JSecurity Remember Me

[Jozef Dransfield-2]

Has anyone had any problems getting the Remember Me part of JSecurity to work, i upgraded from JSecurity 1 so im not sure if i have missed any configuration or something.

Otherwise how exactly does it work? Is it the filters which pass the user through if remember me  is used?

Any help appreciated.

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

    http://xircles.codehaus.org/manage_email

[Peter Ledbrook]

> Otherwise how exactly does it work? Is it the filters which pass the user through if remember me  is used?

The "remember me" feature means that a user can come back to your
application and it will remember the user details. More specifically,
"SecurityUtils.subject.principal" will return a non-null value, for
example the username. So, you can display information relevant to that
user. However, the access control won't allow the user through until
he or she has authenticated, for example by entering a valid password.

In other words, a user has three possible states: unrecognised
(analogous to "guest"), remembered, and authenticated. If you want to
take advantage of "remember me" easily, use the <jsec:user/> and
<jsec:principal/> tags, both of which will output stuff if the user is
either remembered or authenticated.

HTH,

Peter

--
Software Engineer
G2One, Inc.
http://www.g2one.com/

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

    http://xircles.codehaus.org/manage_email

[Jozef Dransfield-2]

Ah cheers for that, i miss understood what remember me was for.


On Friday, July 18, 2008, at 07:54AM, "Peter Ledbrook" <[hidden email]> wrote:

>> Otherwise how exactly does it work? Is it the filters which pass the user through if remember me  is used?
>
>The "remember me" feature means that a user can come back to your
>application and it will remember the user details. More specifically,
>"SecurityUtils.subject.principal" will return a non-null value, for
>example the username. So, you can display information relevant to that
>user. However, the access control won't allow the user through until
>he or she has authenticated, for example by entering a valid password.
>
>In other words, a user has three possible states: unrecognised
>(analogous to "guest"), remembered, and authenticated. If you want to
>take advantage of "remember me" easily, use the <jsec:user/> and
><jsec:principal/> tags, both of which will output stuff if the user is
>either remembered or authenticated.
>
>HTH,
>
>Peter
>
>--
>Software Engineer
>G2One, Inc.
>http://www.g2one.com/
>
>---------------------------------------------------------------------
>To unsubscribe from this list, please visit:
>
>    http://xircles.codehaus.org/manage_email
>
>
>
>

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

    http://xircles.codehaus.org/manage_email

[bredo]

Hi Peter,
I am using the jsec plugin, but I dont want my users to have to
authenticate every time - I want if they check the remember me checkbox
to "auto-login" the user next time they come to the site for say 2 weeks
(which is a common way sites around the web do signing in) - how can I
do that with jsecurity?
thanks,
bredo

Peter Ledbrook wrote:

>> Otherwise how exactly does it work? Is it the filters which pass the user through if remember me  is used?
>>    
>
> The "remember me" feature means that a user can come back to your
> application and it will remember the user details. More specifically,
> "SecurityUtils.subject.principal" will return a non-null value, for
> example the username. So, you can display information relevant to that
> user. However, the access control won't allow the user through until
> he or she has authenticated, for example by entering a valid password.
>
> In other words, a user has three possible states: unrecognised
> (analogous to "guest"), remembered, and authenticated. If you want to
> take advantage of "remember me" easily, use the <jsec:user/> and
> <jsec:principal/> tags, both of which will output stuff if the user is
> either remembered or authenticated.
>
> HTH,
>
> Peter
>
>  

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

    http://xircles.codehaus.org/manage_email

[Les Hazlewood]

Remember me should be good enough for authorization checks/access control.  That is, JSecurity as a framework (dunno about the Grails plugin) doesn't need the user to be authenticated to perform an access control check (role/perm check).

All truly secure parts of an application (access to user account data, changing credit card data, etc), should always check to make sure the user is authenticated first (in addition to any role or perm checks) before being allowed access.  That guarantees the user is who they say they are, whereas Remember Me has no such guarantee.

On Fri, Jul 18, 2008 at 12:14 PM, Andrew Bredon <[hidden email]> wrote:

Hi Peter,
I am using the jsec plugin, but I dont want my users to have to authenticate every time - I want if they check the remember me checkbox to "auto-login" the user next time they come to the site for say 2 weeks (which is a common way sites around the web do signing in) - how can I do that with jsecurity?
thanks,
bredo

Peter Ledbrook wrote:

Otherwise how exactly does it work? Is it the filters which pass the user through if remember me  is used?
   

The "remember me" feature means that a user can come back to your
application and it will remember the user details. More specifically,
"SecurityUtils.subject.principal" will return a non-null value, for
example the username. So, you can display information relevant to that
user. However, the access control won't allow the user through until
he or she has authenticated, for example by entering a valid password.

In other words, a user has three possible states: unrecognised
(analogous to "guest"), remembered, and authenticated. If you want to
take advantage of "remember me" easily, use the <jsec:user/> and
<jsec:principal/> tags, both of which will output stuff if the user is
either remembered or authenticated.

HTH,

Peter

 

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

  http://xircles.codehaus.org/manage_email

[Jozef Dransfield-2]

I believe the plugin does need the user to be authenticated to test for a role and pass through the security filter?

Or am i writing my security filters incorrectly?

i use something like:

x(controller:"x", action:"y") {
before = {
  accessControl {
    role("User")
  }
}

I am trying to achieve the same type of functionality as Andrew

 
On Friday, July 18, 2008, at 06:24PM, "Les Hazlewood" <[hidden email]> wrote:

>Remember me should be good enough for authorization checks/access control.
>That is, JSecurity as a framework (dunno about the Grails plugin) doesn't
>need the user to be authenticated to perform an access control check
>(role/perm check).
>
>All truly secure parts of an application (access to user account data,
>changing credit card data, etc), should always check to make sure the user
>is authenticated first (in addition to any role or perm checks) before being
>allowed access.  That guarantees the user is who they say they are, whereas
>Remember Me has no such guarantee.
>
>On Fri, Jul 18, 2008 at 12:14 PM, Andrew Bredon <
>[hidden email]> wrote:
>
>> Hi Peter,
>> I am using the jsec plugin, but I dont want my users to have to
>> authenticate every time - I want if they check the remember me checkbox to
>> "auto-login" the user next time they come to the site for say 2 weeks (which
>> is a common way sites around the web do signing in) - how can I do that with
>> jsecurity?
>> thanks,
>> bredo
>>
>> Peter Ledbrook wrote:
>>
>>> Otherwise how exactly does it work? Is it the filters which pass the user
>>>> through if remember me  is used?
>>>>
>>>>
>>>
>>> The "remember me" feature means that a user can come back to your
>>> application and it will remember the user details. More specifically,
>>> "SecurityUtils.subject.principal" will return a non-null value, for
>>> example the username. So, you can display information relevant to that
>>> user. However, the access control won't allow the user through until
>>> he or she has authenticated, for example by entering a valid password.
>>>
>>> In other words, a user has three possible states: unrecognised
>>> (analogous to "guest"), remembered, and authenticated. If you want to
>>> take advantage of "remember me" easily, use the <jsec:user/> and
>>> <jsec:principal/> tags, both of which will output stuff if the user is
>>> either remembered or authenticated.
>>>
>>> HTH,
>>>
>>> Peter
>>>
>>>
>>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe from this list, please visit:
>>
>>   http://xircles.codehaus.org/manage_email
>>
>>
>>
>

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

    http://xircles.codehaus.org/manage_email

[Peter Ledbrook]

> I believe the plugin does need the user to be authenticated to test for a role and pass through the security filter?
>
> Or am i writing my security filters incorrectly?
>
> i use something like:
>
> x(controller:"x", action:"y") {
> before = {
>  accessControl {
>    role("User")
>  }
> }
>
> I am trying to achieve the same type of functionality as Andrew

Hmmm...ok. That's going to require a fairly significant change, but I
think an essential one. How about:

  x(controller: "x", action: "y") {
      before = {
          accessControl(auth: false) {
              role("User")
          }
      }
  }


By default, the "auth" parameter would be treated as 'true' and
interpreted as requiring authentication. If set to 'false' as above,
then the access control would accept users that are remembered (but
not authenticated). How does that sound?

Cheers,

Peter

--
Software Engineer
G2One, Inc.
http://www.g2one.com/

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

    http://xircles.codehaus.org/manage_email

[Peter Ledbrook]

> By default, the "auth" parameter would be treated as 'true' and
> interpreted as requiring authentication. If set to 'false' as above,
> then the access control would accept users that are remembered (but
> not authenticated). How does that sound?

Actually, it's a bit harsh to required you to add an "auth: false"
parameter everywhere, so I also need to add a config option that
allows you to determine whether auth is required by default or not.
I'll do that.

Cheers,

Peter

--
Software Engineer
G2One, Inc.
http://www.g2one.com/

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

    http://xircles.codehaus.org/manage_email

[Marc Pompl]

Hi,

I have filed an enhancement request

http://jira.codehaus.org/browse/GRAILSPLUGINS-435

a few days ago, focusing (nearly) the same problem.
I am still in testing phase of my promised patch.
Hopefully, I will finish it within next two days.

Feel free to comment, if you see problems or have other ideas.



Best regards
Marc


Peter Ledbrook schrieb:

>> By default, the "auth" parameter would be treated as 'true' and
>> interpreted as requiring authentication. If set to 'false' as above,
>> then the access control would accept users that are remembered (but
>> not authenticated). How does that sound?
>>    
>
> Actually, it's a bit harsh to required you to add an "auth: false"
> parameter everywhere, so I also need to add a config option that
> allows you to determine whether auth is required by default or not.
> I'll do that.
>
> Cheers,
>
> Peter
>
>  

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

    http://xircles.codehaus.org/manage_email

[bredo]

Great, thanks Peter, I think it's a really useful piece of functionality.

Peter Ledbrook wrote:

>> By default, the "auth" parameter would be treated as 'true' and
>> interpreted as requiring authentication. If set to 'false' as above,
>> then the access control would accept users that are remembered (but
>> not authenticated). How does that sound?
>>    
>
> Actually, it's a bit harsh to required you to add an "auth: false"
> parameter everywhere, so I also need to add a config option that
> allows you to determine whether auth is required by default or not.
> I'll do that.
>
> Cheers,
>
> Peter
>
>  

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

    http://xircles.codehaus.org/manage_email