Custom UserContext [SOLVED]

Question

I need some help with using my own userContext in conjunction with JHeadstart security.
I have the following settings :
- authentication type = JAAS
- use role based authorisation = true
- authorisation type = Custom
- authorisation using group permissions = true
I want to be able to use the standard user/role/permissions provided by Jheadstart but want to be able to use my own user context class to store more information. I could just create a seperate class in conjuntion but I would rather just modify the code creating the Jhs one to use my custom one instead.
Firstly, I have created my myUserContext which implements JhsUser.
Secondly, as per help in the JhsModelServiceImpl.createUserContext method, I have created MyJhsModelService that extends JhsModelServiceImpl and overriden the createUserContext method to create and return myUserContext instead of JhsUser.
Even though I can see it adding all the permissions in setRolesAndPermissions, in the log window shows
25-Apr 18:38:19 DEBUG (JhsNavigationHandlerImpl) -User does not have any required role (Locations), set navigation outcome to 'AccessDenied'
Does this mean it's not picking up myuserContext ?
Do I have to override getJhsUser in JhsAuthorizationProxy as well ?
Thanks,
Brent
Message was edited by:
Brent Harlow

Answer 1

Hi Steven,
You're a bit confused ? I can guarantee that's nothing compared with how confused I've got myself ! :)
You're right though - I did have the guts of it working ok. The changes I had to make was to call the JhsModuleService.setRolesAndPermissions on my custom userContext and then change the hasAccess method in my userContext to check the list of roles and permissions rather than call isUserInRole
The high level steps I now have (in case it helps someone else)
1. Create an AuthenticationFilter filter mapping in web.xml
2. in my AuthenticationFilter check if JhsUser.JHS_USER_KEY stored on session
3. If not, call method on AppModule to create my custom UserContext
4. call (JhsModelServiceImpl)getJhsModelService().setRolesAndPermissions(userCtx, true) to add roles and permissions to custom user context
5. In user context create get/setAuthorizedRolesAndPermissions(List roles)
6. set hasAccess(String roleOrPermission) to return getAuthorizedRolesAndPermissions().contains(roleOrPermission);
I have just one remaining issue - if I call setRolesAndPermissions with addPermissionsForJAASRoles set to true then I get a NPE because FacesContext.getCurrentInstance() returns null. As it happens, I don't need to add the JAAS roles so I pass in false but I would like to know how to avoid the NPE ?
I assume it's something due to the order of my processing ? The facesContext has not been established yet becuase the code is running from the AuthenticationFilter ?
Thanks for your help,
Cheers,
Brent