BlazeDS authentication

Question

I am confused about authentication with BlazeDS. Most of the few examples I have found for authentication and authorization in BlazeDS and consequently Java Servlets in general make use of HTTP basic and digest authentication and realms for authorization. These examples are very simplistic and involve XML files with the user credentials rather than using a database. My past experience in web applications used form based logins and sessions for authentication and authorization, but I am not sure how to do this with Flex apps with BlazeDS backends.

What I want to do is have some way to access some service on the backend to handle authentication like an HTML form and some way to store session data in a cookie for authorization, but I am having trouble finding relevant details using cookies in BlazeDS and Flex applications.

If HTTP authentication with either basic or digest authentication is the best way, then is there any resource to find out how to authentication users with the credentials stored in the database rather than an XML file?

I am not particularly interested in web frameworks since I would like to understand how to authenticate/authorize users with a plain Servlet and BlazeDS.

Fragrance

Answer 1

Authentication with BlazeDS and Flex is no different than with traditional web apps. Flex uses the same networking stack as the browser. So just follow instructions for securing your app server and then it should just work. If you want to have the login form in Flex then you can just send the credentials to j_security_check (for form based auth). Alternatively you can call login on the channelSet. Spring Security and Spring BlazeDS Integration M2 makes this very easy. Check out the Test Drive for a great sample (the usernames and passwords are still in an XML file but you can easily following the Spring documentation to move those to a database or LDAP server).

Neolithic

In the Test Drive, it looks like the channelSet gets reset on each browser refresh. If you've authenticated and refresh the page and check channelSet.authenticated, it says false, but your remoteObject call will still work. It looks like you stay authenticated to Spring, but Flex doesn't know about it. I'd like to find a way to login using Spring security and have it carry over to Flex, JSPs, whatever (like SSO). I'd like to be able to check from Flex to see if you're already authenticated with Spring (other than calling a hack method and seeing if you get denied access). – Auvergne

@I-Never-Finish-Anythi another client-side solution would be to keep this information in a Flash shared object. Store some sort of a token and a time-stamp and if valid perform authentication with that token. Calling a hack method seems a cleaner solution to me. – Motorboating