SEC-2951: Polish
This commit is contained in:
Rob Winch
parent
013177c644
commit
a46ad0f446
|
|
@ -1,6 +1,7 @@
|
|||
= Spring Security Reference
|
||||
Ben Alex; Luke Taylor; Rob Winch; Gunnar Hillert
|
||||
:include-dir: _includes
|
||||
:security-api-url: http://docs.spring.io/spring-security/site/docs/current/apidocs/
|
||||
|
||||
Spring Security is a powerful and highly customizable authentication and access-control framework. It is the de-facto standard for securing Spring-based applications.
|
||||
|
||||
|
|
@ -211,13 +212,13 @@ One (tedious) way to circumvent this issue would be to include all the Spring Fr
|
|||
----
|
||||
<dependencyManagement>
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<dependency>
|
||||
<groupId>org.springframework</groupId>
|
||||
<artifactId>spring-framework-bom</artifactId>
|
||||
<version>{spring-version}</version>
|
||||
<type>pom</type>
|
||||
<scope>import</scope>
|
||||
</dependency>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
</dependencyManagement>
|
||||
----
|
||||
|
|
@ -516,7 +517,7 @@ If you are not using Spring or Spring MVC, you will need to pass in the `Securit
|
|||
import org.springframework.security.web.context.*;
|
||||
|
||||
public class SecurityWebApplicationInitializer
|
||||
extends AbstractSecurityWebApplicationInitializer {
|
||||
extends AbstractSecurityWebApplicationInitializer {
|
||||
|
||||
public SecurityWebApplicationInitializer() {
|
||||
super(SecurityConfig.class);
|
||||
|
|
@ -538,7 +539,7 @@ If we were using Spring elsewhere in our application we probably already had a `
|
|||
import org.springframework.security.web.context.*;
|
||||
|
||||
public class SecurityWebApplicationInitializer
|
||||
extends AbstractSecurityWebApplicationInitializer {
|
||||
extends AbstractSecurityWebApplicationInitializer {
|
||||
|
||||
}
|
||||
----
|
||||
|
|
@ -692,7 +693,7 @@ protected void configure(HttpSecurity http) throws Exception {
|
|||
=== Handling Logouts
|
||||
|
||||
When using the
|
||||
`http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurerAdapter.html[WebSecurityConfigurerAdapter]`,
|
||||
`{security-api-url}org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurerAdapter.html[WebSecurityConfigurerAdapter]`,
|
||||
logout capabilities are automatically applied. The default is that accessing the
|
||||
URL `/logout` will log the user out by:
|
||||
|
||||
|
|
@ -709,22 +710,22 @@ to further customize your logout requirements:
|
|||
protected void configure(HttpSecurity http) throws Exception {
|
||||
http
|
||||
.logout() <1>
|
||||
.logoutUrl("/my/logout") <2>
|
||||
.logoutSuccessUrl("/my/index") <3>
|
||||
.logoutSuccessHandler(logoutSuccessHandler) <4>
|
||||
.invalidateHttpSession(true) <5>
|
||||
.addLogoutHandler(logoutHandler) <6>
|
||||
.deleteCookies(cookieNamesToClear) <7>
|
||||
.and()
|
||||
...
|
||||
.logoutUrl("/my/logout") <2>
|
||||
.logoutSuccessUrl("/my/index") <3>
|
||||
.logoutSuccessHandler(logoutSuccessHandler) <4>
|
||||
.invalidateHttpSession(true) <5>
|
||||
.addLogoutHandler(logoutHandler) <6>
|
||||
.deleteCookies(cookieNamesToClear) <7>
|
||||
.and()
|
||||
...
|
||||
}
|
||||
----
|
||||
|
||||
<1> Provides logout support. This is automatically applied when using `WebSecurityConfigurerAdapter`.
|
||||
<2> The URL that triggers log out to occur (default is `/logout`). If CSRF protection is enabled (default), then the request must also be a POST. For for information, please consult the http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/config/annotation/web/configurers/LogoutConfigurer.html#logoutUrl(java.lang.String)[JavaDoc].
|
||||
<3> The URL to redirect to after logout has occurred. The default is `/login?logout`. For for information, please consult the http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/config/annotation/web/configurers/LogoutConfigurer.html#logoutSuccessUrl(java.lang.String)[JavaDoc].
|
||||
<4> Let's you specify a custom `LogoutSuccessHandler`. If this is specified, `logoutSuccessUrl()` is ignored. For for information, please consult the http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/config/annotation/web/configurers/LogoutConfigurer.html#logoutSuccessHandler(org.springframework.security.web.authentication.logout.LogoutSuccessHandler)[JavaDoc].
|
||||
<5> Specify whether to invalidate the `HttpSession` at the time of logout. This is *true* by default. Configures the `SecurityContextLogoutHandler` under the covers. For for information, please consult the http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/config/annotation/web/configurers/LogoutConfigurer.html#invalidateHttpSession(boolean)[JavaDoc].
|
||||
<2> The URL that triggers log out to occur (default is `/logout`). If CSRF protection is enabled (default), then the request must also be a POST. For for information, please consult the {security-api-url}org/springframework/security/config/annotation/web/configurers/LogoutConfigurer.html#logoutUrl(java.lang.String)[JavaDoc].
|
||||
<3> The URL to redirect to after logout has occurred. The default is `/login?logout`. For for information, please consult the {security-api-url}org/springframework/security/config/annotation/web/configurers/LogoutConfigurer.html#logoutSuccessUrl(java.lang.String)[JavaDoc].
|
||||
<4> Let's you specify a custom `LogoutSuccessHandler`. If this is specified, `logoutSuccessUrl()` is ignored. For for information, please consult the {security-api-url}org/springframework/security/config/annotation/web/configurers/LogoutConfigurer.html#logoutSuccessHandler(org.springframework.security.web.authentication.logout.LogoutSuccessHandler)[JavaDoc].
|
||||
<5> Specify whether to invalidate the `HttpSession` at the time of logout. This is *true* by default. Configures the `SecurityContextLogoutHandler` under the covers. For for information, please consult the {security-api-url}org/springframework/security/config/annotation/web/configurers/LogoutConfigurer.html#invalidateHttpSession(boolean)[JavaDoc].
|
||||
<6> Adds a `LogoutHandler`. `SecurityContextLogoutHandler` is added as the last `LogoutHandler` by default.
|
||||
<7> Allows specifying the names of cookies to be removed on logout success. This is a shortcut for adding a `CookieClearingLogoutHandler` explicitly.
|
||||
|
||||
|
|
@ -734,25 +735,25 @@ Logouts can of course also be configured using the XML Namespace notation. Pleas
|
|||
====
|
||||
|
||||
Generally, in order to customize logout functionality, you can add
|
||||
`http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/web/authentication/logout/LogoutHandler.html[LogoutHandler]`
|
||||
`{security-api-url}org/springframework/security/web/authentication/logout/LogoutHandler.html[LogoutHandler]`
|
||||
and/or
|
||||
`http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/web/authentication/logout/LogoutSuccessHandler.html[LogoutSuccessHandler]`
|
||||
`{security-api-url}org/springframework/security/web/authentication/logout/LogoutSuccessHandler.html[LogoutSuccessHandler]`
|
||||
implementations. For many common scenarios, these handlers are applied under the
|
||||
covers when using the fluent API.
|
||||
|
||||
[[jc-logout-handler]]
|
||||
==== LogoutHandler
|
||||
|
||||
Generally, `http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/web/authentication/logout/LogoutHandler.html[LogoutHandler]`
|
||||
Generally, `{security-api-url}org/springframework/security/web/authentication/logout/LogoutHandler.html[LogoutHandler]`
|
||||
implementations indicate classes that are able to participate in logout handling.
|
||||
They are expected to be invoked to perform necessary cleanup. As such they should
|
||||
not throw exceptions. Various implementations are provided:
|
||||
|
||||
- http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServices.html[PersistentTokenBasedRememberMeServices]
|
||||
- http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/web/authentication/rememberme/TokenBasedRememberMeServices.html[TokenBasedRememberMeServices]
|
||||
- http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/web/authentication/logout/CookieClearingLogoutHandler.html[CookieClearingLogoutHandler]
|
||||
- http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/web/csrf/CsrfLogoutHandler.html[CsrfLogoutHandler]
|
||||
- http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/web/authentication/logout/SecurityContextLogoutHandler.html[SecurityContextLogoutHandler]
|
||||
- {security-api-url}org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServices.html[PersistentTokenBasedRememberMeServices]
|
||||
- {security-api-url}org/springframework/security/web/authentication/rememberme/TokenBasedRememberMeServices.html[TokenBasedRememberMeServices]
|
||||
- {security-api-url}org/springframework/security/web/authentication/logout/CookieClearingLogoutHandler.html[CookieClearingLogoutHandler]
|
||||
- {security-api-url}org/springframework/security/web/csrf/CsrfLogoutHandler.html[CsrfLogoutHandler]
|
||||
- {security-api-url}org/springframework/security/web/authentication/logout/SecurityContextLogoutHandler.html[SecurityContextLogoutHandler]
|
||||
|
||||
Please see <<remember-me-impls>> for details.
|
||||
|
||||
|
|
@ -771,7 +772,7 @@ interface is almost the same as the `LogoutHandler` but may raise an exception.
|
|||
|
||||
The following implementations are provided:
|
||||
|
||||
- http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/web/authentication/logout/SimpleUrlLogoutSuccessHandler.html[SimpleUrlLogoutSuccessHandler]
|
||||
- {security-api-url}org/springframework/security/web/authentication/logout/SimpleUrlLogoutSuccessHandler.html[SimpleUrlLogoutSuccessHandler]
|
||||
- HttpStatusReturningLogoutSuccessHandler
|
||||
|
||||
As mentioned above, you don't need to specify the `SimpleUrlLogoutSuccessHandler` directly.
|
||||
|
|
@ -1091,9 +1092,9 @@ To start using the security namespace in your application context, you need to h
|
|||
xmlns:security="http://www.springframework.org/schema/security"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://www.springframework.org/schema/beans
|
||||
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
|
||||
http://www.springframework.org/schema/security
|
||||
http://www.springframework.org/schema/security/spring-security.xsd">
|
||||
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
|
||||
http://www.springframework.org/schema/security
|
||||
http://www.springframework.org/schema/security/spring-security.xsd">
|
||||
...
|
||||
</beans>
|
||||
----
|
||||
|
|
@ -1111,9 +1112,9 @@ In many of the examples you will see (and in the sample) applications, we
|
|||
xmlns:beans="http://www.springframework.org/schema/beans"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://www.springframework.org/schema/beans
|
||||
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
|
||||
http://www.springframework.org/schema/security
|
||||
http://www.springframework.org/schema/security/spring-security.xsd">
|
||||
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
|
||||
http://www.springframework.org/schema/security
|
||||
http://www.springframework.org/schema/security/spring-security.xsd">
|
||||
...
|
||||
</beans:beans>
|
||||
----
|
||||
|
|
@ -1200,8 +1201,8 @@ To add some users, you can define a set of test data directly in the namespace:
|
|||
<authentication-manager>
|
||||
<authentication-provider>
|
||||
<user-service>
|
||||
<user name="jimi" password="jimispassword" authorities="ROLE_USER, ROLE_ADMIN" />
|
||||
<user name="bob" password="bobspassword" authorities="ROLE_USER" />
|
||||
<user name="jimi" password="jimispassword" authorities="ROLE_USER, ROLE_ADMIN" />
|
||||
<user name="bob" password="bobspassword" authorities="ROLE_USER" />
|
||||
</user-service>
|
||||
</authentication-provider>
|
||||
</authentication-manager>
|
||||
|
|
@ -1276,7 +1277,7 @@ If a form login isn't prompted by an attempt to access a protected resource, the
|
|||
<http use-expressions="false">
|
||||
<intercept-url pattern='/**' access='ROLE_USER' />
|
||||
<form-login login-page='/login.htm' default-target-url='/home.htm'
|
||||
always-use-default-target='true' />
|
||||
always-use-default-target='true' />
|
||||
</http>
|
||||
----
|
||||
|
||||
|
|
@ -1350,9 +1351,9 @@ Passwords should always be encoded using a secure hashing algorithm designed for
|
|||
<authentication-provider>
|
||||
<password-encoder ref="bcryptEncoder"/>
|
||||
<user-service>
|
||||
<user name="jimi" password="d7e6351eaa13189a5a3641bab846c8e8c69ba39f"
|
||||
<user name="jimi" password="d7e6351eaa13189a5a3641bab846c8e8c69ba39f"
|
||||
authorities="ROLE_USER, ROLE_ADMIN" />
|
||||
<user name="bob" password="4e7421b1b8765d8f9406d87e7cc6aa784c4ab97f"
|
||||
<user name="bob" password="4e7421b1b8765d8f9406d87e7cc6aa784c4ab97f"
|
||||
authorities="ROLE_USER" />
|
||||
</user-service>
|
||||
</authentication-provider>
|
||||
|
|
@ -1458,7 +1459,7 @@ Then add the following lines to your application context:
|
|||
<http>
|
||||
...
|
||||
<session-management>
|
||||
<concurrency-control max-sessions="1" />
|
||||
<concurrency-control max-sessions="1" />
|
||||
</session-management>
|
||||
</http>
|
||||
----
|
||||
|
|
@ -1470,7 +1471,7 @@ This will prevent a user from logging in multiple times - a second login will ca
|
|||
<http>
|
||||
...
|
||||
<session-management>
|
||||
<concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
|
||||
<concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
|
||||
</session-management>
|
||||
</http>
|
||||
----
|
||||
|
|
@ -1758,7 +1759,7 @@ The use of `protect-pointcut` is particularly powerful, as it allows you to appl
|
|||
----
|
||||
<global-method-security>
|
||||
<protect-pointcut expression="execution(* com.mycompany.*Service.*(..))"
|
||||
access="ROLE_USER"/>
|
||||
access="ROLE_USER"/>
|
||||
</global-method-security>
|
||||
----
|
||||
|
||||
|
|
@ -1822,7 +1823,7 @@ Another common requirement is that another bean in the context may require a ref
|
|||
</security:authentication-manager>
|
||||
|
||||
<bean id="customizedFormLoginFilter"
|
||||
class="com.somecompany.security.web.CustomFormLoginFilter">
|
||||
class="com.somecompany.security.web.CustomFormLoginFilter">
|
||||
<property name="authenticationManager" ref="authenticationManager"/>
|
||||
...
|
||||
</bean>
|
||||
|
|
@ -2075,21 +2076,21 @@ public static void main(String[] args) throws Exception {
|
|||
BufferedReader in = new BufferedReader(new InputStreamReader(System.in));
|
||||
|
||||
while(true) {
|
||||
System.out.println("Please enter your username:");
|
||||
String name = in.readLine();
|
||||
System.out.println("Please enter your password:");
|
||||
String password = in.readLine();
|
||||
try {
|
||||
System.out.println("Please enter your username:");
|
||||
String name = in.readLine();
|
||||
System.out.println("Please enter your password:");
|
||||
String password = in.readLine();
|
||||
try {
|
||||
Authentication request = new UsernamePasswordAuthenticationToken(name, password);
|
||||
Authentication result = am.authenticate(request);
|
||||
SecurityContextHolder.getContext().setAuthentication(result);
|
||||
break;
|
||||
} catch(AuthenticationException e) {
|
||||
} catch(AuthenticationException e) {
|
||||
System.out.println("Authentication failed: " + e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
System.out.println("Successfully authenticated. Security context contains: " +
|
||||
SecurityContextHolder.getContext().getAuthentication());
|
||||
SecurityContextHolder.getContext().getAuthentication());
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -2102,10 +2103,10 @@ static {
|
|||
|
||||
public Authentication authenticate(Authentication auth) throws AuthenticationException {
|
||||
if (auth.getName().equals(auth.getCredentials())) {
|
||||
return new UsernamePasswordAuthenticationToken(auth.getName(),
|
||||
return new UsernamePasswordAuthenticationToken(auth.getName(),
|
||||
auth.getCredentials(), AUTHORITIES);
|
||||
}
|
||||
throw new BadCredentialsException("Bad Credentials");
|
||||
}
|
||||
throw new BadCredentialsException("Bad Credentials");
|
||||
}
|
||||
}
|
||||
----
|
||||
|
|
@ -2384,7 +2385,7 @@ Spring Security also includes a `UserDetailsService` that can obtain authenticat
|
|||
</bean>
|
||||
|
||||
<bean id="userDetailsService"
|
||||
class="org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl">
|
||||
class="org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl">
|
||||
<property name="dataSource" ref="dataSource"/>
|
||||
</bean>
|
||||
----
|
||||
|
|
@ -2471,16 +2472,16 @@ Spring Security's web infrastructure should only be used by delegating to an ins
|
|||
<bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy">
|
||||
<constructor-arg>
|
||||
<list>
|
||||
<sec:filter-chain pattern="/restful/**" filters="
|
||||
securityContextPersistenceFilterWithASCFalse,
|
||||
basicAuthenticationFilter,
|
||||
exceptionTranslationFilter,
|
||||
filterSecurityInterceptor" />
|
||||
<sec:filter-chain pattern="/**" filters="
|
||||
securityContextPersistenceFilterWithASCTrue,
|
||||
formLoginFilter,
|
||||
exceptionTranslationFilter,
|
||||
filterSecurityInterceptor" />
|
||||
<sec:filter-chain pattern="/restful/**" filters="
|
||||
securityContextPersistenceFilterWithASCFalse,
|
||||
basicAuthenticationFilter,
|
||||
exceptionTranslationFilter,
|
||||
filterSecurityInterceptor" />
|
||||
<sec:filter-chain pattern="/**" filters="
|
||||
securityContextPersistenceFilterWithASCTrue,
|
||||
formLoginFilter,
|
||||
exceptionTranslationFilter,
|
||||
filterSecurityInterceptor" />
|
||||
</list>
|
||||
</constructor-arg>
|
||||
</bean>
|
||||
|
|
@ -2567,13 +2568,13 @@ We've already seen `FilterSecurityInterceptor` briefly when discussing <<tech-in
|
|||
[source,xml]
|
||||
----
|
||||
<bean id="filterSecurityInterceptor"
|
||||
class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
|
||||
class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
|
||||
<property name="authenticationManager" ref="authenticationManager"/>
|
||||
<property name="accessDecisionManager" ref="accessDecisionManager"/>
|
||||
<property name="securityMetadataSource">
|
||||
<security:filter-security-metadata-source>
|
||||
<security:intercept-url pattern="/secure/super/**" access="ROLE_WE_DONT_HAVE"/>
|
||||
<security:intercept-url pattern="/secure/**" access="ROLE_SUPERVISOR,ROLE_TELLER"/>
|
||||
<security:intercept-url pattern="/secure/super/**" access="ROLE_WE_DONT_HAVE"/>
|
||||
<security:intercept-url pattern="/secure/**" access="ROLE_SUPERVISOR,ROLE_TELLER"/>
|
||||
</security:filter-security-metadata-source>
|
||||
</property>
|
||||
</bean>
|
||||
|
|
@ -2590,14 +2591,14 @@ The `SecurityMetadataSource` created by the namespace syntax obtains the configu
|
|||
[source,xml]
|
||||
----
|
||||
<bean id="filterInvocationInterceptor"
|
||||
class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
|
||||
class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
|
||||
<property name="authenticationManager" ref="authenticationManager"/>
|
||||
<property name="accessDecisionManager" ref="accessDecisionManager"/>
|
||||
<property name="runAsManager" ref="runAsManager"/>
|
||||
<property name="securityMetadataSource">
|
||||
<security:filter-security-metadata-source request-matcher="regex">
|
||||
<security:intercept-url pattern="\A/secure/super/.*\Z" access="ROLE_WE_DONT_HAVE"/>
|
||||
<security:intercept-url pattern="\A/secure/.*\" access="ROLE_SUPERVISOR,ROLE_TELLER"/>
|
||||
<security:intercept-url pattern="\A/secure/super/.*\Z" access="ROLE_WE_DONT_HAVE"/>
|
||||
<security:intercept-url pattern="\A/secure/.*\" access="ROLE_SUPERVISOR,ROLE_TELLER"/>
|
||||
</security:filter-security-metadata-source>
|
||||
</property>
|
||||
</bean>
|
||||
|
|
@ -2624,7 +2625,7 @@ class="org.springframework.security.web.authentication.LoginUrlAuthenticationEnt
|
|||
</bean>
|
||||
|
||||
<bean id="accessDeniedHandler"
|
||||
class="org.springframework.security.web.access.AccessDeniedHandlerImpl">
|
||||
class="org.springframework.security.web.access.AccessDeniedHandlerImpl">
|
||||
<property name="errorPage" value="/accessDenied.htm"/>
|
||||
</bean>
|
||||
|
||||
|
|
@ -2679,7 +2680,7 @@ public interface SecurityContextRepository {
|
|||
SecurityContext loadContext(HttpRequestResponseHolder requestResponseHolder);
|
||||
|
||||
void saveContext(SecurityContext context, HttpServletRequest request,
|
||||
HttpServletResponse response);
|
||||
HttpServletResponse response);
|
||||
}
|
||||
----
|
||||
|
||||
|
|
@ -2693,7 +2694,7 @@ The default implementation is `HttpSessionSecurityContextRepository`, which stor
|
|||
class="org.springframework.security.web.context.SecurityContextPersistenceFilter">
|
||||
<property name='securityContextRepository'>
|
||||
<bean class='org.springframework.security.web.context.HttpSessionSecurityContextRepository'>
|
||||
<property name='allowSessionCreation' value='false' />
|
||||
<property name='allowSessionCreation' value='false' />
|
||||
</bean>
|
||||
</property>
|
||||
</bean>
|
||||
|
|
@ -3123,16 +3124,16 @@ Now pretend you authenticate to your bank's website and then, without logging ou
|
|||
----
|
||||
<form action="https://bank.example.com/transfer" method="post">
|
||||
<input type="hidden"
|
||||
name="amount"
|
||||
value="100.00"/>
|
||||
name="amount"
|
||||
value="100.00"/>
|
||||
<input type="hidden"
|
||||
name="routingNumber"
|
||||
value="evilsRoutingNumber"/>
|
||||
name="routingNumber"
|
||||
value="evilsRoutingNumber"/>
|
||||
<input type="hidden"
|
||||
name="account"
|
||||
value="evilsAccountNumber"/>
|
||||
name="account"
|
||||
value="evilsAccountNumber"/>
|
||||
<input type="submit"
|
||||
value="Win Money!"/>
|
||||
value="Win Money!"/>
|
||||
</form>
|
||||
----
|
||||
|
||||
|
|
@ -3177,7 +3178,7 @@ A common question is "do I need to protect JSON requests made by javascript?" Th
|
|||
<form action="https://bank.example.com/transfer" method="post" enctype="text/plain">
|
||||
<input name='{"amount":100,"routingNumber":"evilsRoutingNumber","account":"evilsAccountNumber", "ignore_me":"' value='test"}' type='hidden'>
|
||||
<input type="submit"
|
||||
value="Win Money!"/>
|
||||
value="Win Money!"/>
|
||||
</form>
|
||||
----
|
||||
|
||||
|
|
@ -3201,7 +3202,7 @@ If an application were not validating the Content-Type, then it would be exposed
|
|||
<form action="https://bank.example.com/transfer.json" method="post" enctype="text/plain">
|
||||
<input name='{"amount":100,"routingNumber":"evilsRoutingNumber","account":"evilsAccountNumber", "ignore_me":"' value='test"}' type='hidden'>
|
||||
<input type="submit"
|
||||
value="Win Money!"/>
|
||||
value="Win Money!"/>
|
||||
</form>
|
||||
----
|
||||
|
||||
|
|
@ -3252,7 +3253,7 @@ WebSecurityConfigurerAdapter {
|
|||
@Override
|
||||
protected void configure(HttpSecurity http) throws Exception {
|
||||
http
|
||||
.csrf().disable();
|
||||
.csrf().disable();
|
||||
}
|
||||
}
|
||||
----
|
||||
|
|
@ -3368,12 +3369,12 @@ If you really want to use HTTP GET with logout you can do so, but remember this
|
|||
public class WebSecurityConfig extends
|
||||
WebSecurityConfigurerAdapter {
|
||||
|
||||
@Override
|
||||
protected void configure(HttpSecurity http) throws Exception {
|
||||
http
|
||||
.logout()
|
||||
.logoutRequestMatcher(new AntPathRequestMatcher("/logout"));
|
||||
}
|
||||
@Override
|
||||
protected void configure(HttpSecurity http) throws Exception {
|
||||
http
|
||||
.logout()
|
||||
.logoutRequestMatcher(new AntPathRequestMatcher("/logout"));
|
||||
}
|
||||
}
|
||||
----
|
||||
|
||||
|
|
@ -3511,8 +3512,8 @@ WebSecurityConfigurerAdapter {
|
|||
@Override
|
||||
protected void configure(HttpSecurity http) throws Exception {
|
||||
http
|
||||
// ...
|
||||
.headers()
|
||||
// ...
|
||||
.headers()
|
||||
.frameOptions()
|
||||
.sameOrigin()
|
||||
.and()
|
||||
|
|
@ -3549,9 +3550,9 @@ WebSecurityConfigurerAdapter {
|
|||
@Override
|
||||
protected void configure(HttpSecurity http) throws Exception {
|
||||
http
|
||||
// ...
|
||||
.headers()
|
||||
// do not use any default headers unless explicitly listed
|
||||
// ...
|
||||
.headers()
|
||||
// do not use any default headers unless explicitly listed
|
||||
.defaultsDisabled()
|
||||
.cacheControl();
|
||||
}
|
||||
|
|
@ -3583,8 +3584,8 @@ WebSecurityConfigurerAdapter {
|
|||
@Override
|
||||
protected void configure(HttpSecurity http) throws Exception {
|
||||
http
|
||||
// ...
|
||||
.headers().disable();
|
||||
// ...
|
||||
.headers().disable();
|
||||
}
|
||||
}
|
||||
----
|
||||
|
|
@ -3636,8 +3637,8 @@ WebSecurityConfigurerAdapter {
|
|||
@Override
|
||||
protected void configure(HttpSecurity http) throws Exception {
|
||||
http
|
||||
// ...
|
||||
.headers()
|
||||
// ...
|
||||
.headers()
|
||||
.defaultsDisabled()
|
||||
.cacheControl();
|
||||
}
|
||||
|
|
@ -3708,8 +3709,8 @@ WebSecurityConfigurerAdapter {
|
|||
@Override
|
||||
protected void configure(HttpSecurity http) throws Exception {
|
||||
http
|
||||
// ...
|
||||
.headers()
|
||||
// ...
|
||||
.headers()
|
||||
.defaultsDisabled()
|
||||
.contentTypeOptions();
|
||||
}
|
||||
|
|
@ -3762,8 +3763,8 @@ WebSecurityConfigurerAdapter {
|
|||
@Override
|
||||
protected void configure(HttpSecurity http) throws Exception {
|
||||
http
|
||||
// ...
|
||||
.headers()
|
||||
// ...
|
||||
.headers()
|
||||
.httpStrictTransportSecurity()
|
||||
.includeSubdomains(true)
|
||||
.maxAgeSeconds(31536000);
|
||||
|
|
@ -3802,7 +3803,7 @@ For example, the following will instruct Spring Security to use "X-Frame-Options
|
|||
|
||||
<headers>
|
||||
<frame-options
|
||||
policy="SAMEORIGIN" />
|
||||
policy="SAMEORIGIN" />
|
||||
</headers>
|
||||
</http>
|
||||
----
|
||||
|
|
@ -3818,8 +3819,8 @@ WebSecurityConfigurerAdapter {
|
|||
@Override
|
||||
protected void configure(HttpSecurity http) throws Exception {
|
||||
http
|
||||
// ...
|
||||
.headers()
|
||||
// ...
|
||||
.headers()
|
||||
.frameOptions()
|
||||
.sameOrigin();
|
||||
}
|
||||
|
|
@ -3861,8 +3862,8 @@ WebSecurityConfigurerAdapter {
|
|||
@Override
|
||||
protected void configure(HttpSecurity http) throws Exception {
|
||||
http
|
||||
// ...
|
||||
.headers()
|
||||
// ...
|
||||
.headers()
|
||||
.xssProtection()
|
||||
.block(false);
|
||||
}
|
||||
|
|
@ -3892,12 +3893,12 @@ When using the XML namespace, these headers can be added to the response using t
|
|||
[source,xml]
|
||||
----
|
||||
<http>
|
||||
<!-- ... -->
|
||||
<!-- ... -->
|
||||
|
||||
<headers>
|
||||
<header name="X-Content-Security-Policy" value="default-src 'self'"/>
|
||||
<header name="X-WebKit-CSP" value="default-src 'self'"/>
|
||||
</headers>
|
||||
<headers>
|
||||
<header name="X-Content-Security-Policy" value="default-src 'self'"/>
|
||||
<header name="X-WebKit-CSP" value="default-src 'self'"/>
|
||||
</headers>
|
||||
</http>
|
||||
----
|
||||
|
||||
|
|
@ -3912,8 +3913,8 @@ WebSecurityConfigurerAdapter {
|
|||
@Override
|
||||
protected void configure(HttpSecurity http) throws Exception {
|
||||
http
|
||||
// ...
|
||||
.headers()
|
||||
// ...
|
||||
.headers()
|
||||
.addHeaderWriter(new StaticHeadersWriter("X-Content-Security-Policy","default-src 'self'"))
|
||||
.addHeaderWriter(new StaticHeadersWriter("X-WebKit-CSP","default-src 'self'"));
|
||||
}
|
||||
|
|
@ -3956,8 +3957,8 @@ WebSecurityConfigurerAdapter {
|
|||
@Override
|
||||
protected void configure(HttpSecurity http) throws Exception {
|
||||
http
|
||||
// ...
|
||||
.headers()
|
||||
// ...
|
||||
.headers()
|
||||
.addHeaderWriter(new XFrameOptionsHeaderWriter(XFrameOptionsMode.SAMEORIGIN));
|
||||
}
|
||||
}
|
||||
|
|
@ -4010,8 +4011,8 @@ protected void configure(HttpSecurity http) throws Exception {
|
|||
DelegatingRequestMatcherHeaderWriter headerWriter =
|
||||
new DelegatingRequestMatcherHeaderWriter(matcher,new XFrameOptionsHeaderWriter());
|
||||
http
|
||||
// ...
|
||||
.headers()
|
||||
// ...
|
||||
.headers()
|
||||
.frameOptions().disabled()
|
||||
.addHeaderWriter(headerWriter);
|
||||
}
|
||||
|
|
@ -4079,7 +4080,7 @@ To use concurrent session support, you'll need to add the following to `web.xml`
|
|||
|
||||
<listener>
|
||||
<listener-class>
|
||||
org.springframework.security.web.session.HttpSessionEventPublisher
|
||||
org.springframework.security.web.session.HttpSessionEventPublisher
|
||||
</listener-class>
|
||||
</listener>
|
||||
----
|
||||
|
|
@ -4113,16 +4114,16 @@ class="org.springframework.security.web.session.ConcurrentSessionFilter">
|
|||
<beans:bean id="sas" class="org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy">
|
||||
<beans:constructor-arg>
|
||||
<beans:list>
|
||||
<beans:bean class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy">
|
||||
<beans:bean class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy">
|
||||
<beans:constructor-arg ref="sessionRegistry"/>
|
||||
<beans:property name="maximumSessions" value="1" />
|
||||
<beans:property name="exceptionIfMaximumExceeded" value="true" />
|
||||
</beans:bean>
|
||||
<beans:bean class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy">
|
||||
</beans:bean>
|
||||
<beans:bean class="org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy">
|
||||
</beans:bean>
|
||||
<beans:bean class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy">
|
||||
</beans:bean>
|
||||
<beans:bean class="org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy">
|
||||
<beans:constructor-arg ref="sessionRegistry"/>
|
||||
</beans:bean>
|
||||
</beans:bean>
|
||||
</beans:list>
|
||||
</beans:constructor-arg>
|
||||
</beans:bean>
|
||||
|
|
@ -4199,11 +4200,11 @@ As explained earlier, the benefit of anonymous authentication is that all URI pa
|
|||
<property name="accessDecisionManager" ref="httpRequestAccessDecisionManager"/>
|
||||
<property name="securityMetadata">
|
||||
<security:filter-security-metadata-source>
|
||||
<security:intercept-url pattern='/index.jsp' access='ROLE_ANONYMOUS,ROLE_USER'/>
|
||||
<security:intercept-url pattern='/hello.htm' access='ROLE_ANONYMOUS,ROLE_USER'/>
|
||||
<security:intercept-url pattern='/logoff.jsp' access='ROLE_ANONYMOUS,ROLE_USER'/>
|
||||
<security:intercept-url pattern='/login.jsp' access='ROLE_ANONYMOUS,ROLE_USER'/>
|
||||
<security:intercept-url pattern='/**' access='ROLE_USER'/>
|
||||
<security:intercept-url pattern='/index.jsp' access='ROLE_ANONYMOUS,ROLE_USER'/>
|
||||
<security:intercept-url pattern='/hello.htm' access='ROLE_ANONYMOUS,ROLE_USER'/>
|
||||
<security:intercept-url pattern='/logoff.jsp' access='ROLE_ANONYMOUS,ROLE_USER'/>
|
||||
<security:intercept-url pattern='/login.jsp' access='ROLE_ANONYMOUS,ROLE_USER'/>
|
||||
<security:intercept-url pattern='/**' access='ROLE_USER'/>
|
||||
</security:filter-security-metadata-source>" +
|
||||
</property>
|
||||
</bean>
|
||||
|
|
@ -4389,8 +4390,8 @@ You can of course configure a `MethodSecurityIterceptor` directly in your applic
|
|||
<property name="afterInvocationManager" ref="afterInvocationManager"/>
|
||||
<property name="securityMetadataSource">
|
||||
<sec:method-security-metadata-source>
|
||||
<sec:protect method="com.mycompany.BankManager.delete*" access="ROLE_SUPERVISOR"/>
|
||||
<sec:protect method="com.mycompany.BankManager.getBalance" access="ROLE_TELLER,ROLE_SUPERVISOR"/>
|
||||
<sec:protect method="com.mycompany.BankManager.delete*" access="ROLE_SUPERVISOR"/>
|
||||
<sec:protect method="com.mycompany.BankManager.getBalance" access="ROLE_TELLER,ROLE_SUPERVISOR"/>
|
||||
</sec:method-security-metadata-source>
|
||||
</property>
|
||||
</bean>
|
||||
|
|
@ -4415,8 +4416,8 @@ Let's first consider how the `AspectJSecurityInterceptor` is configured in the S
|
|||
<property name="afterInvocationManager" ref="afterInvocationManager"/>
|
||||
<property name="securityMetadataSource">
|
||||
<sec:method-security-metadata-source>
|
||||
<sec:protect method="com.mycompany.BankManager.delete*" access="ROLE_SUPERVISOR"/>
|
||||
<sec:protect method="com.mycompany.BankManager.getBalance" access="ROLE_TELLER,ROLE_SUPERVISOR"/>
|
||||
<sec:protect method="com.mycompany.BankManager.delete*" access="ROLE_SUPERVISOR"/>
|
||||
<sec:protect method="com.mycompany.BankManager.getBalance" access="ROLE_TELLER,ROLE_SUPERVISOR"/>
|
||||
</sec:method-security-metadata-source>
|
||||
</property>
|
||||
</bean>
|
||||
|
|
@ -4484,8 +4485,8 @@ You will need to configure Spring to load the aspect and wire it with the `Aspec
|
|||
----
|
||||
|
||||
<bean id="domainObjectInstanceSecurityAspect"
|
||||
class="security.samples.aspectj.DomainObjectInstanceSecurityAspect"
|
||||
factory-method="aspectOf">
|
||||
class="security.samples.aspectj.DomainObjectInstanceSecurityAspect"
|
||||
factory-method="aspectOf">
|
||||
<property name="securityInterceptor" ref="bankManagerSecurity"/>
|
||||
</bean>
|
||||
----
|
||||
|
|
@ -4695,10 +4696,10 @@ There are some built-in expressions which are specific to method security, which
|
|||
[source,java]
|
||||
----
|
||||
boolean hasPermission(Authentication authentication, Object targetDomainObject,
|
||||
Object permission);
|
||||
Object permission);
|
||||
|
||||
boolean hasPermission(Authentication authentication, Serializable targetId,
|
||||
String targetType, Object permission);
|
||||
String targetType, Object permission);
|
||||
----
|
||||
|
||||
which map directly to the available versions of the expression, with the exception that the first argument (the `Authentication` object) is not supplied. The first is used in situations where the domain object, to which access is being controlled, is already loaded. Then expression will return true if the current user has the given permission for that object. The second version is used in cases where the object is not loaded, but its identifier is known. An abstract "type" specifier for the domain object is also required, allowing the correct ACL permissions to be loaded. This has traditionally been the Java class of the object, but does not have to be as long as it is consistent with how the permissions are loaded.
|
||||
|
|
@ -4713,7 +4714,7 @@ To use `hasPermission()` expressions, you have to explicitly configure a `Permis
|
|||
|
||||
<bean id="expressionHandler" class=
|
||||
"org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
|
||||
<property name="permissionEvaluator" ref="myPermissionEvaluator"/>
|
||||
<property name="permissionEvaluator" ref="myPermissionEvaluator"/>
|
||||
</bean>
|
||||
----
|
||||
|
||||
|
|
@ -4919,8 +4920,8 @@ A typical configuration using this filter would look like this:
|
|||
<bean id="preauthAuthProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
|
||||
<property name="preAuthenticatedUserDetailsService">
|
||||
<bean id="userDetailsServiceWrapper"
|
||||
class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
|
||||
<property name="userDetailsService" ref="userDetailsService"/>
|
||||
class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
|
||||
<property name="userDetailsService" ref="userDetailsService"/>
|
||||
</bean>
|
||||
</property>
|
||||
</bean>
|
||||
|
|
@ -5006,7 +5007,7 @@ This simple example would obtain the DN for the user by substituting the user lo
|
|||
[source,xml]
|
||||
----
|
||||
<ldap-authentication-provider user-search-filter="(uid={0})"
|
||||
user-search-base="ou=people"/>
|
||||
user-search-base="ou=people"/>
|
||||
----
|
||||
|
||||
If used with the server definition above, this would perform a search under the DN `ou=people,dc=springframework,dc=org` using the value of the `user-search-filter` attribute as a filter. Again the user login name is substituted for the parameter in the filter name, so it will search for an entry with the `uid` attribute equal to the user name. If `user-search-base` isn't supplied, the search will be performed from the root.
|
||||
|
|
@ -5097,18 +5098,18 @@ A typical configuration, using some of the beans we've discussed here, might loo
|
|||
class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider">
|
||||
<constructor-arg>
|
||||
<bean class="org.springframework.security.ldap.authentication.BindAuthenticator">
|
||||
<constructor-arg ref="contextSource"/>
|
||||
<property name="userDnPatterns">
|
||||
<list><value>uid={0},ou=people</value></list>
|
||||
</property>
|
||||
<constructor-arg ref="contextSource"/>
|
||||
<property name="userDnPatterns">
|
||||
<list><value>uid={0},ou=people</value></list>
|
||||
</property>
|
||||
</bean>
|
||||
</constructor-arg>
|
||||
<constructor-arg>
|
||||
<bean
|
||||
class="org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator">
|
||||
<constructor-arg ref="contextSource"/>
|
||||
<constructor-arg value="ou=groups"/>
|
||||
<property name="groupRoleAttribute" value="ou"/>
|
||||
class="org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator">
|
||||
<constructor-arg ref="contextSource"/>
|
||||
<constructor-arg value="ou=groups"/>
|
||||
<property name="groupRoleAttribute" value="ou"/>
|
||||
</bean>
|
||||
</constructor-arg>
|
||||
</bean>
|
||||
|
|
@ -5141,7 +5142,7 @@ The net result of an authentication using `LdapAuthenticationProvider` is the sa
|
|||
public interface UserDetailsContextMapper {
|
||||
|
||||
UserDetails mapUserFromContext(DirContextOperations ctx, String username,
|
||||
Collection<GrantedAuthority> authorities);
|
||||
Collection<GrantedAuthority> authorities);
|
||||
|
||||
void mapUserToContext(UserDetails user, DirContextAdapter ctx);
|
||||
}
|
||||
|
|
@ -5406,25 +5407,25 @@ class="org.springframework.security.authentication.jaas.DefaultJaasAuthenticatio
|
|||
<bean class="org.springframework.security.authentication.jaas.memory.InMemoryConfiguration">
|
||||
<constructor-arg>
|
||||
<map>
|
||||
<!--
|
||||
SPRINGSECURITY is the default loginContextName
|
||||
for AbstractJaasAuthenticationProvider
|
||||
-->
|
||||
<entry key="SPRINGSECURITY">
|
||||
<array>
|
||||
<bean class="javax.security.auth.login.AppConfigurationEntry">
|
||||
<!--
|
||||
SPRINGSECURITY is the default loginContextName
|
||||
for AbstractJaasAuthenticationProvider
|
||||
-->
|
||||
<entry key="SPRINGSECURITY">
|
||||
<array>
|
||||
<bean class="javax.security.auth.login.AppConfigurationEntry">
|
||||
<constructor-arg value="sample.SampleLoginModule" />
|
||||
<constructor-arg>
|
||||
<util:constant static-field=
|
||||
<constructor-arg>
|
||||
<util:constant static-field=
|
||||
"javax.security.auth.login.AppConfigurationEntry$LoginModuleControlFlag.REQUIRED"/>
|
||||
</constructor-arg>
|
||||
<constructor-arg>
|
||||
<map></map>
|
||||
</constructor-arg>
|
||||
</constructor-arg>
|
||||
<constructor-arg>
|
||||
<map></map>
|
||||
</constructor-arg>
|
||||
</bean>
|
||||
</array>
|
||||
</entry>
|
||||
</map>
|
||||
</array>
|
||||
</entry>
|
||||
</map>
|
||||
</constructor-arg>
|
||||
</bean>
|
||||
</property>
|
||||
|
|
@ -5465,14 +5466,14 @@ class="org.springframework.security.authentication.jaas.JaasAuthenticationProvid
|
|||
<property name="callbackHandlers">
|
||||
<list>
|
||||
<bean
|
||||
class="org.springframework.security.authentication.jaas.JaasNameCallbackHandler"/>
|
||||
class="org.springframework.security.authentication.jaas.JaasNameCallbackHandler"/>
|
||||
<bean
|
||||
class="org.springframework.security.authentication.jaas.JaasPasswordCallbackHandler"/>
|
||||
class="org.springframework.security.authentication.jaas.JaasPasswordCallbackHandler"/>
|
||||
</list>
|
||||
</property>
|
||||
<property name="authorityGranters">
|
||||
<list>
|
||||
<bean class="org.springframework.security.authentication.jaas.TestAuthorityGranter"/>
|
||||
<bean class="org.springframework.security.authentication.jaas.TestAuthorityGranter"/>
|
||||
</list>
|
||||
</property>
|
||||
</bean>
|
||||
|
|
@ -5545,9 +5546,9 @@ This section describes how to setup Spring Security to authenticate Service Tick
|
|||
[source,xml]
|
||||
----
|
||||
<bean id="serviceProperties"
|
||||
class="org.springframework.security.cas.ServiceProperties">
|
||||
class="org.springframework.security.cas.ServiceProperties">
|
||||
<property name="service"
|
||||
value="https://localhost:8443/cas-sample/login/cas"/>
|
||||
value="https://localhost:8443/cas-sample/login/cas"/>
|
||||
<property name="sendRenew" value="false"/>
|
||||
</bean>
|
||||
----
|
||||
|
|
@ -5564,12 +5565,12 @@ The following beans should be configured to commence the CAS authentication proc
|
|||
</security:http>
|
||||
|
||||
<bean id="casFilter"
|
||||
class="org.springframework.security.cas.web.CasAuthenticationFilter">
|
||||
class="org.springframework.security.cas.web.CasAuthenticationFilter">
|
||||
<property name="authenticationManager" ref="authenticationManager"/>
|
||||
</bean>
|
||||
|
||||
<bean id="casEntryPoint"
|
||||
class="org.springframework.security.cas.web.CasAuthenticationEntryPoint">
|
||||
class="org.springframework.security.cas.web.CasAuthenticationEntryPoint">
|
||||
<property name="loginUrl" value="https://localhost:9443/cas/login"/>
|
||||
<property name="serviceProperties" ref="serviceProperties"/>
|
||||
</bean>
|
||||
|
|
@ -5588,16 +5589,16 @@ Next you need to add a `CasAuthenticationProvider` and its collaborators:
|
|||
</security:authentication-manager>
|
||||
|
||||
<bean id="casAuthenticationProvider"
|
||||
class="org.springframework.security.cas.authentication.CasAuthenticationProvider">
|
||||
class="org.springframework.security.cas.authentication.CasAuthenticationProvider">
|
||||
<property name="authenticationUserDetailsService">
|
||||
<bean class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
|
||||
<constructor-arg ref="userService" />
|
||||
<constructor-arg ref="userService" />
|
||||
</bean>
|
||||
</property>
|
||||
<property name="serviceProperties" ref="serviceProperties" />
|
||||
<property name="ticketValidator">
|
||||
<bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator">
|
||||
<constructor-arg index="0" value="https://localhost:9443/cas" />
|
||||
<constructor-arg index="0" value="https://localhost:9443/cas" />
|
||||
</bean>
|
||||
</property>
|
||||
<property name="key" value="an_id_for_this_auth_provider_only"/>
|
||||
|
|
@ -5634,11 +5635,11 @@ The CAS protocol supports Single Logout and can be easily added to your Spring S
|
|||
|
||||
<!-- This filter redirects to the CAS Server to signal Single Logout should be performed -->
|
||||
<bean id="requestSingleLogoutFilter"
|
||||
class="org.springframework.security.web.authentication.logout.LogoutFilter">
|
||||
class="org.springframework.security.web.authentication.logout.LogoutFilter">
|
||||
<constructor-arg value="https://localhost:9443/cas/logout"/>
|
||||
<constructor-arg>
|
||||
<bean class=
|
||||
"org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"/>
|
||||
"org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"/>
|
||||
</constructor-arg>
|
||||
<property name="filterProcessesUrl" value="/logout/cas"/>
|
||||
</bean>
|
||||
|
|
@ -5713,10 +5714,10 @@ The next step is to update the `CasAuthenticationProvider` to be able to obtain
|
|||
...
|
||||
<property name="ticketValidator">
|
||||
<bean class="org.jasig.cas.client.validation.Cas20ProxyTicketValidator">
|
||||
<constructor-arg value="https://localhost:9443/cas"/>
|
||||
<constructor-arg value="https://localhost:9443/cas"/>
|
||||
<property name="proxyCallbackUrl"
|
||||
value="https://localhost:8443/cas-sample/login/cas/proxyreceptor"/>
|
||||
<property name="proxyGrantingTicketStorage" ref="pgtStorage"/>
|
||||
value="https://localhost:8443/cas-sample/login/cas/proxyreceptor"/>
|
||||
<property name="proxyGrantingTicketStorage" ref="pgtStorage"/>
|
||||
</bean>
|
||||
</property>
|
||||
</bean>
|
||||
|
|
@ -5771,7 +5772,7 @@ This section builds upon the previous sections to accomodate proxy ticket authen
|
|||
[source,xml]
|
||||
----
|
||||
<bean id="serviceProperties"
|
||||
class="org.springframework.security.cas.ServiceProperties">
|
||||
class="org.springframework.security.cas.ServiceProperties">
|
||||
...
|
||||
<property name="authenticateAllArtifacts" value="true"/>
|
||||
</bean>
|
||||
|
|
@ -5782,13 +5783,13 @@ The next step is to specify `serviceProperties` and the `authenticationDetailsSo
|
|||
[source,xml]
|
||||
----
|
||||
<bean id="casFilter"
|
||||
class="org.springframework.security.cas.web.CasAuthenticationFilter">
|
||||
class="org.springframework.security.cas.web.CasAuthenticationFilter">
|
||||
...
|
||||
<property name="serviceProperties" ref="serviceProperties"/>
|
||||
<property name="authenticationDetailsSource">
|
||||
<bean class=
|
||||
"org.springframework.security.cas.web.authentication.ServiceAuthenticationDetailsSource">
|
||||
<constructor-arg ref="serviceProperties"/>
|
||||
"org.springframework.security.cas.web.authentication.ServiceAuthenticationDetailsSource">
|
||||
<constructor-arg ref="serviceProperties"/>
|
||||
</bean>
|
||||
</property>
|
||||
</bean>
|
||||
|
|
@ -5804,23 +5805,23 @@ You will also need to update the `CasAuthenticationProvider` to handle proxy tic
|
|||
...
|
||||
<property name="ticketValidator">
|
||||
<bean class="org.jasig.cas.client.validation.Cas20ProxyTicketValidator">
|
||||
<constructor-arg value="https://localhost:9443/cas"/>
|
||||
<property name="acceptAnyProxy" value="true"/>
|
||||
<constructor-arg value="https://localhost:9443/cas"/>
|
||||
<property name="acceptAnyProxy" value="true"/>
|
||||
</bean>
|
||||
</property>
|
||||
<property name="statelessTicketCache">
|
||||
<bean class="org.springframework.security.cas.authentication.EhCacheBasedTicketCache">
|
||||
<property name="cache">
|
||||
<property name="cache">
|
||||
<bean class="net.sf.ehcache.Cache"
|
||||
init-method="initialise" destroy-method="dispose">
|
||||
<constructor-arg value="casTickets"/>
|
||||
<constructor-arg value="50"/>
|
||||
<constructor-arg value="true"/>
|
||||
<constructor-arg value="false"/>
|
||||
<constructor-arg value="3600"/>
|
||||
<constructor-arg value="900"/>
|
||||
<constructor-arg value="casTickets"/>
|
||||
<constructor-arg value="50"/>
|
||||
<constructor-arg value="true"/>
|
||||
<constructor-arg value="false"/>
|
||||
<constructor-arg value="3600"/>
|
||||
<constructor-arg value="900"/>
|
||||
</bean>
|
||||
</property>
|
||||
</property>
|
||||
</bean>
|
||||
</property>
|
||||
</bean>
|
||||
|
|
@ -6152,7 +6153,7 @@ private Executor executor; // becomes an instance of our DelegatingSecurityConte
|
|||
public void submitRunnable() {
|
||||
Runnable originalRunnable = new Runnable() {
|
||||
public void run() {
|
||||
// invoke secured service
|
||||
// invoke secured service
|
||||
}
|
||||
};
|
||||
executor.execute(originalRunnable);
|
||||
|
|
@ -6217,7 +6218,7 @@ import org.springframework.security.web.bind.annotation.AuthenticationPrincipal;
|
|||
@RequestMapping("/messages/inbox")
|
||||
public ModelAndView findMessagesForUser() {
|
||||
Authentication authentication =
|
||||
SecurityContextHolder.getContext().getAuthentication();
|
||||
SecurityContextHolder.getContext().getAuthentication();
|
||||
CustomUser custom = (CustomUser) authentication == null ? null : authentication.getPrincipal();
|
||||
|
||||
// .. find messags for this user and return them ...
|
||||
|
|
@ -6272,8 +6273,8 @@ public Callable<String> processUpload(final MultipartFile file) {
|
|||
|
||||
return new Callable<String>() {
|
||||
public Object call() throws Exception {
|
||||
// ...
|
||||
return "someView";
|
||||
// ...
|
||||
return "someView";
|
||||
}
|
||||
};
|
||||
}
|
||||
|
|
@ -6306,9 +6307,9 @@ Spring Security will automatically <<csrf-include-csrf-token,include the CSRF To
|
|||
<c:url var="logoutUrl" value="/logout"/>
|
||||
<form:form action="${logoutUrl}"
|
||||
method="post">
|
||||
<input type="submit"
|
||||
<input type="submit"
|
||||
value="Log out" />
|
||||
<input type="hidden"
|
||||
<input type="hidden"
|
||||
name="${_csrf.parameterName}"
|
||||
value="${_csrf.token}"/>
|
||||
</form:form>
|
||||
|
|
|
|||
Loading…
Reference in New Issue