diff --git a/doc/docbook/acegi.xml b/doc/docbook/acegi.xml
index a294591238..8aebd61e9e 100644
--- a/doc/docbook/acegi.xml
+++ b/doc/docbook/acegi.xml
@@ -542,13 +542,14 @@
configured with configuration attributes in three ways. The first is
via a property editor and the application context, which is shown
above. The second is via defining the configuration attributes in your
- source code using Jakarta Commons Attributes. The third is via writing
- your own ObjectDefinitionSource, although this is
- beyond the scope of this document. Irrespective of the approach used,
- the ObjectDefinitionSource is responsible for
- returning a ConfigAttributeDefinition object that
- contains all of the configuration attributes associated with a single
- secure method.
+ source code using Jakarta Commons Attributes or Java 5 Annotations.
+ The third is via writing your own
+ ObjectDefinitionSource, although this is beyond the
+ scope of this document. Irrespective of the approach used, the
+ ObjectDefinitionSource is responsible for returning
+ a ConfigAttributeDefinition object that contains
+ all of the configuration attributes associated with a single secure
+ method.
It should be noted that the
MethodSecurityInterceptor.setObjectDefinitionSource()
@@ -570,8 +571,8 @@
object. The SecurityConfig object is discussed in
the High Level Design section.
- If using the Jakarta Commons Attributes approach, your bean
- context will be configured differently:
+ If you are using the Jakarta Commons Attributes approach, your
+ bean context will be configured differently:
<bean id="attributes" class="org.springframework.metadata.commons.CommonsAttributes"/>
<bean id="objectDefinitionSource" class="net.sf.acegisecurity.intercept.method.MethodDefinitionAttributes">
@@ -617,6 +618,52 @@
public float getBalance(int id);
}
+ If you are using the Spring Security Java 5 Annotations
+ approach, your bean context will be configured as follows:
+
+ <bean id="attributes" class="net.sf.acegisecurity.annotation.SecurityAnnotationAttributes"/>
+<bean id="objectDefinitionSource" class="net.sf.acegisecurity.intercept.method.MethodDefinitionAttributes">
+ <property name="attributes"><ref local="attributes"/></property>
+</bean>
+
+<bean id="bankManagerSecurity" class="net.sf.acegisecurity.intercept.method.MethodSecurityInterceptor">
+ <property name="validateConfigAttributes"><value>false</value></property>
+ <property name="authenticationManager"><ref bean="authenticationManager"/></property>
+ <property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property>
+ <property name="runAsManager"><ref bean="runAsManager"/></property>
+ <property name="objectDefinitionSource"><ref bean="objectDefinitionSource"/></property>
+</bean>
+
+ In addition, your source code will contain the Acegi Java 5
+ Security Annotations that represent the
+ ConfigAttribute. The following example uses the
+ @Secured annotations to represent the configuration
+ attributes, and results in the same security configuration as provided
+ by the property editor approach:
+
+ import net.sf.acegisecurity.annotation.Secured;
+
+public interface BankManager {
+
+ /**
+ * Delete something
+ */
+ @Secured({"ROLE_SUPERVISOR","RUN_AS_SERVER" })
+ public void deleteSomething(int id);
+
+ /**
+ * Delete another
+ */
+ @Secured({"ROLE_SUPERVISOR","RUN_AS_SERVER" })
+ public void deleteAnother(int id);
+
+ /**
+ * Get balance
+ */
+ @Secured({"ROLE_TELLER","ROLE_SUPERVISOR","BANKSECURITY_CUSTOMER","RUN_AS_SERVER" })
+ public float getBalance(int id);
+}
+
You might have noticed the
validateConfigAttributes property in the above
MethodSecurityInterceptor examples. When set to
@@ -2813,9 +2860,10 @@ key: A private key to prevent modification of the remember-me token
</bean>Don't forget to add your
RememberMeServices implementation to your
AuthenticationProcessingFilter.setRememberMeServices()
- property, include the RememberMeAuthenticationProvider in
- your AuthenticationManager.setProviders() list, and
- add a call to RememberMeProcessingFilter into your
+ property, include the
+ RememberMeAuthenticationProvider in your
+ AuthenticationManager.setProviders() list, and add
+ a call to RememberMeProcessingFilter into your
FilterChainProxy (typically immediately after your
AuthenticationProcessingFilter).