Since you're so persistent and no one answered i gave it a shot. Yes you can do it, but it's not that simple 
Here's what i did
in your-portlet/docroot/WEB-INF/liferay-plugin-package.properties add the following lines
Then create a web.xml file in your-portlet/docroot/WEB-INF/web.xml with the following contents :
add a file called your-portlet/docroot/WEB-INF/remoting-servlet.xml with the following content
Create the security interceptor you are wiring
Here's the client code i used to test :
The ConfigurationFactoryUtil.setConfigurationFactory crap unfortunately is needed because Liferay foolishly loads properties when a service builder entity is constructed
Here's what i did
in your-portlet/docroot/WEB-INF/liferay-plugin-package.properties add the following lines
portal-dependency-jars=\
spring-web-servlet.jar,\
spring-web.jar,\
spring-core.jar,\
spring-context.jar,\
spring-context-support.jar,\
spring-beans.jar,\
spring-asm.jar,\
spring-aop.jar,\
spring-expression.jar,\
asm.jar,\
aopalliance.jar,\Then create a web.xml file in your-portlet/docroot/WEB-INF/web.xml with the following contents :
<!--?xml version="1.0" encoding="UTF-8"?-->
<web-app>
<servlet>
<servlet-name>Spring Servlet</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/remoting-servlet.xml</param-value>
</init-param>
<load-on-startup>0</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>Spring Servlet</servlet-name>
<url-pattern>/spring/*</url-pattern>
</servlet-mapping>
</web-app>add a file called your-portlet/docroot/WEB-INF/remoting-servlet.xml with the following content
<!--?xml version="1.0" encoding="UTF-8"?-->
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemalocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd">
<bean class="org.springframework.web.servlet.handler.BeanNameUrlHandlerMapping">
<property name="interceptors">
<list>
<bean class="org.searchworkings.news.SecurityInterceptor" />
</list>
</property>
</bean>
<bean name="/org_searchworkings_news_service_spring_NewsService-http" class="org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter">
<property name="service">
<bean class="org.searchworkings.news.service.NewsServiceUtil" factory-method="getService" />
</property>
<property name="serviceInterface" value="org.searchworkings.news.service.NewsService" />
</bean>
</beans>Create the security interceptor you are wiring
package org.searchworkings.news;
import com.liferay.portal.model.Company;
import com.liferay.portal.model.User;
import com.liferay.portal.security.auth.PrincipalThreadLocal;
import com.liferay.portal.security.permission.PermissionChecker;
import com.liferay.portal.security.permission.PermissionCheckerFactoryUtil;
import com.liferay.portal.security.permission.PermissionThreadLocal;
import com.liferay.portal.service.CompanyLocalServiceUtil;
import com.liferay.portal.service.UserLocalServiceUtil;
import com.liferay.portal.util.PortalUtil;
import org.springframework.web.servlet.ModelAndView;
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.List;
/**
* @author Jelmer Kuperus
*/
public class SecurityInterceptor extends HandlerInterceptorAdapter {
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
throws Exception {
List<company> companies = CompanyLocalServiceUtil.getCompanies();
long idOfFirstCompany = companies.iterator().next().getCompanyId();
long userId = PortalUtil.getBasicAuthUserId(request, idOfFirstCompany);
if (userId == 0) {
response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
return false;
}
User user = UserLocalServiceUtil.getUser(userId);
PrincipalThreadLocal.setName(userId);
PermissionChecker permissionChecker = PermissionCheckerFactoryUtil.create(user, true);
PermissionThreadLocal.setPermissionChecker(permissionChecker);
return true;
}
@Override
public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler,
ModelAndView modelAndView) throws Exception {
PrincipalThreadLocal.setName(null);
PermissionThreadLocal.setPermissionChecker(null);
}
}
</company>Here's the client code i used to test :
import com.liferay.portal.kernel.configuration.Configuration;
import com.liferay.portal.kernel.configuration.ConfigurationFactory;
import com.liferay.portal.kernel.configuration.ConfigurationFactoryUtil;
import com.liferay.portal.kernel.configuration.Filter;
import org.apache.commons.codec.binary.Base64;
import org.searchworkings.news.service.NewsService;
import org.springframework.remoting.httpinvoker.HttpInvokerProxyFactoryBean;
import org.springframework.remoting.httpinvoker.SimpleHttpInvokerRequestExecutor;
import java.io.IOException;
import java.net.HttpURLConnection;
import java.util.Properties;
public class Main {
public static void main(String[] args) throws Exception {
ConfigurationFactoryUtil.setConfigurationFactory(new ConfigurationFactory() {
@Override
public Configuration getConfiguration(ClassLoader classLoader, String name) {
return new Configuration() {
@Override
public void addProperties(Properties properties) {
}
@Override
public boolean contains(String key) {
return false;
}
@Override
public String get(String key) {
return null;
}
@Override
public String get(String key, Filter filter) {
return null;
}
@Override
public String[] getArray(String key) {
return new String[0];
}
@Override
public String[] getArray(String key, Filter filter) {
return new String[0];
}
@Override
public Properties getProperties() {
return new Properties();
}
@Override
public Properties getProperties(String prefix, boolean removePrefix) {
return new Properties();
}
@Override
public void removeProperties(Properties properties) {
}
@Override
public void set(String key, String value) {
}
};
}
});
HttpInvokerProxyFactoryBean factory = new HttpInvokerProxyFactoryBean();
factory.setServiceUrl("http://localhost:8080/searchworkings-news-portlet/spring/org_searchworkings_news_service_spring_NewsService-http");
factory.setServiceInterface(NewsService.class);
factory.setHttpInvokerRequestExecutor(new SimpleHttpInvokerRequestExecutor() {
@Override
protected void prepareConnection(HttpURLConnection con, int contentLength) throws IOException {
super.prepareConnection(con, contentLength);
con.setRequestProperty("Authorization", "Basic " + new String(Base64.encodeBase64("username:password".getBytes())));
}
});
factory.afterPropertiesSet();
NewsService newsService = (NewsService) factory.getObject();
System.out.println(newsService.getNews(32830L));
}
}The ConfigurationFactoryUtil.setConfigurationFactory crap unfortunately is needed because Liferay foolishly loads properties when a service builder entity is constructed
