[tony.herstell1]

Now you are the genius's... lets be very clear about that...

I had a login Action that called an Authentication object to authenticate the user; then my login action acted on the result of the authentication to decide which page to go to and returned it.

I was fumbling around trying to find the "controller" so that I could tell it which page I wanted it to go to...
e.g.
<security:identity authenticate-method="#{authenticationController.authenticate}"
loginSuccessPage='''' loginFailurePage="" logoutPage="mainMenu"/>

Now I understand what you have done. You have merged the two "things" into one, called authentication.

Perhaps the way I did it was naive, but it made sense at the time.

[tony.herstell1]

After a new user registers I wanted to auto log them in (refactoring for using Seam Security).
I assume there is no reason I can't bully the Identity class into logging them in for me.

user.setPassword(encryptionController.encrypt(user.getPassword()));
 log.info("Crypted Password:" + user.getPassword());
 em.persist(user);
 if (!Identity.instance().isLoggedIn()) {
 Identity.instance().setUsername(user.getUsername());
 Identity.instance().setPassword(user.getPassword());
 Identity.instance().login();
 }
 facesMessages.addFromResourceBundle("user_create_successful");
 log.info("Leaving Registration conversation." + conversation.getId()+")");
 valueToBeReturned = "success";

Might need a em.flush after the persist as my authentication class looks for the username/password on the Dbase... hummm

I also assume I can still just drop the session and things won't go pear shaped when someone deletes the user they are logged in as

 if (Identity.instance().isLoggedIn()) {
 if (loggedInUser.getUser().getId().compareTo(
 userToBeDeleted.getId()) == 0) {
 // We have deleted ourselves, so force a Logout.
 Seam.invalidateSession();
 return "mainMenu";
 }
 }
 facesMessages.addFromResourceBundle("user_delete_successful");

[gavin.king]

Its more correct to call Identity.authenticate() if you are using it from another action.

[tony.herstell1]

Changed.
Thx.

[shane.bryzak]

After a new user registers I wanted to auto log them in (refactoring for using Seam Security).
I assume there is no reason I can't bully the Identity class into logging them in for me.

This is exactly what the seamspace example does. Look at RegisterAction.uploadPicture(), plus the accompanying redirection in pages.xml:

 <page view-id="/register2.xhtml">
 <navigation from-action="#{register.uploadPicture}">
 <redirect view-id="/profile.xhtml"/>
 </navigation>
 </page>