Out of the Sandbox: Spring-Security OpenID Support

I just finished moving the OpenID support For Acegi/Spring-Security out of the sandbox and out into it's own module. It is in dire need of documentation, but the code itself is pretty solid.
Here's the post to the mailing list.

Acegi OpenID Support Update

I said I'd work on the OpenID support in Acegi (aka Spring-Security) and I finally did. Really nothing major, I refactored the functionality from the CAS package that we needed in OpenID up into its own existence in the "providers" package. So now there's a now AuthoritiesPopulator and DaoAuthoritiesPopulator impl that uses the UserDetailsService to look up Authorities for a given principal. This functionality was being "borrowed" from the Cas package, now it's been refactored up. For backwards compatibility I've left the original CasAuthoritesPopulator and DaoCasAuthoritiesPopulator items in as subclasses of the new classes. Both of those extensions are empty now though. They should be removed in the future.

Also, I've removed the janrain support as Janrain is dead. Spring-Security will now use openid4java exclusively. It has been updated to version 0.9.3 of that library.

Now the call goes out to Jeff Dwyer to update MyHippoCampus to the latest stuff and put it through its paces. Thanks Jeff!

Next up? Well, I'm going to slap it into one of the samples and do some testing, and then work on promoting it out of the sandbox. Hopefully we can get openId support into the main project soon :)

OpenID Gains Steam

From Techcrunch

TechCrunch UK’s Mike Butcher is reporting that Google, IBM and Verisign are in late stage discussions with the OpenID Foundation.

Good to see OpenID getting some traction. I really regret not finishing up the OpenID support for Acegi now. The code is still there in the sandbox. It apparently works, the folks over at MyHippoCampus were using it.

Securing Java Applications with Acegi

Consutlant Bilal Siddiqui wrote a series of articles at IBM developerWorks around Acegi. Definitely worth a read if you're trying to understand Acegi. Our reference guide is good, but it's a bit over the top for most folks.

The first article was released in March 2007. The third part was released on September 25 2007. I've fallen behind on my feed reading a bit :P

• Securing Java applications with Acegi, Part 1: Architectural overview and security filters


• Securing Java applications with Acegi, Part 2: Working with an LDAP directory server


• Securing Java applications with Acegi, Part 3: Access control for Java objects

OpenId updates to Acegi

I've promoted my first wave of changes to the Acegi OpenId support in the sandbox.

• Added support for OpenId4java
• Added OpenIdAuthenticationProcessingFilter to replace current Servlet+Filter approach

I'll remove the existing Janrain and servlet stuff once I've had a chance to try and build a sample using the new code.

Update: Acegi and OpenID

I was going full-tilt into refactoring the OpenID support in Acegi. Unfortunately I got held up with home and work (gotta have your priorities in order). There are few central points that I'm focusing on right now...

1. Replace the JanRain support with OpenId4Java.
2. Replace the Servlet that is in there with an AuthenticationProcessingFilter based approach.
3. Try and get some form of integration into the contacts sample.

The JanRain library is all but deceased, and it doesn't seem to support redirects anway. The OpenId4Java library seems to be the most active, and properly supports redirects and discovery. The Servlet that is in there now is well intended but doesn't mesh with the overall architecture in Acegi.

I'm going to try and get this stuff ramped up pretty quickly. Since Ben Alex is starting rumors he's going to be talking about it at Spring One.

OpenID support in Acegi Security

SourceForge.net: acegisecurity-developer

Acegi security now has a first-draft of OpenID support as provided by Robin Bramley of Opsera Limited. We'll definitely need to get some documentation and samples going. It's a great start though.

More info on OpenId...