Seam 3 @ViewConfig not working

[testvogel]

Hi,

I'm trying to configure some access restrictions by using the @ViewConfig annotation. Here is my interface:

@ViewConfig
public interface AppViewConfig {

    static enum Pages {

        @ViewPattern("/admin/*")
        @Admin
        ADMIN,

        @ViewPattern("/user/*")
        @User
        USER,

        @FacesRedirect
        @ViewPattern("/*")
        @AccessDeniedView("/denied.xhtml")
        @LoginView("/login.xhtml")
        ALL;

    }

I also have defined some dummy security rules:

public class SecurityRules {

    public @Secures @User boolean ownerChecker(Identity identity) {

        if (identity.getUser() == null) {
            return false;
        } else {
            return true;
        }
    }

    public @Secures @Admin boolean adminChecker(Identity identity) {
        if (identity.getUser() == null) {
            return false;
        } else {
            return "admin".equals(identity.getUser().getId());
        }
    }

}

I expect that if I call a page /admin/test.xhtml and if I'm not logged in that I will be redirected to the login.xhtml, but this is not happening. I can access all pages every time

Any idea what Im doing wrong?

[bram666]

ola,

i think it is the way how the pretty filter works, you call the xhtml directly and the pretty filter is not called then.

if you map the /admin/test.xhtml to a url /admin/test it prolly will work if you call /admin/test but not if you call /admin/test.jsf (not tested it myself).

[testvogel]

Hi,

is there any other solution or workaround available? I think in seam 2 this could be done by using the pages.xml.

[lightguard]

There's also been some people talking about bugs in this, a work around may be to make sure your restrictions are taking place in the RESTORE_VIEW phase. I don't know if this will fix your particular issue or not, but it certainly couldn't hurt.

[testvogel]

I think I have already defined the security binding to take place in the restore_view phase:

@SecurityBindingType

@RestrictAtPhase(PhaseIdType.RESTORE_VIEW)

@Retention(RetentionPolicy.RUNTIME)

@Target({ElementType.FIELD, ElementType.METHOD, ElementType.TYPE})

public @interface Admin {

}

[testvogel]

Hi all,

I figured out what the problem is. I just have forgot to include the seam-faces in my pom file:

		<dependency>
		<groupId>org.jboss.seam.faces</groupId>
		<artifactId>seam-faces</artifactId>
		<scope>runtime</scope>
		</dependency>

As soon as I include the faces lib the redirecting to the login page is working but now i get an observer exception by every self executed redirect . Does anyone has an idea what I have forgot? The online workaround is to remove the seam-faces dependency from the pom file.