My Journey with #tapestry5 and #JavaEE
Part 13 - Tapestry-security
How to secure web applications has always been a non-trivial task. Tapestry has a module, called Tapestry-Security that simplifies things and integrates Apache Shiro with Tapestry.
As I was starting to use Tapestry-Security in-depth, however, the ugly parts of Tapestry-IOC integration came reared its ugly head again.
Apache Shiro is usually configured with shiro.ini file, which is a simple text file that presents a Java-beans-based standard configuration, is easily understood, and is used by many people. All the examples within Shiro are presented using this configuration file. Unfortunately, Tapestry-Security discards this configuration method in favor of Tapestry-IOC-based method, which is poorly documented and very hard to understand. As more security requirements were added, it became a battle to figure out just what combination of annotations, code, and where to put it all. None of these efforts paid off, and like anything with Tapestry-IOC, crazy errors were a result of seemingly simple modifications, and were impossible to figure out. Since Shiro/Tapestry-IOC/Tapestry-Security combination is rarely-used one, there was no one to help with the setup, and the more rigorous security requirements had to be abandoned in this context.
After the switch to JSF, however, Shiro, with it’s standard configuration, worked as expected, and I was able to build all of the security requirements in the application very quickly.