CDI Qualifiers Question & Seam Security

[zeeman]

I have two authenticators; one for DB and the other for openId. Each authenticator produces a LoggedInUser object.

Through out my app I would like to inject LoggedInUser, regardless whether it comes from DB authenticator or OpenId one. In my code I use @Any to inject LoggedInUser. To avoid ambiguous errors, I use a Stateful EJB CurrentUserManager that observes what authenticators produce and it's the class that produces LoggedInUser.

In production only OpenId one will be uses, in development DB one will be used.

Is this the right way to do this?

Sample code:

@Named("dbAuthenticator")
public class DBAuthenticator extends BaseAuthenticator implements Authenticator {

     @Inject
     @DBAuthenticated
     private Event<LoggedInMemberInfo> loginEventSrc;

}

@Named("openIdAuthenticator")
public class OpenIdAuthenticator extends BaseAuthenticator implements Authenticator {

     @Inject
     @OpenIdAuthenticated
     private Event<LoggedInMemberInfo> loginEventSrc;

}

@Stateful
@SessionScoped
public class CurrentUserManager implements Serializable {

     private static final long serialVersionUID = 1L;
     private LoggedInMemberInfo currentUser;

     @Produces
     @Any
     public LoggedInMemberInfo getCurrentAccount() {
          return currentUser;
     }

     public void onLoginOpenId(@Observes @OpenIdAuthenticated  LoggedInMemberInfo user) {currentUser = user;}
     public void onLoginDB(@Observes @DBAuthenticated  LoggedInMemberInfo user) {currentUser = user;}

I use it in code like this:

@Inject @Any
private LoggedInMemberInfo user;

[lightguard]

I'd actually use alternatives for this. In development I doubt you'll be testing both kinds of authentication simultaneously so an alternative which you switch on and off in beans.xml would probably be a cleaner solution. You read more about alternatives in the Weld docs, or the spec.

[zeeman]

I thought about using alternatives. Does that change how I inject LoggedInUser? Do I still use @Any or use my own @Authenticated annotation?

[lightguard]

You could use @Any but you won't have to. In fact you could use the same qualifier. Because of the alternatives, there will only be one bean that will satisfy that injection point.

[zeeman]

I have to use @any, if I don't get dependency unsatisfied error when starting AS7. Any ideas? I would rather not to have put @Any when injecting the LoggedInUser.

[lightguard]

Please post the code bits you're working with (the inject points, producers, and the beans.xml), or gist or something.

[zeeman]

Hi Jason,

I figured it out. As you can see from my code above. I used @Any on @Produces. So to get that member injected I had to use @Any. After I removed @Any from outjection point I can inject LoggedInMemberInfo without having to use @Any. Thanks for your help.

But that does not make sense, CDI should not error out on @Any. It seems like CDI does a literal match for injection points regardless of their functional meaning. In other words using @Any at outjection code should work for fields injected without using @Any.

My code is exactly what I posted above.

[lightguard]

@Any should be used at injection, not production. You can read the API description at http://docs.jboss.org/cdi/api/1.0/javax/enterprise/inject/Any.html. When you use it with a producer, you're going to force any injection point to also have it. When it's used at injection it's becomes a wildcard match essentially.

Does that help at all?

[zeeman]

yes, this clarifies it for me. Thanks!