Question

I have a session scoped managed bean with name ‘usermanager’. i want to store user information which is newly logged in , in a property of usermanager bean and access it using static metod below. I want to ask these questions ,thanks in advance and sorry for poor english.

1-A managed bean is managed if i get it throught jsf injection mechanizm.That is if i create a instance using new UserManager() this will not be a managed bean .Am i right?

2-In what conditions usermanager in code below can be null.

3-What is the most efficient way of handling user,group permissions in java .Should i use Spring ,Seam for this purpose.

4-Should i store this user info in Httpsession with setParamater(key,Object) or continue to store it in a session bean.

  public static User getUserOfCurrentSession(){
         UserManager userManager = (UserManager) ((HttpServletRequest)FacesContext.getCurrentInstance()
                .getExternalContext().getRequest()).getSession(true)
                .getAttribute("userManager");

         if(userManager!=null){
             return userManager.getUser();
         }
        FacesContext c = FacesContext.getCurrentInstance();
        HttpServletRequest r = (HttpServletRequest) c.getExternalContext()
                .getRequest();
        HttpSession s = r.getSession(false);
        if(s!=null)
          s.invalidate();
        try{
        FacesContext.getCurrentInstance().getExternalContext().redirect("login.xhtml");
        FacesContext.getCurrentInstance().responseComplete();
        return  null;
        }catch(IOException e){
            e.printStackTrace();
        }
        throw  new RuntimeException("Un authonticated  user action");
    }

Answer 1

1. Yes, you are right. You must leave JSF instantiate the bean for it to be managed
2. If there is no session attribute (or bean) called userManager. But you better get this instance through injection.
3. There is no “most efficient way”. It depends on your requirements. I have often done it manually, because it was simple enough. If it is more complex – spring security is said to be good (though I’m reserved).
4. It goes in the session either way, so prefer the bean.