Datasource security

[valbosoft]

Hi,

I'm in the process of securing my datasource, putting

I've created a subclass of IDACall, with the following content:

	@Override
	public void processRequest(HttpServletRequest request,
			HttpServletResponse response) throws ServletException, IOException {
		try {
			JetspeedUser user = (JetspeedUser) request.getSession()
					.getAttribute("JETSPEED_USER");
			if (user != null) {
				RequestContext context = RequestContext.instance(this, request, response);   
				RPCManager rpc = new RPCManager(request, response);
				rpc.setAuthenticated(true);
			}
		} catch (Exception e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		}
		super.processRequest(request, response);
	}

In the debugger I can see that I call rpc.setAuthenticated(true). However, my app still says

java.lang.SecurityException: DataSource 'ds', operationType 'fetch', operationId 'ds_fetch'.  No authenticated user
	at com.isomorphic.datasource.DSRequest.execute(DSRequest.java:1889)
	at com.isomorphic.servlet.IDACall.handleDSRequest(IDACall.java:216)
	at com.isomorphic.servlet.IDACall.processRPCTransaction(IDACall.java:173)
	at com.isomorphic.servlet.IDACall.processRequest(IDACall.java:138)
	at com.valbosoft.smartgwt.IDACall.processRequest(IDACall.java:39)
	at com.isomorphic.servlet.IDACall.doPost(IDACall.java:74)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)
	at com.isomorphic.servlet.BaseServlet.service(BaseServlet.java:152)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
	at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
	at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:602)
	at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
	at java.lang.Thread.run(Thread.java:722)

Is this approach correct? Am I missing something?

I'm using version SmartClient Version: v8.3p_2012-11-22/Pro Deployment (built 2012-11-22)

[Isomorphic]

You are creating and configuring an RPCManager that is not actually used to process the request - you just call super(), so another RPCManager instance is created.

The easiest fix is to call RPCManager.processRequest() instead.

Note that some features, such as the special column types that can record the user making the changes, require a userId, which you can provide with rpcManager.setUserId().