free and more feature rich alternative to BlazeDS, but also outranks LCDS’ out-of-the-box features when it comes to data management, streaming media and integrating with mobile devices and Cloud computing
developer tools like code generation, invocation test drive and interoperability with multiple IDEs and frameworks
supporting integration with mobile clients (Android, Windows Phone 7, RIM Playbook and soon iOS) and the Java service layer, which includes support for Java POJOs, EJBs, Spring Beans, Grails controllers, Hibernate Objects and XML Web Services
Why is the constructor invoked twice when a normal scoped bean is created?
What you see is the instantiation of two objects: one is the actual bean instance, the other one is the proxy. Both likely invoke the default constructor.
That's why it's generally considered a bad idea to do initialization in class construction code. Instead, when using managed beans (objects managed by the EE container) to perform initialisation in a @PostConstruct or @Inject annotated method.
In JEE managed mode, such as an EntityManager injected into a SessionBean, the EntityManager reference, represents a new persistence context for each transaction. This means objects read in one transaction become detached after the end of the transaction, and should no longer be used, or need to be merged into the next transaction. In managed mode, you never create or close an EntityManager.
Transactions
operations that are committed or rolled back as a single unit
JPA provides two mechanisms for transactions
JTA (Java Transaction API
EntityTransaction
all changes made to all persistent objects in the persistence context are part of the transaction.
Domain object instance security: In many applications
it's desirable to define Access Control Lists (ACLs) for individual
domain object instances. We provide a comprehensive ACL package with
features including integer bit masking, permission inheritance
(including blocking), an optimized JDBC-backed ACL repository, caching
and a pluggable, interface-driven design.
OpenID Support: the web's emerging single sign-on standard
(supported by Google, IBM, Sun, Yahoo and others) is also supported in Spring
Security
Easy integration with existing databases: Our implementations
have been designed to make it easy to use your existing authentication schema
and data (without modification). Of course, you can also provide your own Data
Access Object if you wish.
Password encoding: Of course, passwords in your authentication
repository need not be in plain text. We support both SHA and MD5 encoding, and
also pluggable "salt" providers to maximise password security.
Caching: Spring Security optionally integrates with Spring's Ehcache factory. This flexibility
means your database (or other authentication repository) is not repeatedly queried
for authentication information when using Spring Security with stateless
applications.
Run-as replacement: The system fully supports temporarily
replacing the authenticated principal for the duration of the web request or
bean invocation. This enables you to build public-facing object tiers with
different security configurations than your backend objects.
Tag library support: Your JSP files can use our taglib to ensure
that protected content like links and messages are only displayed to users
holding the appropriate granted authorities. The taglib also fully integrates
with Spring Security's ACL services, and obtaining extra information about the
logged-in principal.
User Provisioning APIs: Support for groups, hierarchical roles
and a user management API, which all combine to reduce development time and
significantly improve system administration.
Enterprise-wide single sign on using CAS 3: Spring Security
integrates with JA-SIG's open source Central Authentication
Service (CAS)
An implementation of this interface must be thread safe
If authorization fails, either because the user is not logged in or because it doesn't have required rights, it must throw an appropriate
org.granite.messaging.service.security.SecurityServiceException.
Writing a Security Service
SecurityService interface
nothing to do with a true Flex destination
only one instance of this service is used in the entire web-app
and will be called by concurrent threads
configure
login
This method is called upon each and every service method call invocations (RemoteObject)
or subscribe/publish actions (Consumer/Producer). When used with RemoteObjects,
the authorize method is responsible for checking security, calling the service method, and returning the corresponding result.
authorize
logout
handleSecurityException
default implementation of this method in AbstractSecurityService is to do nothing
security services
are not exposed to outside calls
Interceptor classes and methods are defined using metadata annotations, or in the deployment
descriptor of the application containing the interceptors and target classes
Interceptor Metadata Annotations
AroundInvoke
AroundTimeout
PostConstruct
PreDestroy
Interceptor classes must have a public,
no-argument constructor