Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Need Spring security tag support for JSF/Facelets [SWF-1333] #521

spring-operator opened this issue Jun 16, 2008 · 5 comments


Copy link

spring-operator commented Jun 16, 2008

Vigil Bose opened SWF-1333 and commented

Since Spring security already has support for using "auth" tag inside JSP's and the similar one does not exist for supporting JSF/Facelets view technology. It is cumbersome to go with a third party acegi-jsf components and hack them to make it work with Spring security 2.0.2. It would definitely add a lot of value to provide support of using Spring security tag in JSF/Facelets view technology.

Issue Links:

25 votes, 19 watchers

Copy link
Contributor Author

bansi commented

spend whole day trying to figure out why Spring Security Tags 2.0.2 were not working whereas the sampe Tutorial shipped with there disturbution works perfectly fine.

After lots of debugging with Eclipse debugger, i figured out everything works perfect when i define Spring security tags works inside a JSP page. But if i define similar tags in Facelets xhtml file it doesnt work.

Here is the snippet which works fine


<%@ taglib prefix="sec" uri="" %>

<h1>Home Page</h1>
Your principal object is....: <%= request.getUserPrincipal() %>

Your Authentication Object is <sec:authentication property="principal.username"/>


Here is the snippet which doesnt work


<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "">
<html xmlns=""




xmlns:a4j="" xmlns:rich=""






<ui:composition template="/WEB-INF/layout/layout.xhtml">

<ui:define name="title">

Admin - Manufacturer


<ui:define name="content">


<h:form id="manufacturerForm">

<ui:include src="messages.xhtml"/>

<h1> Maintain Manufacturers </h1>

Your Authentication Object is <sec:authentication property="principal.username"/>


Any pointers/suggestions greatly appreciated



Copy link
Contributor Author

marcin muras commented

Yes it's true in facelets environment this tag doesn't works.

It should be added in certainly but whats more facelets functions can be created.
Such functionality enable to use expression like this e.g. .. rendered="ifAnyGranted('some role')".

So we can use not only tags but also functions in EL expression.
I have implemented such functionality (by using source code from existing tag). (in reality tag logic should be extracted to some external classes so facelets functions impl. could use it)
How can I add this to Spring Security ?

Copy link
Contributor Author

Claude Gex commented

Crank has implemented the authorize tag as a facelet tag.
This may be interesting for several facelet developers - and may also be interesting for the spring core team (possibly the crank crew would be generous and spend the code to start with...).



Copy link
Contributor Author

Dominik Dorn commented


I've created a simple jar file to easily integrate Spring Security and Facelets. You can even add it as maven dependency.

If you are interested in this, take a look at
[URL=""] Using Spring Security with Facelets[/URL]


Copy link
Contributor Author

Rossen Stoyanchev commented

Note that due to the package changes in Facelets between JSF 1.2 and JSF 2 you will need to register the Spring Security taglib by adding a springsecurity.taglib.xml appropriate for your version (details below). Also see the booking-faces sample, which contains the necessary configuration.

  1. Add /WEB-INF/springsecurity.taglib.xml (substite class name with SpringSecurityJsf12TagLibrary for JSF 1.2):

<?xml version="1.0"?>
<!DOCTYPE facelet-taglib PUBLIC
"-//Sun Microsystems, Inc.//DTD Facelet Taglib 1.0//EN"
2. web.xml context parameter:


A Spring Security Facelets tag library has been added with support for JSF 2 and JSF 1.2 environments. The library provides an <authorize> tag and also registers several authorization-related EL functions.

The <authorize> tag is functionally equivalent to the JSP <authorize> tag described in the Spring Security documentation. It supports the following combinations of attributes:

  • access (authorization based on a Spring EL expression with Spring Security specific functions)
  • url, method (authorize if the user is allowed to access the given URL and HTTP method pair)
  • ifAllGranted, ifAnyGranted, ifNotGranted (authorize against a comma-separated lists of authorities)

All <authorize> tag attributes can be Unified EL expressions except the "access" attribute, which is expected to be a Spring EL expression. The "var" attribute can be used to store the result of the authorization for access in EL expressions in other parts of the view.

Use the following to add the tag library to a view ("sec" is recommended but not required):

Then use the <authorize> tag in the view:
<sec:authorize access="hasRole('ROLE_SUPERVISOR') and hasIpAddress('')">
I can see this

Note that in order to use Spring EL expressions you must add the "use-expressions" attribute in your Spring Security configuration:
<security:http auto-config="true" use-expressions="true">

The Spring Security Facelets tag library also provides the following EL functions:

  • areAllGranted(String authorities)
  • areAnyGranted(String authorities)
  • areNotGranted(String authorities)
  • isAllowed(String url, String method)

They can be used in any component attribute. For example:

<h:panelGroup id="bookingsFragment" rendered="#{sec:areAllGranted('ROLE_USER, ROLE_SUPERVISOR')}">

This functionality will be available in Spring Web Flow 2.2.0.RC1.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet

No branches or pull requests

2 participants