SEC-2532: Add disclaimer about jdbcAuthentication() with persistent data stores

This commit is contained in:
Rob Winch 2014-04-28 14:45:51 -05:00
parent 3f24210a2a
commit d6f540fdee

View File

@ -138,19 +138,31 @@ public class AuthenticationManagerBuilder extends AbstractConfiguredSecurityBuil
/** /**
* Add JDBC authentication to the {@link AuthenticationManagerBuilder} and * Add JDBC authentication to the {@link AuthenticationManagerBuilder} and
* return a {@link JdbcUserDetailsManagerConfigurer} to allow customization of the * return a {@link JdbcUserDetailsManagerConfigurer} to allow customization
* JDBC authentication. * of the JDBC authentication.
*
* <p>
* When using with a persistent data store, it is best to add users external
* of configuration using something like <a
* href="http://flywaydb.org/">Flyway</a> or <a
* href="http://www.liquibase.org/">Liquibase</a> to create the schema and
* adding users to ensure these steps are only done once and that the
* optimal SQL is used.
* </p>
* *
* <p> * <p>
* This method also ensure that a {@link UserDetailsService} is available * This method also ensure that a {@link UserDetailsService} is available
* for the {@link #getDefaultUserDetailsService()} method. Note that * for the {@link #getDefaultUserDetailsService()} method. Note that
* additional {@link UserDetailsService}'s may override this * additional {@link UserDetailsService}'s may override this
* {@link UserDetailsService} as the default. * {@link UserDetailsService} as the default. See the <a href=
* "http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#user-schema"
* >User Schema</a> section of the reference for the default schema.
* </p> * </p>
* *
* @return a {@link JdbcUserDetailsManagerConfigurer} to allow customization of the * @return a {@link JdbcUserDetailsManagerConfigurer} to allow customization
* JDBC authentication * of the JDBC authentication
* @throws Exception if an error occurs when adding the JDBC authentication * @throws Exception
* if an error occurs when adding the JDBC authentication
*/ */
public JdbcUserDetailsManagerConfigurer<AuthenticationManagerBuilder> jdbcAuthentication() public JdbcUserDetailsManagerConfigurer<AuthenticationManagerBuilder> jdbcAuthentication()
throws Exception { throws Exception {