Re: patching and subclassing securityfilter for my own customizations

Hello Ethan,

Together with help (code and requirements) from the community, I am the
primary author of SecurityFilter.

----- Original Message -----
From: "Ethan Tuttle" <[email protected]>

> For my own purposes, I want to make it:
>
> - not wrap the HttpRequest, rather use a request attribute to store and
get
> the user principal.  This is nicer for my view (velocity templates).

You won't be able to pass along the GET and POST parameters after a
successful login without wrapping the request. You also won't be able to use
the security-related methods on the request without wrapping it. Perhaps if
you could explain what you don't like about wrapped requests, I could better
understand what you need.

> - store a backend service object in addition to the user principal

Perhaps a utility class could be created to access the service object (and
create it on-the-fly if it is not yet present) could be used to achieve a
similar result, and would work with SecurityFilter or container-managed
security. On the other hand, this does seem to be a common request, so
perhaps there is some value in providing extra support in this area with
SecurityFilter. With the current SecurityFilter and container-managed
security, the filter/container does all the login processing with no
explicit hooks (besides a scheme as described above) for
application-specific processing.

> - respond to "remember me" options in the login form
>
> - automatically authenticate with my own persistent cookie system

This seems like a nice feature that could be added to SecurityFilter. This
would be a nice bit of infrastructure to "bake in" to SecurityFilter for
easy re-use.

> - mark failed logins by placing a flag in the request

Do you want this so that you can use the same page for the login form and
the error page (which is often also a login form, albeit with an error
message)? Perhaps a login form that looked for error flag could be used for
the login page, and then have the error page be a page that puts the flag in
the request and then forwards to the login form page could achieve this
result without coupling the app to a particular security implementation.

> These customizations could be implemented by my own subclass, if the
> SecurityFilter class was a little more decomposed with public access to
the
> important methods.

I wasn't thinking about extensions much when I wrote the filter, so it is
probably weak in this area. I am interested in any suggestions you have.

>
> I'm going to do the modifications myself to make the subclassing possible.
>
> Would the author / community be interested in my changes when I'm done?

Yes, please keep us posted on your findings/progress. Contributions are
welcome.

-Max

>
> Ethan
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:
> With Great Power, Comes Great Responsibility
> Learn to use your power at OSDN's High Performance Computing Channel
> http://hpc.devchannel.org/
> _______________________________________________
> securityfilter-user mailing list
> securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> https://lists.sourceforge.net/lists/listinfo/securityfilter-user
>




-------------------------------------------------------
This sf.net email is sponsored by:
With Great Power, Comes Great Responsibility 
Learn to use your power at OSDN's High Performance Computing Channel
http://hpc.devchannel.org/