jsf and jstl

[Predrag Ristic]

I have a simple seam project created in Eclipse.All my web pages have extension xhtml and I access each of them by typing page_name.seam.I would like to restrict access to every other page other than login page if the user is not logged in.I tried to use <c:if> tag but it didn't work.Other c: tags won't work either.Can anyone tell me how to implement this login check?Thanks

[Cristian Boariu]

Hi Ristic,
You must make a pages.xml where you will have like:

<page view-id="/admin/Test.xhtml">
        <restrict>
            #{s:hasRole('ACCES_ALL_PAGES_ROLE')}
        </restrict>
        <begin-conversation join="true"/>
    </page>    

check this out for more info:

http://docs.jboss.com/seam/1.1.5.GA/reference/en/html/security.html

Also note that you can add that role after login, like:
identity.addRole("ACCES_ALL_PAGES_ROLE");

Have fun.

[Predrag Ristic]

I've added identity attribute in my LoginBean class and in method that is invoked when user clicks on the submit button there is line
identity.addRole("logged").This method is registered in components.xml.Your tip about restriction is used in pages.xml but but I always get rejected no matter what username I use.

[Cristian Boariu]

Hi,
Can youu paste some code?

[Predrag Ristic]

components.xml :

<?xml version="1.0" encoding="UTF-8"?>
<components xmlns="http://jboss.com/products/seam/components"
            xmlns:core="http://jboss.com/products/seam/core"
            xmlns:persistence="http://jboss.com/products/seam/persistence"
            xmlns:drools="http://jboss.com/products/seam/drools"
            xmlns:bpm="http://jboss.com/products/seam/bpm"
            xmlns:security="http://jboss.com/products/seam/security"
            xmlns:mail="http://jboss.com/products/seam/mail"
            xmlns:web="http://jboss.com/products/seam/web"
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
            xsi:schemaLocation=
                "http://jboss.com/products/seam/core http://jboss.com/products/seam/core-2.2.xsd
                 http://jboss.com/products/seam/persistence http://jboss.com/products/seam/persistence-2.2.xsd
                 http://jboss.com/products/seam/drools http://jboss.com/products/seam/drools-2.2.xsd
                 http://jboss.com/products/seam/bpm http://jboss.com/products/seam/bpm-2.2.xsd
                 http://jboss.com/products/seam/security http://jboss.com/products/seam/security-2.2.xsd
                 http://jboss.com/products/seam/mail http://jboss.com/products/seam/mail-2.2.xsd
                 http://jboss.com/products/seam/web http://jboss.com/products/seam/web-2.2.xsd
                 http://jboss.com/products/seam/components http://jboss.com/products/seam/components-2.2.xsd">

   <core:init debug="true" jndi-pattern="@jndiPattern@"/>

   <core:manager concurrent-request-timeout="500"
                 conversation-timeout="1000000000"
                 conversation-id-parameter="cid"
                 parent-conversation-id-parameter="pid"/>

   <!-- Make sure this URL pattern is the same as that used by the Faces Servlet -->
   <web:hot-deploy-filter url-pattern="*.seam"/>

   <persistence:managed-persistence-context name="entityManager" auto-create="true"
                      persistence-unit-jndi-name="java:/Prodavnica-seamEntityManagerFactory"/>

   <drools:rule-base name="securityRules">
      <drools:rule-files>
         <value>/security.drl</value>
      </drools:rule-files>
   </drools:rule-base>

   <security:rule-based-permission-resolver security-rules="#{securityRules}"/>

   <security:identity authenticate-method="#{register_bean.IsExists}" remember-me="true"/>

   <event type="org.jboss.seam.security.notLoggedIn">
      <action execute="#{redirect.captureCurrentView}"/>
   </event>
   <event type="org.jboss.seam.security.loginSuccessful">
      <action execute="#{redirect.returnToCapturedView}"/>
   </event>

   <mail:mail-session host="localhost" port="25"/>

   <!-- For use with jBPM pageflow or process management -->
   <!--
   <bpm:jbpm>
      <bpm:process-definitions></bpm:process-definitions>
      <bpm:pageflow-definitions></bpm:pageflow-definitions>
   </bpm:jbpm>
   -->

</components>

login.xhml:

<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<ui:composition xmlns="http://www.w3.org/1999/xhtml"
	xmlns:s="http://jboss.com/products/seam/taglib"
	xmlns:ui="http://java.sun.com/jsf/facelets"
	xmlns:f="http://java.sun.com/jsf/core"
	xmlns:h="http://java.sun.com/jsf/html"
	xmlns:rich="http://richfaces.org/rich" template="layout/template.xhtml">



	<ui:define name="body">

		<h:form id="loginForm">
			<table>
				<tr>
					<td><h:outputLabel for="username">
						<b>Username:</b>
					</h:outputLabel></td>
					<td><h:inputText id="username" value="#{customer.first_name}"
						validator="MyValidator"></h:inputText></td>

					<td align="left"><h:messages for="username"
						style="color : red" /></td>
				</tr>
				<tr>
					<td><h:outputLabel for="password">
						<b>Password:</b>
					</h:outputLabel></td>
					<td><h:inputSecret id="password" value="#{customer.pwd}" /></td>
				</tr>
			</table>


			<div class="actionButtons"><h:commandButton id="submit"
				value="Login" action="#{register_bean.IsExists}" /><br />
			</div>
			
		</h:form>

	</ui:define>
</ui:composition>

pages.xml:

<?xml version="1.0" encoding="UTF-8"?>
<pages login-view-id="/login.xhtml"
 no-conversation-view-id="/home.xhtml"
 xmlns="http://jboss.com/products/seam/pages"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://jboss.com/products/seam/pages http://jboss.com/products/seam/pages-2.2.xsd">
 <page validate-model="true" view-id="/login_success.xhtml"/>
 
 <page view-id="/page.xhtml">
 	<restrict>
 		#{s:hasRole('logged')}
 	</restrict>
 	
 	<begin-conversation join="true"/>
 </page>
 
 <page conversation-required="true" login-required="true" view-id="/login.xhtml"/>
 
 <page view-id="/error.xhtml"/>
 <exception class="org.jboss.seam.framework.EntityNotFoundException">
  <redirect view-id="/error.xhtml">
   <message severity="warn">Record not found</message>
  </redirect>
 </exception>
 <exception class="javax.persistence.EntityNotFoundException">
  <redirect view-id="/error.xhtml">
   <message severity="warn">Record not found</message>
  </redirect>
 </exception>
 <exception class="javax.persistence.EntityExistsException">
  <redirect view-id="/error.xhtml">
   <message severity="warn">Duplicate record</message>
  </redirect>
 </exception>
 <exception class="javax.persistence.OptimisticLockException">
  <end-conversation/>
  <redirect view-id="/error.xhtml">
   <message severity="warn">Another user changed the same data, please try again</message>
  </redirect>
 </exception>
 <exception class="org.jboss.seam.security.AuthorizationException">
  <redirect view-id="/error.xhtml">
   <message severity="error">You don't have permission to access this resource</message>
  </redirect>
 </exception>
 <!--
		<exception class="org.jboss.seam.security.NotLoggedInException">
		<redirect view-id="/login.xhtml"> <message
		severity="warn">#{messages['org.jboss.seam.NotLoggedIn']}</message>
		</redirect> </exception>
	-->
 <exception class="javax.faces.application.ViewExpiredException">
  <redirect view-id="/error.xhtml">
   <message severity="warn">Your session has timed out, please try again</message>
  </redirect>
 </exception>
 <exception class="org.jboss.seam.ConcurrentRequestTimeoutException" log-level="trace">
  <http-error error-code="503"/>
 </exception>
<!-- <exception class="org.jboss.seam.security.NotLoggedInException">-->
<!--  <redirect view-id="/login.xhtml">-->
<!--   <message severity="warn">Morate se logovati</message>-->
<!--  </redirect>-->
<!-- </exception>-->
</pages>

[Cristian Boariu]

After you have injected the identity component, have you checked with debug that after the login click, it has the new role?

[Predrag Ristic]

I could not find any property of identity in the Variables tab in the debug mode that could show if the role is set or not.This is the managed bean.I hope it can help you so you can help me

package org.domain.prodavnicaseam.session;

import java.util.ArrayList;
import java.util.Collection;
import java.util.Iterator;

import javax.ejb.Remove;
import javax.ejb.Stateful;
import javax.ejb.Stateless;
import javax.faces.event.AbortProcessingException;
import javax.faces.event.ActionEvent;
import javax.faces.event.ActionListener;
import javax.persistence.EntityManager;
import javax.persistence.Persistence;
import javax.persistence.PersistenceContext;
import javax.persistence.Query;

import org.domain.prodavnicaseam.entity.Cart;
import org.domain.prodavnicaseam.entity.CartItem;
import org.domain.prodavnicaseam.entity.Customer;
import org.jboss.seam.ScopeType;
import org.jboss.seam.annotations.Begin;
import org.jboss.seam.annotations.Destroy;
import org.jboss.seam.annotations.In;
import org.jboss.seam.annotations.Name;
import org.jboss.seam.annotations.Out;
import org.jboss.seam.annotations.Scope;
import org.jboss.seam.security.Identity;

@Stateful
@Name("register_bean")
public class LoginBeanAction implements LoginBean {

	@In
	private Customer customer;
	
	@In 
	private Identity identity;

	public Identity getIdentity() {
		return identity;
	}

	public Identity GetIdentity()
	{
		return this.getIdentity();
	}
	
	public void setIdentity(Identity identity) {
		this.identity = identity;
	}

	@PersistenceContext
	private EntityManager em;
	
	private Log log;
	

	public Log getLog() {
		return log;
	}

	public void setLog(Log log) {
		this.log = log;
	}

	private TableId[] id;

	public TableId[] getId() {
		return id;
	}

	public void setId(TableId[] id) {
		this.id = id;
	}

	private Collection<Cart> cartCollection = new ArrayList<Cart>();

	public Collection<Cart> getCartCollection() {
		return cartCollection;
	}

	public void setCartCollection(Collection<Cart> cartCollection) {
		this.cartCollection = cartCollection;
	}

	public Customer getCustomer() {
		return customer;
	}

	public void setCustomer(Customer customer) {
		this.customer = customer;
	}

	public EntityManager getEm() {
		return em;
	}

	public void setEm(EntityManager em) {
		this.em = em;
	}

	
	
	public Customer GetCustomer() {

//		Query query = em
//				.createQuery("select c from Customer c where c.first_name=#{customer.first_name}");
//		Customer customer = (Customer) query.getSingleResult();
//
//		return customer;

		 return this.getCustomer();
	}

	@Begin(join = true)
	public String IsExists() {
		String out = "error";
		Customer customer1 = null;
		Query query = em
				.createQuery("select c from Customer c where c.first_name=#{customer.first_name}");
		try {
			customer1 = (Customer) query.getSingleResult();
		} catch (Exception e) {
			out = "error";
		}
		if (customer1 != null ) {
			
			if(customer.getFirst_name().equals(customer1.getFirst_name()))
			{
				out = "login_success";
				this.customer = customer1;
				this.cartCollection = customer1.getCartCollection();
				Log log1=new Log();
				log1.setLogged(true);
				this.setLog(log1);
				this.identity.addRole("logged");
				
			//	this.identity.login();
			}
			else
				{
				//	out="error";
					
				}
		}

		return out;
	}

	public Log GetLog()
	{
		Log log1=this.getLog();
		return log1;
	}
	
	public boolean Get_Log()
	{
		Log log1=this.getLog();
		if(log1.isLogged())
			return true;
		else
			return false;
	}
	
	public Collection<TableId> GetCartIds() {
		Customer customer1 = null;
		Collection<TableId> ids = new ArrayList<TableId>();
		Query query = em
				.createQuery("select c from Customer c where c.first_name=#{customer.first_name}");
		try {
			customer1 = (Customer) query.getSingleResult();
		} catch (Exception e) {
			// out="error";
		}
		if (customer1 != null) {
			// out = "login_success";
			// this.customer=customer1;
			Collection<Cart> carts = customer1.getCartCollection();

			// ids=new TableId[carts.size()];
			// int index=0;
			for (Iterator iterator = carts.iterator(); iterator.hasNext();) {
				Cart cart = (Cart) iterator.next();
				TableId id = new TableId();
				id.setTable_id(cart.getCart_id());
				ids.add(id);

			}
		}

		return ids;
	}

	public Collection<Cart_item> GetCartItems(int cart_id) {
		Collection<Cart_item> cart_items = new ArrayList<Cart_item>();
		Customer customer1 = null;
		Query query = em
				.createQuery("select c from Customer c where c.first_name=#{customer.first_name}");
		try {
			customer1 = (Customer) query.getSingleResult();
		} catch (Exception e) {

		}
		if (customer1 != null) {
			Collection<Cart> carts = customer1.getCartCollection();
			if (carts != null) {
				for (Iterator iterator = carts.iterator(); iterator.hasNext();) {
					Cart cart = (Cart) iterator.next();
					if (cart.getCart_id() == cart_id) {
						Collection<CartItem> items = cart
								.getCartitemCollection();
						for (Iterator iterator2 = items.iterator(); iterator2
								.hasNext();) {
							CartItem cartItem = (CartItem) iterator2.next();
							Cart_item cart_item = new Cart_item();
							cart_item.setCart_item_id(cartItem.getItem_id());
							cart_items.add(cart_item);
						}
					}
				}
			}

		}
		return cart_items;
	}

	public Collection<Cart> GetCartCollection() {
		return this.getCartCollection();
	}
	
	@Remove @Destroy
	public void Destroy()
	{
		
	}
}

[Cristian Boariu]

Please notice that in jsf you have: register_bean and in the @Name of the seam component there is a missing "_"

[Predrag Ristic]

I think that I have written register_bean everywhere.Can you show more precisely what do you mean?

[Cristian Boariu]

my fault...i did not noticed it because of the the background.......however i recommend to use cammel case like registerBean...of course this is not the problem here but it's good for better practices:)

[Cristian Boariu]

Also try to use the instance of Identity..I think that is: Identity.instance().addRole

[Predrag Ristic]

I really don't understand why it doesn't work when I add the role with
this.identity.addRole("logged");
I thought that is all what is necessary