This is an automated email from the ASF dual-hosted git repository.
papegaaij pushed a commit to branch wicket-8.x
in repository https://gitbox.apache.org/repos/asf/wicket.git
The following commit(s) were added to refs/heads/wicket-8.x by this push:
new 9db120cc7e WICKET-7193 Deprecate the authentication strategy and the
remember-me panel
9db120cc7e is described below
commit 9db120cc7e604c728dcea9eea6cd3b62547b790d
Author: Emond Papegaaij <[email protected]>
AuthorDate: Sun Aug 23 21:19:56 2026 +0200
WICKET-7193 Deprecate the authentication strategy and the remember-me panel
IAuthenticationStrategy exists to persist sign-in credentials so that a
later
visit signs the user in automatically. Its contract is credential-shaped and
cannot be anything else: load() hands its result straight to
AuthenticatedWebSession.signIn(String, String), so what is stored on the
client
is the password, replayed on every visit for as long as the cookie lives.
DefaultAuthenticationStrategy, the only real implementation, joins the
username
and the password with "-sep-" and writes them to a cookie named LoggedIn.
That
cookie is HttpOnly and SameSite=Lax, but it has no Secure attribute and a
thirty
day lifetime, and it is encrypted with PBEWithMD5AndDES -- DES in an
unauthenticated mode -- under a key regenerated on every restart. Anyone who
obtains it can sign in as the user, and the fixed separator is a crib for
recovering the password itself.
None of that is a defect in the implementation. AuthenticatedWebSession
already
documents that a cookie based login "may not rely on putting username and
password into the cookie but something else that safely identifies the
user",
and this contract cannot express that: load() returns credentials for
authenticate(String, String) to check, so a token could only be carried by
making
the application accept that token as a password. There is no replacement
and no
configuration that makes it safe, which is the second case SECURITY.md
describes
-- the design rather than the implementation is the problem, so it is
deprecated
with no replacement offered.
Deprecating the strategy alone would not be enough. SECURITY.md is explicit
that
deprecating a member does not deprecate the behaviour behind it where the
feature
is still reachable without the application opting in, and an application
that
writes new SignInPanel("signInPanel") -- as SignInPage does -- gets
credential
persistence without naming a single deprecated member. Rather than change a
default on a supported release line, SignInPanel and SignInPage are
deprecated as
well, and UsernamePasswordPanel and UsernamePasswordPage are added in their
place: naming a deprecated class is something an application does
deliberately,
which is what SECURITY.md excludes.
The new types are copies with the remember-me support removed and
everything else
kept, including the package, the member names, the "signInForm" component
id, the
signInFailed resource key and all nine localizations, so migrating is a
change of
type name. Nothing else changes: this commit adds annotations, javadoc and
two new
types; no default is flipped and no behaviour moves.
Two properties of SignInPanel's remember-me support are named in its
javadoc and
deliberately left as they are, because the remedy is to stop using the panel
rather than to harden something that is being removed. Passing false to
SignInPanel(String, boolean) only hides the checkbox -- rememberMe still
starts
out true and an invisible form component is never updated from the request,
so
the credentials are persisted on every successful sign in regardless. And
onConfigure() consults neither flag, so any instance of the panel signs a
visitor
in from an existing cookie.
On this line the bare @Deprecated form is used, since 8.x targets Java 8
and the
since and forRemoval members were added in Java 9; the suppressions that go
with
it name deprecation rather than removal for the same reason. The tests here
are
JUnit 4, so the sweep that renders the panel in every locale is a loop in a
plain
test rather than a parameterized one, and nothing in the build changes. The
new
panel copies this branch's SignInPanel, whose form declares onSubmit()
final.
The removal happens in Wicket 11.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
---
.../authroles/authentication/pages/SignInPage.java | 13 ++
.../authentication/pages/UsernamePasswordPage.html | 12 ++
.../{SignInPage.java => UsernamePasswordPage.java} | 15 +-
.../pages/UsernamePasswordPage_de.html | 12 ++
.../pages/UsernamePasswordPage_fr.html | 28 +++
.../pages/UsernamePasswordPage_hu.html | 28 +++
.../pages/UsernamePasswordPage_pl.html | 12 ++
.../pages/UsernamePasswordPage_ru.html | 28 +++
.../authentication/panel/SignInPanel.java | 32 +++-
.../panel/UsernamePasswordPanel.html | 37 ++++
.../panel/UsernamePasswordPanel.java | 196 +++++++++++++++++++++
.../panel/UsernamePasswordPanel_de.html | 41 +++++
.../panel/UsernamePasswordPanel_de.properties | 15 ++
.../panel/UsernamePasswordPanel_fr.html | 37 ++++
.../panel/UsernamePasswordPanel_fr.properties.xml | 21 +++
.../panel/UsernamePasswordPanel_hu.html | 37 ++++
.../panel/UsernamePasswordPanel_hu.properties | 15 ++
.../panel/UsernamePasswordPanel_ja.html | 37 ++++
.../panel/UsernamePasswordPanel_ko.html | 37 ++++
.../panel/UsernamePasswordPanel_nl.html | 41 +++++
.../panel/UsernamePasswordPanel_nl.properties | 15 ++
.../panel/UsernamePasswordPanel_pl.html | 41 +++++
.../panel/UsernamePasswordPanel_pl.properties | 15 ++
.../panel/UsernamePasswordPanel_ru.html | 37 ++++
.../panel/UsernamePasswordPanel_ru.properties | 15 ++
.../panel/UsernamePasswordPanel_zh_CN.html | 41 +++++
.../authentication/panel/SignInPanelTest.java | 1 +
...nelTest.java => UsernamePasswordPanelTest.java} | 78 +++++++-
.../authentication/IAuthenticationStrategy.java | 25 +++
.../strategy/DefaultAuthenticationStrategy.java | 12 ++
.../strategy/NoOpAuthenticationStrategy.java | 4 +
.../apache/wicket/protocol/http/WebSession.java | 3 +
.../apache/wicket/settings/SecuritySettings.java | 9 +
33 files changed, 973 insertions(+), 17 deletions(-)
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/SignInPage.java
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/SignInPage.java
index 44bf6a708e..96a7df2200 100644
---
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/SignInPage.java
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/SignInPage.java
@@ -23,9 +23,22 @@ import
org.apache.wicket.request.mapper.parameter.PageParameters;
/**
* A base class which provide standard functionality for sign in.
+ * <p>
+ * <strong>This page is deprecated for security reasons.</strong> It hosts a
{@link SignInPanel},
+ * whose "remember me" support stores the username and the password in a
cookie on the client. Use
+ * {@link UsernamePasswordPage} instead, which hosts a
+ * {@link
org.apache.wicket.authroles.authentication.panel.UsernamePasswordPanel} and is
otherwise
+ * the same page. See {@link SignInPanel} for the mechanism and {@code
SECURITY.md} for the scope
+ * this places the page in.
+ * </p>
*
* @author Jonathan Locke
+ * @deprecated use {@link UsernamePasswordPage}, which is this page without
the "remember me" option.
+ * Persisting credentials on the client cannot be made safe, so
this page is removed in
+ * Wicket 11.
*/
+@Deprecated
+@SuppressWarnings("deprecation")
public class SignInPage extends WebPage
{
private static final long serialVersionUID = 1L;
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage.html
new file mode 100644
index 0000000000..a4ebdfcd8a
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage.html
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<html xmlns:wicket="http://wicket.apache.org";>
+<head>
+ <title>Sign In</title>
+</head>
+<body>
+ <h2>Sign In</h2>
+ <p>
+ <span wicket:id="signInPanel"/>
+ </p>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/SignInPage.java
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage.java
similarity index 78%
copy from
wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/SignInPage.java
copy to
wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage.java
index 44bf6a708e..e12801299f 100644
---
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/SignInPage.java
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage.java
@@ -16,24 +16,25 @@
*/
package org.apache.wicket.authroles.authentication.pages;
-import org.apache.wicket.authroles.authentication.panel.SignInPanel;
+import org.apache.wicket.authroles.authentication.panel.UsernamePasswordPanel;
import org.apache.wicket.markup.html.WebPage;
import org.apache.wicket.request.mapper.parameter.PageParameters;
/**
- * A base class which provide standard functionality for sign in.
+ * A base class which provide standard functionality for sign in, by hosting a
+ * {@link UsernamePasswordPanel}.
*
* @author Jonathan Locke
*/
-public class SignInPage extends WebPage
+public class UsernamePasswordPage extends WebPage
{
private static final long serialVersionUID = 1L;
/**
* Construct
*/
- public SignInPage()
+ public UsernamePasswordPage()
{
this(null);
}
@@ -44,8 +45,10 @@ public class SignInPage extends WebPage
* @param parameters
* The page parameters
*/
- public SignInPage(final PageParameters parameters)
+ public UsernamePasswordPage(final PageParameters parameters)
{
- add(new SignInPanel("signInPanel"));
+ super(parameters);
+
+ add(new UsernamePasswordPanel("signInPanel"));
}
}
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_de.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_de.html
new file mode 100644
index 0000000000..e4e6fcacaf
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_de.html
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<html xmlns:wicket="http://wicket.apache.org";>
+<head>
+ <title>Anmelden</title>
+</head>
+<body>
+ <h2>Anmelden</h2>
+ <p>
+ <span wicket:id="signInPanel"/>
+ </p>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_fr.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_fr.html
new file mode 100644
index 0000000000..9068ffc1ed
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_fr.html
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<head>
+ <title>Authentification</title>
+</head>
+<body>
+ <h2>Veuillez vous authentifier</h2>
+ <p>
+ <span wicket:id="signInPanel"/>
+ </p>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_hu.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_hu.html
new file mode 100644
index 0000000000..2d32334b8b
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_hu.html
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<head>
+ <title>Bejelentkezés</title>
+</head>
+<body>
+ <h2>Bejelentkezés</h2>
+ <p>
+ <span wicket:id="signInPanel"/>
+ </p>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_pl.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_pl.html
new file mode 100644
index 0000000000..e20dbb3c31
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_pl.html
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<html xmlns:wicket="http://wicket.apache.org";>
+<head>
+ <title>Zaloguj się</title>
+</head>
+<body>
+ <h2>Zaloguj się</h2>
+ <p>
+ <span wicket:id="signInPanel"/>
+ </p>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_ru.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_ru.html
new file mode 100644
index 0000000000..988a577da4
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_ru.html
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<head>
+ <title>Вход</title>
+</head>
+<body>
+ <h2>Вход</h2>
+ <p>
+ <span wicket:id="signInPanel"/>
+ </p>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/SignInPanel.java
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/SignInPanel.java
index 4e2923de98..cc825014eb 100644
---
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/SignInPanel.java
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/SignInPanel.java
@@ -35,14 +35,40 @@ import org.apache.wicket.model.CompoundPropertyModel;
* passing the username and password submitted. The signIn() method should
authenticate the user's
* session.
*
- * @see IAuthenticationStrategy
- * @see org.apache.wicket.settings.SecuritySettings#getAuthenticationStrategy()
- * @see DefaultAuthenticationStrategy
+ * <p>
+ * <strong>This panel is deprecated for security reasons.</strong> Its
"remember me" support hands
+ * the username and the password to {@link IAuthenticationStrategy}, whose
default implementation
+ * {@link DefaultAuthenticationStrategy} writes them into a cookie, so the
password is stored on the
+ * client and replayed on every visit. That mechanism is deprecated with no
replacement, because
+ * whatever it persists is what signs the user in; see {@link
IAuthenticationStrategy} for why it
+ * cannot be made safe.
+ * </p>
+ * <p>
+ * Use {@link UsernamePasswordPanel} instead. It is this panel without the
"remember me" option and
+ * with the same API otherwise, so switching over is a change of type name. An
application that needs
+ * a persistent login has to implement one itself, with a random, revocable,
per-device token rather
+ * than with the password.
+ * </p>
+ * <p>
+ * Two properties of the "remember me" support here are worth knowing before
relying on it, and
+ * neither is going to be fixed: the remedy is to stop using this panel rather
than to harden
+ * something that is being removed. Passing {@code false} to {@link
#SignInPanel(String, boolean)}
+ * only hides the checkbox — the {@code rememberMe} property still
starts out {@code true}, an
+ * invisible form component is never updated from the request, and so the
credentials are persisted
+ * on every successful sign in regardless. And {@link #onConfigure()} consults
neither flag, so any
+ * instance of this panel signs a visitor in from an existing cookie. See
{@code SECURITY.md} for the
+ * scope this places the panel in.
+ * </p>
*
* @author Jonathan Locke
* @author Juergen Donnerstag
* @author Eelco Hillenius
+ * @deprecated use {@link UsernamePasswordPanel}, which is this panel without
the "remember me"
+ * option. Persisting credentials on the client cannot be made
safe, so this panel is
+ * removed in Wicket 11.
*/
+@Deprecated
+@SuppressWarnings("deprecation")
public class SignInPanel extends Panel
{
private static final long serialVersionUID = 1L;
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel.html
new file mode 100644
index 0000000000..e65528a111
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel.html
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<body>
+ <wicket:panel>
+ <span wicket:id="feedback"/>
+
+ <form wicket:id="signInForm">
+ <dl>
+ <dt>Username:</dt>
+ <dd><input wicket:id="username" type="text"
size="30"/></dd>
+ <dt>Password:</dt>
+ <dd><input wicket:id="password" type="password"
size="30"/></dd>
+ <dd>
+ <input type="submit" name="submit" value="Sign
In"/>
+ <input type="reset" value="Reset"/>
+ </dd>
+ </dl>
+ </form>
+ </wicket:panel>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel.java
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel.java
new file mode 100644
index 0000000000..b20af77b88
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel.java
@@ -0,0 +1,196 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.wicket.authroles.authentication.panel;
+
+import org.apache.wicket.authroles.authentication.AuthenticatedWebSession;
+import org.apache.wicket.markup.html.form.PasswordTextField;
+import org.apache.wicket.markup.html.form.StatelessForm;
+import org.apache.wicket.markup.html.form.TextField;
+import org.apache.wicket.markup.html.panel.FeedbackPanel;
+import org.apache.wicket.markup.html.panel.Panel;
+import org.apache.wicket.model.CompoundPropertyModel;
+
+/**
+ * Reusable sign in panel with a username and a password field. When the
panel's form is submitted,
+ * the submitted values are passed to {@link
AuthenticatedWebSession#signIn(String, String)}, which
+ * authenticates the user's session.
+ * <p>
+ * The credentials live no longer than the session: nothing is written to the
client, so a user signs
+ * in again once the session has ended. Wicket offers no supported way to
persist credentials on the
+ * client and get an automatic sign in on a later visit — anything
stored there authenticates
+ * the user by itself, and the framework cannot make that safe. An application
that needs a
+ * persistent login has to implement one, and should do so with a random,
revocable, per-device token
+ * rather than with the password; {@link
AuthenticatedWebSession#signIn(boolean)} exists so that such
+ * a token can sign a session in without being passed to
+ * {@link AuthenticatedWebSession#authenticate(String, String)}.
+ *
+ * @author Jonathan Locke
+ * @author Juergen Donnerstag
+ * @author Eelco Hillenius
+ */
+public class UsernamePasswordPanel extends Panel
+{
+ private static final long serialVersionUID = 1L;
+
+ private static final String SIGN_IN_FORM = "signInForm";
+
+ /** password. */
+ private String password;
+
+ /** user name. */
+ private String username;
+
+ /**
+ * @see org.apache.wicket.Component#Component(String)
+ */
+ public UsernamePasswordPanel(final String id)
+ {
+ super(id);
+
+ // Create feedback panel and add to page
+ add(new FeedbackPanel("feedback"));
+
+ // Add sign-in form to page, passing feedback panel as
+ // validation error handler
+ add(new SignInForm(SIGN_IN_FORM));
+ }
+
+ /**
+ *
+ * @return signin form
+ */
+ protected SignInForm getForm()
+ {
+ return (SignInForm)get(SIGN_IN_FORM);
+ }
+
+ /**
+ * Convenience method to access the password.
+ *
+ * @return The password
+ */
+ public String getPassword()
+ {
+ return password;
+ }
+
+ /**
+ * Set the password
+ *
+ * @param password
+ */
+ public void setPassword(final String password)
+ {
+ this.password = password;
+ }
+
+ /**
+ * Convenience method to access the username.
+ *
+ * @return The user name
+ */
+ public String getUsername()
+ {
+ return username;
+ }
+
+ /**
+ * Set the username
+ *
+ * @param username
+ */
+ public void setUsername(final String username)
+ {
+ this.username = username;
+ }
+
+ /**
+ * Sign in user if possible.
+ *
+ * @param username
+ * The username
+ * @param password
+ * The password
+ * @return True if signin was successful
+ */
+ private boolean signIn(String username, String password)
+ {
+ return AuthenticatedWebSession.get().signIn(username, password);
+ }
+
+ /**
+ * Called when sign in failed
+ */
+ protected void onSignInFailed()
+ {
+ // Try the component based localizer first. If not found try the
+ // application localizer. Else use the default
+ error(getLocalizer().getString("signInFailed", this, "Sign in
failed"));
+ }
+
+ /**
+ * Called when sign in was successful
+ */
+ protected void onSignInSucceeded()
+ {
+ // If login has been called because the user was not yet logged
in, than continue to the
+ // original destination, otherwise to the Home page
+ continueToOriginalDestination();
+ setResponsePage(getApplication().getHomePage());
+ }
+
+ /**
+ * Sign in form.
+ */
+ public final class SignInForm extends
StatelessForm<UsernamePasswordPanel>
+ {
+ private static final long serialVersionUID = 1L;
+
+ /**
+ * Constructor.
+ *
+ * @param id
+ * id of the form component
+ */
+ public SignInForm(final String id)
+ {
+ super(id);
+
+ setModel(new
CompoundPropertyModel<>(UsernamePasswordPanel.this));
+
+ // Attach textfields for username and password
+ add(new TextField<>("username").setRequired(true));
+ add(new PasswordTextField("password"));
+ }
+
+ /**
+ * @see org.apache.wicket.markup.html.form.Form#onSubmit()
+ */
+ @Override
+ public final void onSubmit()
+ {
+ if (signIn(getUsername(), getPassword()))
+ {
+ onSignInSucceeded();
+ }
+ else
+ {
+ onSignInFailed();
+ }
+ }
+ }
+}
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_de.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_de.html
new file mode 100644
index 0000000000..4e677ad936
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_de.html
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<head>
+ <title>Wicket Examples - signin2</title>
+ <link rel="stylesheet" type="text/css" href="style.css"/>
+</head>
+<body>
+ <wicket:panel>
+ <span wicket:id="feedback"/>
+
+ <form wicket:id="signInForm">
+ <dl>
+ <dt>Benutzername:</dt>
+ <dd><input wicket:id="username" type="text"
size="30"/></dd>
+ <dt>Passwort:</dt>
+ <dd><input wicket:id="password" type="password"
size="30"/></dd>
+ <dd>
+ <input type="submit" name="submit"
value="Anmelden"/>
+ <input type="reset" value="Reset"/>
+ </dd>
+ </dl>
+ </form>
+ </wicket:panel>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_de.properties
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_de.properties
new file mode 100644
index 0000000000..7f775fdad8
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_de.properties
@@ -0,0 +1,15 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+signInFailed = Fehler bei der Anmeldung
\ No newline at end of file
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_fr.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_fr.html
new file mode 100644
index 0000000000..97b9cb0bcd
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_fr.html
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<body>
+ <wicket:panel>
+ <span wicket:id="feedback"/>
+
+ <form wicket:id="signInForm">
+ <dl>
+ <dt>Identifiant:</dt>
+ <dd><input wicket:id="username" type="text"
size="30"/></dd>
+ <dt>Mot de passe:</dt>
+ <dd><input wicket:id="password" type="password"
size="30"/></dd>
+ <dd>
+ <input type="submit" name="submit"
value="S'identifier"/>
+ <input type="reset" value="Annuler"/>
+ </dd>
+ </dl>
+ </form>
+ </wicket:panel>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_fr.properties.xml
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_fr.properties.xml
new file mode 100644
index 0000000000..502e02c835
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_fr.properties.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd";>
+<properties>
+ <entry key="signInFailed">Erreur d'authentification</entry>
+</properties>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_hu.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_hu.html
new file mode 100644
index 0000000000..c7c2244553
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_hu.html
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<body>
+ <wicket:panel>
+ <span wicket:id="feedback"/>
+
+ <form wicket:id="signInForm">
+ <dl>
+ <dt>Felhasználónév:</dt>
+ <dd><input wicket:id="username" type="text"
size="30"/></dd>
+ <dt>Jelszó:</dt>
+ <dd><input wicket:id="password" type="password"
size="30"/></dd>
+ <dd>
+ <input type="submit" name="submit"
value="Bejelentkezés"/>
+ <input type="reset" value="Alaphelyzet"/>
+ </dd>
+ </dl>
+ </form>
+ </wicket:panel>
+</body>
+</html>
\ No newline at end of file
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_hu.properties
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_hu.properties
new file mode 100644
index 0000000000..b4abc6fad8
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_hu.properties
@@ -0,0 +1,15 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+signInFailed = Hiba a bejelentkez\u00E9s sor\u00E1n
\ No newline at end of file
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ja.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ja.html
new file mode 100644
index 0000000000..037bf77751
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ja.html
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<body>
+ <wicket:panel>
+ <span wicket:id="feedback"/>
+
+ <form wicket:id="signInForm">
+ <dl>
+ <dt>ユーザー名:</dt>
+ <dd><input wicket:id="username" type="text"
size="30"/></dd>
+ <dt>パスワード:</dt>
+ <dd><input wicket:id="password" type="password"
size="30"/></dd>
+ <dd>
+ <input type="submit" name="submit"
value="サインイン"/>
+ <input type="reset" value="リセット"/>
+ </dd>
+ </dl>
+ </form>
+ </wicket:panel>
+</body>
+</html>
\ No newline at end of file
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ko.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ko.html
new file mode 100644
index 0000000000..b4e8729c7d
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ko.html
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<body>
+ <wicket:panel>
+ <span wicket:id="feedback"/>
+
+ <form wicket:id="signInForm">
+ <dl>
+ <dt>사용자명:</dt>
+ <dd><input wicket:id="username" type="text"
size="30"/></dd>
+ <dt>비밀번호:</dt>
+ <dd><input wicket:id="password" type="password"
size="30"/></dd>
+ <dd>
+ <input type="submit" name="submit" value="로그인"/>
+ <input type="reset" value="취소"/>
+ </dd>
+ </dl>
+ </form>
+ </wicket:panel>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_nl.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_nl.html
new file mode 100644
index 0000000000..c3fef8a2e3
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_nl.html
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<head>
+ <title>Wicket Examples - signin2</title>
+ <link rel="stylesheet" type="text/css" href="style.css"/>
+</head>
+<body>
+ <wicket:panel>
+ <span wicket:id="feedback"/>
+
+ <form wicket:id="signInForm">
+ <dl>
+ <dt>Gebruikersnaam:</dt>
+ <dd><input wicket:id="username" type="text"
size="30"/></dd>
+ <dt>Wachtwoord:</dt>
+ <dd><input wicket:id="password" type="password"
size="30"/></dd>
+ <dd>
+ <input type="submit" name="submit"
value="Aanmelden"/>
+ <input type="reset" value="Reset"/>
+ </dd>
+ </dl>
+ </form>
+ </wicket:panel>
+</body>
+</html>
\ No newline at end of file
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_nl.properties
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_nl.properties
new file mode 100644
index 0000000000..4200873f21
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_nl.properties
@@ -0,0 +1,15 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+signInFailed = Inloggen mislukt
\ No newline at end of file
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_pl.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_pl.html
new file mode 100644
index 0000000000..5c54dc2139
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_pl.html
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<head>
+ <title>Wicket Examples - signin2</title>
+ <link rel="stylesheet" type="text/css" href="style.css"/>
+</head>
+<body>
+ <wicket:panel>
+ <span wicket:id="feedback"/>
+
+ <form wicket:id="signInForm">
+ <dl>
+ <dt>Użytkownik:</dt>
+ <dd><input wicket:id="username" type="text"
size="30"/></dd>
+ <dt>Hasło:</dt>
+ <dd><input wicket:id="password" type="password"
size="30"/></dd>
+ <dd>
+ <input type="submit" name="submit"
value="Wchodzę"/>
+ <input type="reset" value="Rezygnuję"/>
+ </dd>
+ </dl>
+ </form>
+ </wicket:panel>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_pl.properties
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_pl.properties
new file mode 100644
index 0000000000..3282a1589c
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_pl.properties
@@ -0,0 +1,15 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+signInFailed = Bl\u0105d podczas logowania
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ru.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ru.html
new file mode 100644
index 0000000000..abf835faa9
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ru.html
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<body>
+<wicket:panel>
+ <span wicket:id="feedback" />
+
+ <form wicket:id="signInForm">
+ <dl>
+ <dt>Логин:</dt>
+ <dd><input wicket:id="username" type="text"
size="30"/></dd>
+ <dt>Пароль:</dt>
+ <dd><input wicket:id="password" type="password"
size="30"/></dd>
+ <dd>
+ <input type="submit" name="submit"
value="Вход"/>
+ <input type="reset" value="Сброс"/>
+ </dd>
+ </dl>
+ </form>
+</wicket:panel>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ru.properties
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ru.properties
new file mode 100644
index 0000000000..7cfd8df3e6
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ru.properties
@@ -0,0 +1,15 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+signInFailed = \u041d\u0435 \u0443\u0434\u0430\u043b\u043e\u0441\u044c
\u0432\u043e\u0439\u0442\u0438
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_zh_CN.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_zh_CN.html
new file mode 100644
index 0000000000..75acb5f023
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_zh_CN.html
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<head>
+ <title>Wicket Examples - signin2</title>
+ <link rel="stylesheet" type="text/css" href="style.css"/>
+</head>
+<body>
+ <wicket:panel>
+ <span wicket:id="feedback"/>
+
+ <form wicket:id="signInForm">
+ <dl>
+ <dt>用户名:</dt>
+ <dd><input wicket:id="username" type="text"
size="30"/></dd>
+ <dt>密码:</dt>
+ <dd><input wicket:id="password" type="password"
size="30"/></dd>
+ <dd>
+ <input type="submit" name="submit" value="到"/>
+ <input type="reset" value="重新设置"/>
+ </dd>
+ </dl>
+ </form>
+ </wicket:panel>
+</body>
+</html>
\ No newline at end of file
diff --git
a/wicket-auth-roles/src/test/java/org/apache/wicket/authroles/authentication/panel/SignInPanelTest.java
b/wicket-auth-roles/src/test/java/org/apache/wicket/authroles/authentication/panel/SignInPanelTest.java
index 73735f5e71..18c78dbc04 100644
---
a/wicket-auth-roles/src/test/java/org/apache/wicket/authroles/authentication/panel/SignInPanelTest.java
+++
b/wicket-auth-roles/src/test/java/org/apache/wicket/authroles/authentication/panel/SignInPanelTest.java
@@ -35,6 +35,7 @@ import org.junit.Test;
/**
* Tests for {@link SignInPanel}
*/
+@SuppressWarnings("deprecation") // the panel under test is deprecated
public class SignInPanelTest extends Assert
{
diff --git
a/wicket-auth-roles/src/test/java/org/apache/wicket/authroles/authentication/panel/SignInPanelTest.java
b/wicket-auth-roles/src/test/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanelTest.java
similarity index 57%
copy from
wicket-auth-roles/src/test/java/org/apache/wicket/authroles/authentication/panel/SignInPanelTest.java
copy to
wicket-auth-roles/src/test/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanelTest.java
index 73735f5e71..2802f114c9 100644
---
a/wicket-auth-roles/src/test/java/org/apache/wicket/authroles/authentication/panel/SignInPanelTest.java
+++
b/wicket-auth-roles/src/test/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanelTest.java
@@ -16,10 +16,12 @@
*/
package org.apache.wicket.authroles.authentication.panel;
+import java.util.Locale;
import java.util.concurrent.atomic.AtomicInteger;
+import javax.servlet.http.Cookie;
+
import org.apache.wicket.MarkupContainer;
-import org.apache.wicket.Session;
import org.apache.wicket.authroles.authentication.AuthenticatedWebApplication;
import org.apache.wicket.authroles.authentication.AuthenticatedWebSession;
import org.apache.wicket.authroles.authorization.strategies.role.Roles;
@@ -28,15 +30,19 @@ import org.apache.wicket.markup.html.WebPage;
import org.apache.wicket.request.Request;
import org.apache.wicket.util.resource.IResourceStream;
import org.apache.wicket.util.resource.StringResourceStream;
+import org.apache.wicket.util.tester.FormTester;
import org.apache.wicket.util.tester.WicketTester;
import org.junit.Assert;
import org.junit.Test;
/**
- * Tests for {@link SignInPanel}
+ * Tests for {@link UsernamePasswordPanel}
*/
-public class SignInPanelTest extends Assert
+public class UsernamePasswordPanelTest extends Assert
{
+ private static final String USERNAME = "user";
+
+ private static final String PASSWORD = "secret";
/**
* https://issues.apache.org/jira/browse/WICKET-3980
@@ -59,14 +65,70 @@ public class SignInPanelTest extends Assert
assertEquals(1, constructorsCalls.get());
}
- private static class TestPage extends WebPage implements
IMarkupResourceStreamProvider
+ /**
+ * The panel ships localized markup; every variant has to resolve and
render, which is what
+ * catches a missing component or a stray {@code wicket:id} in one of
them.
+ */
+ @Test
+ public void rendersInEveryLocale()
+ {
+ for (String languageTag : new String[] { "de", "fr", "hu",
"ja", "ko", "nl", "pl", "ru",
+ "zh-CN" })
+ {
+ WicketTester tester = new WicketTester(new
TestApplication());
+
tester.getSession().setLocale(Locale.forLanguageTag(languageTag));
+
+ tester.startPage(new TestPage(new AtomicInteger(0)));
+
+ tester.assertRenderedPage(TestPage.class);
+
tester.assertComponent("signInPanel:signInForm:username",
+
org.apache.wicket.markup.html.form.TextField.class);
+ }
+ }
+
+ /**
+ * This panel keeps nothing on the client: a successful sign in must
leave no cookie behind, and
+ * in particular not the one the removed authentication strategy used.
+ */
+ @Test
+ public void signInPersistsNothingOnTheClient()
{
+ WicketTester tester = new WicketTester(new TestApplication());
+ tester.startPage(new TestPage(new AtomicInteger(0)));
+
+ FormTester form =
tester.newFormTester("signInPanel:signInForm");
+ form.setValue("username", USERNAME);
+ form.setValue("password", PASSWORD);
+ form.submit();
+
+ assertTrue("should be signed in",
AuthenticatedWebSession.get().isSignedIn());
+ for (Cookie cookie : tester.getLastResponse().getCookies())
+ {
+ assertNotEquals("no credentials may be persisted on the
client", "LoggedIn",
+ cookie.getName());
+ }
+ }
+
+ /**
+ * The page hosting the panel. It doubles as the home page, so it needs
a default constructor for
+ * the redirect after a successful sign in.
+ */
+ public static class TestPage extends WebPage implements
IMarkupResourceStreamProvider
+ {
+ /**
+ * Construct.
+ */
+ public TestPage()
+ {
+ this(new AtomicInteger(0));
+ }
+
private TestPage(AtomicInteger constructorCalls)
{
super();
constructorCalls.incrementAndGet();
- add(new SignInPanel("signInPanel"));
+ add(new UsernamePasswordPanel("signInPanel"));
}
@Override
@@ -79,13 +141,13 @@ public class SignInPanelTest extends Assert
}
/**
- * A {@link Session session} for the test
+ * A {@link org.apache.wicket.Session session} for the test
*/
public static class TestSession extends AuthenticatedWebSession
{
/**
* Construct.
- *
+ *
* @param request
* the current web request
*/
@@ -103,7 +165,7 @@ public class SignInPanelTest extends Assert
@Override
public boolean authenticate(String username, String password)
{
- return false;
+ return USERNAME.equals(username) &&
PASSWORD.equals(password);
}
}
diff --git
a/wicket-core/src/main/java/org/apache/wicket/authentication/IAuthenticationStrategy.java
b/wicket-core/src/main/java/org/apache/wicket/authentication/IAuthenticationStrategy.java
index dacbafe73c..caaab9b1fd 100644
---
a/wicket-core/src/main/java/org/apache/wicket/authentication/IAuthenticationStrategy.java
+++
b/wicket-core/src/main/java/org/apache/wicket/authentication/IAuthenticationStrategy.java
@@ -22,9 +22,34 @@ import org.apache.wicket.Application;
* The interface of an authentication strategy which is accessible via
* {@link Application#getSecuritySettings()}. Implementations determine how
logon data (username and
* password) are persisted (e.g. Cookie), retrieved and removed.
+ * <p>
+ * <strong>This interface is deprecated for security reasons and cannot be
made safe.</strong>
+ * Whatever it persists is what signs the user in: {@link #load()} hands its
result straight to
+ * {@code AuthenticatedWebSession#signIn(String, String)}, so what is stored
on the client is the
+ * password, and it is replayed on every visit for as long as the cookie
lives. Wicket's own
+ * implementation joins the username and the password with a fixed separator
and writes them to a
+ * cookie that has a thirty day lifetime and no {@code Secure} attribute,
encrypted with
+ * {@code PBEWithMD5AndDES} — DES in an unauthenticated mode —
under a key that is
+ * regenerated on every restart. Anyone who obtains that cookie can sign in as
the user, and the
+ * fixed separator gives them a crib for recovering the password itself.
+ * </p>
+ * <p>
+ * None of that is a defect in the implementation. {@code
AuthenticatedWebSession} already says that
+ * a cookie based login "may not rely on putting username and password into
the cookie but something
+ * else that safely identifies the user", and this contract cannot express
that: {@link #load()}
+ * returns credentials for {@code authenticate(String, String)} to check, so a
token can only be
+ * carried here by making the application accept that token as a password.
There is therefore no
+ * replacement and no configuration that makes this safe. An application that
needs a persistent
+ * login has to implement one itself, with a random, revocable, per-device
token, and can sign the
+ * session in with {@code AuthenticatedWebSession#signIn(boolean)} once it has
verified that token
+ * for itself. See {@code SECURITY.md} for the scope this places the interface
in.
+ * </p>
*
* @author Juergen Donnerstag
+ * @deprecated no replacement; see above. Persisting credentials on the client
so that a later visit
+ * can replay them cannot be made safe, so this is removed in
Wicket 11.
*/
+@Deprecated
public interface IAuthenticationStrategy
{
/**
diff --git
a/wicket-core/src/main/java/org/apache/wicket/authentication/strategy/DefaultAuthenticationStrategy.java
b/wicket-core/src/main/java/org/apache/wicket/authentication/strategy/DefaultAuthenticationStrategy.java
index d51efbc551..1da5b4d431 100644
---
a/wicket-core/src/main/java/org/apache/wicket/authentication/strategy/DefaultAuthenticationStrategy.java
+++
b/wicket-core/src/main/java/org/apache/wicket/authentication/strategy/DefaultAuthenticationStrategy.java
@@ -31,8 +31,20 @@ import org.slf4j.LoggerFactory;
* Wicket's default implementation of an authentication strategy. It'll
concatenate username and
* password, encrypt it and put it into one Cookie.
*
+ * <p>
+ * <strong>This class is deprecated for security reasons and cannot be made
safe.</strong> It joins
+ * the username and the password with {@code -sep-} and writes the result to a
cookie, so the
+ * password itself is stored on the client and replayed on every visit. See
+ * {@link IAuthenticationStrategy} for why there is no replacement, and {@code
SECURITY.md} for the
+ * scope this places the class in.
+ * </p>
+ *
* @author Juergen Donnerstag
+ * @deprecated no replacement; see {@link IAuthenticationStrategy}. Persisting
credentials on the
+ * client cannot be made safe, so this is removed in Wicket 11.
*/
+@Deprecated
+@SuppressWarnings("deprecation")
public class DefaultAuthenticationStrategy implements IAuthenticationStrategy
{
private static final Logger logger =
LoggerFactory.getLogger(DefaultAuthenticationStrategy.class);
diff --git
a/wicket-core/src/main/java/org/apache/wicket/authentication/strategy/NoOpAuthenticationStrategy.java
b/wicket-core/src/main/java/org/apache/wicket/authentication/strategy/NoOpAuthenticationStrategy.java
index 21460638cd..d806c424bc 100644
---
a/wicket-core/src/main/java/org/apache/wicket/authentication/strategy/NoOpAuthenticationStrategy.java
+++
b/wicket-core/src/main/java/org/apache/wicket/authentication/strategy/NoOpAuthenticationStrategy.java
@@ -22,7 +22,11 @@ import
org.apache.wicket.authentication.IAuthenticationStrategy;
* A no-op implementation. No username or password will be persisted or
retrieved.
*
* @author Juergen Donnerstag
+ * @deprecated no replacement; this implementation goes with the deprecated
+ * {@link IAuthenticationStrategy} it implements, and is removed
in Wicket 11.
*/
+@Deprecated
+@SuppressWarnings("deprecation")
public class NoOpAuthenticationStrategy implements IAuthenticationStrategy
{
@Override
diff --git
a/wicket-core/src/main/java/org/apache/wicket/protocol/http/WebSession.java
b/wicket-core/src/main/java/org/apache/wicket/protocol/http/WebSession.java
index eee338d217..345001bade 100644
--- a/wicket-core/src/main/java/org/apache/wicket/protocol/http/WebSession.java
+++ b/wicket-core/src/main/java/org/apache/wicket/protocol/http/WebSession.java
@@ -59,6 +59,9 @@ public class WebSession extends Session
*
* @see org.apache.wicket.Session#invalidate()
*/
+ // the authentication strategy is deprecated for removal, but clearing
whatever it persisted is
+ // exactly what has to keep happening while it still exists
+ @SuppressWarnings("deprecation")
@Override
public void invalidate()
{
diff --git
a/wicket-core/src/main/java/org/apache/wicket/settings/SecuritySettings.java
b/wicket-core/src/main/java/org/apache/wicket/settings/SecuritySettings.java
index 94eadea099..c53b014a0c 100644
--- a/wicket-core/src/main/java/org/apache/wicket/settings/SecuritySettings.java
+++ b/wicket-core/src/main/java/org/apache/wicket/settings/SecuritySettings.java
@@ -51,6 +51,7 @@ public class SecuritySettings
private IAuthorizationStrategy authorizationStrategy =
IAuthorizationStrategy.ALLOW_ALL;
/** The authentication strategy. */
+ @SuppressWarnings("deprecation")
private IAuthenticationStrategy authenticationStrategy;
/** factory for creating crypt objects */
@@ -221,7 +222,11 @@ public class SecuritySettings
* Gets the authentication strategy.
*
* @return Returns the authentication strategy.
+ * @deprecated no replacement; see {@link IAuthenticationStrategy}.
Persisting credentials on the
+ * client cannot be made safe, so this is removed in Wicket
11.
*/
+ @Deprecated
+ @SuppressWarnings("deprecation")
public IAuthenticationStrategy getAuthenticationStrategy()
{
if (authenticationStrategy == null)
@@ -237,7 +242,11 @@ public class SecuritySettings
* @param strategy
* new authentication strategy
* @return {@code this} object for chaining
+ * @deprecated no replacement; see {@link IAuthenticationStrategy}.
Persisting credentials on the
+ * client cannot be made safe, so this is removed in Wicket
11.
*/
+ @Deprecated
+ @SuppressWarnings("deprecation")
public SecuritySettings setAuthenticationStrategy(final
IAuthenticationStrategy strategy)
{
authenticationStrategy = strategy;
