This assumes that you want to A) do comment authentication and B) do it against an identity system apart from Roller's local db.
In order for Roller to support comment authentication there are a couple changes that need to be made. first change is that the way the RollerSession class works to identify the authentic client and provide access to a User object representing that client needs a bit of updating and enhancing. second, we need to tidy up a few places in the code so that we use the RollerSession as the only way of getting access to the authentic client User. lastly we'll need to add some new elements to the rendering system to support dynamic comment form rendering and allow that to be tied into the existing rendering and comment posting system.
This is different for everyone so I won't go into details. The assumption though is that whatever you do to configure this works how you want and Roller can simply expect that if a client is authentic then the value of request.getUserPrinciple() is non-null.
This part is relatively easy, we just need to rework and expand on the getRollerSession() and getAuthenticatedUser() methods. The primary expansion here is that we need to remove the assumption that the only place we need to look for a User is in the local Roller db, which is a very limiting assumption. Instead we want the RollerSession to consult our authentication provider as well, so that users who aren't in the local db can still be accessed by Roller via a User object.
The pseudo code for this is basically ...
user = try local db user lookup
if(user == null) {
user = try user lookup via authentication provider
// CustomUserRegistry.getUserDetailsFromAuthentication(); // lookup user via Acegi
}
|
A more exhaustive look at this is necessary, but the most obvious culprit here is the ParsedRequest.getAuthenticatedUser() method, which simply goes directly to the db to look for the user. Instead this needs to be changed so that we call RollerSession.getAuthenticatedUser() in order to be consistent and of course to get the use of the new code we setup above.
The main key with this point is that we can't have different pieces of the code making up their own way of looking up the authentic client user, it needs to be the same everywhere.
Now for the actual comment form rendering. The basic strategy is to do things the same way we do the comment authentication right now, which is effectively to use javascript and include that part of the page dynamically. To do this we just need a few additions to the rendering system.
And to round out the implementation we need to make a few modifications to the current hook points in the rendering system which have to do with comment posting.