2 Replies Latest reply on Mar 13, 2014 11:15 AM by mbarkley

    Access Control using Errai navigation

    holsen
    holsen Mar 13, 2014 6:49 AM

      Hi there,

       

      I am trying to figure out the best way to add access control to my Errai project, which uses Errai navigation. Currently I'm doing some validation checks within the @PageShowing method. If the user is not allowed to access that page,
      I'll send the user back to where he came from using History.back(); However that isn't really a great solution. I'm thinking of extending Navigation.class. Any suggestions?

       

      Thanks!

       

      Chris

        • 1. Re: Access Control using Errai navigation
          jfuerth
          jfuerth Mar 13, 2014 10:55 AM (in response to holsen)

          Hi Chris,

           

          All but the very earliest releases of errai-navigation allow you to initiate a new navigation event (with Navigation.goTo(), Transition.go(), or TransitionAnchor.click()) from within a @PageShowing method. If you do this, the original navigation event is pre-empted and will not appear in the browser’s location history.

           

          Additionally, Max Barkley has done some more work recently on a declarative security system that works with Errai Navigation. The API isn’t 100% locked down yet, but your feedback would be valuable! Maybe Max could follow up on this thread with a pointer to something you could experiment with to see if it will meet your particular security needs.

           

          -Jonathan

            • Actions
          • 2. Re: Access Control using Errai navigation
            mbarkley
            mbarkley Mar 13, 2014 11:15 AM (in response to holsen)

            Hi Chris,

             

            We've recently been putting a lot of work into our Errai Security module, which provides declarative annotations that can restrict page access based on whether a user is authenticated with the correct "roles". It's currently available in 3.0-SNAPSHOT. You can check out the Errai Security Demo to see it in action. The demo uses Picketlink on the server, but using a different back-end only requires implementing a single interface.

             

            If there's anything you feel Errai Security is missing for your use case, I would really appreciate your feedback.

             

            Cheers.

              • Actions