Details
-
Type:
Bug
-
Status: Closed
-
Priority:
Major
-
Resolution: Won't Fix
-
Affects Version/s: 1.8.2-EE-GA_P02, EE-1.8.2.GA_P03
-
Fix Version/s: EE-1.8.2.GA_P04
-
Component/s: Framework
-
Labels:None
-
Environment:J2EE security frame work
Description
I have an application that received a JMS message that causes a server push. The thread that is pushing the content to the server does not have the information to determine the role of the current user. This is very similar to
http://jira.icefaces.org/browse/ICE-3707
however I cannot use the ACEGI security framework and can only use the J2EE security frame work.
I worked around this by modifying SessionDispatcher.java that I have attached. The changed file is against 1.8.2.GA_P02 source.
The code caches the user roles on the first access and then provides access to those user roles when later asked regardless if the thread is a normal thread or one for an ajax push. The user roles are cached using the sessionId which is the used to lookup the cached roles later with this same sessionId.
This or something similar needs to be made as part of the standard offering and requiring ACEGI security is not always an option.
http://jira.icefaces.org/browse/ICE-3707
however I cannot use the ACEGI security framework and can only use the J2EE security frame work.
I worked around this by modifying SessionDispatcher.java that I have attached. The changed file is against 1.8.2.GA_P02 source.
The code caches the user roles on the first access and then provides access to those user roles when later asked regardless if the thread is a normal thread or one for an ajax push. The user roles are cached using the sessionId which is the used to lookup the cached roles later with this same sessionId.
This or something similar needs to be made as part of the standard offering and requiring ACEGI security is not always an option.
Activity
- All
- Comments
- History
- Activity
- Remote Attachments
- Subversion
This limitation is a direct result of ICEfaces 1.8 push architecture which attempts to cache the last request object for use by push operations that occur between requests. This prevents the renderOnUserRole functionality from working as expected in this context. Using ACEGI or Spring Security is the only alternative with ICEfaces 1.8.