Security in Play 2? - play-framework

The old Google Groups will be going away soon, but your browser is incompatible with the new version.
Message from discussion Security in Play 2?
Received-SPF: pass (google.com: domain of sc...@scottphillips.com designates 209.85.160.52 as permitted sender) client-ip=209.85.160.52;
MIME-Version: 1.0
In-Reply-To: <24980536.205.1334371688533.JavaMail.geo-discussion-forums@pbje9>
References: <24980536.205.1334371688533.JavaMail.geo-discussion-forums@pbje9>
From: Scott Phillips <sc...@scottphillips.com>
Date: Sat, 14 Apr 2012 14:50:35 -0500
Message-ID: <CAPs1SdNSttctBgOhsyiWH56JrEmT3ZyqDpOYR0KJZ0jYihk...@mail.gmail.com>
Subject: Re: [play-framework] Security in Play 2?
To: play-framework@googlegroups.com
Content-Type: multipart/alternative; boundary=047d7b15a805728ada04bda8e946

--047d7b15a805728ada04bda8e946
Content-Type: text/plain; charset=ISO-8859-1

I would assume that you could use Spring security in the general
application without problem with Play 2.0. The only thing that might trip
things up is the securityContextHolder which maintains the security context
on the local thread. So you'd probably want to build a global intercepter
that always sets the context for the current thread. However, what you
can't use is anything in from the "Web Application Security" portion of the
library because that all assumes a regular servlet-based deployment which
isn't present with Play. It relays filters and chains and all that stuff.

http://static.springsource.org/spring-security/site/docs/3.0.x/reference/springsecurity.html
vs
http://static.springsource.org/spring-security/site/docs/3.0.x/reference/web-app-security.html

I think the closet project that I know in the play world to deliver this
type annotation style security checking is the Deadbolt module. With that
you can specify who's able to access what resources at the controller &
view level with annotation based expressions.

https://github.com/schaloner/deadbolt-2

Scott--

On Fri, Apr 13, 2012 at 9:48 PM, Pradeep Singh <prdpksi...@gmail.com> wrote:

> I've just started looking at Play 2 but out of curiosity I tried to
> explore what options were available for authentication and authorization in
> the framework. I don't see anything yet in the documentation. There does
> seem to be some documentation for Play 1 at
> http://www.playframework.org/documentation/1.2.3/guide8. Is this thing
> available in Play 2 as well? How does it compare with Spring Security?
> Because anything less than Spring Security won't be acceptable, unless
> there's a way to use Spring Security itself. Like I said, I am still
> exploring the framework. Lots of good stuff so far but security is
> something that'll be critical in my app.
>
> --
> You received this message because you are subscribed to the Google Groups
> "play-framework" group.
> To view this discussion on the web visit
> https://groups.google.com/d/msg/play-framework/-/g-Tk7LFndAMJ.
> To post to this group, send email to play-framework@googlegroups.com.
> To unsubscribe from this group, send email to
> play-framework+unsubscribe@googlegroups.com.
> For more options, visit this group at
> http://groups.google.com/group/play-framework?hl=en.
>

--047d7b15a805728ada04bda8e946
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<br>I would assume that you could use Spring security in the general applic=
ation without problem with Play 2.0. The only thing that might trip things =
up is the securityContextHolder which maintains the security context on the=
 local thread. So you&#39;d probably want to build a global intercepter tha=
t always sets the context for the current thread. However, what you can&#39=
;t use is anything in from the &quot;Web Application Security&quot; portion=
 of the library because that all assumes a regular servlet-based deployment=
 which isn&#39;t present with Play. It relays filters and chains and all th=
at stuff.<br>

<br><a href=3D"http://static.springsource.org/spring-security/site/docs/3.0=
.x/reference/springsecurity.html">http://static.springsource.org/spring-sec=
urity/site/docs/3.0.x/reference/springsecurity.html</a><br>vs<br><a href=3D=
"http://static.springsource.org/spring-security/site/docs/3.0.x/reference/w=
eb-app-security.html">http://static.springsource.org/spring-security/site/d=
ocs/3.0.x/reference/web-app-security.html</a><br>

<br>I think the closet project that I know in the play world to deliver thi=
s type annotation style security checking is the Deadbolt module. With that=
 you can specify who&#39;s able to access what resources at the controller =
&amp; view level with annotation based expressions.<br>

<br><a href=3D"https://github.com/schaloner/deadbolt-2">https://github.com/=
schaloner/deadbolt-2</a><br><br>Scott--<br><br><div class=3D"gmail_quote">O=
n Fri, Apr 13, 2012 at 9:48 PM, Pradeep Singh <span dir=3D"ltr">&lt;<a href=
=3D"mailto:prdpksi...@gmail.com">prdpksi...@gmail.com</a>&gt;</span> wrote:=
<br>

<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">I&#39;ve just started looking at Play 2 but =
out of curiosity I tried to explore what options were available for authent=
ication and authorization in the framework. I don&#39;t see anything yet in=
 the documentation. There does seem to be some documentation for Play 1 at=
=A0<a href=3D"http://www.playframework.org/documentation/1.2.3/guide8" targ=
et=3D"_blank">http://www.playframework.org/documentation/1.2.3/guide8</a>. =
Is this thing available in Play 2 as well? How does it compare with Spring =
Security? Because anything less than Spring Security won&#39;t be acceptabl=
e, unless there&#39;s a way to use Spring Security itself. Like I said, I a=
m still exploring the framework. Lots of good stuff so far but security is =
something that&#39;ll be critical in my app.

<span class=3D"HOEnZb"><font color=3D"#888888"><p></p>

-- <br>
You received this message because you are subscribed to the Google Groups &=
quot;play-framework&quot; group.<br>
To view this discussion on the web visit <a href=3D"https://groups.google.c=
om/d/msg/play-framework/-/g-Tk7LFndAMJ" target=3D"_blank">https://groups.go=
ogle.com/d/msg/play-framework/-/g-Tk7LFndAMJ</a>.<br>=20
To post to this group, send email to <a href=3D"mailto:play-framework@googl=
egroups.com" target=3D"_blank">play-framework@googlegroups.com</a>.<br>
To unsubscribe from this group, send email to <a href=3D"mailto:play-framew=
ork%2Bunsubscribe@googlegroups.com" target=3D"_blank">play-framework+unsubs=
cribe@googlegroups.com</a>.<br>

For more options, visit this group at <a href=3D"http://groups.google.com/g=
roup/play-framework?hl=3Den" target=3D"_blank">http://groups.google.com/gro=
up/play-framework?hl=3Den</a>.<br>


</font></span></blockquote></div><br>

--047d7b15a805728ada04bda8e946--
Create a group - Google Groups - Google Home - Terms of Service - Privacy Policy
Account Options
