Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-29 15:22:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added information on config jar to instructions on getting started using namespace.

Browse Source
This commit is contained in:
Luke Taylor 2010-06-30 13:45:13 +01:00
parent 8df356de29
commit 8615369697
1 changed files with 326 additions and 342 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

668
docs/manual/src/docbook/namespace-config.xml
View File

@ -9,9 +9,9 @@
<para> Namespace configuration has been available since version 2.0 of the Spring framework. <para> Namespace configuration has been available since version 2.0 of the Spring framework.
It allows you to supplement the traditional Spring beans application context syntax with It allows you to supplement the traditional Spring beans application context syntax with
elements from additional XML schema. You can find more information in the Spring <link elements from additional XML schema. You can find more information in the Spring <link
xlink:href="http://static.springsource.org/spring/docs/3.0.x/spring-framework-reference/html/apc.html" xlink:href="http://static.springsource.org/spring/docs/3.0.x/spring-framework-reference/html/apc.html"
> Reference Documentation</link>. A namespace element can be used simply to allow a > Reference Documentation</link>. A namespace element can be used simply to allow a more
more concise way of configuring an individual bean or, more powerfully, to define an concise way of configuring an individual bean or, more powerfully, to define an
alternative configuration syntax which more closely matches the problem domain and hides alternative configuration syntax which more closely matches the problem domain and hides
the underlying complexity from the user. A simple element may conceal the fact that the underlying complexity from the user. A simple element may conceal the fact that
multiple beans and processing steps are being added to the application context. For multiple beans and processing steps are being added to the application context. For
@ -22,15 +22,16 @@
beans. The most common alternative configuration requirements are supported by beans. The most common alternative configuration requirements are supported by
attributes on the <literal>ldap-server</literal> element and the user is isolated from attributes on the <literal>ldap-server</literal> element and the user is isolated from
worrying about which beans they need to create and what the bean property names are. <footnote> worrying about which beans they need to create and what the bean property names are. <footnote>
<para>You can find out more about the use of the <literal>ldap-server</literal> <para>You can find out more about the use of the <literal>ldap-server</literal> element
element in the chapter on <link xlink:href="#ldap">LDAP</link>.</para> in the chapter on <link xlink:href="#ldap">LDAP</link>.</para>
</footnote>. Use of a good XML editor while editing the application context file should </footnote>. Use of a good XML editor while editing the application context file should
provide information on the attributes and elements that are available. We would provide information on the attributes and elements that are available. We would
recommend that you try out the <link recommend that you try out the <link
xlink:href="http://www.springsource.com/products/sts">SpringSource Tool Suite</link> xlink:href="http://www.springsource.com/products/sts">SpringSource Tool Suite</link> as
as it has special features for working with standard Spring namespaces. </para> it has special features for working with standard Spring namespaces. </para>
<para> To start using the security namespace in your application context, all you need to do <para> To start using the security namespace in your application context, you need to have
is add the schema declaration to your application context file: <programlisting language="xml"> the <literal>spring-security-config</literal> jar on your classpath. Then all you need
to do is add the schema declaration to your application context file: <programlisting language="xml">
<![CDATA[ <![CDATA[
<beans xmlns="http://www.springframework.org/schema/beans" <beans xmlns="http://www.springframework.org/schema/beans"
xmlns:security="http://www.springframework.org/schema/security" xmlns:security="http://www.springframework.org/schema/security"
@ -63,43 +64,37 @@
provide a simplified and concise syntax for enabling them within an application. The provide a simplified and concise syntax for enabling them within an application. The
design is based around the large-scale dependencies within the framework, and can be design is based around the large-scale dependencies within the framework, and can be
divided up into the following areas: <itemizedlist> divided up into the following areas: <itemizedlist>
<listitem> <listitem>
<para> <para> <emphasis>Web/HTTP Security</emphasis> - the most complex part. Sets up
<emphasis>Web/HTTP Security</emphasis> - the most complex part. Sets up the filters and related service beans used to apply the framework
the filters and related service beans used to apply the framework authentication mechanisms, to secure URLs, render login and error pages and
authentication mechanisms, to secure URLs, render login and error pages much more.</para>
and much more.</para> </listitem>
</listitem> <listitem>
<listitem> <para> <emphasis>Business Object (Method) Security</emphasis> - options for
<para> securing the service layer.</para>
<emphasis>Business Object (Method) Security</emphasis> - options for </listitem>
securing the service layer.</para> <listitem>
</listitem> <para> <emphasis>AuthenticationManager</emphasis> - handles authentication
<listitem> requests from other parts of the framework.</para>
<para> </listitem>
<emphasis>AuthenticationManager</emphasis> - handles authentication <listitem>
requests from other parts of the framework.</para> <para> <emphasis>AccessDecisionManager</emphasis> - provides access decisions
</listitem> for web and method security. A default one will be registered, but you can
<listitem> also choose to use a custom one, declared using normal Spring bean
<para> syntax.</para>
<emphasis>AccessDecisionManager</emphasis> - provides access decisions </listitem>
for web and method security. A default one will be registered, but you <listitem>
can also choose to use a custom one, declared using normal Spring bean <para> <emphasis>AuthenticationProvider</emphasis>s - mechanisms against which
syntax.</para> the authentication manager authenticates users. The namespace provides
</listitem> supports for several standard options and also a means of adding custom
<listitem> beans declared using a traditional syntax. </para>
<para> </listitem>
<emphasis>AuthenticationProvider</emphasis>s - mechanisms against which <listitem>
the authentication manager authenticates users. The namespace provides <para> <emphasis>UserDetailsService</emphasis> - closely related to
supports for several standard options and also a means of adding custom authentication providers, but often also required by other beans.</para>
beans declared using a traditional syntax. </para> </listitem>
</listitem> <!-- todo: diagram and link to other sections which describe the interfaces -->
<listitem>
<para>
<emphasis>UserDetailsService</emphasis> - closely related to
authentication providers, but often also required by other beans.</para>
</listitem>
<!-- todo: diagram and link to other sections which describe the interfaces -->
</itemizedlist></para> </itemizedlist></para>
<para>We'll see how to configure these in the following sections.</para> <para>We'll see how to configure these in the following sections.</para>
</section> </section>
@ -115,7 +110,7 @@
<section xml:id="ns-web-xml"> <section xml:id="ns-web-xml">
<title><literal>web.xml</literal> Configuration</title> <title><literal>web.xml</literal> Configuration</title>
<para> The first thing you need to do is add the following filter declaration to your <para> The first thing you need to do is add the following filter declaration to your
<literal>web.xml</literal> file: <programlisting language="xml"><![CDATA[ <literal>web.xml</literal> file: <programlisting language="xml"><![CDATA[
<filter> <filter>
<filter-name>springSecurityFilterChain</filter-name> <filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
@ -129,12 +124,11 @@
infrastructure. <classname>DelegatingFilterProxy</classname> is a Spring Framework infrastructure. <classname>DelegatingFilterProxy</classname> is a Spring Framework
class which delegates to a filter implementation which is defined as a Spring bean class which delegates to a filter implementation which is defined as a Spring bean
in your application context. In this case, the bean is named in your application context. In this case, the bean is named
<quote>springSecurityFilterChain</quote>, which is an internal infrastructure <quote>springSecurityFilterChain</quote>, which is an internal infrastructure bean
bean created by the namespace to handle web security. Note that you should not use created by the namespace to handle web security. Note that you should not use this
this bean name yourself. Once you've added this to your bean name yourself. Once you've added this to your <filename>web.xml</filename>,
<filename>web.xml</filename>, you're ready to start editing your application context you're ready to start editing your application context file. Web security services
file. Web security services are configured using the <literal>&lt;http&gt;</literal> are configured using the <literal>&lt;http&gt;</literal> element. </para>
element. </para>
</section> </section>
<section xml:id="ns-minimal"> <section xml:id="ns-minimal">
<title>A Minimal <literal>&lt;http&gt;</literal> Configuration</title> <title>A Minimal <literal>&lt;http&gt;</literal> Configuration</title>
@ -145,12 +139,12 @@
]]> ]]>
</programlisting> Which says that we want all URLs within our application to be secured, </programlisting> Which says that we want all URLs within our application to be secured,
requiring the role <literal>ROLE_USER</literal> to access them. The requiring the role <literal>ROLE_USER</literal> to access them. The
<literal>&lt;http></literal> element is the parent for all web-related namespace <literal>&lt;http></literal> element is the parent for all web-related namespace
functionality. The <literal>&lt;intercept-url></literal> element defines a functionality. The <literal>&lt;intercept-url></literal> element defines a
<literal>pattern</literal> which is matched against the URLs of incoming <literal>pattern</literal> which is matched against the URLs of incoming requests
requests using an ant path style syntax. You can also use regular-expression using an ant path style syntax. You can also use regular-expression matching as an
matching as an alternative (see the namespace appendix for more details). The alternative (see the namespace appendix for more details). The
<literal>access</literal> attribute defines the access requirements for requests <literal>access</literal> attribute defines the access requirements for requests
matching the given pattern. With the default configuration, this is typically a matching the given pattern. With the default configuration, this is typically a
comma-separated list of roles, one of which a user must have to be allowed to make comma-separated list of roles, one of which a user must have to be allowed to make
the request. The prefix <quote>ROLE_</quote> is a marker which indicates that a the request. The prefix <quote>ROLE_</quote> is a marker which indicates that a
@ -159,18 +153,18 @@
limited to the use of simple roles (hence the use of the prefix to differentiate limited to the use of simple roles (hence the use of the prefix to differentiate
between different types of security attributes). We'll see later how the between different types of security attributes). We'll see later how the
interpretation can vary<footnote> interpretation can vary<footnote>
<para>The interpretation of the comma-separated values in the <para>The interpretation of the comma-separated values in the
<literal>access</literal> attribute depends on the implementation of the <literal>access</literal> attribute depends on the implementation of the <link
<link xlink:href="#ns-access-manager">AccessDecisionManager</link> which xlink:href="#ns-access-manager">AccessDecisionManager</link> which is used. In
is used. In Spring Security 3.0, the attribute can also be populated with an Spring Security 3.0, the attribute can also be populated with an <link
<link xlink:href="#el-access">EL expression</link>.</para> xlink:href="#el-access">EL expression</link>.</para>
</footnote>.</para> </footnote>.</para>
<note> <note>
<para>You can use multiple <literal>&lt;intercept-url&gt;</literal> elements to <para>You can use multiple <literal>&lt;intercept-url&gt;</literal> elements to
define different access requirements for different sets of URLs, but they will define different access requirements for different sets of URLs, but they will
be evaluated in the order listed and the first match will be used. So you must be evaluated in the order listed and the first match will be used. So you must
put the most specific matches at the top. You can also add a put the most specific matches at the top. You can also add a
<literal>method</literal> attribute to limit the match to a particular HTTP <literal>method</literal> attribute to limit the match to a particular HTTP
method (<literal>GET</literal>, <literal>POST</literal>, <literal>PUT</literal> method (<literal>GET</literal>, <literal>POST</literal>, <literal>PUT</literal>
etc.). If a request matches multiple patterns, the method-specific match will etc.). If a request matches multiple patterns, the method-specific match will
take precedence regardless of ordering.</para> take precedence regardless of ordering.</para>
@ -189,17 +183,17 @@
<sidebar> <sidebar>
<para>If you are familiar with pre-namespace versions of the framework, you can <para>If you are familiar with pre-namespace versions of the framework, you can
probably already guess roughly what's going on here. The probably already guess roughly what's going on here. The
<literal>&lt;http&gt;</literal> element is responsible for creating a <literal>&lt;http&gt;</literal> element is responsible for creating a
<classname>FilterChainProxy</classname> and the filter beans which it uses. <classname>FilterChainProxy</classname> and the filter beans which it uses.
Common problems like incorrect filter ordering are no longer an issue as the Common problems like incorrect filter ordering are no longer an issue as the
filter positions are predefined.</para> filter positions are predefined.</para>
<para>The <literal>&lt;authentication-provider&gt;</literal> element creates a <para>The <literal>&lt;authentication-provider&gt;</literal> element creates a
<classname>DaoAuthenticationProvider</classname> bean and the <classname>DaoAuthenticationProvider</classname> bean and the
<literal>&lt;user-service&gt;</literal> element creates an <literal>&lt;user-service&gt;</literal> element creates an
<classname>InMemoryDaoImpl</classname>. All <classname>InMemoryDaoImpl</classname>. All
<literal>authentication-provider</literal> elements must be children of the <literal>authentication-provider</literal> elements must be children of the
<literal>&lt;authentication-manager></literal> element, which creates a <literal>&lt;authentication-manager></literal> element, which creates a
<classname>ProviderManager</classname> and registers the authentication <classname>ProviderManager</classname> and registers the authentication
providers with it. You can find more detailed information on the beans that are providers with it. You can find more detailed information on the beans that are
created in the <link xlink:href="#appendix-namespace">namespace appendix</link>. created in the <link xlink:href="#appendix-namespace">namespace appendix</link>.
It's worth cross-checking this if you want to start understanding what the It's worth cross-checking this if you want to start understanding what the
@ -209,20 +203,20 @@
<para> The configuration above defines two users, their passwords and their roles within <para> The configuration above defines two users, their passwords and their roles within
the application (which will be used for access control). It is also possible to load the application (which will be used for access control). It is also possible to load
user information from a standard properties file using the user information from a standard properties file using the
<literal>properties</literal> attribute on <literal>user-service</literal>. See <literal>properties</literal> attribute on <literal>user-service</literal>. See the
the section on <link xlink:href="#core-services-in-memory-service">in-memory section on <link xlink:href="#core-services-in-memory-service">in-memory
authentication</link> for more details on the file format. Using the authentication</link> for more details on the file format. Using the
<literal>&lt;authentication-provider&gt;</literal> element means that the user <literal>&lt;authentication-provider&gt;</literal> element means that the user
information will be used by the authentication manager to process authentication information will be used by the authentication manager to process authentication
requests. You can have multiple <literal>&lt;authentication-provider&gt;</literal> requests. You can have multiple <literal>&lt;authentication-provider&gt;</literal>
elements to define different authentication sources and each will be consulted in elements to define different authentication sources and each will be consulted in
turn.</para> turn.</para>
<para> At this point you should be able to start up your application and you will be <para> At this point you should be able to start up your application and you will be
required to log in to proceed. Try it out, or try experimenting with the required to log in to proceed. Try it out, or try experimenting with the
<quote>tutorial</quote> sample application that comes with the project. The <quote>tutorial</quote> sample application that comes with the project. The above
above configuration actually adds quite a few services to the application because we configuration actually adds quite a few services to the application because we have
have used the <literal>auto-config</literal> attribute. For example, form-based used the <literal>auto-config</literal> attribute. For example, form-based login
login processing is automatically enabled. </para> processing is automatically enabled. </para>
<section xml:id="ns-auto-config"> <section xml:id="ns-auto-config">
<title>What does <literal>auto-config</literal> Include?</title> <title>What does <literal>auto-config</literal> Include?</title>
<para> The <literal>auto-config</literal> attribute, as we have used it above, is <para> The <literal>auto-config</literal> attribute, as we have used it above, is
@ -234,16 +228,16 @@
</http> </http>
]]></programlisting> These other elements are responsible for setting up form-login, basic ]]></programlisting> These other elements are responsible for setting up form-login, basic
authentication and logout handling services respectively <footnote> authentication and logout handling services respectively <footnote>
<para>In versions prior to 3.0, this list also included remember-me <para>In versions prior to 3.0, this list also included remember-me
functionality. This could cause some confusing errors with some functionality. This could cause some confusing errors with some
configurations and was removed in 3.0. In 3.0, the addition of an configurations and was removed in 3.0. In 3.0, the addition of an
<classname>AnonymousAuthenticationFilter</classname> is part of the <classname>AnonymousAuthenticationFilter</classname> is part of the default
default <literal>&lt;http></literal> configuration, so the <literal>&lt;http></literal> configuration, so the <literal>&lt;anonymous
<literal>&lt;anonymous /></literal> element is added regardless of /></literal> element is added regardless of whether
whether <literal>auto-config</literal> is enabled.</para> <literal>auto-config</literal> is enabled.</para>
</footnote>. They each have attributes which can be used to alter their </footnote>. They each have attributes which can be used to alter their
behaviour. In anything other than very basic scenarios, it is probably better behaviour. In anything other than very basic scenarios, it is probably better to
to omit the <literal>auto-config</literal> attribute and configure what you require omit the <literal>auto-config</literal> attribute and configure what you require
explicitly in the interest of clarity.</para> explicitly in the interest of clarity.</para>
</section> </section>
</section> </section>
@ -264,21 +258,20 @@
</http> </http>
]]> ]]>
</programlisting> Note that you can still use <literal>auto-config</literal>. The </programlisting> Note that you can still use <literal>auto-config</literal>. The
<literal>form-login</literal> element just overrides the default settings. Also <literal>form-login</literal> element just overrides the default settings. Also note
note that we've added an extra <literal>intercept-url</literal> element to say that that we've added an extra <literal>intercept-url</literal> element to say that any
any requests for the login page should be available to anonymous users <footnote> requests for the login page should be available to anonymous users <footnote>
<para>See the chapter on <link xlink:href="#anonymous">anonymous <para>See the chapter on <link xlink:href="#anonymous">anonymous
authentication</link> and also the <link authentication</link> and also the <link xlink:href="#authz-authenticated-voter"
xlink:href="#authz-authenticated-voter">AuthenticatedVoter</link> class >AuthenticatedVoter</link> class for more details on how the value
for more details on how the value <literal>IS_AUTHENTICATED_ANONYMOUSLY</literal> is processed.</para>
<literal>IS_AUTHENTICATED_ANONYMOUSLY</literal> is processed.</para>
</footnote>. Otherwise the request would be matched by the pattern </footnote>. Otherwise the request would be matched by the pattern
<literal>/**</literal> and it wouldn't be possible to access the login page <literal>/**</literal> and it wouldn't be possible to access the login page itself!
itself! This is a common configuration error and will result in an infinite loop in This is a common configuration error and will result in an infinite loop in the
the application. Spring Security will emit a warning in the log if your login page application. Spring Security will emit a warning in the log if your login page
appears to be secured. It is also possible to have all requests matching a appears to be secured. It is also possible to have all requests matching a
particular pattern bypass the security filter chain completely, by defining a separate particular pattern bypass the security filter chain completely, by defining a
<literal>http</literal> element for the pattern like this: <programlisting language="xml"><![CDATA[ separate <literal>http</literal> element for the pattern like this: <programlisting language="xml"><![CDATA[
<http pattern="/css/**" secured="false"/> <http pattern="/css/**" secured="false"/>
<http pattern="/login.jsp*" secured="false"/> <http pattern="/login.jsp*" secured="false"/>
@ -287,27 +280,26 @@
<form-login login-page='/login.jsp'/> <form-login login-page='/login.jsp'/>
</http> </http>
]]> ]]>
</programlisting> </programlisting> From Spring Security 3.1 it is now possible to use multiple
From Spring Security 3.1 it is now possible to use multiple <literal>http</literal> <literal>http</literal> elements to define separate security filter chain
elements to define separate security filter chain configurations for different configurations for different request patterns. If the <literal>pattern</literal>
request patterns. If the <literal>pattern</literal> attribute is omitted from an attribute is omitted from an <literal>http</literal> element, it matches all
<literal>http</literal> element, it matches all requests. Creating an unsecured requests. Creating an unsecured pattern is a simple example of this syntax, where
pattern is a simple example of this syntax, where the pattern is mapped to an empty filter chain the pattern is mapped to an empty filter chain <footnote>
<footnote><para>The use of multiple <literal>&lt;http&gt;</literal> elements is an <para>The use of multiple <literal>&lt;http&gt;</literal> elements is an important
important feature, allowing the namespace to simultaneously support both stateful and stateless feature, allowing the namespace to simultaneously support both stateful and
paths within the same application, for example. The previous syntax, using the attribute stateless paths within the same application, for example. The previous syntax,
<literal>filters="none"</literal> on an <literal>intercept-url</literal> element using the attribute <literal>filters="none"</literal> on an
is incompatible with this change and is no longer supported in 3.1.</para></footnote>. <literal>intercept-url</literal> element is incompatible with this change and is
We'll look at this new syntax in more detail in the chapter on the no longer supported in 3.1.</para>
<link xlink:href="#filter-chains-with-ns">Security Filter Chain</link>. </footnote>. We'll look at this new syntax in more detail in the chapter on the
</para> <link xlink:href="#filter-chains-with-ns">Security Filter Chain</link>. </para>
<para> <para> It's important to realise that these unsecured requests will be completely
It's important to realise that these unsecured requests will be completely oblivious to any Spring Security web-related configuration or additional attributes
oblivious to any Spring Security web-related configuration or additional such as <literal>requires-channel</literal>, so you will not be able to access
attributes such as <literal>requires-channel</literal>, so you will not be able to information on the current user or call secured methods during the request. Use
access information on the current user or call secured methods during the request. <literal>access='IS_AUTHENTICATED_ANONYMOUSLY'</literal> as an alternative if you
Use <literal>access='IS_AUTHENTICATED_ANONYMOUSLY'</literal> as an alternative if still want the security filter chain to be applied.</para>
you still want the security filter chain to be applied.</para>
<para>If you want to use basic authentication instead of form login, then change the <para>If you want to use basic authentication instead of form login, then change the
configuration to <programlisting language="xml"><![CDATA[ configuration to <programlisting language="xml"><![CDATA[
<http auto-config='true'> <http auto-config='true'>
@ -327,9 +319,9 @@
"/". You can also configure things so that the user <emphasis>always</emphasis> "/". You can also configure things so that the user <emphasis>always</emphasis>
ends up at this page (regardless of whether the login was "on-demand" or they ends up at this page (regardless of whether the login was "on-demand" or they
explicitly chose to log in) by setting the explicitly chose to log in) by setting the
<literal>always-use-default-target</literal> attribute to "true". This is <literal>always-use-default-target</literal> attribute to "true". This is useful
useful if your application always requires that the user starts at a "home" if your application always requires that the user starts at a "home" page, for
page, for example: <programlisting language="xml"><![CDATA[ example: <programlisting language="xml"><![CDATA[
<http pattern="/login.htm*" secured="false"/> <http pattern="/login.htm*" secured="false"/>
<http> <http>
<intercept-url pattern='/**' access='ROLE_USER' /> <intercept-url pattern='/**' access='ROLE_USER' />
@ -338,11 +330,11 @@
</http> </http>
]]> </programlisting></para> ]]> </programlisting></para>
<para>For even more control over the destination, you can use the <para>For even more control over the destination, you can use the
<literal>authentication-success-handler-ref</literal> attribute as an <literal>authentication-success-handler-ref</literal> attribute as an
alternative to <literal>default-target-url</literal>. The referenced bean should alternative to <literal>default-target-url</literal>. The referenced bean should
be an instance of <interfacename>AuthenticationSuccessHandler</interfacename>. be an instance of <interfacename>AuthenticationSuccessHandler</interfacename>.
You'll find more on this in the <link xlink:href="#form-login-flow-handling" You'll find more on this in the <link xlink:href="#form-login-flow-handling"
>Core Filters</link> chapter and also in the namespace appendix, as well as >Core Filters</link> chapter and also in the namespace appendix, as well as
information on how to customize the flow when authentication fails. </para> information on how to customize the flow when authentication fails. </para>
</section> </section>
</section> </section>
@ -353,7 +345,7 @@
user information in something like a database or an LDAP server. LDAP namespace user information in something like a database or an LDAP server. LDAP namespace
configuration is dealt with in the <link xlink:href="#ldap">LDAP chapter</link>, so configuration is dealt with in the <link xlink:href="#ldap">LDAP chapter</link>, so
we won't cover it here. If you have a custom implementation of Spring Security's we won't cover it here. If you have a custom implementation of Spring Security's
<classname>UserDetailsService</classname>, called "myUserDetailsService" in your <classname>UserDetailsService</classname>, called "myUserDetailsService" in your
application context, then you can authenticate against this using <programlisting language="xml"><![CDATA[ application context, then you can authenticate against this using <programlisting language="xml"><![CDATA[
<authentication-manager> <authentication-manager>
<authentication-provider user-service-ref='myUserDetailsService'/> <authentication-provider user-service-ref='myUserDetailsService'/>
@ -367,12 +359,11 @@
</authentication-manager> </authentication-manager>
]]> ]]>
</programlisting> Where <quote>securityDataSource</quote> is the name of a </programlisting> Where <quote>securityDataSource</quote> is the name of a
<classname>DataSource</classname> bean in the application context, pointing at a <classname>DataSource</classname> bean in the application context, pointing at a
database containing the standard Spring Security <link database containing the standard Spring Security <link
xlink:href="#db_schema_users_authorities">user data tables</link>. xlink:href="#db_schema_users_authorities">user data tables</link>. Alternatively,
Alternatively, you could configure a Spring Security you could configure a Spring Security <classname>JdbcDaoImpl</classname> bean and
<classname>JdbcDaoImpl</classname> bean and point at that using the point at that using the <literal>user-service-ref</literal> attribute: <programlisting language="xml"><![CDATA[
<literal>user-service-ref</literal> attribute: <programlisting language="xml"><![CDATA[
<authentication-manager> <authentication-manager>
<authentication-provider user-service-ref='myUserDetailsService'/> <authentication-provider user-service-ref='myUserDetailsService'/>
</authentication-manager> </authentication-manager>
@ -383,18 +374,18 @@
</beans:bean> </beans:bean>
]]> ]]>
</programlisting> You can also use standard </programlisting> You can also use standard
<interfacename>AuthenticationProvider</interfacename> beans as follows <programlisting language="xml"><![CDATA[ <interfacename>AuthenticationProvider</interfacename> beans as follows <programlisting language="xml"><![CDATA[
<authentication-manager> <authentication-manager>
<authentication-provider ref='myAuthenticationProvider'/> <authentication-provider ref='myAuthenticationProvider'/>
</authentication-manager> </authentication-manager>
]]> ]]>
</programlisting> where <literal>myAuthenticationProvider</literal> is the name of a </programlisting> where <literal>myAuthenticationProvider</literal> is the name of a
bean in your application context which implements bean in your application context which implements
<interfacename>AuthenticationProvider</interfacename>. You can use multiple <interfacename>AuthenticationProvider</interfacename>. You can use multiple
<literal>authentication-provider</literal> elements, in which case the providers <literal>authentication-provider</literal> elements, in which case the providers
will be queried in the order they are declared. See <xref linkend="ns-auth-manager" will be queried in the order they are declared. See <xref linkend="ns-auth-manager"
/> for more on information on how the Spring Security /> for more on information on how the Spring Security
<interfacename>AuthenticationManager</interfacename> is configured using the <interfacename>AuthenticationManager</interfacename> is configured using the
namespace. </para> namespace. </para>
<section xml:id="ns-password-encoder"> <section xml:id="ns-password-encoder">
<title>Adding a Password Encoder</title> <title>Adding a Password Encoder</title>
@ -425,8 +416,8 @@
<salt-source user-property="username"/> <salt-source user-property="username"/>
</password-encoder> </password-encoder>
]]></programlisting> You can use a custom password encoder bean by using the ]]></programlisting> You can use a custom password encoder bean by using the
<literal>ref</literal> attribute of <literal>password-encoder</literal>. <literal>ref</literal> attribute of <literal>password-encoder</literal>. This
This should contain the name of a bean in the application context which is an should contain the name of a bean in the application context which is an
instance of Spring Security's <interfacename>PasswordEncoder</interfacename> instance of Spring Security's <interfacename>PasswordEncoder</interfacename>
interface. </para> interface. </para>
</section> </section>
@ -443,8 +434,8 @@
<title>Adding HTTP/HTTPS Channel Security</title> <title>Adding HTTP/HTTPS Channel Security</title>
<para>If your application supports both HTTP and HTTPS, and you require that particular <para>If your application supports both HTTP and HTTPS, and you require that particular
URLs can only be accessed over HTTPS, then this is directly supported using the URLs can only be accessed over HTTPS, then this is directly supported using the
<literal>requires-channel</literal> attribute on <literal>requires-channel</literal> attribute on
<literal>&lt;intercept-url&gt;</literal>: <programlisting language="xml"><![CDATA[ <literal>&lt;intercept-url&gt;</literal>: <programlisting language="xml"><![CDATA[
<http> <http>
<intercept-url pattern="/secure/**" access="ROLE_USER" requires-channel="https"/> <intercept-url pattern="/secure/**" access="ROLE_USER" requires-channel="https"/>
<intercept-url pattern="/**" access="ROLE_USER" requires-channel="any"/> <intercept-url pattern="/**" access="ROLE_USER" requires-channel="any"/>
@ -482,8 +473,8 @@
<para>If you wish to place constraints on a single user's ability to log in to your <para>If you wish to place constraints on a single user's ability to log in to your
application, Spring Security supports this out of the box with the following application, Spring Security supports this out of the box with the following
simple additions. First you need to add the following listener to your simple additions. First you need to add the following listener to your
<filename>web.xml</filename> file to keep Spring Security updated about <filename>web.xml</filename> file to keep Spring Security updated about session
session lifecycle events: <programlisting language="xml"><![CDATA[ lifecycle events: <programlisting language="xml"><![CDATA[
<listener> <listener>
<listener-class> <listener-class>
org.springframework.security.web.session.HttpSessionEventPublisher org.springframework.security.web.session.HttpSessionEventPublisher
@ -506,45 +497,44 @@
</session-management> </session-management>
</http>]]> </http>]]>
</programlisting>The second login will then be rejected. By </programlisting>The second login will then be rejected. By
<quote>rejected</quote>, we mean that the user will be sent to the <quote>rejected</quote>, we mean that the user will be sent to the
<literal>authentication-failure-url</literal> if form-based login is being <literal>authentication-failure-url</literal> if form-based login is being used.
used. If the second authentication takes place through another non-interactive If the second authentication takes place through another non-interactive
mechanism, such as <quote>remember-me</quote>, an <quote>unauthorized</quote> mechanism, such as <quote>remember-me</quote>, an <quote>unauthorized</quote>
(402) error will be sent to the client. If instead you want to use an error (402) error will be sent to the client. If instead you want to use an error
page, you can add the attribute page, you can add the attribute
<literal>session-authentication-error-url</literal> to the <literal>session-authentication-error-url</literal> to the
<literal>session-management</literal> element. </para> <literal>session-management</literal> element. </para>
<para>If you are using a customized authentication filter for form-based login, then <para>If you are using a customized authentication filter for form-based login, then
you have to configure concurrent session control support explicitly. More you have to configure concurrent session control support explicitly. More
details can be found in the <link xlink:href="#session-mgmt">Session Management details can be found in the <link xlink:href="#session-mgmt">Session Management
chapter</link>. </para> chapter</link>. </para>
</section> </section>
<section xml:id="ns-session-fixation"> <section xml:id="ns-session-fixation">
<title>Session Fixation Attack Protection</title> <title>Session Fixation Attack Protection</title>
<para> <para> <link xlink:href="http://en.wikipedia.org/wiki/Session_fixation">Session
<link xlink:href="http://en.wikipedia.org/wiki/Session_fixation">Session fixation</link> attacks are a potential risk where it is possible for a
fixation</link> attacks are a potential risk where it is possible for a
malicious attacker to create a session by accessing a site, then persuade malicious attacker to create a session by accessing a site, then persuade
another user to log in with the same session (by sending them a link containing another user to log in with the same session (by sending them a link containing
the session identifier as a parameter, for example). Spring Security protects the session identifier as a parameter, for example). Spring Security protects
against this automatically by creating a new session when a user logs in. If you against this automatically by creating a new session when a user logs in. If you
don't require this protection, or it conflicts with some other requirement, you don't require this protection, or it conflicts with some other requirement, you
can control the behaviour using the can control the behaviour using the
<literal>session-fixation-protection</literal> attribute on <literal>session-fixation-protection</literal> attribute on
<literal>&lt;session-management&gt;</literal>, which has three options <itemizedlist> <literal>&lt;session-management&gt;</literal>, which has three options <itemizedlist>
<listitem> <listitem>
<para><literal>migrateSession</literal> - creates a new session and <para><literal>migrateSession</literal> - creates a new session and copies
copies the existing session attributes to the new session. This is the existing session attributes to the new session. This is the
the default.</para> default.</para>
</listitem> </listitem>
<listitem> <listitem>
<para><literal>none</literal> - Don't do anything. The original session <para><literal>none</literal> - Don't do anything. The original session will
will be retained.</para> be retained.</para>
</listitem> </listitem>
<listitem> <listitem>
<para><literal>newSession</literal> - Create a new "clean" session, <para><literal>newSession</literal> - Create a new "clean" session, without
without copying the existing session data.</para> copying the existing session data.</para>
</listitem> </listitem>
</itemizedlist></para> </itemizedlist></para>
</section> </section>
</section> </section>
@ -558,24 +548,23 @@
</http> </http>
]]></programlisting>You should then register yourself with an OpenID provider (such as ]]></programlisting>You should then register yourself with an OpenID provider (such as
myopenid.com), and add the user information to your in-memory myopenid.com), and add the user information to your in-memory
<literal>&lt;user-service&gt;</literal> : <programlisting language="xml"><![CDATA[ <literal>&lt;user-service&gt;</literal> : <programlisting language="xml"><![CDATA[
<user name="http://jimi.hendrix.myopenid.com/" authorities="ROLE_USER" /> <user name="http://jimi.hendrix.myopenid.com/" authorities="ROLE_USER" />
]]></programlisting> You should be able to login using the <literal>myopenid.com</literal> site to ]]></programlisting> You should be able to login using the <literal>myopenid.com</literal> site to
authenticate. It is also possible to select a specific authenticate. It is also possible to select a specific
<interfacename>UserDetailsService</interfacename> bean for use OpenID by setting <interfacename>UserDetailsService</interfacename> bean for use OpenID by setting the
the <literal>user-service-ref</literal> attribute on the <literal>user-service-ref</literal> attribute on the <literal>openid-login</literal>
<literal>openid-login</literal> element. See the previous section on <link element. See the previous section on <link xlink:href="#ns-auth-providers"
xlink:href="#ns-auth-providers">authentication providers</link> for more >authentication providers</link> for more information. Note that we have omitted the
information. Note that we have omitted the password attribute from the above user password attribute from the above user configuration, since this set of user data is
configuration, since this set of user data is only being used to load the only being used to load the authorities for the user. A random password will be
authorities for the user. A random password will be generate internally, preventing generate internally, preventing you from accidentally using this user data as an
you from accidentally using this user data as an authentication source elsewhere in authentication source elsewhere in your configuration.</para>
your configuration.</para>
<section> <section>
<title>Attribute Exchange</title> <title>Attribute Exchange</title>
<para>Support for OpenID <link <para>Support for OpenID <link
xlink:href="http://openid.net/specs/openid-attribute-exchange-1_0.html" xlink:href="http://openid.net/specs/openid-attribute-exchange-1_0.html"
>attribute exchange</link>. As an example, the following configuration would >attribute exchange</link>. As an example, the following configuration would
attempt to retrieve the email and full name from the OpenID provider, for use by attempt to retrieve the email and full name from the OpenID provider, for use by
the application:<programlisting language="xml"><![CDATA[ the application:<programlisting language="xml"><![CDATA[
<openid-login> <openid-login>
@ -585,27 +574,26 @@
</attribute-exchange> </attribute-exchange>
</openid-login>]]></programlisting>The <quote>type</quote> of each OpenID attribute is a URI, </openid-login>]]></programlisting>The <quote>type</quote> of each OpenID attribute is a URI,
determined by a particular schema, in this case <link determined by a particular schema, in this case <link
xlink:href="http://axschema.org/">http://axschema.org/</link>. If an xlink:href="http://axschema.org/">http://axschema.org/</link>. If an attribute
attribute must be retrieved for successful authentication, the must be retrieved for successful authentication, the <literal>required</literal>
<literal>required</literal> attribute can be set. The exact schema and attribute can be set. The exact schema and attributes supported will depend on
attributes supported will depend on your OpenID provider. The attribute values your OpenID provider. The attribute values are returned as part of the
are returned as part of the authentication process and can be accessed authentication process and can be accessed afterwards using the following code:
afterwards using the following code:
<programlisting language="java"> <programlisting language="java">
OpenIDAuthenticationToken token = OpenIDAuthenticationToken token =
(OpenIDAuthenticationToken)SecurityContextHolder.getContext().getAuthentication(); (OpenIDAuthenticationToken)SecurityContextHolder.getContext().getAuthentication();
List&lt;OpenIDAttribute> attributes = token.getAttributes();</programlisting>The List&lt;OpenIDAttribute> attributes = token.getAttributes();</programlisting>The
<classname>OpenIDAttribute</classname> contains the attribute type and the <classname>OpenIDAttribute</classname> contains the attribute type and the
retrieved value (or values in the case of multi-valued attributes). We'll see retrieved value (or values in the case of multi-valued attributes). We'll see
more about how the <classname>SecurityContextHolder</classname> class is used more about how the <classname>SecurityContextHolder</classname> class is used
when we look at core Spring Security components in the <link when we look at core Spring Security components in the <link
xlink:href="#core-components">technical overview</link> chapter. Multiple xlink:href="#core-components">technical overview</link> chapter. Multiple
attribute exchange configurations are also be supported, if you wish to use attribute exchange configurations are also be supported, if you wish to use
multiple identity providers. You can supply multiple multiple identity providers. You can supply multiple
<literal>attribute-exchange</literal> elements, using an <literal>attribute-exchange</literal> elements, using an
<literal>identifier-matcher</literal> attribute on each. This contains a <literal>identifier-matcher</literal> attribute on each. This contains a regular
regular expression which will be matched against the OpenID identifier supplied expression which will be matched against the OpenID identifier supplied by the
by the user. See the OpenID sample application in the codebase for an example user. See the OpenID sample application in the codebase for an example
configuration, providing different attribute lists for the Google, Yahoo and configuration, providing different attribute lists for the Google, Yahoo and
MyOpenID providers.</para> MyOpenID providers.</para>
</section> </section>
@ -618,123 +606,122 @@ List&lt;OpenIDAttribute> attributes = token.getAttributes();</programlisting>The
which there isn't currently a namespace configuration option (CAS, for example). Or which there isn't currently a namespace configuration option (CAS, for example). Or
you might want to use a customized version of a standard namespace filter, such as you might want to use a customized version of a standard namespace filter, such as
the <literal>UsernamePasswordAuthenticationFilter</literal> which is created by the the <literal>UsernamePasswordAuthenticationFilter</literal> which is created by the
<literal>&lt;form-login&gt;</literal> element, taking advantage of some of the <literal>&lt;form-login&gt;</literal> element, taking advantage of some of the extra
extra configuration options which are available by using the bean explicitly. How configuration options which are available by using the bean explicitly. How can you
can you do this with namespace configuration, since the filter chain is not directly do this with namespace configuration, since the filter chain is not directly
exposed? </para> exposed? </para>
<para>The order of the filters is always strictly enforced when using the namespace. <para>The order of the filters is always strictly enforced when using the namespace.
When the application context is being created, the filter beans are sorted by the When the application context is being created, the filter beans are sorted by the
namespace handling code and the standard Spring Security filters each have an alias namespace handling code and the standard Spring Security filters each have an alias
in the namespace and a well-known position.<note> in the namespace and a well-known position.<note>
<para>In previous versions, the sorting took place after the filter instances <para>In previous versions, the sorting took place after the filter instances had
had been created, during post-processing of the application context. In been created, during post-processing of the application context. In version 3.0+
version 3.0+ the sorting is now done at the bean metadata level, before the the sorting is now done at the bean metadata level, before the classes have been
classes have been instantiated. This has implications for how you add your instantiated. This has implications for how you add your own filters to the
own filters to the stack as the entire filter list must be known during the stack as the entire filter list must be known during the parsing of the
parsing of the <literal>&lt;http></literal> element, so the syntax has <literal>&lt;http></literal> element, so the syntax has changed slightly in
changed slightly in 3.0.</para> 3.0.</para>
</note>The filters, aliases and namespace elements/attributes which create the </note>The filters, aliases and namespace elements/attributes which create the
filters are shown in <xref linkend="filter-stack"/>. The filters are listed in the filters are shown in <xref linkend="filter-stack"/>. The filters are listed in the
order in which they occur in the filter chain. <table xml:id="filter-stack"> order in which they occur in the filter chain. <table xml:id="filter-stack">
<title>Standard Filter Aliases and Ordering</title> <title>Standard Filter Aliases and Ordering</title>
<tgroup cols="3" align="left"> <tgroup cols="3" align="left">
<colspec colnum="1" colname="col1" colwidth="2*"/> <colspec colnum="1" colname="col1" colwidth="2*"/>
<colspec colnum="2" colname="col2" colwidth="2*"/> <colspec colnum="2" colname="col2" colwidth="2*"/>
<colspec colnum="3" colname="col3" colwidth="1*"/> <colspec colnum="3" colname="col3" colwidth="1*"/>
<thead> <thead>
<row> <row>
<entry align="center">Alias</entry> <entry align="center">Alias</entry>
<entry align="center">Filter Class</entry> <entry align="center">Filter Class</entry>
<entry align="center">Namespace Element or Attribute</entry> <entry align="center">Namespace Element or Attribute</entry>
</row> </row>
</thead> </thead>
<tbody> <tbody>
<row> <row>
<entry> CHANNEL_FILTER</entry> <entry> CHANNEL_FILTER</entry>
<entry><literal>ChannelProcessingFilter</literal></entry> <entry><literal>ChannelProcessingFilter</literal></entry>
<entry><literal>http/intercept-url@requires-channel</literal></entry> <entry><literal>http/intercept-url@requires-channel</literal></entry>
</row> </row>
<row> <row>
<entry> CONCURRENT_SESSION_FILTER</entry> <entry> CONCURRENT_SESSION_FILTER</entry>
<entry><literal>ConcurrentSessionFilter</literal> <entry><literal>ConcurrentSessionFilter</literal> </entry>
</entry> <entry><literal>session-management/concurrency-control</literal></entry>
<entry><literal>session-management/concurrency-control</literal></entry> </row>
</row> <row>
<row> <entry> SECURITY_CONTEXT_FILTER</entry>
<entry> SECURITY_CONTEXT_FILTER</entry> <entry><classname>SecurityContextPersistenceFilter</classname></entry>
<entry><classname>SecurityContextPersistenceFilter</classname></entry> <entry><literal>http</literal></entry>
<entry><literal>http</literal></entry> </row>
</row> <row>
<row> <entry> LOGOUT_FILTER </entry>
<entry> LOGOUT_FILTER </entry> <entry><literal>LogoutFilter</literal></entry>
<entry><literal>LogoutFilter</literal></entry> <entry><literal>http/logout</literal></entry>
<entry><literal>http/logout</literal></entry> </row>
</row> <row>
<row> <entry> X509_FILTER </entry>
<entry> X509_FILTER </entry> <entry><literal>X509AuthenticationFilter</literal></entry>
<entry><literal>X509AuthenticationFilter</literal></entry> <entry><literal>http/x509</literal></entry>
<entry><literal>http/x509</literal></entry> </row>
</row> <row>
<row> <entry> PRE_AUTH_FILTER </entry>
<entry> PRE_AUTH_FILTER </entry> <entry><literal>AstractPreAuthenticatedProcessingFilter</literal>
<entry><literal>AstractPreAuthenticatedProcessingFilter</literal> Subclasses</entry>
Subclasses</entry> <entry>N/A</entry>
<entry>N/A</entry> </row>
</row> <row>
<row> <entry> CAS_FILTER </entry>
<entry> CAS_FILTER </entry> <entry><literal>CasAuthenticationFilter</literal></entry>
<entry><literal>CasAuthenticationFilter</literal></entry> <entry>N/A</entry>
<entry>N/A</entry> </row>
</row> <row>
<row> <entry> FORM_LOGIN_FILTER </entry>
<entry> FORM_LOGIN_FILTER </entry> <entry><literal>UsernamePasswordAuthenticationFilter</literal></entry>
<entry><literal>UsernamePasswordAuthenticationFilter</literal></entry> <entry><literal>http/form-login</literal></entry>
<entry><literal>http/form-login</literal></entry> </row>
</row> <row>
<row> <entry> BASIC_AUTH_FILTER </entry>
<entry> BASIC_AUTH_FILTER </entry> <entry><literal>BasicAuthenticationFilter</literal></entry>
<entry><literal>BasicAuthenticationFilter</literal></entry> <entry><literal>http/http-basic</literal></entry>
<entry><literal>http/http-basic</literal></entry> </row>
</row> <row>
<row> <entry> SERVLET_API_SUPPORT_FILTER</entry>
<entry> SERVLET_API_SUPPORT_FILTER</entry> <entry><literal>SecurityContextHolderAwareFilter</literal></entry>
<entry><literal>SecurityContextHolderAwareFilter</literal></entry> <entry><literal>http/@servlet-api-provision</literal></entry>
<entry><literal>http/@servlet-api-provision</literal></entry> </row>
</row> <row>
<row> <entry> REMEMBER_ME_FILTER </entry>
<entry> REMEMBER_ME_FILTER </entry> <entry><classname>RememberMeAuthenticationFilter</classname></entry>
<entry><classname>RememberMeAuthenticationFilter</classname></entry> <entry><literal>http/remember-me</literal></entry>
<entry><literal>http/remember-me</literal></entry> </row>
</row> <row>
<row> <entry> ANONYMOUS_FILTER </entry>
<entry> ANONYMOUS_FILTER </entry> <entry><literal>AnonymousAuthenticationFilter</literal></entry>
<entry><literal>AnonymousAuthenticationFilter</literal></entry> <entry><literal>http/anonymous</literal></entry>
<entry><literal>http/anonymous</literal></entry> </row>
</row> <row>
<row> <entry> SESSION_MANAGEMENT_FILTER</entry>
<entry> SESSION_MANAGEMENT_FILTER</entry> <entry><literal>SessionManagementFilter</literal></entry>
<entry><literal>SessionManagementFilter</literal></entry> <entry><literal>session-management</literal></entry>
<entry><literal>session-management</literal></entry> </row>
</row> <row>
<row> <entry>EXCEPTION_TRANSLATION_FILTER </entry>
<entry>EXCEPTION_TRANSLATION_FILTER </entry> <entry><classname>ExceptionTranslationFilter</classname></entry>
<entry><classname>ExceptionTranslationFilter</classname></entry> <entry><literal>http</literal></entry>
<entry><literal>http</literal></entry> </row>
</row> <row>
<row> <entry> FILTER_SECURITY_INTERCEPTOR </entry>
<entry> FILTER_SECURITY_INTERCEPTOR </entry> <entry><classname>FilterSecurityInterceptor</classname></entry>
<entry><classname>FilterSecurityInterceptor</classname></entry> <entry><literal>http</literal></entry>
<entry><literal>http</literal></entry> </row>
</row> <row>
<row> <entry> SWITCH_USER_FILTER </entry>
<entry> SWITCH_USER_FILTER </entry> <entry><literal>SwitchUserFilter</literal></entry>
<entry><literal>SwitchUserFilter</literal></entry> <entry>N/A</entry>
<entry>N/A</entry> </row>
</row> </tbody>
</tbody> </tgroup>
</tgroup>
</table> You can add your own filter to the stack, using the </table> You can add your own filter to the stack, using the
<literal>custom-filter</literal> element and one of these names to specify the <literal>custom-filter</literal> element and one of these names to specify the
position your filter should appear at: <programlisting language="xml"><![CDATA[ position your filter should appear at: <programlisting language="xml"><![CDATA[
<http> <http>
<custom-filter position="FORM_LOGIN_FILTER" ref="myFilter" /> <custom-filter position="FORM_LOGIN_FILTER" ref="myFilter" />
@ -745,20 +732,20 @@ List&lt;OpenIDAttribute> attributes = token.getAttributes();</programlisting>The
</programlisting> You can also use the <literal>after</literal> or <literal>before</literal> </programlisting> You can also use the <literal>after</literal> or <literal>before</literal>
attributes if you want your filter to be inserted before or after another filter in attributes if you want your filter to be inserted before or after another filter in
the stack. The names "FIRST" and "LAST" can be used with the the stack. The names "FIRST" and "LAST" can be used with the
<literal>position</literal> attribute to indicate that you want your filter to <literal>position</literal> attribute to indicate that you want your filter to
appear before or after the entire stack, respectively. </para> appear before or after the entire stack, respectively. </para>
<tip> <tip>
<title>Avoiding filter position conflicts</title> <title>Avoiding filter position conflicts</title>
<para> If you are inserting a custom filter which may occupy the same position as <para> If you are inserting a custom filter which may occupy the same position as
one of the standard filters created by the namespace then it's important that one of the standard filters created by the namespace then it's important that
you don't include the namespace versions by mistake. Avoid using the you don't include the namespace versions by mistake. Avoid using the
<literal>auto-config</literal> attribute and remove any elements which <literal>auto-config</literal> attribute and remove any elements which create
create filters whose functionality you want to replace. </para> filters whose functionality you want to replace. </para>
<para> Note that you can't replace filters which are created by the use of the <para> Note that you can't replace filters which are created by the use of the
<literal>&lt;http&gt;</literal> element itself - <literal>&lt;http&gt;</literal> element itself -
<classname>SecurityContextPersistenceFilter</classname>, <classname>SecurityContextPersistenceFilter</classname>,
<classname>ExceptionTranslationFilter</classname> or <classname>ExceptionTranslationFilter</classname> or
<classname>FilterSecurityInterceptor</classname>. </para> <classname>FilterSecurityInterceptor</classname>. </para>
</tip> </tip>
<para> If you're replacing a namespace filter which requires an authentication entry <para> If you're replacing a namespace filter which requires an authentication entry
point (i.e. where the authentication process is triggered by an attempt by an point (i.e. where the authentication process is triggered by an attempt by an
@ -772,11 +759,11 @@ List&lt;OpenIDAttribute> attributes = token.getAttributes();</programlisting>The
a traditional bean syntax and link them into the namespace, as we've just seen. a traditional bean syntax and link them into the namespace, as we've just seen.
The corresponding <interfacename>AuthenticationEntryPoint</interfacename> can be The corresponding <interfacename>AuthenticationEntryPoint</interfacename> can be
set using the <literal>entry-point-ref</literal> attribute on the set using the <literal>entry-point-ref</literal> attribute on the
<literal>&lt;http&gt;</literal> element. </para> <literal>&lt;http&gt;</literal> element. </para>
<para> The CAS sample application is a good example of the use of custom beans with <para> The CAS sample application is a good example of the use of custom beans with
the namespace, including this syntax. If you aren't familiar with authentication the namespace, including this syntax. If you aren't familiar with authentication
entry points, they are discussed in the <link entry points, they are discussed in the <link
xlink:href="#tech-intro-auth-entry-point">technical overview</link> chapter. xlink:href="#tech-intro-auth-entry-point">technical overview</link> chapter.
</para> </para>
</section> </section>
</section> </section>
@ -787,9 +774,9 @@ List&lt;OpenIDAttribute> attributes = token.getAttributes();</programlisting>The
security to your service layer methods. It provides support for JSR-250 annotation security to your service layer methods. It provides support for JSR-250 annotation
security as well as the framework's original <literal>@Secured</literal> annotation. security as well as the framework's original <literal>@Secured</literal> annotation.
From 3.0 you can also make use of new <link xlink:href="#el-access">expression-based From 3.0 you can also make use of new <link xlink:href="#el-access">expression-based
annotations</link>. You can apply security to a single bean, using the annotations</link>. You can apply security to a single bean, using the
<literal>intercept-methods</literal> element to decorate the bean declaration, or <literal>intercept-methods</literal> element to decorate the bean declaration, or you
you can secure multiple beans across the entire service layer using the AspectJ style can secure multiple beans across the entire service layer using the AspectJ style
pointcuts. </para> pointcuts. </para>
<section xml:id="ns-global-method"> <section xml:id="ns-global-method">
<title>The <literal>&lt;global-method-security&gt;</literal> Element</title> <title>The <literal>&lt;global-method-security&gt;</literal> Element</title>
@ -797,14 +784,14 @@ List&lt;OpenIDAttribute> attributes = token.getAttributes();</programlisting>The
setting the appropriate attributes on the element), and also to group together setting the appropriate attributes on the element), and also to group together
security pointcut declarations which will be applied across your entire application security pointcut declarations which will be applied across your entire application
context. You should only declare one context. You should only declare one
<literal>&lt;global-method-security&gt;</literal> element. The following <literal>&lt;global-method-security&gt;</literal> element. The following declaration
declaration would enable support for Spring Security's <literal>@Secured</literal>: <programlisting><![CDATA[ would enable support for Spring Security's <literal>@Secured</literal>: <programlisting><![CDATA[
<global-method-security secured-annotations="enabled" /> <global-method-security secured-annotations="enabled" />
]]> ]]>
</programlisting> Adding an annotation to a method (on an class or interface) would then limit </programlisting> Adding an annotation to a method (on an class or interface) would then limit
the access to that method accordingly. Spring Security's native annotation support the access to that method accordingly. Spring Security's native annotation support
defines a set of attributes for the method. These will be passed to the defines a set of attributes for the method. These will be passed to the
<interfacename>AccessDecisionManager</interfacename> for it to make the actual <interfacename>AccessDecisionManager</interfacename> for it to make the actual
decision: decision:
<programlisting language="java"> <programlisting language="java">
public interface BankService { public interface BankService {
@ -843,16 +830,13 @@ List&lt;OpenIDAttribute> attributes = token.getAttributes();</programlisting>The
annotations are a good choice if you need to define simple rules that go beyond annotations are a good choice if you need to define simple rules that go beyond
checking the role names against the user's list of authorities. You can enable more checking the role names against the user's list of authorities. You can enable more
than one type of annotation in the same application, but you should avoid mixing than one type of annotation in the same application, but you should avoid mixing
annotations types in the same interface or class to avoid confusion. annotations types in the same interface or class to avoid confusion. <note>
<note> <para>The annotated methods will only be secured for instances which are defined as
<para>The annotated methods will only be secured for instances which are defined Spring beans (in the same application context in which method-security is
as Spring beans (in the same application context in which method-security enabled). If you want to secure instances which are not created by Spring (using
is enabled). If you want to secure instances which are not created by Spring the <literal>new</literal> operator, for example) then you need to use AspectJ.
(using the <literal>new</literal> operator, for example) then you need to use
AspectJ.
</para> </para>
</note> </note> </para>
</para>
<section xml:id="ns-protect-pointcut"> <section xml:id="ns-protect-pointcut">
<title>Adding Security Pointcuts using <literal>protect-pointcut</literal></title> <title>Adding Security Pointcuts using <literal>protect-pointcut</literal></title>
<para> The use of <literal>protect-pointcut</literal> is particularly powerful, as <para> The use of <literal>protect-pointcut</literal> is particularly powerful, as
@ -866,8 +850,8 @@ List&lt;OpenIDAttribute> attributes = token.getAttributes();</programlisting>The
</programlisting> This will protect all methods on beans declared in the application </programlisting> This will protect all methods on beans declared in the application
context whose classes are in the <literal>com.mycompany</literal> package and context whose classes are in the <literal>com.mycompany</literal> package and
whose class names end in "Service". Only users with the whose class names end in "Service". Only users with the
<literal>ROLE_USER</literal> role will be able to invoke these methods. As <literal>ROLE_USER</literal> role will be able to invoke these methods. As with
with URL matching, the most specific matches must come first in the list of URL matching, the most specific matches must come first in the list of
pointcuts, as the first matching expression will be used. </para> pointcuts, as the first matching expression will be used. </para>
</section> </section>
</section> </section>
@ -879,24 +863,24 @@ List&lt;OpenIDAttribute> attributes = token.getAttributes();</programlisting>The
later, as this section is only really relevant for people who need to do some later, as this section is only really relevant for people who need to do some
customization in order to use more than simple role-based security. </para> customization in order to use more than simple role-based security. </para>
<para> When you use a namespace configuration, a default instance of <para> When you use a namespace configuration, a default instance of
<interfacename>AccessDecisionManager</interfacename> is automatically registered for <interfacename>AccessDecisionManager</interfacename> is automatically registered for you
you and will be used for making access decisions for method invocations and web URL and will be used for making access decisions for method invocations and web URL access,
access, based on the access attributes you specify in your based on the access attributes you specify in your <literal>intercept-url</literal> and
<literal>intercept-url</literal> and <literal>protect-pointcut</literal> <literal>protect-pointcut</literal> declarations (and in annotations if you are using
declarations (and in annotations if you are using annotation secured methods). </para> annotation secured methods). </para>
<para> The default strategy is to use an <classname>AffirmativeBased</classname> <para> The default strategy is to use an <classname>AffirmativeBased</classname>
<interfacename>AccessDecisionManager</interfacename> with a <interfacename>AccessDecisionManager</interfacename> with a
<classname>RoleVoter</classname> and an <classname>AuthenticatedVoter</classname>. <classname>RoleVoter</classname> and an <classname>AuthenticatedVoter</classname>. You
You can find out more about these in the chapter on <link xlink:href="#authz-arch" can find out more about these in the chapter on <link xlink:href="#authz-arch"
>authorization</link>.</para> >authorization</link>.</para>
<section xml:id="ns-custom-access-mgr"> <section xml:id="ns-custom-access-mgr">
<title>Customizing the AccessDecisionManager</title> <title>Customizing the AccessDecisionManager</title>
<para> If you need to use a more complicated access control strategy then it is easy to <para> If you need to use a more complicated access control strategy then it is easy to
set an alternative for both method and web security. </para> set an alternative for both method and web security. </para>
<para> For method security, you do this by setting the <para> For method security, you do this by setting the
<literal>access-decision-manager-ref</literal> attribute on <literal>access-decision-manager-ref</literal> attribute on
<literal>global-method-security</literal> to the Id of the appropriate <literal>global-method-security</literal> to the Id of the appropriate
<interfacename>AccessDecisionManager</interfacename> bean in the application <interfacename>AccessDecisionManager</interfacename> bean in the application
context: <programlisting language="xml"><![CDATA[ context: <programlisting language="xml"><![CDATA[
<global-method-security access-decision-manager-ref="myAccessDecisionManagerBean"> <global-method-security access-decision-manager-ref="myAccessDecisionManagerBean">
... ...
@ -913,7 +897,7 @@ List&lt;OpenIDAttribute> attributes = token.getAttributes();</programlisting>The
<section xml:id="ns-auth-manager"> <section xml:id="ns-auth-manager">
<title>The Authentication Manager and the Namespace</title> <title>The Authentication Manager and the Namespace</title>
<para> The main interface which provides authentication services in Spring Security is the <para> The main interface which provides authentication services in Spring Security is the
<interfacename>AuthenticationManager</interfacename>. This is usually an instance of <interfacename>AuthenticationManager</interfacename>. This is usually an instance of
Spring Security's <classname>ProviderManager</classname> class, which you may already be Spring Security's <classname>ProviderManager</classname> class, which you may already be
familiar with if you've used the framework before. If not, it will be covered later, in familiar with if you've used the framework before. If not, it will be covered later, in
the <link xlink:href="#tech-intro-authentication">technical overview chapter</link>. The the <link xlink:href="#tech-intro-authentication">technical overview chapter</link>. The
@ -921,12 +905,12 @@ List&lt;OpenIDAttribute> attributes = token.getAttributes();</programlisting>The
namespace element. You can't use a custom <classname>AuthenticationManager</classname> namespace element. You can't use a custom <classname>AuthenticationManager</classname>
if you are using either HTTP or method security through the namespace, but this should if you are using either HTTP or method security through the namespace, but this should
not be a problem as you have full control over the not be a problem as you have full control over the
<classname>AuthenticationProvider</classname>s that are used.</para> <classname>AuthenticationProvider</classname>s that are used.</para>
<para> You may want to register additional <classname>AuthenticationProvider</classname> <para> You may want to register additional <classname>AuthenticationProvider</classname>
beans with the <classname>ProviderManager</classname> and you can do this using the beans with the <classname>ProviderManager</classname> and you can do this using the
<literal>&lt;authentication-provider&gt;</literal> element with the <literal>&lt;authentication-provider&gt;</literal> element with the
<literal>ref</literal> attribute, where the value of the attribute is the name of <literal>ref</literal> attribute, where the value of the attribute is the name of the
the provider bean you want to add. For example: <programlisting language="xml"><![CDATA[ provider bean you want to add. For example: <programlisting language="xml"><![CDATA[
<authentication-manager> <authentication-manager>
<authentication-provider ref="casAuthenticationProvider"/> <authentication-provider ref="casAuthenticationProvider"/>
</authentication-manager> </authentication-manager>