mirror of
https://github.com/spring-projects/spring-security.git
synced 2025-07-16 07:13:30 +00:00
SEC-639: Updated to filter-chain-map syntax. Also removed use of property editor configuration for FilterSecurityInterceptor examples
This commit is contained in:
Luke Taylor
parent
029f8a2409
commit
7395e2b900
@ -67,23 +67,21 @@
|
||||
example:</para>
|
||||
|
||||
<para><programlisting>
|
||||
<bean id="filterInvocationInterceptor"
|
||||
class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
|
||||
<property name="authenticationManager"><ref bean="authenticationManager"/></property>
|
||||
<property name="accessDecisionManager"><ref local="httpRequestAccessDecisionManager"/></property>
|
||||
<property name="objectDefinitionSource">
|
||||
<value>
|
||||
CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
|
||||
PATTERN_TYPE_APACHE_ANT
|
||||
/index.jsp=ROLE_ANONYMOUS,ROLE_USER
|
||||
/hello.htm=ROLE_ANONYMOUS,ROLE_USER
|
||||
/logoff.jsp=ROLE_ANONYMOUS,ROLE_USER
|
||||
/acegilogin.jsp*=ROLE_ANONYMOUS,ROLE_USER
|
||||
/**=ROLE_USER
|
||||
</value>
|
||||
</property>
|
||||
</bean>
|
||||
|
||||
<![CDATA[
|
||||
<bean id="filterInvocationInterceptor"
|
||||
class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
|
||||
<property name="authenticationManager" ref="authenticationManager"/>
|
||||
<property name="accessDecisionManager" ref="httpRequestAccessDecisionManager"/>
|
||||
<property name="objectDefinitionSource">
|
||||
<security:filter-invocation-definition-source>
|
||||
<security:intercept-url pattern='/index.jsp' access='ROLE_ANONYMOUS,ROLE_USER'/>
|
||||
<security:intercept-url pattern='/hello.htm' access='ROLE_ANONYMOUS,ROLE_USER'/>
|
||||
<security:intercept-url pattern='/logoff.jsp' access='ROLE_ANONYMOUS,ROLE_USER'/>
|
||||
<security:intercept-url pattern='/login.jsp' access='ROLE_ANONYMOUS,ROLE_USER'/>
|
||||
<security:intercept-url pattern='/**' access='ROLE_USER'/>
|
||||
</security:filter-invocation-definition-source>" +
|
||||
</property>
|
||||
</bean>]]>
|
||||
</programlisting>Rounding out the anonymous authentication discussion
|
||||
is the <literal>AuthenticationTrustResolver</literal> interface, with
|
||||
its corresponding <literal>AuthenticationTrustResolverImpl</literal>
|
||||
|
||||
@ -1,7 +1,8 @@
|
||||
<chapter xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="authentication-common-auth-services"><info><title>Common Authentication Services</title></info>
|
||||
|
||||
<chapter xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="authentication-common-auth-services">
|
||||
<info><title>Common Authentication Services</title></info>
|
||||
|
||||
<section xml:id="mechanisms-providers-entry-points"><info><title>Mechanisms, Providers and Entry Points</title></info>
|
||||
<section xml:id="mechanisms-providers-entry-points">
|
||||
<info><title>Mechanisms, Providers and Entry Points</title></info>
|
||||
|
||||
|
||||
<para>If you're using Spring Security-provided authentication
|
||||
@ -18,17 +19,16 @@
|
||||
Spring Security application will have such an entry, and it looks like
|
||||
this:</para>
|
||||
|
||||
<para><programlisting>
|
||||
|
||||
<filter>
|
||||
<filter-name>filterChainProxy</filter-name>
|
||||
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
|
||||
</filter>
|
||||
<para><programlisting><![CDATA[
|
||||
<filter>
|
||||
<filter-name>filterChainProxy</filter-name>
|
||||
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
|
||||
</filter>
|
||||
|
||||
<filter-mapping>
|
||||
<filter-name>filterChainProxy</filter-name>
|
||||
<url-pattern>/*</url-pattern>
|
||||
</filter-mapping>
|
||||
<filter-mapping>
|
||||
<filter-name>filterChainProxy</filter-name>
|
||||
<url-pattern>/*</url-pattern>
|
||||
</filter-mapping>]]>
|
||||
</programlisting></para>
|
||||
|
||||
<para>The above declarations will cause every web request to be passed
|
||||
@ -38,30 +38,27 @@
|
||||
As explained in the filters section of this reference guide, the
|
||||
<classname>FilterChainProxy</classname> is a generally-useful class
|
||||
that enables web requests to be passed to different filters based on
|
||||
the URL patterns. Those delegated filters are managed inside the
|
||||
URL patterns. Those delegated filters are managed inside the
|
||||
application context, so they can benefit from dependency injection.
|
||||
Let's have a look at what the FilterChainProxy bean definition would
|
||||
look like inside your application context:</para>
|
||||
|
||||
<para><programlisting><bean id="filterChainProxy"
|
||||
class="org.springframework.security.util.FilterChainProxy">
|
||||
<property name="filterInvocationDefinitionSource">
|
||||
<value>
|
||||
CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
|
||||
PATTERN_TYPE_APACHE_ANT
|
||||
/**=httpSessionContextIntegrationFilter,logoutFilter,authenticationProcessingFilter,basicProcessingFilter,securityContextHolderAwareRequestFilter,rememberMeProcessingFilter,anonymousProcessingFilter,exceptionTranslationFilter,filterInvocationInterceptor,switchUserProcessingFilter
|
||||
</value>
|
||||
</property>
|
||||
</bean></programlisting></para>
|
||||
<para><programlisting><![CDATA[
|
||||
<bean id="filterChainProxy"
|
||||
class="org.springframework.security.util.FilterChainProxy">
|
||||
<security:filter-chain-map path-type="ant">
|
||||
<security:filter-chain pattern="/**" filters="httpSessionContextIntegrationFilter,logoutFilter,authenticationProcessingFilter,basicProcessingFilter,securityContextHolderAwareRequestFilter,rememberMeProcessingFilter,anonymousProcessingFilter,exceptionTranslationFilter,filterInvocationInterceptor,switchUserProcessingFilter"/>
|
||||
</security:filter-chain-map>
|
||||
</bean>]]></programlisting></para>
|
||||
|
||||
<para>Internally Spring Security will use a
|
||||
<literal>PropertyEditor</literal> to convert the string presented in
|
||||
the above XML fragment into a
|
||||
<literal>FilterInvocationDefinitionSource</literal> object. What's
|
||||
important to note at this stage is that a series of filters will be
|
||||
<para>The <literal>filter-chain-map</literal> syntax from the security namespace
|
||||
allows you to define the mapping from URLs to filter chains, using a sequence of
|
||||
<literal>filter-chain</literal> child elements. Each of these defines a set of URLs using
|
||||
the <literal>pattern</literal> attribute and a chain of filters using the <literal>filters</literal>
|
||||
attribute.What's important to note at this stage is that a series of filters will be
|
||||
run - in the order specified by the declaration - and each of those
|
||||
filters are actually the <literal><bean id></literal> of another
|
||||
bean inside the application context. So, in our case some extra beans
|
||||
filters are actually the <literal>id</literal> of another
|
||||
bean in the application context. So, in our case some extra beans
|
||||
will also appear in the application context, and they'll be named
|
||||
<literal>httpSessionContextIntegrationFilter</literal>,
|
||||
<literal>logoutFilter</literal> and so on. The order that the filters
|
||||
|
||||
@ -347,29 +347,29 @@ if (this.securityInterceptor == null)
|
||||
beans:</para>
|
||||
|
||||
<programlisting>
|
||||
<bean id="exceptionTranslationFilter"
|
||||
class="org.springframework.security.ui.ExceptionTranslationFilter">
|
||||
<property name="authenticationEntryPoint"><ref local="authenticationEntryPoint"/></property>
|
||||
</bean>
|
||||
<![CDATA[
|
||||
<bean id="exceptionTranslationFilter"
|
||||
class="org.springframework.security.ui.ExceptionTranslationFilter">
|
||||
<property name="authenticationEntryPoint" ref="authenticationEntryPoint"/>
|
||||
</bean>
|
||||
|
||||
<bean id="authenticationEntryPoint"
|
||||
class="org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint">
|
||||
<property name="loginFormUrl"><value>/acegilogin.jsp</value></property>
|
||||
<property name="forceHttps"><value>false</value></property>
|
||||
</bean>
|
||||
<bean id="authenticationEntryPoint"
|
||||
class="org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint">
|
||||
<property name="loginFormUrl" value="/acegilogin.jsp"/>
|
||||
<property name="forceHttps" value="false"/>
|
||||
</bean>
|
||||
|
||||
<bean id="filterSecurityInterceptor"
|
||||
class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
|
||||
<property name="authenticationManager"><ref bean="authenticationManager"/></property>
|
||||
<property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property>
|
||||
<property name="objectDefinitionSource">
|
||||
<property name="filterInvocationDefinitionSource">
|
||||
<security:filter-invocation-definition-source path-type="regex">
|
||||
<security:intercept-url pattern="\A/secure/super/.*\Z" access="ROLE_WE_DONT_HAVE"/>
|
||||
<security:intercept-url pattern="\A/secure/.*\" access="ROLE_SUPERVISOR,ROLE_TELLER"/>
|
||||
</security:filter-invocation-definition-source>
|
||||
</property>
|
||||
</bean> </programlisting>
|
||||
<bean id="filterSecurityInterceptor"
|
||||
class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
|
||||
<property name="authenticationManager" ref="authenticationManager"/>
|
||||
<property name="accessDecisionManager" ref="accessDecisionManager"/>
|
||||
<property name="objectDefinitionSource">
|
||||
<security:filter-invocation-definition-source>
|
||||
<security:intercept-url pattern="/secure/super/**" access="ROLE_WE_DONT_HAVE"/>
|
||||
<security:intercept-url pattern="/secure/**" access="ROLE_SUPERVISOR,ROLE_TELLER"/>
|
||||
</security:filter-invocation-definition-source>
|
||||
</property>
|
||||
</bean>]]> </programlisting>
|
||||
|
||||
<para>The <classname>ExceptionTranslationFilter</classname> provides
|
||||
the bridge between Java exceptions and HTTP responses. It is solely
|
||||
@ -407,9 +407,12 @@ if (this.securityInterceptor == null)
|
||||
Level Design section of this document.</para>
|
||||
|
||||
<para>The <literal>FilterSecurityInterceptor</literal> can be
|
||||
configured with configuration attributes in two ways. The first is via
|
||||
a property editor and the application context, which is shown above.
|
||||
The second is via writing your own
|
||||
configured with configuration attributes in two ways. The first,
|
||||
which is shown above, is using the <literal><filter-invocation-definition-source></literal>
|
||||
namespace element. This is similar to the <literal><filter-chain-map></literal>
|
||||
used to configure a <literal>FilterChainProxy</literal> but the <literal><intercept-url></literal>
|
||||
child elements only use the <literal>pattern</literal> and <literal>access</literal> attributes.
|
||||
The second is by writing your own
|
||||
<literal>ObjectDefinitionSource</literal>, although this is beyond the
|
||||
scope of this document. Irrespective of the approach used, the
|
||||
<literal>ObjectDefinitionSource</literal> is responsible for returning
|
||||
@ -430,8 +433,8 @@ if (this.securityInterceptor == null)
|
||||
little relevance to most users of the
|
||||
<literal>FilterSecurityInterceptor</literal>.</para>
|
||||
|
||||
<para>If using the application context property editor approach (as
|
||||
shown above), commas are used to delimit the different configuration
|
||||
<para>When using the namespace option to configure the interceptor,
|
||||
commas are used to delimit the different configuration
|
||||
attributes that apply to each HTTP URL. Each configuration attribute
|
||||
is assigned into its own <literal>SecurityConfig</literal> object. The
|
||||
<literal>SecurityConfig</literal> object is discussed in the High
|
||||
@ -441,27 +444,26 @@ if (this.securityInterceptor == null)
|
||||
configuration attributes against <literal>FilterInvocations</literal>
|
||||
based on expression evaluation of the request URL. Two standard
|
||||
expression syntaxes are supported. The default is to treat all
|
||||
expressions as regular expressions. Alternatively, the presence of a
|
||||
<literal>PATTERN_TYPE_APACHE_ANT</literal> directive will cause all
|
||||
expressions to be treated as Apache Ant paths. It is not possible to
|
||||
expressions as Apache Ant paths and regular expressions are also supported
|
||||
for ore complex cases. The <literal>path-type</literal> attribute is used
|
||||
to specify the type of pattern being used. It is not possible to
|
||||
mix expression syntaxes within the same definition. For example, the
|
||||
earlier configuration could be generated using Apache Ant paths as
|
||||
follows:</para>
|
||||
previous configuration using regular expressions instead of Ant paths would be
|
||||
written as follows:</para>
|
||||
|
||||
<programlisting><bean id="filterInvocationInterceptor"
|
||||
class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
|
||||
<property name="authenticationManager"><ref bean="authenticationManager"/></property>
|
||||
<property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property>
|
||||
<property name="runAsManager"><ref bean="runAsManager"/></property>
|
||||
<property name="objectDefinitionSource">
|
||||
<value>
|
||||
CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
|
||||
PATTERN_TYPE_APACHE_ANT
|
||||
/secure/super/**=ROLE_WE_DONT_HAVE
|
||||
/secure/**=ROLE_SUPERVISOR,ROLE_TELLER
|
||||
</value>
|
||||
</property>
|
||||
</bean> </programlisting>
|
||||
<programlisting><![CDATA[
|
||||
<bean id="filterInvocationInterceptor"
|
||||
class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
|
||||
<property name="authenticationManager" ref="authenticationManager"/>
|
||||
<property name="accessDecisionManager" ref="accessDecisionManager"/>
|
||||
<property name="runAsManager" ref="runAsManager"/>
|
||||
<property name="objectDefinitionSource">
|
||||
<security:filter-invocation-definition-source path-type="regex">
|
||||
<security:intercept-url pattern="\A/secure/super/.*\Z" access="ROLE_WE_DONT_HAVE"/>
|
||||
<security:intercept-url pattern="\A/secure/.*\" access="ROLE_SUPERVISOR,ROLE_TELLER"/>
|
||||
</security:filter-invocation-definition-source>
|
||||
</property>
|
||||
</bean>]]> </programlisting>
|
||||
|
||||
<para>Irrespective of the type of expression syntax used, expressions
|
||||
are always evaluated in the order they are defined. Thus it is
|
||||
@ -474,15 +476,6 @@ if (this.securityInterceptor == null)
|
||||
<literal>/secure/super/</literal> pattern would never be
|
||||
evaluated.</para>
|
||||
|
||||
<para>The special keyword
|
||||
<literal>CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON</literal> causes
|
||||
the <literal>FilterInvocationDefinitionSource</literal> to
|
||||
automatically convert a request URL to lowercase before comparison
|
||||
against the expressions. Whilst by default the case of the request URL
|
||||
is not converted, it is generally recommended to use
|
||||
<literal>CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON</literal> and
|
||||
write each expression assuming lowercase.</para>
|
||||
|
||||
<para>As with other security interceptors, the
|
||||
<literal>validateConfigAttributes</literal> property is observed. When
|
||||
set to <literal>true</literal> (the default), at startup time the
|
||||
|
||||
@ -58,7 +58,7 @@
|
||||
username parameter as well - just don't do this in production!</para>
|
||||
|
||||
<para>Note that you'll need a
|
||||
<literal><literal>SiteminderAuthenticationProvider</literal></literal>
|
||||
<literal>SiteminderAuthenticationProvider</literal>
|
||||
configured against your <literal>ProviderManager</literal> in order to
|
||||
use the Siteminder authentication mechanism. Normally an
|
||||
<literal>AuthenticationProvider</literal> expects the password
|
||||
|
||||
@ -145,13 +145,15 @@
|
||||
The filter chain is then declared in the application context, using
|
||||
code such as this:</para>
|
||||
|
||||
<para><programlisting>
|
||||
<bean id="filterChainProxy" class="org.springframework.security.util.FilterChainProxy">
|
||||
<sec:filter-chain-map path-type="ant">
|
||||
<sec:filter-chain pattern="/webServices/**" filters="httpSessionContextIntegrationFilterWithASCFalse,basicProcessingFilter,exceptionTranslationFilter,filterSecurityInterceptor"/>
|
||||
<sec:filter-chain pattern="/**" filters="httpSessionContextIntegrationFilterWithASCTrue,authenticationProcessingFilter,exceptionTranslationFilter,filterSecurityInterceptor"/>
|
||||
</sec:filter-chain-map>
|
||||
</bean> </programlisting></para>
|
||||
<para><programlisting><![CDATA[
|
||||
<bean id="filterChainProxy" class="org.springframework.security.util.FilterChainProxy">
|
||||
<sec:filter-chain-map path-type="ant">
|
||||
<sec:filter-chain pattern="/webServices/**" filters="httpSessionContextIntegrationFilterWithASCFalse,basicProcessingFilter,exceptionTranslationFilter,filterSecurityInterceptor"/>
|
||||
<sec:filter-chain pattern="/**" filters="httpSessionContextIntegrationFilterWithASCTrue,authenticationProcessingFilter,exceptionTranslationFilter,filterSecurityInterceptor"/>
|
||||
</sec:filter-chain-map>
|
||||
</bean>
|
||||
]]>
|
||||
</programlisting></para>
|
||||
|
||||
<para>You may notice similarities with the way
|
||||
<literal>FilterSecurityInterceptor</literal> is declared. Both regular
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user