All of our applications are currently using form based authentication in the EJB container .. am I correct that this (Form based authentication) is not supported in Lift? As I see it, After checking the users cookie against the Authentication server I would want to cache the returned User object for a period to prevent hitting the server for each request. The only downfall is that if the user logs out of the authentication server and the cache is not cleared then the user would still be authenticated until the cache expires.
I may be living in the dark ages, but I did not think you could log a user out using HttpAuthentication short of closing the browser ... is this true? On Wed, Mar 25, 2009 at 10:20 AM, Timothy Perrett <[email protected]>wrote: > > > Further to that example, no doubt someone will laugh at me for using > database access on each request... However this is just an example! In > reality I actually read from an LRU cache to save the database access. > > Cheers, Tim > > On 25/03/2009 15:08, "Timothy Perrett" <[email protected]> wrote: > > > > > Chad, > > > > We have HTTP Basic Auth and HTTP Digest Auth support in Lift. The > > authentication is implemented as a partial function that you implement > > like so: > > > > LiftRules.httpAuthProtectedResource.prepend { > > case (ParsePath("api" :: _, _, _, _)) => Full(AuthRole("admin")) > > } > > > > LiftRules.authentication = HttpBasicAuthentication("lift") { > > case (username, password, req) => { > > User.find(By(User.username, username)) match { > > case Full(user) if user.password.match_?(password) => { > > userRoles(AuthRole("admin")) > > true > > } > > case _ => false > > } > > } > > } > > > > Does that make things clearer for you? Essentially what happens is > > this: > > > > user request (no auth) ==> challenge > > user request (with auth) ==> sucsess (or challenge if incorrect) > > > > HTTP Digest is a lot more complex, if you need info on that, let me > > know. > > > > Thanks > > > > Tim > > > > > > On Mar 25, 2:42 pm, Chad Skinner <[email protected]> wrote: > >> Humm, I am learning something about HttpBasicAuthentication and need to > look > >> into this more. Is this method called for every request ... even before > the > >> user fills out the login form? > > > > > > > > > > > --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "Lift" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/liftweb?hl=en -~----------~----~----~----~------~----~------~--~---
