebSession extends AuthenticatedWebSession {
private static final Logger logger = Logger.getLogger(MyAuthenticatedWebSession.class);
@SpringBean
private AuthenticationManager authenticationManager;
public MyAuthenticatedWebSession(Request request) {
super(request);
injectDependencies();}
return ensureDependenciesNotNull()authenticated;
}
private void ensureDependenciesNotNull() {@Override
public Roles if (authenticationManager == nullgetRoles() {
Roles roles throw= new IllegalStateException("AdminSession requires an authenticationManager."Roles();
}
}
private void injectDependencies() {getRolesIfSignedIn(roles);
InjectorHolder.getInjector().inject(this)return roles;
}
@Override
private public boolean authenticate(String username, String passwordvoid getRolesIfSignedIn(Roles roles) {
boolean authenticated = false;if (isSignedIn()) {
try {
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
Authentication authentication = authenticationManager.authenticate(new UsernamePasswordAuthenticationTokenaddRolesFromAuthentication(usernameroles, passwordauthentication));
}
}
private void SecurityContextHolder.getContext().setAuthentication(authentication);addRolesFromAuthentication(Roles roles, Authentication authentication) {
for (GrantedAuthority authority : authenticated = authentication.isAuthenticatedgetAuthorities()); {
} catch (AuthenticationException e) {
roles.add(authority.getAuthority());
}
logger.warn(format("User '%s' failed to login. Reason: %s", username, e.getMessage()));}
}
|
Spring 2 Application
Code Block |
---|
title | MyWebApplication.java |
---|
|
public class MyWebApplication extends AuthenticatedWebApplication implements ApplicationContextAware {
private ApplicationContext context;
boolean isInitialized authenticated = false;
@Override
}
protected void init() {
return authenticated;
if (!isInitialized) }{
@Override
public Roles getRolessuper.init() {;
Roles roles = new RolessetListeners();
isInitialized = getRolesIfSignedIn(roles)true;
return roles;}
}
private void getRolesIfSignedInsetListeners(Roles roles) {
ifaddComponentInstantiationListener(new (isSignedIn(SpringComponentInjector(this, context)) {;
}
@Override
public Class<?> getHomePage() {
Authentication authentication =return SecurityContextHolder.getContext().getAuthentication()HomePage.class;
}
public void setApplicationContext(ApplicationContext context) throws addRolesFromAuthentication(roles, authentication);BeansException {
}this.context = context;
}
private void addRolesFromAuthentication(Roles roles, Authentication authentication@Override
protected Class<? extends WebPage> getSignInPageClass() {
for (GrantedAuthority authority : authentication.getAuthorities()) {return LoginPage.class;
}
@Override
protected Class<? extends roles.add(authority.getAuthority());
AuthenticatedWebSession> getWebSessionClass() {
return }MyAuthenticatedWebSession.class;
}
}
|
Spring 3 Application
Code Block |
---|
title | MyWebApplicationMyWebApplicationSpring3.java |
---|
|
public class MyWebApplicationMyWebApplicationSpring3 extends AuthenticatedWebApplication implements ApplicationContextAware {
private ApplicationContext context;
boolean isInitialized = false;
@Override
protected void init() {
if (!isInitialized) {
super.init();
setListeners();
isInitialized = true;
}
}
private void setListeners() {
addComponentInstantiationListener(new SpringComponentInjector(this, context));
}
@Override
public Class<?> getHomePage() {
return HomePage.class;
}
public void setApplicationContext(ApplicationContext context) throws BeansException {
this.context = context;
}
@Override
protected Class<? extends WebPage> getSignInPageClass() {
return LoginPage.class;
}
@Override
protected Class<? extends AuthenticatedWebSession> getWebSessionClass() {
return MyAuthenticatedWebSession.class;
}
}
|
...