From 3eb9870162b3ea7f24b974b33b0a5be32e9940c7 Mon Sep 17 00:00:00 2001 From: Vishal Puri Date: Thu, 17 May 2007 12:30:36 +0000 Subject: [PATCH] SEC-271: Added more security elements --- ...ticationMechanismBeanDefinitionParser.java | 4 +- .../LogoutFilterBeanDefinitionParser.java | 7 +- .../config/SecurityNamespaceHandler.java | 2 + .../config/spring-security-2.0.xsd | 125 ++++++++++--- ...LogoutFilterBeanDefinitionParserTests.java | 2 +- .../RememberMeBeanDefinitionParserTest.java | 2 +- .../config/authentication-dao-defaults.xml | 10 +- .../config/logout-filter-with-handlers.xml | 2 +- .../config/security-namespaces.xml | 172 +++++++++++------- 9 files changed, 216 insertions(+), 110 deletions(-) diff --git a/core/src/main/java/org/acegisecurity/config/AuthenticationMechanismBeanDefinitionParser.java b/core/src/main/java/org/acegisecurity/config/AuthenticationMechanismBeanDefinitionParser.java index 210c2d2f34..12821ba25d 100644 --- a/core/src/main/java/org/acegisecurity/config/AuthenticationMechanismBeanDefinitionParser.java +++ b/core/src/main/java/org/acegisecurity/config/AuthenticationMechanismBeanDefinitionParser.java @@ -44,7 +44,7 @@ public class AuthenticationMechanismBeanDefinitionParser extends AbstractBeanDef if (node.getNodeType() == Node.ELEMENT_NODE) { Element childElement = (Element) node; - providerExists = true; + this.providerExists = true; if (AUTHENTICATION_JDBC.equals(node.getLocalName())) { String attribute = childElement.getAttribute(REF); @@ -60,7 +60,7 @@ public class AuthenticationMechanismBeanDefinitionParser extends AbstractBeanDef } - if (!providerExists) { + if (!this.providerExists) { RootBeanDefinition rootBeanDefinition = new RootBeanDefinition(AuthenticationProviderOrderResolver.class); BeanDefinitionHolder beanDefinitionHolder = new BeanDefinitionHolder(rootBeanDefinition, "providerOrderResolver"); diff --git a/core/src/main/java/org/acegisecurity/config/LogoutFilterBeanDefinitionParser.java b/core/src/main/java/org/acegisecurity/config/LogoutFilterBeanDefinitionParser.java index 246aa513b2..9c81a1bd82 100644 --- a/core/src/main/java/org/acegisecurity/config/LogoutFilterBeanDefinitionParser.java +++ b/core/src/main/java/org/acegisecurity/config/LogoutFilterBeanDefinitionParser.java @@ -4,9 +4,6 @@ package org.acegisecurity.config; import org.acegisecurity.ui.logout.LogoutFilter; -import org.apache.commons.logging.Log; -import org.apache.commons.logging.LogFactory; -import org.springframework.beans.factory.config.BeanDefinitionHolder; import org.springframework.beans.factory.support.AbstractBeanDefinition; import org.springframework.beans.factory.support.RootBeanDefinition; import org.springframework.beans.factory.xml.AbstractBeanDefinitionParser; @@ -34,9 +31,7 @@ public class LogoutFilterBeanDefinitionParser extends AbstractBeanDefinitionPars // add the properties RootBeanDefinition definition = new RootBeanDefinition(LogoutFilter.class); setConstructorArgumentIfAvailable(0, element, REDIRECT_AFTER_LOGOUT_URL, "logoutSuccessUrl", definition); - // setPropertyIfAvailable(element, - // element.getAttribute(REDIRECT_AFTER_LOGOUT_URL), "logoutSuccessUrl", - // definition); + setPropertyIfAvailable(element, LOGOUT_URL, "filterProcessesUrl", definition); // register BFPP to check if LogoutFilter does not have setHandlers diff --git a/core/src/main/java/org/acegisecurity/config/SecurityNamespaceHandler.java b/core/src/main/java/org/acegisecurity/config/SecurityNamespaceHandler.java index 60868dba9e..31113b0a31 100644 --- a/core/src/main/java/org/acegisecurity/config/SecurityNamespaceHandler.java +++ b/core/src/main/java/org/acegisecurity/config/SecurityNamespaceHandler.java @@ -26,6 +26,8 @@ public class SecurityNamespaceHandler extends NamespaceHandlerSupport { registerBeanDefinitionParser("authentication-remember-me-services", new RememberMeServicesBeanDefinitionParser()); registerBeanDefinitionParser("authentication-remember-me-filter", new RememberMeFilterBeanDefinitionParser()); registerBeanDefinitionParser("logout-support", new LogoutFilterBeanDefinitionParser()); + registerBeanDefinitionParser("exception-translation", new ExceptionTranslationFilterBeanDefinitionParser()); + registerBeanDefinitionParser("authentication-form", new AuthenticationProcessingFilterBeanDefinitionParser()); } } diff --git a/core/src/main/resources/org/acegisecurity/config/spring-security-2.0.xsd b/core/src/main/resources/org/acegisecurity/config/spring-security-2.0.xsd index 23f7bbf986..9971e85299 100644 --- a/core/src/main/resources/org/acegisecurity/config/spring-security-2.0.xsd +++ b/core/src/main/resources/org/acegisecurity/config/spring-security-2.0.xsd @@ -124,6 +124,103 @@ type="xsd:string" use="optional" /> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -158,30 +255,10 @@ - - - - - - - - + + + @@ -339,6 +416,8 @@ + + diff --git a/core/src/test/java/org/acegisecurity/config/LogoutFilterBeanDefinitionParserTests.java b/core/src/test/java/org/acegisecurity/config/LogoutFilterBeanDefinitionParserTests.java index 3b6cd61b40..5161fdd470 100644 --- a/core/src/test/java/org/acegisecurity/config/LogoutFilterBeanDefinitionParserTests.java +++ b/core/src/test/java/org/acegisecurity/config/LogoutFilterBeanDefinitionParserTests.java @@ -14,7 +14,7 @@ import junit.framework.TestCase; */ public class LogoutFilterBeanDefinitionParserTests extends TestCase { - public void testXX(){ + public void testLogoutFilter(){ ApplicationContext context = new ClassPathXmlApplicationContext("org/acegisecurity/config/logout-filter-with-handlers.xml"); } diff --git a/core/src/test/java/org/acegisecurity/config/RememberMeBeanDefinitionParserTest.java b/core/src/test/java/org/acegisecurity/config/RememberMeBeanDefinitionParserTest.java index 127128c330..d79557b098 100644 --- a/core/src/test/java/org/acegisecurity/config/RememberMeBeanDefinitionParserTest.java +++ b/core/src/test/java/org/acegisecurity/config/RememberMeBeanDefinitionParserTest.java @@ -7,7 +7,7 @@ import org.springframework.context.support.ClassPathXmlApplicationContext; public class RememberMeBeanDefinitionParserTest extends TestCase { - public void testRememberMeDefaults() { + public void testParserDefaults() { ApplicationContext context = new ClassPathXmlApplicationContext("org/acegisecurity/config/principal-repository-properties.xml"); diff --git a/core/src/test/resources/org/acegisecurity/config/authentication-dao-defaults.xml b/core/src/test/resources/org/acegisecurity/config/authentication-dao-defaults.xml index cf53167f7d..6de9406972 100644 --- a/core/src/test/resources/org/acegisecurity/config/authentication-dao-defaults.xml +++ b/core/src/test/resources/org/acegisecurity/config/authentication-dao-defaults.xml @@ -15,14 +15,8 @@ http://www.springframework.org/schema/security http://www.springframework.org/sc - - + + diff --git a/core/src/test/resources/org/acegisecurity/config/logout-filter-with-handlers.xml b/core/src/test/resources/org/acegisecurity/config/logout-filter-with-handlers.xml index 977261e59d..94208ced75 100644 --- a/core/src/test/resources/org/acegisecurity/config/logout-filter-with-handlers.xml +++ b/core/src/test/resources/org/acegisecurity/config/logout-filter-with-handlers.xml @@ -14,7 +14,7 @@ http://www.springframework.org/schema/security http://www.springframework.org/sc + redirectAfterLogoutUrl="/" logoutUrl="/logout"/> diff --git a/core/src/test/resources/org/acegisecurity/config/security-namespaces.xml b/core/src/test/resources/org/acegisecurity/config/security-namespaces.xml index 1d9bd0e57f..b6d778a655 100644 --- a/core/src/test/resources/org/acegisecurity/config/security-namespaces.xml +++ b/core/src/test/resources/org/acegisecurity/config/security-namespaces.xml @@ -12,12 +12,15 @@ - + + FilterChainProxy bean definition is dissatisfied with the auto approach. The auto approach simply creates a bean definition similar to that shown + below with the AUTODETECT_ALL_ORDERED_FILTERs. As suggested, this causes a runtime check of app ctx for all javax.servlet.Filter instances, and + for each that also implemented Ordered, these are automatically applied to the pattern shown (which is **/* in the case of autodetect=true).*--> @@ -30,118 +33,151 @@ - + superclass AbstractAccessDecisionManager requires refactoring so if no setProvider(List) given, it introspects app ctx for all AccessDecisionVoters + and uses their Ordered interface to apply them; if one doesn't implement Ordered, assume it is Integer.MAX_VALUE --> + - + - - - + AuthenticationManager interface is implemented by ProviderManager + So if you have any auto-detection, create a ProviderManager definition + If ProviderManager.setProvider(List) is never called, auto-detect all AuthenticationProviders from app ctx, using Ordered to resolve their order + Every authentication mechanism OR provider must start with security:authentication-something + Use appropriate attrs and elements depending on provider or mechanism + --> + + + + + - + - - + + - - + + - - + + - - + is used as the entry point by ExceptionTranslationFilter; for things like BasicAuthenticationfilter, they're smart enough to know they need a + BasicAuthenticationProcessingFilterEntryPoint, so they use that one; here we have an entryPointOrder to say when we make the BasicEntryPoint, + we will call setOrder(2) such that this app effectively will use somehing with a higher order as the app-wide default --> + + + beans depending on a UserDetailsService will auto-detect it at runtime OR provide a way of setUserDetailsService(UserDetailsService) if to specified explicitly. + If they fail to provide a repository, the security-autodetect will set one up for them with a few basic in-memory users and pwds --> - - - - - - + + + + + + + - + - + - - - - + + + + - + - + - + - + - - - + and ALL patterns in the url-mapping MUST be of the SAME type (ie cannot mix a regular expression and Ant Path) - give exception if tried --> + + + - - - + + + - - - - - + via the sourceBeanId property; in that case they must specify "custom"; if unspecified, it means it's described as nested elements using the + security:method-pattern element, and you will therefore create it via the MethodDefinitionSourceEditor (that is what the default source=xml means, too) + For aspectj and springAop, that means create a MethodSecurityInterceptor and AspectJSecurityInterceptor bean definition respectively (in the case of + springAop, also create a MethodDefinitionSourceAdvisor); defaults to springAop=true, aspectJ=false --> + + + + + - + - - + alternately if there are > 1 such handlers, we can nominate the one to use via accessDeniedBeanRef; provide nested elements for + other props; i do not mind if you move the access denied stuff to a sub-element --> + + \ No newline at end of file