When you use Basic authentication to secure access to destinations in Flex, you usually secure the endpoints of the channels that these destinations use in the "web.xml" file. You then configure the destination to access the secured resource in order to be challenged for a user name (principal) and password (credentials). The web browser performs the challenge, which happens independently of Flex. The web application container authenticates the user's credentials.

With Flamingo you don't need to configure secure channels for basic authentication. If you have basic authentication applied on the server either via standard Java EE configuration in the "web.xml" file or via native Spring Security or Seam configuration, you don't need any additional settings in Flex.

<web:authentication-filter url-pattern="/seam/resource/*" auth-type="basic"/> 

<http auto-config="true">

      <intercept-url pattern="/flamingo/**" access="ROLE_USER" />

      <intercept-url pattern="/**" filters="none" />

    </http>

    <authentication-provider>

      <password-encoder hash="md5"/>

        <user-service>

          <user name="rod" password="a564de63c2d0da68cf47586ee05984d7" authorities="ROLE_USER" />

          <user name="dianne" password="65d15fe9156f9c4bbffd98085992a44e" authorities="ROLE_USER" />                         

        </user-service>

   </authentication-provider>

When using custom authentication you should call certain methods on the server to perform the authentication itself. For custom authentication, Flex uses a custom login adapter, known as a login command, to check a user's credentials and log a principal into the application server. If you also want to use custom authorization, you must link the specified role references to roles that are defined in your application server's user store. Flamingo does not require you to configure roles for custom authentication/authorization as all necessary data is taken from the server configuration.

Seam

The standard approach to usage of custom authentication is the use of the identity component as shown in example 5.2.1.3 with the help of the CallSet component. After that, user will be logged on the server. As an alternative to this, you can use the setCredentials() method for the RemoteObject class (HessianService does not support this mechanism):

<mx:RemoteObject id="service" destination="identity"/>
<mx:Button label="Authenticate" click="service.setCredentials('username', 'password'); service.isLoggedIn()"/>

Spring

There are two ways how you can use custom authentication for Spring:

1. Create a Spring Service bean with methods like "login", "doLogout", "isLoggedIn" that will be requested from Flex. This bean will perform authentication using Spring Security API.

2. Use methods "setCredentials", "logout" of the RemoteObject component. For example:

<mx:RemoteObject id="service" destination="myService"/>

<mx:Button label="Call secure method" click="service.setCredentials('username', 'password'); service.callMethod()"/>

In this example, before calling method callMethod the authentication will be performed on the server according to Spring Security configuration set in the application.

Method "logout" of RemoteObject will remove currently authenticated principal from the security context. Methods "setCredentials" and "logout" affect not only the destination they were called from but the whole application as well.

In this mode you can check which roles a user currently logged on has and then deny or grant access to some resource. The roles are usually defined on the server side in the method described in the "components.xml" file:

        <security:identity authenticate-method="#{authenticator.authenticate}"/>
      

After calling identity.login() you can check a role using the identity.hasRole() server call.

Checking Seam permission involves executing the rule engine, therefore it should be done on server. Typically you need to check permissions in the way described below:

<mx:Script>
    <![CDATA[
    private function permissionResultHandler(event:ResultEvent):void
    {
        if ( event.result ) {
            Alert.show("You have permission");
        } else {
            Alert.show("You do not have permission");
        }
    }
    ]]>
</mx:Script>
<mx:RemoteObject id="identityService" destination="identity">
    <mx:method name="hasPermission" result="permissionResultHandler(event)" />
</mx:RemoteObject>
<mx:Button label="Check permission" click="identityService.hasPermission('account',  'delete', null)"/>