Well, in order to use IdentityManager.createUser you have to be logged in and you have to posses Permission with target seam.user and action create. ...CATCH XXII :)...

So if you need to populate your database with first user, you can use ordinary SQL INSERT statement in import-dev.sql (which is located in resources directory), provided you have generated your application with seam-gen and you are using dev profile. If not you can run INSERT statement against your database manually.

However in order to do this you have to find out how to calculate passwordHash. I suggest you create small TestNG test to help you, something like this...

public class PasswordHashTest extends SeamTest {
    @Test
    public void testPasswordHash() throws Exception {
        new ComponentTest() {
            @Override
            protected void testComponents() throws Exception {
                PasswordHash passwordHash = PasswordHash.instance();

                final byte[] salt = passwordHash.generateRandomSalt();
                final int iterations = 1000;
                final String password = "password";
                final String hash = passwordHash.createPasswordKey(password.toCharArray(), salt, iterations);

                assert hash != null : "Hash not calculated!";

                System.out.println("Password: " + password);
                System.out.println("Salt: " + BinTools.bin2hex(salt));
                System.out.println("Iterations: " + iterations);
                System.out.println("Hash: " + hash);
                
            }
        }.run();
    }
}

This should print out password, salt, iterations and calculated hash, this works with default hashing algorithm and seam version 2.2.GA, it might not work with different version and you might need to modify it to work with different hashing algorithm...

But If you use seam 2.2.GA and you change

 @Column(name = "PASSWORD", nullable = false, length = 50)
 @NotNull
 @UserPassword(hash = "MD5")
 @Length(max = 50)
 public String getPassword() {
  return this.password;
 }

to

 @Column(name = "PASSWORD", nullable = false, length = 50)
 @NotNull
 @UserPassword()
 @Length(max = 50)
 public String getPassword() {
  return this.password;
 }

it might just work...because now you have all fields you needed for your SQL statement.

PS: Still I am seam newbie so there might be much easier way how to accomplish this.

PS2: There is no guarantee what so ever, that any code I wrote is useful for any particular purpose. :)

You can use security.drl if you like, for example this is how you grant all permissions to admin user. (not role, but particular user)

rule AdminUserHasAllPermissions
   no-loop
   activation-group "permissions"   
when
   $perm: PermissionCheck(granted == false)
   Principal(name == "admin")
then
   $perm.grant();
end

But if you have set up JpaPermissionStore correctly in components.xml, you should not need to modify security.drl at all.

Permissions can be granted directly to User or to Role. You can have 2 Permission tables, one for User and one for Role, or one Permission table for both with discriminator column.

In your case you need to post source code for your Permission table and your components.xml, and probably db scripts, otherwise it is hard to tell.

It must be pretty difficult to start with seam if you do not have any EJB/Hibernate skills...I suggest you read Seam in Action or Seam reference first...trial and error will not work in this case...

RE: source code

I see several problems:

1. you have to define permission class in your components.xml:

add something like this:

<security:jpa-permission-store user-permission-class="com.acme.model.AccountPermission"/>

details here:

15.6.10.3. JpaPermissionStore

2. I don't think that your admin role should be conditional true, change it to false

RE: questions

1. as I said you are storing permissions for two different entities, user and role in one table, in your case all permissions apply to admin role, if you changed discriminator to user, your permissions would apply directly to admin user, if you stored permissions in two different tables let's say UserPermissions and RolePermissions, then there would be no discriminator column...

2. yes it can be done, permission target will simply contain entity name and id separated by colon, for example provided you have an entity called Project, your permission target will contain Project:5.

details here:

15.6.10.3.5. Identifier Policy

3. Simply said:

When you set up your JpaPermissionResolver correctly you will have 2 resolvers in chain, if drools is first and jpa second, then if you grand permission in drools resolver, jpa resolver will be skipped...

If drools resolver does not grand permission, then jpa resolver will be queried and might grand permission...

If neither of them grands permission, then you will receive AuthorizationException.

So these resolvers are complementary...you might even write your own resolver if needed.

Have a look here:

15.6.8. The Permission Authorization Model

Hi I am workng on the same issue of Password Hashing.Can you please share some code with me.

Thanks!!