Easy way to secure all pages in an app?

[lawrieg]

Hi,

I'm just wondering whether there is an easy way to enforce that a user must be logged in to access any pages in an application (except, of course, the login page itself...)

I basically want the login page to be the first page the user sees, and for them not to be able to access any other pages until they have successfully logged in.

Is it possible to set this up without putting login-required="true" in every page's page.xml file?

Thanks,

Lawrie

[pmuir]

<page view-id="/*" login-required="true" />

[lawrieg]

Hi Pete,

Just tried this and can't seem to make it work - IE just hangs indefinitely and Firefox gives me the following message:

The page isn't redirecting properly

Firefox has detected that the server is redirecting the request for this address in a way that will never complete.

I tried setting <page login-required="false"> in login.page.xml but this didn't help.

Any thoughts?

Cheers,

Lawrie

[gavin.king]

Use a wildcard view idd.

[gavin.king]

You also need < pages login-view-id="..." >.

And you need to be using current CVS.

[lawrieg]

I'm now using the latest CVS version, have ensured all the settings suggested above are correctly set, but I'm still getting the problem.

Seam appears to be trying (but failing) to redirect to:

http://localhost:8080/customerbuilder/login.seam?cid=1&clr=true

It seems perhaps that using a wildcard to set all pages to require login also then means you need to be logged in in order to get to the login page, and setting login-required="false" for login.xhtml (either in login.pages.xml or pages.xml) does not work.

Any thoughts?

[gavin.king]

Right, you are not supposed to set login-required on *, only on /secure/*.

But I guess I can account for your usecase by *not* requiring login on the login-view-id ;-)

[gavin.king]

Done in CVS. That should fix your prob.

[lawrieg]

Many thanks Gavin - jobs a good'un!

Cheers,

Lawrie