It is possible to define roles for users. Based on this roles, components with an action
attribute
like a button are enabled or disabled for the current user.
To allow an action only for a specific role, you have to annotate a method with
@RolesAllowed({"role1", "role2"})
.
This method must not have a parameter.
Also, the name of the beans must be distinct. Tobago only read an el expression once and put it in the cache including the annotation. After that, Tobago only work with the cache.
There are different ways to define roles for Tomcat and Jetty.
Roles are defined in a tomcat-users.xml within the <tomcat-users>
tag.
<tomcat-users>
<user username="guest" password="guest" roles="demo-guest"/>
<user username="admin" password="admin" roles="demo-admin"/>
</tomcat-users>
For Jetty, roles are defined in a config file. This config file could be set in the configuration of the jetty-plugin in the pom file.
# username: password [,rolename ...]
guest: guest,demo-guest
admin: admin,demo-admin
In this example there are two content boxes. The left one is for admin users. The right one is for guests and admins.
If you run the demo on your local machine, you may change the scope of the
RoleController
from @SessionScoped
to
@ApplicationScoped
.
In that case, the guest can read the text added by the admin.
This is a box only for admins. A text can be added in the inputfield.
The submit button is only enabled for admin users.
Notice, that the method set in the action
attribute of the
<tc:button/>
have the annotation
@RolesAllowed({"admin"})
.
This is a box for guests and admins. It displays the text which is set by an admin on the left. You also can hit the logout button to relogin.