Spring Security multiple filterChainProxy mapping/filters, custom filters Json Output - json

I have a part of my web application that is an RESTfull api and part a more standard web-pages.
I wish to have the REST part with some custom filters such as the EntryPoint, SuccessHandler and FailureHandler. This part is within the /rest/** mapping.
In the other hand, everything else needs to have more common filters and is mapped with /**.
The problem is to find an easy way to define the filterChainProxy with different mapping-filters.
Right now this solution doesn't work:
<!-- Normal web app -->
<http auto-config="true" use-expressions="true" authentication-manager-ref="authenticationManager">
<form-login/>
<logout/>
<intercept-url pattern="/**" access="hasRole('ROLE_USER')" />
</http>
<!-- Configure RESTfull services -->
<http use-expressions="true" authentication-manager-ref="authenticationManager" entry-point-ref="restAuthenticationEntryPoint" >
<form-login authentication-success-handler-ref="restAuthenticationSuccessHandler" login-page="/rest/login" username-parameter="username" password-parameter="password" />
<logout logout-url="/rest/logout" />
<intercept-url pattern="/rest/**" method="GET" access="hasRole('ROLE_USER')" />
<intercept-url pattern="/rest/**" method="POST" access="hasRole('ROLE_ADMIN')" />
<intercept-url pattern="/rest/**" method="PUT" access="hasRole('ROLE_ADMIN')" />
<intercept-url pattern="/rest/**" method="DELETE" access="hasRole('ROLE_ADMIN')" />
</http>
It complains with: the univseral match being before other patterns.
Is there a way to define such a thing without resorting to define the filterChainProxy with the definition? The http version does help quite a lot to reduce the amount of configuration as I will have to manually set a UsernamePasswordAuthenticationFilter etc.
The next problem is more simple: I have to respond, after the form-login authentication with a JSON object.
So far, I have implemented a SuccessHandler (actually a version of the SimpleUrlAuthenticationSuccessHandler without the redirect part).
How do I write my JSON output?
I must have something like this:
HTTP 200 OK
with:
{"success":true,"customer {"email":"customer#email.com","session_id":"b83a41dfaca6785399f00837888886e646ff9088"}}
and a similar thing with the FailureHandler. It must be quite simple and it's surely is some very basic thing, but how do you do that? Redirecting to a custom controller is not a solution since I will have the 301 redirect status that a very simple REST client might not be able to understand.
At the very least, I wish to have only the http header and no body at all.
thanks!

If you can upgrade to Spring Security 3.1 it supports multiple chains using namespace configuration.

Related

Vue 3 keep-alive cache routes

I'm using Vue 3 <keep-alive>. When I don't use :key it caches (improperly across different URLs as expected).
By adding
<router-view :key="$route.fullPath" v-slot="{ Component }">
<keep-alive>
<component :is="Component" />
</keep-alive>
</router-view>
I would think that it only makes an API call if the cache key doesnt exist, so that when I go to a different route and come back, it won't make a second api call.
But when I add :key="$route.fullPath" now it makes an API call every single time even if I revisit the same URL?
In Vue 3, put the key on the <component> rather than the <router-view>:
<router-view v-slot="{ Component }">
<keep-alive>
<component :is="Component" :key="$route.fullPath"></component>
</keep-alive>
</router-view>

Update View with Backend, won't work

Following issue, I want to update my front-end from my backing-bean.
View:
<p:layoutUnit id="center" position="center">
<p:layout>
<p:layoutUnit id="inner_north" position="north" size="100">
<h:form id="fortschrittForm">
<h:panelGrid columns="10" id="fortschritt" cellspacing="7" title="Fortschritt" cellpadding="6">
<h:outputText value="Mails heruntergeladen:"/>
<p:graphicImage library="img" name="erfolg.png"
rendered="#{managedBean.mails}" />
<h:outputText value="Pdfs wurden gelesen:"/>
<p:graphicImage library="img" name="erfolg.png"
rendered="#{managedBean.pdfs}" />
</h:panelGrid>
</h:form>
[...]
Button:
<p:commandButton value="Transition starten" actionListener="#{managedBean.prozessablauf}" update=":formTabelle:formDetail:msg anzeigeRisiko"/>
Backend:
public void prozessablauf() {
try {
emailHerunterladen();
mails = true;
RequestContext.getCurrentInstance().update("fortschrittForm:fortschritt");
} catch (Exception e) {
e.printStackTrace();
}
My problem is that
RequestContext.getCurrentInstance().update("fortschrittForm:fortschritt");
is not firing. Just when the method is completely done, all icons are shown. But I want in particular to update the fortschrittForm.
Heres the code in from firebug:
enter image description here
My problem is that
RequestContext.getCurrentInstance().update("fortschrittForm:fortschritt");
is not firing.
You misunderstand the behavior of RequestContext#update method. It does not trigger a seperate response. It just provides a simple way to set which components to update within the current request at runtime instead of hardcoding it via the update attribute in the markup.
Just when the method is completely done, all icons are shown.
This is the normal behavior.
Every change to the view on the client side has to be made with a request from the client side. This is how it works (unless you are using sockets or something like this). So to reflect updates from a long running or composite process on the server side, you have to poll for updates from the client as long as the process is running.
E.g. <p:poll /> is a very good candidate to go with and i would try something like this:
When requesting the start of the process on the client side, also start <p:poll /> with update attribute set to the target part of the view.
While the process is running on the server side, update the model values associated with the target part of the view on the client side respectivley.
When process ends on the server side, request a final update of the target part of the view and stop polling on the client side.
In addition I just found something interesting, which may be an option for you also. Have a look at PrimeFaces Push

Disable System Ribbon in CRM 2011

I would like to conditionally disable a System Ribbon = AddNew in a CRM 2011 form with javascript. That means if the statusCode is X or Y disable the Ribbon, how could I do this?
I tryed to get the ID of the Ribbon in order to change the classname of the Ribbon to disabled, but I got Null because the Ribbons are loaded asychronously!
To expand on Anwar's answer, the key to getting this to work is to intercept and repurpose the functionality of the AddNew ribbon button, but once you do, there won't be any need for hacking the Ribbon DOM. Below are a few steps that you can take to get there.
1) Create a solution with the Application Ribbon included.
2) Find in the SDK the sample ribbon for the Application Ribbon or build it yourself using the solution included in the SDK.
\sdk\resources\exportedribbonxml
\sdk\samplecode\cs\client\ribbon\exportribbonxml\exportedribbonxml
3) Find in the Application Ribbon template the control you're interested in, which I assume in this case is the AddNew button in entity subgrids. Repurpose this control in a CustomAction and make the location of the CustomAction the same name as the control you want to repurpose.
<CustomAction Id="YourOrg.SubGrid.{!EntityLogicalName}.AddNewStandard"
Location="Mscrm.SubGrid.{!EntityLogicalName}.AddNewStandard">
<CommandUIDefinition>
<Button Id="Mscrm.SubGrid.{!EntityLogicalName}.AddNewStandard"
Command="Mscrm.AddNewRecordFromSubGridStandard" Sequence="20"
LabelText="$Resources(EntityDisplayName):Ribbon.SubGrid.AddNew"
Alt="$Resources(EntityDisplayName):Ribbon.SubGrid.AddNew"
Image16by16="/_imgs/ribbon/NewRecord_16.png"
Image32by32="/_imgs/ribbon/newrecord32.png" TemplateAlias="o1"
ToolTipTitle="$Resources(EntityDisplayName):Mscrm_SubGrid_EntityLogicalName_MainTab_Management_AddNewStandard_ToolTipTitle"
ToolTipDescription="$Resources(EntityDisplayName):Mscrm_SubGrid_EntityLogicalName_MainTab_Management_AddNewStandard_ToolTipDescription" />
</CommandUIDefinition>
</CustomAction>
4) Find in the Application Ribbon template the definition of the command of this button, and using the exact definition as the basis of a new CommandDefinition, add in your own custom rule (in this case, a new EnableRule).
<CommandDefinition Id="Mscrm.AddNewRecordFromSubGridStandard">
<EnableRules>
<EnableRule Id="Mscrm.AppendToPrimary" />
<EnableRule Id="Mscrm.EntityFormIsEnabled" />
<EnableRule Id="YourOrg.DisableNewStuff" /> <!--your custom rule-->
</EnableRules>
<DisplayRules>
<DisplayRule Id="Mscrm.ShowForOneToManyGrids" />
<DisplayRule Id="Mscrm.AppendToPrimary" />
<DisplayRule Id="Mscrm.CreateSelectedEntityPermission" />
<DisplayRule Id="Mscrm.AppendSelected" />
<DisplayRule Id="Mscrm.HideAddNewForChildEntities" />
</DisplayRules>
<Actions>
<JavaScriptFunction FunctionName="Mscrm.GridRibbonActions.addNewFromSubGridStandard"
Library="/_static/_common/scripts/RibbonActions.js">
<CrmParameter Value="SelectedEntityTypeCode" />
<CrmParameter Value="PrimaryEntityTypeCode" />
<CrmParameter Value="FirstPrimaryItemId" />
<CrmParameter Value="PrimaryControl" />
</JavaScriptFunction>
</Actions>
</CommandDefinition>
5) Here is where Anwar's answer comes in: using both the OrRule and the ValueRule, define your EnableRule to check on the statuscodes of the entity. The linked demonstration relates to a new ribbon button, but the same rules work for repurposed ribbon controls as well.
Publish your changes when you're done and your ribbon should be all set. Because I'm not sure how familiar you are with RibbonXml, I'll also mention that Microsoft has some comprehensive walkthroughs that are pretty helpful (after much time studying them!) in picking it up.
This article explains exactly what your are looking for.
Please follow this link
How To Use "ValueRule" and "OrRule" in Ribbon Customizations - CRM 2011
This is how i hide the delete button on invoice form, based on status code, onload of the form:
var statusVal = Xrm.Page.getAttribute("statuscode").getValue();
if (statusVal==4 || statusVal==6) {
//Disable delete button
var x =top.document.getElementById("invoice|NoRelationship|Form|Mscrm.Form.invoice.Delete-Medium");
x.style.display='none';
You can get the id of the element span, which you want to hide from the source of the page.

Anchor tag on ICEfaces component

I'm looking for a way to set focus to an ICEfaces component by means of an anchor tag. For instance, when a field fails validation I want to output something like this:
Field XYZ failed validation
and then, at the XYZ component, have something like:
<ice:inputText id="XYZ" anchor="xyz">
This would enable the user to click on the error message and get focus on the offending component. Is this in any way possible? (I'm aware of the outputLink and inputLink component, but the error message would typically reside in a message.properties file making it hard to use components...)
I'm using ICEfaces version 1.8.2
Use labels. There they are for.
<h:outputLabel for="xyz">message</h:outputLabel>
<h:inputText id="xyz" />
Substitute with ice variants if necessary.

set var value from input field value

I started short time ago with JSP, JSTL, HTML and JavaScript so here is my problem:
I need to set the value of a var the value of an input hidden. Other option is if it possible to compare using
<c:if test="....">
the value of a variable that I sent with the request with the value of the hidden input.
Thanks.
Update
I've been trying but can't make it work.
I have this field that contains the id of and object. I also have the list with the objects so what I have to do is find the object related to that ID.
<input type="text" name="id1" />
but if I do this:
<c:set var="dd" value="${param.id1}" />
<input type="text" value="${dd}" />
The input text is empty but the text related to id1 displays 850 (i.e. the value is dinamic)
Any suggestion why is not working?
Update 2
I need the "multipart/form-data" because in the form I need to upload a picture. I understand how to get the parameters from Java, but since I'm not using the server but the JSP pages, there's any way to do it? Just need to read that input element and save it in a variable.
You can access request parameters by implicit ${param} variable.
E.g. http://example.com/context/page.jsp?foo=bar in combination with
<c:if test="${param.foo == 'bar'}">
The foo's param value is bar!
</c:if>
<c:if test="${param.foo != 'bar'}">
The foo's param value is not bar, it is: ${param.foo}
</c:if>
would show the first condition.
If you actually want to retain some hidden input element in subsequent requests (which wasn't really made clear in your question), then all you basically need to do is:
<input type="hidden" name="foo" value="${param.foo}">
Update: as per your update: you need to give the input element a name as well. Thus, e.g.
<input type="text" name="id1" value="${param.id1}" />
This way it's available by request.getParameter("id1") and inherently also ${param.id1}. Do you see it now?
Update 2: as per your comment here: certainly this is related to enctype="multipart/form-data". With this encoding, the request parameters aren't in the parameter map anymore, but instead in the request body, because of the mixup with binary data (file uploads). It's going to be a long story to explain it all, but basically you need to parse the request yourself. If you're on Servlet 2.5 or older, then the Apache Commons FileUpload is very helpful here. Read especially "User Guide" and "Frequently Asked Questions" over there to see code examples and to learn how to use it the right way (also in MSIE!). You can even decide to abstract the FileUpload away so that you can stick using HttpServletRequest#getParameter() and ${param} the usual way, also see this article.
If you're already on Servlet 3.0, then you can just make use of HttpServletRequest#getParts(). You can even abstract it away so that you can stick using HttpServletRequest#getParameter() and ${param} the usual way, also see this article.
Update 3: Oh, you really don't want to use JSP to do all the processing. There it is not for. It's high time to learn Servlet. Besides, when using a Filter which puts all parameters from the request body back in the request parameter map (as described in the both articles), you also don't necessarily need a Servlet after all.