Re: j_security_check-behaviour - looking for workaround

2008-12-02 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Gregor, Gregor Schneider wrote: > Hi Chris, > > On Tue, Dec 2, 2008 at 4:13 PM, Christopher Schultz > <[EMAIL PROTECTED]> wrote: >> For Securityfilter's next version, we are attempting to make it easy to >> implement it as a Tomcat Valve, which shoul

Re: j_security_check-behaviour - looking for workaround

2008-12-02 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Gregor, Gregor Schneider wrote: > The link looks like this: > > src="../snbulletopen.gif" border="0" align="absmiddle"> Medizin > > As you can see, in this menue there's always the target (the inner > frame) specified. > > However, j_security_chec

Re: j_security_check-behaviour - looking for workaround

2008-12-02 Thread Gregor Schneider
Hi Chris, On Tue, Dec 2, 2008 at 4:13 PM, Christopher Schultz <[EMAIL PROTECTED]> wrote: > > For Securityfilter's next version, we are attempting to make it easy to > implement it as a Tomcat Valve, which should allow things like SSO. > Do you have any information when this next version will be av

Re: j_security_check-behaviour - looking for workaround

2008-12-02 Thread Gregor Schneider
Hi Chris, On Tue, Dec 2, 2008 at 3:51 PM, Christopher Schultz <[EMAIL PROTECTED]> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > >> Now if the session times out, the user clicks on the menue, the url >> requested is the source of the IFrame. > > This shouldn't be the case: the URL re

Re: j_security_check-behaviour - looking for workaround

2008-12-02 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mikolaj, Mikolaj Rydzewski wrote: > You can try to use securityfilter (and deal with AA on your (or > securityfilter's) own), or implement tomcat-specific solution using > Valves. For Securityfilter's next version, we are attempting to make it easy t

Re: j_security_check-behaviour - looking for workaround

2008-12-02 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Gregor, Gregor Schneider wrote: > However, if you have a webapp working with frames, this scenario does not > work. > > Imagine a webpage having this structure: [snip] > Now if the session times out, the user clicks on the menue, the url > request

Re: j_security_check-behaviour - looking for workaround

2008-12-01 Thread Mikolaj Rydzewski
Gregor Schneider wrote: - the bad news: Since SecurityFilter does not support SingleSignOn, looks that I'm not able to use it without adapting the code. Another thought: Might a customized JAAS-implementation be a solution? Since I haven't been dealing with JAAS yet - does anybody know a good s

Re: j_security_check-behaviour - looking for workaround

2008-12-01 Thread Gregor Schneider
Hi Mikolaj, On Mon, Dec 1, 2008 at 1:50 PM, Mikolaj Rydzewski <[EMAIL PROTECTED]> wrote: > > Try http://securityfilter.sourceforge.net/ > - the good news: Your karma has grown - the bad news: Since SecurityFilter does not support SingleSignOn, looks that I'm not able to use it without adapting

Re: j_security_check-behaviour - looking for workaround

2008-12-01 Thread Mikolaj Rydzewski
Gregor Schneider wrote: Now enlarge your personal karma and be so kind to post some suggestions, please ;) Try http://securityfilter.sourceforge.net/ -- Mikolaj Rydzewski <[EMAIL PROTECTED]> - To start a new topic, e-mail:

j_security_check-behaviour - looking for workaround

2008-12-01 Thread Gregor Schneider
Hi there, we're running some websites which are heavily framed (unfortunately) using IFrames. Authorization is done via FormBased Auth using Tomcat's built-in j_security_check-method. However, this is giving us some headaches when an application times out. As you may know, j_security_check oper