From 7461d0e5f1b91339a400f08eb43fc707a4055912 Mon Sep 17 00:00:00 2001 From: Luke Taylor Date: Thu, 7 Aug 2008 19:12:56 +0000 Subject: [PATCH] Added authentication, method security and start of LDAP ns info --- src/docbkx/appendix-namespace.xml | 139 +++++++++++++++++++++++++++++- 1 file changed, 135 insertions(+), 4 deletions(-) diff --git a/src/docbkx/appendix-namespace.xml b/src/docbkx/appendix-namespace.xml index fe7a0d3bf2..17840c772b 100644 --- a/src/docbkx/appendix-namespace.xml +++ b/src/docbkx/appendix-namespace.xml @@ -19,10 +19,10 @@
- The <literal><http></literal> Element + Web Application Security - the <literal><http></literal> Element - This element encapsulates the security configuration for the web layer of your application. It creates a - FilterChainProxy bean named "springSecurityFilterChain" which maintains the stack of + The <http> element encapsulates the security configuration for the web layer of your application. + It creates a FilterChainProxy bean named "springSecurityFilterChain" which maintains the stack of security filters which make up the web security configuration See the introductory chapter for how to set up the mapping from your web.xml. Some core filters are always created and others will @@ -459,6 +459,137 @@
-
+ Authentication Services + + If you are using the namespace, an AuthenticationManager is + automatically registered and will be used by all the namespace-created beans which need to reference it. + The bean is an instance of Spring Security's ProviderManager class, which needs to be + configured with a list of one or moreAuthenticationProvider instances. + These can either be created using syntax elements provided by the namespace, or they can be + standard bean definitions, marked for addition to the list using the + custom-authentication-provider element. + + +
+ The <authentication-provider< Element + + This element is basically a shorthand syntax for configuring a DaoAuthenticationProvider. + DaoAuthenticationProvider loads user information from a UserDetailsService and + compares the username/password combination with the values supplied at login. The UserDetailsService instance + can be defined either by using an available namespace element (jdbc-user-service or by using the user-service-ref + attribute to point to a bean defined elsewhere in the application context). You can find examples of these variations in the + namespace introduction. + +
+
+ Using <literal><custom-authentication-provider></literal> to register an AuthenticationProvider + + If you have written your own AuthenticationProvider implementation (or want + to configure one of Spring Security's own implementations as a traditional bean for some reason, then + you can use the following syntax to add it to the internal ProviderManager's list: + + + + ]]> + +
+ +
+ The <literal><authentication-manager></literal> Element + + Since the AuthenticationManager will be automatically registered in the application + context, this element is entirely optional. It allows you to define an alias name for the internal instance for use + in your own configuration and also to supply a link to a ConcurrentSessionController + if you are configuring concurrent session control yourself rather than through the namespace (a rare requirement). + Its use is described in the namespace introduction. + +
+ +
+ +
+ Method Security + +
+ The <literal><global-method-security></literal> Element + + This element is the primary means of adding support for securing methods on Spring Security beans. Methods can + be secured by the use of annotations (defined at the interface or class level) or by defining a set of + pointcuts as child elements, using AspectJ syntax. + + + Method security uses the same AccessDecisionManager configuration as web security, + but this can be overridden as explained above , using the same + attribute. + +
+ The <literal><secured-annotations></literal> and <literal><jsr250-annotations></literal> Attributes + + Setting these to "true" will enable support for Spring Security's own @Secured annotations and + JSR-250 annotations, respectively. They are both disabled by default. Use of JSR-250 annotations also adds a + Jsr250Voter to the AccessDecisionManager, so you need to + make sure you do this if you are using a custom implementation and want to use these annotations. + +
+
+ Securing Methods using <literal><protect-pointcut></literal> + + Rather than defining security attributes on an individual method or class basis using the + @Secured annotation, you can define cross-cutting security constraints across whole + sets of methods and interfaces in your service layer using the <protect-pointcut> + element. This has two attributes: + + expression - the pointcut expression + access - the security attributes which apply + + You can find an example in the namespace introduction. + +
+
+ +
+ LDAP Namespace Options + + LDAP is covered in some details in its own chapter. We will expand on that + here with some explanation of how the namespace options map to Spring beans. The LDAP implementation uses + Spring LDAP extensively, so some familiarity with that project's API may be useful. + +
+ Defining the LDAP Server using the <literal><ldap-server></literal> Element + + This element sets up a Spring LDAP ContextSource for use by the + other LDAP beans, defining the location of the LDAP server and other information (such as a username + and password, if it doesn't allow anonymous access) for connecting to it. It can also be used to + create an embedded server for testing. + Details of the syntax for both options are covered in the LDAP chapter. + The actual ContextSource implementation is + DefaultSpringSecurityContextSource which extends Spring LDAP's + LdapContextSource class. The manager-dn and manager-password + attributes map to the latter's userDn and password properties respectively. + + + If you only have one server defined in your application context, the other LDAP namespace-defined beans + will use it automatically. Otherwise, you can give the element an "id" attribute and refer to it from other + namespace beans using the server-ref attribute. This is actually the bean Id of the + ContextSource instance, if you want to use it in other traditional Spring beans. + +
+
+ The <literal><ldap-provider> Element</literal> + + This element is shorthand for the creation of an LdapAuthenticationProvider instance. + + +
+ + +
+ + + +
+