SpringSecurity, JEE6, JSF2 - renderização condicional

15 respostas
F

Olá Pessoal, estou precisando de um ajuda com o Spring Security.;

Seguinte, fiz toda a configuração do security, pegando o Role no banco e tal, até ai tudo bem.

Gostaria que componentes jsf rederizassem de forma condicional, por exemplo: numa pagina tenho dois botoes de acao: Visualizar e Excluir; queria que o botao excluir fosse renderizado apenas para o ROLE_ADMIN,

usei esta lib: http://dominikdorn.com/facelets/

na minha pagina xhtml usei o xmlsn:

xmlns:security="http://www.springframework.org/security/taglibs/facelets/tags">

e pra renderizar:

<security:ifAnyGranted roles="ROLE_ADMIN"> <p:commandButton type="button" value="admin" onclick="alert('botao admini')" /> </security:ifAnyGranted>

quando vou acessar a página com um ROLE NAO administrador, o botao é renderizado da mesma forma.

Alguem já passou por isto?

15 Respostas

F

Adendo;

Se eu usar o seguinte xmlns:

xmlns:security="http://www.springframework.org/security/facelets/tags"

Conforme o site da lib pra facelets indica, depois de autenticado e redirecionado, o seguinte erro é apresentado:

SEVERE: Servlet.service() for servlet [FacesServlet] in context with path [/SpringSecurity] threw exception [org.springframework.security.core.Authentication.getAuthorities()Ljava/util/List;] with root cause java.lang.NoSuchMethodError: org.springframework.security.core.Authentication.getAuthorities()Ljava/util/List; at org.springframework.security.taglibs.facelets.SpringSecurityELLibrary.getUserAuthorities(SpringSecurityELLibrary.java:58) at org.springframework.security.taglibs.facelets.SpringSecurityELLibrary.ifAnyGranted(SpringSecurityELLibrary.java:79) at org.springframework.security.taglibs.facelets.IfAnyGrantedTag.apply(IfAnyGrantedTag.java:38) at javax.faces.view.facelets.CompositeFaceletHandler.apply(CompositeFaceletHandler.java:94) at javax.faces.view.facelets.DelegatingMetaTagHandler.applyNextHandler(DelegatingMetaTagHandler.java:131) at com.sun.faces.facelets.tag.jsf.ComponentTagHandlerDelegateImpl.apply(ComponentTagHandlerDelegateImpl.java:162) at javax.faces.view.facelets.DelegatingMetaTagHandler.apply(DelegatingMetaTagHandler.java:114) at javax.faces.view.facelets.DelegatingMetaTagHandler.applyNextHandler(DelegatingMetaTagHandler.java:131) at com.sun.faces.facelets.tag.jsf.ComponentTagHandlerDelegateImpl.apply(ComponentTagHandlerDelegateImpl.java:162) at javax.faces.view.facelets.DelegatingMetaTagHandler.apply(DelegatingMetaTagHandler.java:114) at javax.faces.view.facelets.DelegatingMetaTagHandler.applyNextHandler(DelegatingMetaTagHandler.java:131) at com.sun.faces.facelets.tag.jsf.ComponentTagHandlerDelegateImpl.apply(ComponentTagHandlerDelegateImpl.java:162) at javax.faces.view.facelets.DelegatingMetaTagHandler.apply(DelegatingMetaTagHandler.java:114) at javax.faces.view.facelets.CompositeFaceletHandler.apply(CompositeFaceletHandler.java:94) at com.sun.faces.facelets.compiler.NamespaceHandler.apply(NamespaceHandler.java:89) at javax.faces.view.facelets.CompositeFaceletHandler.apply(CompositeFaceletHandler.java:94) at com.sun.faces.facelets.compiler.EncodingHandler.apply(EncodingHandler.java:79) at com.sun.faces.facelets.impl.DefaultFacelet.apply(DefaultFacelet.java:148) at com.sun.faces.application.view.FaceletViewHandlingStrategy.buildView(FaceletViewHandlingStrategy.java:734) at com.sun.faces.lifecycle.RenderResponsePhase.execute(RenderResponsePhase.java:96) at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:97) at com.sun.faces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:135) at javax.faces.webapp.FacesServlet.service(FacesServlet.java:309) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:304) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:368) at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:109) at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:83) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380) at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:97) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380) at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:100) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380) at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:78) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380) at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:54) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380) at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:35) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380) at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilter(BasicAuthenticationFilter.java:177) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380) at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:187) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380) at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:105) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380) at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:79) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:380) at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:169) at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:237) at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:167) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:242) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:240) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:203) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:164) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:108) at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:558) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:379) at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:242) at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:259) at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:281) at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908) at java.lang.Thread.run(Thread.java:619)

Já andei vasculhando o google a respeito a não tenho tido mto êxito, conto com os gujeiros agora!

A

Olá fabiomedeirosf.
Você conseguiu resolver esse erro? Estou com o mesmo problema! :S

F

andii,

Ainda não obtive solução.

Mto embora tenha dado com o spring, mas se descobrir algo.

Peguei o livro de security 3, se quiser posso te enviar, dei uma folheada, parece que o livro aborda o assunto.

Abco

A

Então, consegui resolver agora pouco, faltava um .jar
Bom… pra usar a taglib eu uso o:
facelets-taglib-0.3_jsf-2.0_spring-3.jar
e o que estava faltando é:
taglib-core-0.4.jar

:slight_smile:

F

andii,

esse taglib-core0.4.jar é de onde, so spring?

A

Fabio é do Spring Security mesmo… .segue o link:
http://spring-security-facelets-taglib.googlecode.com/svn/repo/org/springframework/security/taglib-core/0.4/

T

andii.brunetta:
Fabio é do Spring Security mesmo… .segue o link:
http://spring-security-facelets-taglib.googlecode.com/svn/repo/org/springframework/security/taglib-core/0.4/

estou tentando configurar o spring para utilizar esse recurso mas sem sucesso : o erro que é apresentado :

java.lang.NoSuchMethodError: org.springframework.security.core.Authentication.getAuthorities()Ljava/util/List;

at org.springframework.security.taglibs.facelets.SpringSecurityELLibrary.getUserAuthorities(SpringSecurityELLibrary.java:58)

at org.springframework.security.taglibs.facelets.SpringSecurityELLibrary.ifAnyGranted(SpringSecurityELLibrary.java:79)

at org.springframework.security.taglibs.facelets.IfAnyGrantedTag.apply(IfAnyGrantedTag.java:38)

at javax.faces.view.facelets.CompositeFaceletHandler.apply(CompositeFaceletHandler.java:98)

at javax.faces.view.facelets.DelegatingMetaTagHandler.applyNextHandler(DelegatingMetaTagHandler.java:137)

at com.sun.faces.facelets.tag.jsf.ComponentTagHandlerDelegateImpl.apply(ComponentTagHandlerDelegateImpl.java:184)

at javax.faces.view.facelets.DelegatingMetaTagHandler.apply(DelegatingMetaTagHandler.java:120)

at javax.faces.view.facelets.CompositeFaceletHandler.apply(CompositeFaceletHandler.java:98)

at javax.faces.view.facelets.DelegatingMetaTagHandler.applyNextHandler(DelegatingMetaTagHandler.java:137)

at com.sun.faces.facelets.tag.jsf.ComponentTagHandlerDelegateImpl.apply(ComponentTagHandlerDelegateImpl.java:184)

at javax.faces.view.facelets.DelegatingMetaTagHandler.apply(DelegatingMetaTagHandler.java:120)

at javax.faces.view.facelets.CompositeFaceletHandler.apply(CompositeFaceletHandler.java:98)

at javax.faces.view.facelets.DelegatingMetaTagHandler.applyNextHandler(DelegatingMetaTagHandler.java:137)

at com.sun.faces.facelets.tag.jsf.ComponentTagHandlerDelegateImpl.apply(ComponentTagHandlerDelegateImpl.java:184)

at javax.faces.view.facelets.DelegatingMetaTagHandler.apply(DelegatingMetaTagHandler.java:120)

at javax.faces.view.facelets.CompositeFaceletHandler.apply(CompositeFaceletHandler.java:98)

at com.sun.faces.facelets.compiler.NamespaceHandler.apply(NamespaceHandler.java:93)
A

Olá tenclar!
No meu caso estava faltando uma lib, então a solução era:
Para usar a taglib eu uso o: facelets-taglib-0.3_jsf-2.0_spring-3.jar
e o que estava faltando é: taglib-core-0.4.jar

F

Fabio, tem como passar esse livro?

Estou tendo exatamente o mesmo problema…

axei esta pagina que explica como usar:
http://static.springsource.org/spring-webflow/docs/2.2.x/reference/html/ch13s09.html
Mas apos seguir os passos meu projeto passa a dar erro de deployment (apos adicionar o …)

E sem adicionar essa parte no web.xml aceita o namespace (netbeans nao marca como errado hehe) mas quando autenticado ele simplesmente nao encontra as funçoes “areAnyGranted()” e etc…

Gostaria muito de saber como resolver isso, to precisando MESMO!

Obrigado desde ja!

S

it’s not a problem with missing jars

go to the actual site: http://code.google.com/p/spring-security-facelets-taglib/ there is updated, mvn dependency configuration, i am using sprng security 3.0.5 release so I have added:

<dependency>

    <groupid>

    org.springframework.security

    </groupid>

    <artifactid>

    facelets-taglib-jsf20-spring-3

    </artifactid>

    <version>

    0.5

    </version>

</dependency>

and now it’s working like a charm :slight_smile:

A

Eu coloco o atributo rendered no componente que desejo ocultar.

Exemplo:

<p:menuitem value="MINHA PAGINA" action="/pagina.xhtml" ajax="false" 
                            rendered="#{facesContext.externalContext.isUserInRole('ROLE_ADMIN') or facesContext.externalContext.isUserInRole('ROLE_CLIENTE') or facesContext.externalContext.isUserInRole('ROLE_USUARIO')}" ></p:menuitem>

Você pode personalizar da forma que achar melhor.

L
Oi pessoal, estou com problemas pra renderizar isso também.. Meu xml de configuracao do spring-security está assim:
<?xml version="1.0" encoding="UTF-8"?>

<beans xmlns="http://www.springframework.org/schema/beans"
  xmlns:sec="http://www.springframework.org/schema/security"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans 
  		http://www.springframework.org/schema/beans/spring-beans-3.0.xsd 
  		http://www.springframework.org/schema/security 
  		http://www.springframework.org/schema/security/spring-security-3.0.3.xsd">				
	
		<sec:http auto-config="true" access-denied-page="/acessonegado.jsf">
		
		<sec:intercept-url pattern="/login*" access="IS_AUTHENTICATED_ANONYMOUSLY" />
		<sec:intercept-url pattern="/visao/home*" access="ROLE_USER, ROLE_ADM" />
		<sec:intercept-url pattern="/visao/caixaVisao/**" access="ROLE_USER, ROLE_ADM" />
		<sec:intercept-url pattern="/visao/adminVisao/**" access="ROLE_ADMIN" />	
		
		<sec:form-login login-page="/login.jsf"
					    login-processing-url="/j_spring_security_check" 
						default-target-url="/visao/home.jsf" 
					    authentication-failure-url="/login.jsf" />
					    
		<sec:logout logout-success-url="/login.jsf" />
		
			
	</sec:http>

	<sec:authentication-manager>
		<sec:authentication-provider user-service-ref="hibernateUserDetailsService" ref="daoAuthenticationProvider" />
	</sec:authentication-manager>

	<bean id="daoAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
		<property name="userDetailsService" ref="hibernateUserDetailsService" />
	</bean>

	<bean id="loggerListener" class="org.springframework.security.access.event.LoggerListener" />						
 
</beans>
Na minha página xhtml eu coloco esse xmlns
xmlns:sec="http://www.springframework.org/security/facelets/tags"
e desta forma eu tento renderizar
<p:tab title="Menu" rendered="#{sec:areAllGranted('ROLE_ADMIN')}">

e ele me retorna esse erro:

[color=red]Grave: Critical error during deployment:
com.sun.faces.config.ConfigurationException: java.lang.ClassNotFoundException: org.springframework.faces.security.FaceletsAuthorizeTagHandler
at com.sun.faces.config.processor.FaceletTaglibConfigProcessor.processHandlerClass(FaceletTaglibConfigProcessor.java:436)
at com.sun.faces.config.processor.FaceletTaglibConfigProcessor.processTags(FaceletTaglibConfigProcessor.java:371)
at com.sun.faces.config.processor.FaceletTaglibConfigProcessor.processTagLibrary(FaceletTaglibConfigProcessor.java:314)
at com.sun.faces.config.processor.FaceletTaglibConfigProcessor.process(FaceletTaglibConfigProcessor.java:263)
at com.sun.faces.config.ConfigManager.initialize(ConfigManager.java:362)
at com.sun.faces.config.ConfigureListener.contextInitialized(ConfigureListener.java:225)
at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4779)
at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5273)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1568)
at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1558)
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:334)
at java.util.concurrent.FutureTask.run(FutureTask.java:166)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603)
at java.lang.Thread.run(Thread.java:722)
Caused by: java.lang.ClassNotFoundException: org.springframework.faces.security.FaceletsAuthorizeTagHandler
at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1701)
at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1546)
at com.sun.faces.util.Util.loadClass(Util.java:293)
at com.sun.faces.config.processor.AbstractConfigProcessor.loadClass(AbstractConfigProcessor.java:311)
at com.sun.faces.config.processor.FaceletTaglibConfigProcessor.processHandlerClass(FaceletTaglibConfigProcessor.java:420)
... 15 more[/color]

E minha aplicaçao nao roda, quando vou testar dá um erro 404 =/

Alguém poderia me ajudar? sou bem novo no spring-security e qualquer ajuda é util... tenho que configurar alguma coisa ainda?

A

Está faltando a lib que contém esta classe:

org.springframework.faces.security.FaceletsAuthorizeTagHandler

Adiciona ela ao seu projeto!

L

valeu cara!,

eu baixei o jar desse site http://mavenhub.com/c/org/springframework/faces/security/FaceletsAuthorizeTagHandler/jar

e agora estou encarando o seguinte problema…
[color=red]
Grave: Critical error during deployment:
com.sun.faces.config.ConfigurationException:
Source Document: jar:file:/C:/workspace/.metadata/.plugins/org.eclipse.wst.server.core/tmp0/wtpwebapps/CashWeb/WEB-INF/lib/org.springframework.faces-2.3.0.RELEASE.jar!/META-INF/faces-config.xml
Cause: Class ‘org.springframework.faces.webflow.FlowActionListener’ is missing a runtime dependency: java.lang.NoClassDefFoundError: org/springframework/webflow/execution/RequestContext

[/color]

Alguém sabe o que é?

L

Pessoal eu consegui resolver o problema baixando as libs do spring-webflow 2.2.1 e funcionou… agora estou com problemas no EL porque no console do Eclipse aparece:

Grave: Servlet.service() for servlet [Faces Servlet] in context with path [/CashWeb] threw exception [/visao/templates/templateMenuAdmin.xhtml @20,68 rendered="#{sec:areAllGranted(‘ROLE_ADMIN’)}" Function ‘sec:areAllGranted’ not found] with root cause
javax.el.ELException: Function ‘sec:areAllGranted’ not found

e Erro 500 (no browser)

Pergunta: Vcs poderiam me informar sobre como configurar esse EL? eu coloco isso no faces-context?

Obrigado pela paciência pessoal
att

Criado 2 de janeiro de 2011
Ultima resposta 2 de mar. de 2012
Respostas 15
Participantes 7