2007-05-03 19:00:18 -04:00
<?xml version="1.0" encoding="ISO-8859-1"?>
<document > <properties > <title > Acegi Security System for Spring</title> </properties> <body > <section name= "" > <b > </b> <center > <b > What is Acegi Security?</b> </center> </section> <section name= "" > <br > </br> <p >
2006-05-29 09:26:29 -04:00
Acegi Security is a powerful, flexible security solution for enterprise software,
2006-05-29 06:57:47 -04:00
with a particular emphasis on applications that use
2007-05-03 19:00:18 -04:00
<a href= "http://www.springframework.org/" > Spring</a> . Using Acegi Security provides your
2006-05-29 06:57:47 -04:00
applications with comprehensive authentication, authorization, instance-based access control,
channel security and human user detection capabilities.
2007-05-03 19:00:18 -04:00
</p> <br > </br> </section> <section name= "" > <b > </b> <center > <b > Key Features</b> </center> </section> <section name= "" > <br > </br> <ul >
<li > <b > Stable and mature.</b> Acegi Security 1.0.0 was released in May 2006 after
2006-05-29 06:57:47 -04:00
more than two and a half years of use in large production software projects, 70,000+ downloads
and hundreds of community contributions.
2007-05-03 19:00:18 -04:00
In terms of release numbering, we also use the <a href= "http://apr.apache.org/versioning.html" > Apache APR Project
Versioning Guidelines</a> so that you can easily identify release
compatibility.<br > </br> <br > </br>
</li> <li > <b > Well documented:</b> All APIs are fully documented using
2006-05-29 06:57:47 -04:00
<a href= "http://acegisecurity.sourceforge.net/multiproject/acegi-security/apidocs/index.html" > JavaDoc</a> ,
with almost 100 pages of
<a href= "reference.html" > Reference Guide</a> documentation providing an easy-to-follow
introduction. Even more documentation is provided on this web site, as
2007-05-03 19:00:18 -04:00
shown in the left hand navigation sidebar.<br > </br> <br > </br>
</li> <li > <b > Fast results:</b> View our <a href= "suggested.html" > suggested steps</a>
for the fastest way to develop complex, security-compliant applications.<br > </br> <br > </br>
</li> <li > <b > Enterprise-wide single sign on:</b> Using JA-SIG's open
source <a href= "http://www.ja-sig.org/products/cas/" > Central Authentication
Service</a> (CAS), the Acegi Security can participate
2005-10-23 01:12:23 -04:00
in an enterprise-wide single sign on environment. You no longer need
every web application to have its own authentication database. Nor are
you restricted to single sign on across a single web container. Advanced
single sign on features like proxy support and forced refresh of logins
2007-05-03 19:00:18 -04:00
are supported by both CAS and Acegi Security.<br > </br> <br > </br>
</li> <li > <b > Reuses your Spring expertise:</b> We use Spring application
2005-10-23 01:12:23 -04:00
contexts for all configuration, which should help Spring developers get
2007-05-03 19:00:18 -04:00
up-to-speed nice and quickly.<br > </br> <br > </br>
</li> <li > <b > Domain object instance security:</b> In many applications it's
2005-10-23 01:12:23 -04:00
desirable to define Access Control Lists (ACLs) for individual domain
object instances. We provide a comprehensive ACL package with features
including integer bit masking, permission inheritence (including
blocking), a JDBC-backed ACL repository, caching and a pluggable,
2007-05-03 19:00:18 -04:00
interface-driven design.<br > </br> <br > </br>
</li> <li > <b > Non-intrusive setup:</b> The entire security system can operate
2005-10-23 01:12:23 -04:00
within a single web application using the provided filters. There is no
need to make special changes or deploy libraries to your Servlet or EJB
2007-05-03 19:00:18 -04:00
container.<br > </br> <br > </br>
</li> <li > <b > Full (but optional) container integration:</b> The credential
2005-10-23 01:12:23 -04:00
collection and authorization capabilities of your Servlet or EJB
container can be fully utilised via included "container adapters". We
currently support Catalina (Tomcat), Jetty, JBoss and Resin, with
2007-05-03 19:00:18 -04:00
additional containers easily added.<br > </br> <br > </br>
</li> <li > <b > Keeps your objects free of security code:</b> Many applications
2005-10-23 01:12:23 -04:00
need to secure data at the bean level based on any combination of
parameters (user, time of day, authorities held, method being invoked,
parameter on method being invoked....). This package gives you this
flexibility without adding security code to your Spring business
2007-05-03 19:00:18 -04:00
objects.<br > </br> <br > </br>
</li> <li > <b > After invocation security:</b> Acegi Security can not only protect
2005-10-23 01:12:23 -04:00
methods from being invoked in the first place, but it can also
2006-05-29 06:57:47 -04:00
deal with the objects returned from the methods. Included implementations
2005-10-23 01:12:23 -04:00
of after invocation security can throw an exception or mutate the returned
2007-05-03 19:00:18 -04:00
object based on ACLs.<br > </br> <br > </br>
</li> <li > <b > Secures your HTTP requests as well:</b> In addition to securing
2005-10-23 01:12:23 -04:00
your beans, the project also secures your HTTP requests. No longer is it
necessary to rely on web.xml security constraints. Best of all, your
HTTP requests can now be secured by your choice of regular expressions
or Apache Ant paths, along with pluggable authentication, authorization
2007-05-03 19:00:18 -04:00
and run-as replacement managers.<br > </br> <br > </br>
</li> <li > <b > Channel security:</b> Acegi Security can
2005-10-23 01:12:23 -04:00
automatically redirect requests across an appropriate transport channel.
Whilst flexible enough to support any of your "channel" requirements (eg
the remote user is a human, not a robot), a common channel security
feature is to ensure your secure pages will only be available over
HTTPS, and your public pages only over HTTP. Acegi Security also
2006-05-29 06:57:47 -04:00
supports unusual port combinations (including if accessed via an
intermediate server like Apache) and pluggable transport decision
2007-05-03 19:00:18 -04:00
managers.<br > </br> <br > </br>
</li> <li > <b > Supports HTTP BASIC authentication:</b> Perfect for remoting
2005-10-23 01:12:23 -04:00
protocols or those web applications that prefer a simple browser pop-up
(rather than a form login), Acegi Security can directly process HTTP
2007-05-03 19:00:18 -04:00
BASIC authentication requests as per RFC 1945.<br > </br> <br > </br>
</li> <li > <b > Supports HTTP Digest authentication:</b> For greater security than
2005-10-23 01:12:23 -04:00
offered by BASIC authentcation, Acegi Security also supports Digest Authentication
(which never sends the user's password across the wire). Digest Authentication
is widely supported by modern browsers. Acegi Security's implementation complies
2007-05-03 19:00:18 -04:00
with both RFC 2617 and RFC 2069.<br > </br> <br > </br>
</li> <li > <b > Computer Associates Siteminder support:</b> Authentication can be
2006-05-29 06:57:47 -04:00
delegated through to CA's Siteminder solution, which is common in large
2007-05-03 19:00:18 -04:00
corporate environments.<br > </br> <br > </br>
</li> <li > <b > X509 (Certificate) support:</b> Acegi Security can easily read
client-side X509 certificates for authenticating users.<br > </br> <br > </br>
</li> <li > <b > LDAP Support:</b> Do you have an LDAP directory? Acegi Security can
happily authenticate against it.<br > </br> <br > </br>
</li> <li > <b > Tag library support:</b> Your JSP files can use our taglib
2005-10-23 01:12:23 -04:00
to ensure that protected content like links and messages are only
displayed to users holding the appropriate granted authorities. The taglib
2006-05-29 06:57:47 -04:00
also fully integrates with Acegi Security's ACL services, and
2007-05-03 19:00:18 -04:00
obtaining extra information about the logged-in principal.<br > </br> <br > </br>
</li> <li > <b > Configuration via IoC XML, Commons Attributes, or JDK 5 Annotations:</b> You
2005-10-23 01:12:23 -04:00
select the method used to configure your security environment. The
2006-05-29 06:57:47 -04:00
project supports configuration via Spring application contexts, as well
as Jakarta Commons Attributes and Java 5's annotations feature. Some users
(such as those building content management systems) pull configuration data
from a database, which exemplifies Acegi Security's flexible configuration
2007-05-03 19:00:18 -04:00
metadata system.<br > </br> <br > </br>
</li> <li > <b > Various authentication backends:</b> We include the ability to
2006-05-29 06:57:47 -04:00
retrieve your user and granted authority definitions from an XML
file, JDBC datasource or Properties file. Alternatively, you can implement the
single-method UserDetailsService interface and obtain authentication details from
2007-05-03 19:00:18 -04:00
anywhere you like.<br > </br> <br > </br>
</li> <li > <b > Event support:</b> Building upon Spring's
<code > ApplicationEvent</code> services, you can write your own listeners
2005-10-23 01:12:23 -04:00
for authentication-related events, along with authorisation-related events.
This enables you to implement account lockout and audit log systems, with
2007-05-03 19:00:18 -04:00
complete decoupling from Acegi Security code.<br > </br> <br > </br>
</li> <li > <b > Easy integration with existing databases:</b> Our implementations
2005-10-23 01:12:23 -04:00
have been designed to make it very easy to use your existing
authentication schema and data (without modification). Of course,
2007-05-03 19:00:18 -04:00
you can also provide your own Data Access Object if you wish.<br > </br> <br > </br>
</li> <li > <b > Caching:</b> Acegi Security integrates with Spring's <a href= "http://ehcache.sourceforge.net/" > EHCACHE</a> factory.
2005-10-23 01:12:23 -04:00
This flexibility means your database (or other authentication
repository) is not repeatedly queried for authentication
2007-05-03 19:00:18 -04:00
information.<br > </br> <br > </br>
</li> <li > <b > Pluggable architecture:</b> Every critical aspect of the package
2005-10-23 01:12:23 -04:00
has been modelled using high cohesion, loose coupling, interface-driven
design principles. You can easily replace, customise or extend parts of
2007-05-03 19:00:18 -04:00
the package.<br > </br> <br > </br>
</li> <li > <b > Startup-time validation:</b> Every critical object dependency and
2005-10-23 01:12:23 -04:00
configuration parameter is validated at application context startup
time. Security configuration errors are therefore detected early and
2007-05-03 19:00:18 -04:00
corrected quickly.<br > </br> <br > </br>
</li> <li > <b > Remoting support:</b> Does your project use a rich client? Not a
2005-10-23 01:12:23 -04:00
problem. Acegi Security integrates with standard Spring remoting
protocols, because it automatically processes the HTTP BASIC
authentication headers they present. Add our BASIC authentication filter
2006-05-29 06:57:47 -04:00
to your web.xml and you're done. You can also easily use RMI or Digest
2007-05-03 19:00:18 -04:00
authentication for your rich clients with a simple configuration statement.<br > </br> <br > </br>
</li> <li > <b > Advanced password encoding:</b> Of course, passwords in your
2005-10-23 01:12:23 -04:00
authentication repository need not be in plain text. We support both SHA
and MD5 encoding, and also pluggable "salt" providers to maximise
2006-05-29 06:57:47 -04:00
password security. Acegi Security doesn't even need to see the password
if your backend can use a bind-based strategy for authentication (such as
2007-05-03 19:00:18 -04:00
an LDAP directory, or a database login).<br > </br> <br > </br>
</li> <li > <b > Run-as replacement:</b> The system fully supports
2006-05-29 06:57:47 -04:00
temporarily replacing the authenticated principal for the duration of the web
2005-10-23 01:12:23 -04:00
request or bean invocation. This enables you to build public-facing
object tiers with different security configurations than your backend
2007-05-03 19:00:18 -04:00
objects.<br > </br> <br > </br>
</li> <li > <b > Transparent security propagation:</b> Acegi Security can automatically
2005-10-23 01:12:23 -04:00
transfer its core authentication information from one machine to another,
2007-05-03 19:00:18 -04:00
using a variety of protocols including RMI and Spring's HttpInvoker.<br > </br> <br > </br>
</li> <li > <b > Compatible with HttpServletRequest's security methods:</b> Even though
2005-10-23 01:12:23 -04:00
Acegi Security can deliver authentication using a range of pluggable mechanisms
(most of which require no web container configuration), we allow you to access
2006-05-29 06:57:47 -04:00
the resulting Authentication object via the getRemoteUser() and other
2007-05-03 19:00:18 -04:00
security methods on HttpServletRequest.<br > </br> <br > </br>
</li> <li > <b > Unit tests:</b> A must-have of any quality security project, unit
2005-10-23 01:12:23 -04:00
tests are included. Our unit test coverage is very high, as shown in the
2007-05-03 19:00:18 -04:00
<a href= "multiproject/acegi-security/clover/index.html" > coverage report</a> .<br > </br> <br > </br>
</li> <li > <b > Built by Maven:</b> This assists you in effectively reusing the Acegi
Security artifacts in your own Maven-based projects.<br > </br> <br > </br>
</li> <li > <b > Supports your own unit tests:</b> We provide a number of classes
2005-10-23 01:12:23 -04:00
that assist with your own unit testing of secured business objects. For
example, you can change the authentication identity and its associated
2007-05-03 19:00:18 -04:00
granted authorities directly within your test methods.<br > </br> <br > </br>
</li> <li > <b > Peer reviewed:</b> Whilst nothing is ever completely secure,
2005-10-23 01:12:23 -04:00
using an open source security package leverages the continuous design
2007-05-03 19:00:18 -04:00
and code quality improvements that emerge from peer review.<br > </br> <br > </br>
</li> <li > <b > Community:</b> Well-known for its supportive community, Acegi Security
2006-05-29 06:57:47 -04:00
has an active group of developers and users. Visit our project resources (below)
2007-05-03 19:00:18 -04:00
to access these services.<br > </br> <br > </br>
</li> <li > <b > Apache license.</b> You can confidently use Acegi Security in your project.<br > </br> <br > </br> </li> </ul> <br > </br> <b >
<hr > </hr>
2005-10-23 01:12:23 -04:00
2007-05-03 19:00:18 -04:00
</b> <center > <b > Project Resources</b> </center> </section> <section name= "" > <br > </br> <center >
<a href= "http://forum.springframework.org/" > <b > Support Forums</b> </a> <br > </br> <br > </br>
<a href= "mail-lists.html" > <b > Developer Mailing List</b> </a> <br > </br> <br > </br>
<a href= "downloads.html" > <b > Downloads</b> </a>
</center> </section> </body> </document>
