An implementation of this interface must be thread safe
If authorization fails, either because the user is not logged in or because it doesn't have required rights, it must throw an appropriate
org.granite.messaging.service.security.SecurityServiceException.
Writing a Security Service
SecurityService interface
nothing to do with a true Flex destination
only one instance of this service is used in the entire web-app
and will be called by concurrent threads
configure
login
This method is called upon each and every service method call invocations (RemoteObject)
or subscribe/publish actions (Consumer/Producer). When used with RemoteObjects,
the authorize method is responsible for checking security, calling the service method, and returning the corresponding result.
authorize
logout
handleSecurityException
default implementation of this method in AbstractSecurityService is to do nothing
security services
are not exposed to outside calls
always have to include this library in either
WEB-INF/lib
support for CDI is included in the library granite-cdi.jar
10.1. Configuration with Servlet 3
On Servlet 3 compliant containers, GraniteDS can use the new APIs to automatically register its own servlets and filters and thus does not need any
particular configuration in web.xml. This automatic setup is triggered when GraniteDS finds a class annotated with
@FlexFilter in one of the application archives:
@FlexFilter declaration will setup an AMF processor for the specified url pattern
tideAnnotations
defines suitable default values
@TideEnabled
@RemoteDestination
always declared by default
tideInterfaces
tideRoles
exceptionConverters
amf3MessageInterceptor
10.3.2. Typesafe Remoting with Dependency Injection
It is possible to benefit from even more type safety by using the annotation [Inject] instead of In.
When using this annotation, the full class name is used to find the target bean in the CDI context instead of the bean name.
Security
integration between the client RemoteObject
credentials and the server-side container security
client-side component named
identity
API to define runtime authorization checks on the Flex UI
Gas3 uses the principle of "Base" and customizable inherited classes that let you add methods to generated classes without facing the risk
of losing them when a new generation process is executed
5.3. Java Classes and Corresponding Templates
summary of templates used by the generator depending on the kind of Java class it encounters:
these templates are bundled in the granite-generator.jar archive, in the org.granite.generator.template
package and accessible as resources via the class loader
class: protocol is used because all standard templates are available in the classpath
Alternatively, you may use the file: protocol to load your template from the filesystem. These templates can be
specified either by using absolute paths (eg. file:/absolute/path/to/mytemplate.gsp) or paths relative to your
current Eclipse project root directory (eg. path/to/mytemplate.gsp).
ActionScript 3 generator is able to write AS3 typed client proxies for exposed remote services
Compared to the usual Flex RemoteObject, this can greatly help development by bringing
auto-completion
improved type-safety
in Flex
when using remote services.
replicate validation annotations in order to use the Flex side validation framework
Known Limitations
Gas3 does not support inner classes
must declare your classes in separated source files
if you want them to be correctly handled by the generator
10.3.5. Security
GraniteDS provides a client-side component named identity that ensures the integration between the client RemoteObject
credentials and the server-side container security. It additionally includes an easy-to-use API to define runtime authorization checks on the Flex UI.
CDI identity component (of class org.granite.tide.cdi.Identity) predictably provides two methods
login() and logout()
identity component is integrated with server-side role-based security and can be used to get information or show/hide UI
depending on the user access rights:
GraniteDS provides out-of-the-box integration with Seam 2.2 via either the RemoteObject API or the Tide API
to remotely call Seam components, and fully supports serialization of JPA entities from and to your Flex application, taking care of lazily loaded associations