LoginManager.RestorePrincipal
|
View:
New views
8 Messages
—
Rating Filter:
Alert me
|
 |
LoginManager.RestorePrincipal
by Andres Serral-2
::
Rate this Message:
My Flex app
has users with multiple profiles.
So the
login process has 2 steps.
1- User Authentication
2- Profile
Selection
Off course,
I must set the authentication user, Principal and roles after step
2.
By the way,
the user could select one profile and then switch to another profile
without logout.
Some idea
to do this?
I thought calling LoginManager.RestorePrincipal
method... but the LoginManager class is
private
Thanks
 Por Favor considere
el medio ambiente y no imprima este mail a no ser que sea absolutamente
necesario. RS apoya el cuidado del medio ambiente.
_______________________________________________ fluorine mailing list fluorine@... http://fluorine.thesilentgroup.com/mailman/listinfo/fluorine_fluorine.thesilentgroup.com |
||||
|
|
Re: LoginManager.RestorePrincipal
by Shannon Deminick
::
Rate this Message:
Some parts of this message have been removed.
Learn more about Nabble's security policy.
Are you changing the profile within flash (i.e. by a user
clicking a button?), if so ,you should just be able to setcredentials on a
method call with the new credentials… --- SHANNON DEMINICK --- SUITE 101, 4-14 BUCKINGHAM ST. --- From: fluorine-bounces@...
[mailto:fluorine-bounces@...] On Behalf Of Andres
Serral My
Flex app has users with multiple profiles. So
the login process has 2 steps.
1- User Authentication
2- Profile Selection Off
course, I must set the authentication user, Principal and roles after step 2. By
the way, the user could select one profile and then switch to
another profile without logout. Some
idea to do this? I thought
calling LoginManager.RestorePrincipal method... but the LoginManager class is
private Thanks
_______________________________________________ fluorine mailing list fluorine@... http://fluorine.thesilentgroup.com/mailman/listinfo/fluorine_fluorine.thesilentgroup.com |
||||
|
|
Re: LoginManager.RestorePrincipal
by Andres Serral-2
::
Rate this Message:
Some parts of this message have been removed.
Learn more about Nabble's security policy.
Shannon, thanks for you repply
Yes. After login to the app, the user cans change his
profile by clicking a button.
But, how can I change credentials within Fluorine?
I tried setting HttpContext.Current.User...
But, after doing that, the security configuration (set on
services-config.xml file) doesn´t apply, just mantains the first principal
object (set by the first loggin)
I Checked FluorineContext.Current.User property is
readonly
Thanks in advance
Por Favor considere
el medio ambiente y no imprima este mail a no ser que sea absolutamente
necesario. RS apoya el cuidado del medio ambiente.
From: Shannon Deminick [mailto:SD@...] Sent: Tuesday, May 19, 2009 8:13 PM To: andres.serral@...; Fluorine Mailing List Subject: RE: [Fluorine] LoginManager.RestorePrincipal Are
you changing the profile within flash (i.e. by a user clicking a button?), if so
,you should just be able to setcredentials on a method call with the new
credentials
--- SHANNON
DEMINICK --- SUITE
101, 4-14 BUCKINGHAM ST. --- From:
fluorine-bounces@...
[mailto:fluorine-bounces@...] On Behalf Of Andres
Serral My Flex app
has users with multiple profiles. So the login
process has 2 steps.
1- User Authentication
2- Profile Selection Off course, I
must set the authentication user, Principal and roles after step
2. By the way,
the user could select one profile and then switch to another profile
without logout. Some idea to
do this? I thought
calling LoginManager.RestorePrincipal method... but the LoginManager class is
private Thanks
_______________________________________________ fluorine mailing list fluorine@... http://fluorine.thesilentgroup.com/mailman/listinfo/fluorine_fluorine.thesilentgroup.com |
||||
|
|
Re: LoginManager.RestorePrincipal
by Shannon Deminick
::
Rate this Message:
Some parts of this message have been removed.
Learn more about Nabble's security policy.
Couple of questions? -
Is this a 100% flash site, or an html/flash hybrid site? -
Is the user initially logging the user in via Fluorine
authentication or standard html forms authentication? -
If you are logging in via Fluorine/flash, are you inheriting
from the GenericLoginCommand class to do your authentication? Fluorine should re-authenticate (call your DoAuthentication
method) each time you setcredentials on your remoting calls. The Invoke method
of the of the AuthenticationFilter class is what will re-authenticate your
remoting call so long as you’ve setcredentials on your remoting calls.
This essentially adds AMF headers to your request, this method checks for them
and calls DoAuthentication if found and sets a principal (which is stored in
cache by the way). So if you make a remoting call to a “Login” method
of your remoting class and setcredentials on the call for ‘User1’,
then your Principal should be set to User1, then if you make another call to “Login”
and setcredentials on the call for ‘User2’ then your Principal
should now be User2. The Invoke method uses the StorePrincipal and RestorePrincipal
methods of the FluorineWebContext class. If you want to change the principal
manually you could try to use the ClearPrincipal, StorePrincipal and
RestorePrincipal methods of the FluorineContext.Current object. Also, when using remoting authentication you shouldn’t
always setcredentials on all of your calls since this will cause the
DoAuthentication method to fire everytime. Though this will work, there is more
performance overhead. Another option is to call setcredentials the first time
you want to log in and then not setcredentials on subsequent calls. This will
also work since the Principal is kept in cache, but if you server recycles, or
the cache is turned over, then Fluorine has no way of re-authenticating. The preferred
solution which seems to actually not be documented is: -
Once you setcredentials and Fluorine authenticates your request,
Fluorine will add an encrypted key to the AMF header response with the name of “data”.
-
You should use this value and on all subsequent requests to
secured Fluorine methods, add a custom AMF header called ‘CredentialsId’
(ensure that you manually set the ‘Credentials’ header value to
null). -
When Fluorine recognizes this header it just persists the
existing principal but doesn’t need to go through the whole
re-authentication process. -
This also adds a layer of security since username/passwords are
not being sent over http on each request. Hope this helps, --- SHANNON DEMINICK --- SUITE 101, 4-14 BUCKINGHAM ST. --- From:
fluorine-bounces@...
[mailto:fluorine-bounces@...] On Behalf Of Andres
Serral Shannon,
thanks for you repply Yes.
After login to the app, the user cans change his profile by clicking
a button. But,
how can I change credentials within Fluorine? I
tried setting HttpContext.Current.User... But,
after doing that, the security configuration (set on services-config.xml
file) doesn´t apply, just mantains the first principal object (set by
the first loggin) I
Checked FluorineContext.Current.User property is readonly Thanks
in advance
From: Shannon Deminick
[mailto:SD@...] Are you changing the profile within flash (i.e. by a user
clicking a button?), if so ,you should just be able to setcredentials on a
method call with the new credentials… --- SHANNON DEMINICK --- SUITE 101, 4-14 BUCKINGHAM ST. --- From:
fluorine-bounces@...
[mailto:fluorine-bounces@...] On Behalf Of Andres
Serral My
Flex app has users with multiple profiles. So
the login process has 2 steps.
1- User Authentication
2- Profile Selection Off
course, I must set the authentication user, Principal and roles after step 2. By
the way, the user could select one profile and then switch to
another profile without logout. Some
idea to do this? I thought
calling LoginManager.RestorePrincipal method... but the LoginManager class is
private Thanks
_______________________________________________ fluorine mailing list fluorine@... http://fluorine.thesilentgroup.com/mailman/listinfo/fluorine_fluorine.thesilentgroup.com |
||||
|
|
Re: LoginManager.RestorePrincipal
by Support-179
::
Rate this Message:
Some parts of this message have been removed.
Learn more about Nabble's security policy.
Some additional thoughts:
- Service credentials (or channelset credentials in flex) not
necessary map directly to a "user interface with user/password/login". One can
consider this operation just simply being a communication channel authentication
at a given moment.
An application can change these credentials anytime (by
"logging out" and "logging in") without asking visually the user each time with
a login box (of course the code knows what re-authentication means for the
application)
- Do not try to change the current security configuration (the
Principal) from back end code. The only place where user code is supposed to
configure Principals is the login command
- as long the Flash client (swf) is not closed the back
end will know how to restore the current Principal (restore means automatic
re-authentication), you do not have to deal with timeout issues (this is because
of the special encrypted AMF header set by FluorineFx). One should not handle or
care about setting AMF headers manually
-in the case of Flex starting from
v1.0.0.17 one will have to use the
<login-after-disconnect>true</login-after-disconnect> option (as in
BlazeDS) to have the client automatically re-authenticate itself if a timeout
occurs
From: fluorine-bounces@... [mailto:fluorine-bounces@...] On Behalf Of Shannon Deminick Sent: Thursday, May 21, 2009 3:28 AM To: andres.serral@...; Fluorine Mailing List Subject: Re: [Fluorine] LoginManager.RestorePrincipal Couple
of questions? -
Is
this a 100% flash site, or an html/flash hybrid site? -
Is
the user initially logging the user in via Fluorine authentication or standard
html forms authentication? -
If
you are logging in via Fluorine/flash, are you inheriting from the
GenericLoginCommand class to do your authentication? Fluorine
should re-authenticate (call your DoAuthentication method) each time you
setcredentials on your remoting calls. The Invoke method of the of the
AuthenticationFilter class is what will re-authenticate your remoting call so
long as youve setcredentials on your remoting calls. This essentially adds AMF
headers to your request, this method checks for them and calls DoAuthentication
if found and sets a principal (which is stored in cache by the
way). So
if you make a remoting call to a Login method of your remoting class and
setcredentials on the call for User1, then your Principal should be set to
User1, then if you make another call to Login and setcredentials on the call
for User2 then your Principal should now be User2. The
Invoke method uses the StorePrincipal and RestorePrincipal methods of the
FluorineWebContext class. If you want to change the principal manually you could
try to use the ClearPrincipal, StorePrincipal and RestorePrincipal methods of
the FluorineContext.Current object. Also,
when using remoting authentication you shouldnt always setcredentials on all of
your calls since this will cause the DoAuthentication method to fire everytime.
Though this will work, there is more performance overhead. Another option is to
call setcredentials the first time you want to log in and then not
setcredentials on subsequent calls. This will also work since the Principal is
kept in cache, but if you server recycles, or the cache is turned over, then
Fluorine has no way of re-authenticating. The preferred solution which seems to
actually not be documented is: -
Once
you setcredentials and Fluorine authenticates your request, Fluorine will add an
encrypted key to the AMF header response with the name of data.
-
You
should use this value and on all subsequent requests to secured Fluorine
methods, add a custom AMF header called CredentialsId (ensure that you
manually set the Credentials header value to null). -
When
Fluorine recognizes this header it just persists the existing principal but
doesnt need to go through the whole re-authentication
process. -
This
also adds a layer of security since username/passwords are not being sent over
http on each request. Hope
this helps, --- SHANNON
DEMINICK --- SUITE
101, 4-14 BUCKINGHAM ST. --- From:
fluorine-bounces@...
[mailto:fluorine-bounces@...] On Behalf Of Andres
Serral Shannon,
thanks for you repply Yes. After
login to the app, the user cans change his profile by clicking a
button. But, how can I
change credentials within Fluorine? I tried
setting HttpContext.Current.User... But, after
doing that, the security configuration (set on services-config.xml file)
doesn´t apply, just mantains the first principal object (set by
the first loggin) I Checked
FluorineContext.Current.User property is readonly Thanks in
advance
From: Shannon Deminick
[mailto:SD@...] Are
you changing the profile within flash (i.e. by a user clicking a button?), if so
,you should just be able to setcredentials on a method call with the new
credentials
--- SHANNON
DEMINICK --- SUITE
101, 4-14 BUCKINGHAM ST. --- From:
fluorine-bounces@...
[mailto:fluorine-bounces@...] On Behalf Of Andres
Serral My Flex app
has users with multiple profiles. So the login
process has 2 steps.
1- User Authentication
2- Profile Selection Off course, I
must set the authentication user, Principal and roles after step
2. By the way,
the user could select one profile and then switch to another profile
without logout. Some idea to
do this? I thought
calling LoginManager.RestorePrincipal method... but the LoginManager class is
private Thanks
_______________________________________________ fluorine mailing list fluorine@... http://fluorine.thesilentgroup.com/mailman/listinfo/fluorine_fluorine.thesilentgroup.com |
||||
|
|
Re: LoginManager.RestorePrincipal
by Shannon Deminick
::
Rate this Message:
Some parts of this message have been removed.
Learn more about Nabble's security policy.
Oops!, yes sorry I stand corrected in the manually setting of headers…
We actually have to extend NetConnection (using Flash, not Flex) to support the
RequestPersistentHeader implementation in order for the encrypted Fluorine
header to work (I believe this is works as per normal in Flex). This then
automatically sends back up the encrypted key that Fluorine creates for
persisting authentication. Cheers, --- SHANNON DEMINICK --- SUITE 101, 4-14 BUCKINGHAM ST. --- From:
fluorine-bounces@...
[mailto:fluorine-bounces@...] On Behalf Of Support Some additional thoughts: - Service credentials (or channelset credentials in flex) not
necessary map directly to a "user interface with
user/password/login". One can consider this operation just simply being a
communication channel authentication at a given moment. An application can change these credentials anytime (by
"logging out" and "logging in") without asking visually the
user each time with a login box (of course the code knows what
re-authentication means for the application) - Do not try to change the current security configuration (the
Principal) from back end code. The only place where user code is supposed to
configure Principals is the login command - as long the Flash client (swf) is not closed the back end will
know how to restore the current Principal (restore means automatic
re-authentication), you do not have to deal with timeout issues (this is
because of the special encrypted AMF header set by FluorineFx). One should not
handle or care about setting AMF headers manually -in the case of Flex starting from v1.0.0.17 one will have to use
the <login-after-disconnect>true</login-after-disconnect> option
(as in BlazeDS) to have the client automatically re-authenticate itself if a
timeout occurs From: fluorine-bounces@...
[mailto:fluorine-bounces@...] On Behalf Of Shannon
Deminick Couple of questions? -
Is this a 100% flash site, or an html/flash hybrid site? -
Is the user initially logging the user in via Fluorine
authentication or standard html forms authentication? -
If you are logging in via Fluorine/flash, are you inheriting
from the GenericLoginCommand class to do your authentication? Fluorine should re-authenticate (call your DoAuthentication
method) each time you setcredentials on your remoting calls. The Invoke method
of the of the AuthenticationFilter class is what will re-authenticate your
remoting call so long as you’ve setcredentials on your remoting calls.
This essentially adds AMF headers to your request, this method checks for them
and calls DoAuthentication if found and sets a principal (which is stored in
cache by the way). So if you make a remoting call to a “Login” method
of your remoting class and setcredentials on the call for ‘User1’,
then your Principal should be set to User1, then if you make another call to
“Login” and setcredentials on the call for ‘User2’ then
your Principal should now be User2. The Invoke method uses the StorePrincipal and RestorePrincipal
methods of the FluorineWebContext class. If you want to change the principal
manually you could try to use the ClearPrincipal, StorePrincipal and
RestorePrincipal methods of the FluorineContext.Current object. Also, when using remoting authentication you shouldn’t
always setcredentials on all of your calls since this will cause the
DoAuthentication method to fire everytime. Though this will work, there is more
performance overhead. Another option is to call setcredentials the first time
you want to log in and then not setcredentials on subsequent calls. This will
also work since the Principal is kept in cache, but if you server recycles, or
the cache is turned over, then Fluorine has no way of re-authenticating. The
preferred solution which seems to actually not be documented is: -
Once you setcredentials and Fluorine authenticates your request,
Fluorine will add an encrypted key to the AMF header response with the name of
“data”. -
You should use this value and on all subsequent requests to
secured Fluorine methods, add a custom AMF header called
‘CredentialsId’ (ensure that you manually set the
‘Credentials’ header value to null). -
When Fluorine recognizes this header it just persists the
existing principal but doesn’t need to go through the whole
re-authentication process. -
This also adds a layer of security since username/passwords are
not being sent over http on each request. Hope this helps, --- SHANNON DEMINICK --- SUITE 101, 4-14 BUCKINGHAM ST. --- From:
fluorine-bounces@...
[mailto:fluorine-bounces@...] On Behalf Of Andres
Serral Shannon,
thanks for you repply Yes.
After login to the app, the user cans change his profile by clicking
a button. But,
how can I change credentials within Fluorine? I
tried setting HttpContext.Current.User... But,
after doing that, the security configuration (set on services-config.xml
file) doesn´t apply, just mantains the first principal object (set by
the first loggin) I
Checked FluorineContext.Current.User property is readonly Thanks
in advance
From: Shannon Deminick [mailto:SD@...]
Are you changing the profile within flash (i.e. by a user
clicking a button?), if so ,you should just be able to setcredentials on a
method call with the new credentials… --- SHANNON DEMINICK --- SUITE 101, 4-14 BUCKINGHAM ST. --- From:
fluorine-bounces@...
[mailto:fluorine-bounces@...] On Behalf Of Andres
Serral My
Flex app has users with multiple profiles. So
the login process has 2 steps.
1- User Authentication
2- Profile Selection Off
course, I must set the authentication user, Principal and roles after step 2. By
the way, the user could select one profile and then switch to
another profile without logout. Some
idea to do this? I thought
calling LoginManager.RestorePrincipal method... but the LoginManager class is
private Thanks
_______________________________________________ fluorine mailing list fluorine@... http://fluorine.thesilentgroup.com/mailman/listinfo/fluorine_fluorine.thesilentgroup.com |
||||
|
|
Re: LoginManager.RestorePrincipal
by Marcelo Caetano Martins Muniz
::
Rate this Message:
Some parts of this message have been removed.
Learn more about Nabble's security policy.
Hi guys, I’m new in this
list. But I’m working on a multiplayer on-line game using FluorineFX and
I’m getting a few problems. Here is the scenario: I’m calling Invoke
(FluorineFx.Messaging.Api.IServiceCapableConnection) to invoke calls on the client,
and it is lagging a lot! I’m using <runtime
asyncHandler="true"/> in the fluorinefx settings, but it is taking
in same cases up to 5017 milliseconds to run the call: Do you guys have any
idea why does that call lags so badly?
Thanks, Marcelo Muniz Nenhum vírus encontrado nessa mensagem recebida.
_______________________________________________ fluorine mailing list fluorine@... http://fluorine.thesilentgroup.com/mailman/listinfo/fluorine_fluorine.thesilentgroup.com |
||||
|
|
Re: LoginManager.RestorePrincipal
by Support-179
::
Rate this Message:
Some parts of this message have been removed.
Learn more about Nabble's security policy.
Unfortunately the RequestPersistentHeader is a moving target,
it is a member of mx.remoting.Connection in my Flash CS3 installation, those
using Renaun's remoteobject had to patch it etc.
In any case in a Flash application it will
work.
In Flex will not, that is why
<login-after-disconnect>true</login-after-disconnect> must be used
for re-authentication (this option is a Flex thing, the channelset API manages
what to do in this case)
In pre v1.0.0.17 versions the gateway also used an http cookie
to store the encrypted data but this is dropped now.
The important aspect is that until the swf is not closed
(Flash or Flex) to have the option to stay in authenticated state (without
requiring user interaction) whatever happens in the back
end.
Zoli From: fluorine-bounces@... [mailto:fluorine-bounces@...] On Behalf Of Shannon Deminick Sent: Friday, May 22, 2009 2:56 AM To: Fluorine Mailing List Subject: Re: [Fluorine] LoginManager.RestorePrincipal Oops!,
yes sorry I stand corrected in the manually setting of headers
We actually have
to extend NetConnection (using Flash, not Flex) to support the
RequestPersistentHeader implementation in order for the encrypted Fluorine
header to work (I believe this is works as per normal in Flex). This then
automatically sends back up the encrypted key that Fluorine creates for
persisting authentication. Cheers, --- SHANNON
DEMINICK --- SUITE
101, 4-14 BUCKINGHAM ST. --- From:
fluorine-bounces@...
[mailto:fluorine-bounces@...] On Behalf Of
Support Some
additional thoughts: -
Service credentials (or channelset credentials in flex) not necessary map
directly to a "user interface with user/password/login". One can consider this
operation just simply being a communication channel authentication at a given
moment. An
application can change these credentials anytime (by "logging out" and "logging
in") without asking visually the user each time with a login box (of course the
code knows what re-authentication means for the
application) - Do not
try to change the current security configuration (the Principal) from back end
code. The only place where user code is supposed to configure Principals is the
login command - as
long the Flash client (swf) is not closed the back end will know how to restore
the current Principal (restore means automatic re-authentication), you do not
have to deal with timeout issues (this is because of the special encrypted AMF
header set by FluorineFx). One should not handle or care about setting AMF
headers manually -in the
case of Flex starting from v1.0.0.17 one will have to use the
<login-after-disconnect>true</login-after-disconnect> option (as in
BlazeDS) to have the client automatically re-authenticate itself if a timeout
occurs From:
fluorine-bounces@...
[mailto:fluorine-bounces@...] On Behalf Of
Shannon Deminick Couple
of questions? -
Is
this a 100% flash site, or an html/flash hybrid site? -
Is
the user initially logging the user in via Fluorine authentication or standard
html forms authentication? -
If
you are logging in via Fluorine/flash, are you inheriting from the
GenericLoginCommand class to do your authentication? Fluorine
should re-authenticate (call your DoAuthentication method) each time you
setcredentials on your remoting calls. The Invoke method of the of the
AuthenticationFilter class is what will re-authenticate your remoting call so
long as youve setcredentials on your remoting calls. This essentially adds AMF
headers to your request, this method checks for them and calls DoAuthentication
if found and sets a principal (which is stored in cache by the
way). So
if you make a remoting call to a Login method of your remoting class and
setcredentials on the call for User1, then your Principal should be set to
User1, then if you make another call to Login and setcredentials on the call
for User2 then your Principal should now be User2. The
Invoke method uses the StorePrincipal and RestorePrincipal methods of the
FluorineWebContext class. If you want to change the principal manually you could
try to use the ClearPrincipal, StorePrincipal and RestorePrincipal methods of
the FluorineContext.Current object. Also,
when using remoting authentication you shouldnt always setcredentials on all of
your calls since this will cause the DoAuthentication method to fire everytime.
Though this will work, there is more performance overhead. Another option is to
call setcredentials the first time you want to log in and then not
setcredentials on subsequent calls. This will also work since the Principal is
kept in cache, but if you server recycles, or the cache is turned over, then
Fluorine has no way of re-authenticating. The preferred solution which seems to
actually not be documented is: -
Once
you setcredentials and Fluorine authenticates your request, Fluorine will add an
encrypted key to the AMF header response with the name of data.
-
You
should use this value and on all subsequent requests to secured Fluorine
methods, add a custom AMF header called CredentialsId (ensure that you
manually set the Credentials header value to null). -
When
Fluorine recognizes this header it just persists the existing principal but
doesnt need to go through the whole re-authentication
process. -
This
also adds a layer of security since username/passwords are not being sent over
http on each request. Hope
this helps, --- SHANNON
DEMINICK --- SUITE
101, 4-14 BUCKINGHAM ST. --- From:
fluorine-bounces@...
[mailto:fluorine-bounces@...] On Behalf Of Andres
Serral Shannon,
thanks for you repply Yes. After
login to the app, the user cans change his profile by clicking a
button. But, how can I
change credentials within Fluorine? I tried
setting HttpContext.Current.User... But, after
doing that, the security configuration (set on services-config.xml file)
doesn´t apply, just mantains the first principal object (set by
the first loggin) I Checked
FluorineContext.Current.User property is readonly Thanks in
advance
From: Shannon Deminick
[mailto:SD@...] Are
you changing the profile within flash (i.e. by a user clicking a button?), if so
,you should just be able to setcredentials on a method call with the new
credentials
--- SHANNON
DEMINICK --- SUITE
101, 4-14 BUCKINGHAM ST. --- From:
fluorine-bounces@...
[mailto:fluorine-bounces@...] On Behalf Of Andres
Serral My Flex app
has users with multiple profiles. So the login
process has 2 steps.
1- User Authentication
2- Profile Selection Off course, I
must set the authentication user, Principal and roles after step
2. By the way,
the user could select one profile and then switch to another profile
without logout. Some idea to
do this? I thought
calling LoginManager.RestorePrincipal method... but the LoginManager class is
private Thanks
_______________________________________________ fluorine mailing list fluorine@... http://fluorine.thesilentgroup.com/mailman/listinfo/fluorine_fluorine.thesilentgroup.com |
logofirmamail.gif (1K) 
| Free embeddable forum powered by Nabble | Forum Help |
