Use IdentityStore and JPA authentication

[chris.simons]

I'm reading up on the new Seam security features.

Is it possible to configure Seam to point to an IdentityStore (such as LDAP) but also provide authentication via JPA?  Ex. Giving the user the option to login using Exchange password or internal authentication.  Would doing so exclude the ability to use the new IdentityStore?

Also, I'm having trouble getting my page to redirect after login.  This worked before upgrading to Seam 2.1.SP1.  Any ideas of what I may be missing? 

Thanks.

[andre.eugenio]

You can provide your custom authentication method configuring in components.xml

     <security:identity 
          authenticate-method="#{customBean.customMethod}"      
     />

[chris.simons]

Andre,

I do have that in my components.xml.  I assume you're saying that within the customMethod, I would be providing the means to check both authentication systems.  However, would this preclude the ability to define an IdentityStore?

Thanks.

[andre.eugenio]

I guess not because the identityStore it's responsible for a lot more of things than just authenticate the user.

[shane.bryzak]

The easiest way to achieve what you want is probably to extend IdentityManager and override the authenticate() method so that it attempts to authenticate with both of your identity stores.  Of course for all other identity management-related functionality you're going to be limited to just one identity store.  This means that for user management (if you have it in your app) you'll only see the usernames provided by your chosen identity store implementation.  Oh, and you'll only be able to load roles from one identity store also.

[chris.simons]

Thanks, Shane, that's the answer I needed.

[bgroeneveld]

Extending the JpaIdentityStore to override the authenticate() method works great - thanks!  Now it would be nice to be able to provide our own user and role entities using the components.xml definition.  We would still like to read our roles from persistent storage.  Assumedly, some form of:

<security:jpa-identity-store user-class="com.company.security.User"
                             role-class="com.company.security.Role" />

Looking at the JpaIdentityStore it isn't even clear to us how to set the User and Role entity classes otherwise - can you provide us with some direction?  Thanks!

[bgroeneveld]

Overriding JpaIdentityStore.init() does provide a solid workaround:

|
    @Create
    @Override
    public void init()
    {          
       setUserClass(com.company.security.User.class);
       setRoleClass(com.company.security.Role.class);
       super.init();
       return;
    }
|