Skip to content

ISIS-2534: Spring Security Integration#387

Merged
andi-huber merged 29 commits intomasterfrom
ISIS-2534-spring_sec
Feb 27, 2021
Merged

ISIS-2534: Spring Security Integration#387
andi-huber merged 29 commits intomasterfrom
ISIS-2534-spring_sec

Conversation

@andi-huber
Copy link
Copy Markdown
Contributor

@andi-huber andi-huber commented Feb 18, 2021

  • Implement a new security module based on Spring Security (similar to keycloak)
  • Ajax requests (Wicket) get rejected by Spring's filter due to these request not having the CSRF protection token
  • Figure out a way to disable CSRF filters, while not interfering with any potential app dev security customization options
  • Integrate with Wicket
  • Integrate with Vaadin
  • Integrate with SecMan

This change is Reviewable

@andi-huber andi-huber added this to the 2.0.0-M6 milestone Feb 18, 2021
@andi-huber andi-huber self-assigned this Feb 18, 2021
@andi-huber andi-huber force-pushed the ISIS-2534-spring_sec branch 2 times, most recently from 57d7fb7 to 48b0c58 Compare February 19, 2021 16:46
@andi-huber andi-huber modified the milestones: 2.0.0-M6, 2.0.0-M5 Feb 21, 2021
joonatan-r and others added 18 commits February 24, 2021 09:09
Without this patch applied, when a user clicks a menu item in an expired
session, the session is simply refreshed and no action is taken. This is
a problem because from the user's point of view the click is ignored. This
patch fixes the problem by notifying user that the session was expired and
was refreshed from the click.
just for reference on how to do that
CSRF in wicket viewer is yet considered experimental, so the framework
disables it by default unless configured otherwise
requests

yet commented out, because does not work
Bumps `togglz.version` from 2.9.2 to 2.9.6.

Updates `togglz-core` from 2.9.2 to 2.9.6
- [Release notes](https://github.com/togglz/togglz/releases)
- [Commits](togglz/togglz@2.9.2...2.9.6)

Updates `togglz-junit` from 2.9.2 to 2.9.6
- [Release notes](https://github.com/togglz/togglz/releases)
- [Commits](togglz/togglz@2.9.2...2.9.6)

Updates `togglz-servlet` from 2.9.2 to 2.9.6
- [Release notes](https://github.com/togglz/togglz/releases)
- [Commits](togglz/togglz@2.9.2...2.9.6)

Updates `togglz-console` from 2.9.2 to 2.9.6
- [Release notes](https://github.com/togglz/togglz/releases)
- [Commits](togglz/togglz@2.9.2...2.9.6)

Signed-off-by: dependabot[bot] <support@github.com>
yet missing conversion from Identifier to ApplicationFeatureId
rename method that is exclusively used for i18n translation contexts

fix wrong usages when identifying actions: these should always include
their parameter class name list
logical their logical names

A generalization of Java's class type to also hold a logical name, which
can be supplied lazily.

Simplifies the factory methods of Identifier.
Identifier

made possible, because Identifier now also supports logical type names
aka object-type
@andi-huber andi-huber marked this pull request as ready for review February 27, 2021 19:48
@andi-huber andi-huber merged commit 2976f60 into master Feb 27, 2021
@andi-huber andi-huber deleted the ISIS-2534-spring_sec branch February 27, 2021 19:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants