How to use Google App Engine security on Wicket?

Question

I'm developing an Wicket GAE application, and everything looks fine. But I have one question, how to correctly integrate GAE's security with Wicket?

I have two security-related use cases:

Pages allowed for authenticated users: only logged user can see them - other users must be redirected to Google's authentication (and, after success, get back to the same page)
Pages with actions allowed for some users: any user can see the page, but only special users can run actions (ex: anyone can read the news, but only the author of the specific post can edit).

The second one I guess I can do by "hiding" the forms and/or actions (other suggestions are welcome). The first one I could not find how to do.

GAE instructs to use servlet-based authentication or some API calls to redirect to Google's auth with a return link. I guess this works with Wicket's redirection, but shouldn't it be a 401 redirect? And, more important: how to test it?

If I use Wicket's security, how can I define which pages user can access and how to send to Google's auth?

Richard Nichols Richard Nichols · Accepted Answer · 2011-09-05T12:35:55

The security features of the visural-wicket library (full disclosure - this is my open source project) may allow the integration you're looking for.

This blog post explains the basic mechanism -

http://www.richardnichols.net/2011/09/securing-wicket-with-visural-wicket/

You can integrate with Google's security by using their UserService to return an IClient wrapping the google user -

public class GoogleUser implements IClient<String> {
    private final User user;
    private final boolean admin;
    public GoogleUser(User user, boolean admin) {
        this.user = user;
    }    
    public String getId() {
        return user.getUserId();
    }
    public User getUser() {
        return user;
    }
    public boolean isAdmin() {
        return admin;
    }
}

public class MyApp extends Application {

    public void init() {
        // ...
        getSecuritySettings().setAuthorizationStrategy(new com.visural.wicket.security.AuthorizationStrategy(new IClientProvider() {
            public IClient getCurrentClient() {
                UserService s = UserServiceFactory.getUserService();
                return new GoogleUser(s.getCurrentUser(), s.isUserAdmin());
            }
        }));
        // ...
    }
}

You can then implement security in your pages or components like this -

public class MyPage extends WebPage implements ISecureRenderInstance {
    // ...

    public IPrivilege getRenderPrivilege() {
       return new IPrivilege<GoogleUser>() {
           public boolean isGrantedToClient(GoogleUser client) {
               return client != null && client.isAdmin()
           }
       };
       // instead of returning a anonymous class like this, you could also
       // package up common privileges into a singleton instance,
       // e.g. return Privilege.ADMIN;
    }
}

How to use Google App Engine security on Wicket?

1 Answers