diff --git a/doc/xdocs/upgrade/upgrade-090-100.html b/doc/xdocs/upgrade/upgrade-090-100.html
index 99af9438ac..93f82cf7ea 100644
--- a/doc/xdocs/upgrade/upgrade-090-100.html
+++ b/doc/xdocs/upgrade/upgrade-090-100.html
@@ -1,4 +1,8 @@
-
+
+
+
+
+
Acegi Security - Upgrading from version 0.8.0 to 1.0.0
@@ -8,86 +12,110 @@
The following should help most casual users of the project update their
applications:
+
-
-
- Changes 0.9.0 to RC1
+Changes 0.9.0 to RC1
- - The top level package name has changed. Simply find "net.sf.acegisecurity" and replace with
- "org.acegisecurity".
-
- -
- DaoAuthenticationProvider has a property, authenticationDao. This property should now be renamed to
- userDetailsService.
-
-
- -
- In JSPs, each "authz" taglib prefix must be changed from uri="http://acegisecurity.sf.net/authz"
- to uri="http://acegisecurity.org/authz".
-
-
- - net.sf.acegisecurity.providers.dao.AuthenticationDao is now org.acegisecurity.userdetails.UserDetailsService.
- The interface signature has not changed. Similarly, User and UserDetails have moved into the latter's package as well.
- If you've implemented your own AuthenticationDao, you'll need to change the class it's implementing and quite likely
- the import packages for User and UserDetails. In addition, if using JdbcDaoImpl or InMemoryDaoImpl please
- note they have moved to this new package.
-
- - Acegi Security is now localised. In net.sf.acegisecurity you will find a messages.properties. It is
- suggested to register this in your application context, perhaps using ReloadableResourceBundleMessageSource.
- If you do not do this, the default messages included in the source code will be used so this change is
- not critical. The Spring LocaleContextHolder class is used to determine the locale of messages included in
- exceptions. At present only the default messages.properties is included (which is in English). If
- you localise this file to another language, please consider attaching it to a
- new JIRA task
- so that we can include it in future Acegi Security releases.
-
- Changes RC1 to RC2
-
- -
- org.acegisecurity.ui.rememberme.RememberMeProcessingFilter now requires an authenticationManager property. This will generally
- point to an implementation of org.acegisecurity.providers.ProviderManager.
-
-
- -
- org.acegisecurity.intercept.web.AuthenticationEntryPoint has moved to a new location,
- org.acegisecurity.ui.AuthenticationEntryPoint.
-
-
- -
- org.acegisecurity.intercept.web.SecurityEnforcementFilter has moved to a new location and name,
- org.acegisecurity.ui.ExceptionTranslationFilter. In addition, the "filterSecurityInterceptor"
- property on the old SecurityEnforcementFilter class has been removed. This is because
- SecurityEnforcementFilter will no longer delegate to FilterSecurityInterceptor as it has in the
- past. Because this delegation feature has been removed (see SEC-144 for a background as to why),
- please add a new filter definition for FilterSecurityInterceptor to the end of your
- FilterChainProxy. Generally you'll also rename the old SecurityEnforcementFilter entry in your
- FilterChainProxy to ExceptionTranslationFilter, more accurately reflecting its purpose.
- If you are not using FilterChainProxy (although we recommend that you do), you will need to add
- an additional filter entry to web.xml and use FilterToBeanProxy to access the FilterSecurityInterceptor.
-
-
- -
- If you are directly using SecurityContextHolder.setContext(SecurityContext) - which is not
- very common - please not that best practise is now to call SecurityContextHolder.clearContext()
- if you wish to erase the contents of the SecurityContextHolder. Previously code such as
- SecurityContextHolder.setContext(new SecurityContextImpl()) would have been used. The revised
- method internally stores null, which helps avoids redeployment issue caused by the previous
- approaches (see SEC-159 for further details).
-
+
- Changes RC2 to Final
-
- -
- AbstractProcessingFilter.onUnsuccessfulAuthentication(HttpServletRequest, HttpServletResponse)
- has changed it signature (SEC-238). If subclassing, please override the new signature.
-
-
- -
- ExceptionTranslationFilter no longer provides a sendAccessDenied() method. Use the
- new AccessDeniedHandler instead if custom handling is required.
-
-
-
+- The top level package name has changed. Simply find "net.sf.acegisecurity" and replace with
+"org.acegisecurity".
+
+-
+DaoAuthenticationProvider has a property, authenticationDao. This property should now be renamed to
+userDetailsService.
+
+
+-
+In JSPs, each "authz" taglib prefix must be changed from uri="http://acegisecurity.sf.net/authz"
+to uri="http://acegisecurity.org/authz".
+
+
+- net.sf.acegisecurity.providers.dao.AuthenticationDao is now org.acegisecurity.userdetails.UserDetailsService.
+The interface signature has not changed. Similarly, User and UserDetails have moved into the latter's package as well.
+If you've implemented your own AuthenticationDao, you'll need to change the class it's implementing and quite likely
+the import packages for User and UserDetails. In addition, if using JdbcDaoImpl or InMemoryDaoImpl please
+note they have moved to this new package.
+
+- Acegi Security is now localised. In net.sf.acegisecurity you will find a messages.properties. It is
+suggested to register this in your application context, perhaps using ReloadableResourceBundleMessageSource.
+If you do not do this, the default messages included in the source code will be used so this change is
+not critical. The Spring LocaleContextHolder class is used to determine the locale of messages included in
+exceptions. At present only the default messages.properties is included (which is in English). If
+you localise this file to another language, please consider attaching it to a
+new JIRA task
+so that we can include it in future Acegi Security releases.
+
+
+
+
+Changes RC1 to RC2
+
+
+
+
+-
+org.acegisecurity.ui.rememberme.RememberMeProcessingFilter now requires an authenticationManager property. This will generally
+point to an implementation of org.acegisecurity.providers.ProviderManager.
+
+
+-
+org.acegisecurity.intercept.web.AuthenticationEntryPoint has moved to a new location,
+org.acegisecurity.ui.AuthenticationEntryPoint.
+
+
+-
+org.acegisecurity.intercept.web.SecurityEnforcementFilter has moved to a new location and name,
+org.acegisecurity.ui.ExceptionTranslationFilter. In addition, the "filterSecurityInterceptor"
+property on the old SecurityEnforcementFilter class has been removed. This is because
+SecurityEnforcementFilter will no longer delegate to FilterSecurityInterceptor as it has in the
+past. Because this delegation feature has been removed (see SEC-144 for a background as to why),
+please add a new filter definition for FilterSecurityInterceptor to the end of your
+FilterChainProxy. Generally you'll also rename the old SecurityEnforcementFilter entry in your
+FilterChainProxy to ExceptionTranslationFilter, more accurately reflecting its purpose.
+If you are not using FilterChainProxy (although we recommend that you do), you will need to add
+an additional filter entry to web.xml and use FilterToBeanProxy to access the FilterSecurityInterceptor.
+
+
+-
+If you are directly using SecurityContextHolder.setContext(SecurityContext) - which is not
+very common - please not that best practise is now to call SecurityContextHolder.clearContext()
+if you wish to erase the contents of the SecurityContextHolder. Previously code such as
+SecurityContextHolder.setContext(new SecurityContextImpl()) would have been used. The revised
+method internally stores null, which helps avoids redeployment issue caused by the previous
+approaches (see SEC-159 for further details).
+
+
+
+
+
+Changes RC2 to Final
+
+
+
+
+-
+AbstractProcessingFilter.onUnsuccessfulAuthentication(HttpServletRequest, HttpServletResponse)
+has changed it signature (SEC-238). If subclassing, please override the new signature.
+
+
+-
+ExceptionTranslationFilter no longer provides a sendAccessDenied() method. Use the
+new AccessDeniedHandler instead if custom handling is required.
+
+
+-
+There have been some changes to the LDAP provider APIs to allow for future improvements, as detailed in
+SEC-264. These
+should only affect users who have written their own extensions to the provider. The general LDAP
+classes are now in the packages org.acegisecurity.ldap and the org.acegisecurity.userdetails.ldap
+package has been introduced. The search and authentication classes now return an
+LdapUserDetails
+instance. The LdapAuthoritiesPopulator interface and its default implementation now both make use of
+LdapUserDetails. Any customized versions should be updated to use the new method signatures.
+
+
+