Blazeds and Spring security, can remember-me be used in this combination?

Question

I'm using the latest release of Spring Blzeds integration which has some features making it easier to secure invocations on destination objects. However the basic setup I use which uses the ChannelSet login approach form the flex side looses the authentication information (sessions) on each page refresh. Here's the configuration I'm using:

<http entry-point-ref="preAuthenticatedEntryPoint" >

    </http>


    <beans:bean id="preAuthenticatedEntryPoint" class="org.springframework.security.ui.preauth.PreAuthenticatedProcessingFilterEntryPoint" />


    <beans:bean id="userAccountManager" class="com.comp.service.managers.jpa.UserAccountJpaManager" />
    <beans:bean id="userService" class="com.comp.auth.JpaUserDetailsService" />
    <beans:bean id="defaultPasswordEncoder" class="com.comp.auth.DefaultPasswordEncoder" />

    <authentication-provider user-service-ref="userService">
        <password-encoder ref="defaultPasswordEncoder"/>
    </authentication-provider>

<flex:message-broker>
    <flex:secured />
</flex:message-broker>

<bean id="testService" class="com.comp.service.TestService">
    <flex:remoting-destination channels="comp-amf" />
    <security:intercept-methods>
        <security:protect method="say*" access="ROLE_USER" />
    </security:intercept-methods>
</bean>

Is there another way to configure/implement this so I could get persistent sessions (remember me). Is it possible to do the logins from flex over standard HTTP POST (like forms) and still get the same level of granularity for protecting remote object calls?

Answer 1

Try adding this to your config:

<http entry-point-ref="preAuthenticatedEntryPoint" create-session="always">