169449bf24
In response to: http://forum.springframework.org/viewtopic.php?t=3874
...
JaasAuthenticationProvider now checks that the java.security.auth.login.config is null before attempting to use it.
Also, The loginConfig resource is attempted as a file first as spaces in the path name can cause FileNotFoundExceptions for URLs
2005-03-13 22:26:56 +00:00
df91d352cb
AbstractBasicAclEntry improved compatibility with Hibernate, as per http://forum.springframework.org/viewtopic.php?t=3949 .
2005-03-13 21:01:16 +00:00
f594fdf751
Tidying and tests to bring Dao populator up to full coverage.
2005-03-12 21:56:04 +00:00
76f868c777
More tests.
2005-03-12 21:27:22 +00:00
765cc02599
Tidying.
2005-03-12 21:24:55 +00:00
9f62da7d1c
Better test method names.
2005-03-12 21:20:43 +00:00
0a4fc1731a
Tests added to bring X509ProcessingFilter up to full coverage.
2005-03-12 20:47:58 +00:00
c3c5487b93
Now sets WebAuthenticationDetails on authentication request token.
2005-03-12 20:46:58 +00:00
acee1ef696
Added "details" property
2005-03-12 20:40:05 +00:00
5d1cd29dfb
Added tearDown method which resets the context to null to prevent occasional breaking of other test classes.
2005-03-12 13:44:00 +00:00
f578915728
Test class for X509 filter.
2005-03-11 17:42:39 +00:00
af02c42e9f
First version that works.
2005-03-11 03:15:54 +00:00
fbb4bc0873
Added regexp matching within the DN to extract the user name.
2005-03-11 02:47:43 +00:00
29050b29b2
Dao populator tests for X.509. Tests matching of regexps in the certificate Subject to extract the user name.
2005-03-11 02:08:07 +00:00
4763f953d3
FilterChainProxy now supports replacement of ServletRequest and ServetResponse by Filter beans.
2005-03-11 01:41:43 +00:00
5c86b97f37
First working (kind of) version.
2005-03-11 00:39:36 +00:00
c5fe428400
Patch by Matt Raible which returns null if Authentication is anonymous.
2005-03-10 12:00:30 +00:00
b898b87ffb
Enhance test coverage as part of diagnosis of reported bug at http://forum.springframework.org/viewtopic.php?p=15751 .
2005-03-10 11:39:32 +00:00
15535fff41
SecurityEnforcementFilter caused NullPointerException when anonymous authentication used with BasicProcessingFilterEntryPoint.
2005-03-10 11:11:25 +00:00
08dbf66880
(Currently functionless) entry point implementation for X.509
2005-03-10 03:21:25 +00:00
aabcef4c69
Dao populator for X509, mirroring the CAS one.
2005-03-10 03:20:25 +00:00
fea1725f39
Removed inappropriate inheritance from AbstractProcessingFilter (doesn't make sense for X509 case).
2005-03-10 03:16:45 +00:00
ae91b58685
First stab at X509 authentication provider
2005-03-09 02:14:30 +00:00
da3801b914
Javadoc improvements.
2005-03-09 02:02:05 +00:00
559f480f4b
Corrected Javadoc typos.
2005-03-07 22:35:28 +00:00
ab6d43ff08
Corrected Javadoc typo.
2005-03-07 16:53:42 +00:00
051a34f859
Support credentialsExpiredUrl as per request made in http://forum.springframework.org/viewtopic.php?t=3862 .
2005-03-07 12:23:48 +00:00
5c3799cd16
Changed "opal ticket" to "opaque ticket" in Javadoc.
2005-03-05 19:48:02 +00:00
124f33bb09
Corrected Javadoc typo
2005-03-05 18:27:05 +00:00
6b12779902
Minor Javadoc corrections
2005-03-05 18:23:04 +00:00
4ef54828c0
corrected javadoc link
2005-03-05 01:05:23 +00:00
f1e071b0f1
Added remember-me services.
2005-03-01 02:30:38 +00:00
0d33b06990
Fix NullPointerException if a pattern is given without any config attributes (eg /**/*.css=). Contributed by Konstantin Shaposhnikov.
2005-02-28 22:06:53 +00:00
873c3f6c3d
Improve Linux and non-Sun JDK (specifically IBM JDK) compatibility.
2005-02-28 03:02:32 +00:00
d47a2190f7
Correct test failure on high performance JREs.
2005-02-27 07:16:38 +00:00
44397bb05d
Committing ConcurrentSessionController feature and tests. Documentation is needed.
2005-02-26 21:48:07 +00:00
4125db5650
Added in a default constructor to use the original sessionid and a constructor for specifying the sessionId
2005-02-25 05:24:10 +00:00
693ac5a24a
Anonymous principal support. As requested by the community at various times, including in http://forum.springframework.org/viewtopic.php?t=1925 .
2005-02-23 06:09:56 +00:00
3c4faf58c7
HttpSessionEventPublisher, HttpSessionCreatedEvent, HttpSessionDestroyedEvent
...
Used together to provide published events in the ApplicationContext about HttpSessions.
Useful for things like Single Session logins.
2005-02-23 02:54:41 +00:00
8b24b1cf7a
MockFilterChain extended TestCase but had no public constructor and no test methods.
...
The expectedToProceed test is internally handled by a static call to TestCase.assertTrue() and TestCase.fail()
2005-02-23 02:47:31 +00:00
a3818184f4
Added Digest Authentication support (RFC 2617 and RFC 2069).
2005-02-22 06:14:44 +00:00
dda66a0454
Significantly refactor "well-known location model" to authentication processing mechanism and HttpSessionContextIntegrationFilter model.
2005-02-21 06:48:31 +00:00
ba02d45677
Clean up imports.
2005-02-21 06:34:16 +00:00
e52f3eacb1
Use WebAuthenticationDetails for Authentication.getDetails() by default.
2005-02-21 00:09:49 +00:00
a5ea6f5436
Rewrite FilterChainProxy to separate functionality from FilterToBeanProxy and properly implement filter chaining issues.
2005-02-20 05:40:18 +00:00
57842d4ba8
IoC container vs servlet container lifecycle separation.
2005-02-20 05:38:57 +00:00
44f1c83dab
Move MockFilterChain to external class.
2005-02-20 05:38:14 +00:00
6d693ac0d4
Improve logging.
2005-02-20 05:37:13 +00:00
7c9fad0477
Added filter chain
2005-02-18 20:08:03 +00:00
0b296e7cf0
Correct issue with JdbcDaoImpl default SQL query not using consistent case sensitivity as per http://forum.springframework.org/viewtopic.php?t=3526 .
2005-02-15 07:14:59 +00:00
1949c3b27e
Added AuthenticationException to the commence method signature of the AutenticationEntryPoint. The best example of this
...
is the BasicProcessingFilterEntryPoint where the authException.getMessage() is used to send back an informative 401,
instead of just the error code.
Added AccessDeniedException to the sendAccessDeniedError method signature. The accessDeniedException.getMessage() result
is used to send an invormative 403 error back to the servletResponse by default.
2005-02-15 03:28:18 +00:00
beadf24610
Use static HttpServletResponse.SC_UNAUTHORIZED instead of 401 HTTP response code.
2005-02-13 00:59:48 +00:00
6370fadfdc
FilterSecurityInterceptor now only executes once per request (improves performance with SiteMesh). Suggested by Sanjiv Jivan.
2005-02-11 05:49:41 +00:00
cbe53e21b9
HttpSessionIntegrationFilter no longer creates a HttpSession unnecessarily.
2005-02-10 07:15:20 +00:00
834f69168d
Support getUserPrincipal().
2005-02-04 22:38:07 +00:00
0be77abe75
Allow empty passwords as per http://forum.springframework.org/viewtopic.php?p=13343 .
2005-02-04 09:43:33 +00:00
4e6a4742bd
Tapestry integration improvements, as per http://forum.springframework.org/viewtopic.php?p=13327
2005-02-04 07:36:46 +00:00
82c15b1874
The JaasAuthenticationCallbackHandler handle method now takes a callback and the authentication in progress, the setAuthentication method has been removed.
...
The JaasAuthenticationProvider afterPropertiesSet method now makes use of the java.security.auth.login.config System property before trying to use the login.config.url.X properties.
2005-01-31 05:16:32 +00:00
debc67fa6d
Allow site deployment from each subproject
2005-01-19 22:18:37 +00:00
cc669f4e35
Retrieve bean from parent bean factory if not found, as per http://forum.springframework.org/viewtopic.php?t=3005 .
2005-01-19 21:21:07 +00:00
7e234869a5
Make Serializable.
2005-01-19 21:09:39 +00:00
99088fe14c
Fix JavaDoc error.
2005-01-16 03:57:43 +00:00
fd2cc5dbc7
Add subclass hook so it can customise request properties.
2005-01-06 20:32:36 +00:00
bb1e96c85a
Add notice.txt to generated artifacts.
2005-01-04 22:05:40 +00:00
d6207106c0
Expand test coverage.
2005-01-04 20:20:21 +00:00
9176aa0efb
Add new AuthenticationFailure* events.
2005-01-04 20:19:42 +00:00
c939bcb176
Add account expiration and credentials expiration capabilities.
2005-01-03 01:14:26 +00:00
6c1e2f23b2
Allow last attempted username to be displayed in views.
2004-12-25 23:38:39 +00:00
c77cb84f52
Fix group names etc as required to ensure a multiproject:install works from /docs if there is a CLEAN (empty) Maven repository.
2004-12-25 07:02:31 +00:00
5689807f38
Make Maven sign generated JARs. The last stage of the transition from Ant.
2004-12-24 05:48:54 +00:00
61a631af26
JavaDocs fix.
2004-12-22 23:49:25 +00:00
8fb64e1e1b
Fix repository URLs so "viewcvs" URLs (associated with changelog plugin) are all correct.
2004-12-22 03:47:55 +00:00
dc726ac75c
Clarify and enforce interface interface contract for AuthenticationDao.
2004-12-21 20:53:32 +00:00
4bcc1222e1
Modifications to support EH-CACHE upgrade (EH-CACHE appears to have changed the way the default cache configuration file gets handled).
2004-12-21 13:04:11 +00:00
823a2e990b
Add hook methods to AbstractProcessingFilter.
2004-12-20 11:14:34 +00:00
c5ea35d093
Extend After ACL provider to also filter arrays. Thanks to Joni Suominen.
2004-12-17 21:56:05 +00:00
cb61c88478
Increased test coverate to 100%
2004-12-09 23:53:11 +00:00
8853ba28e2
Replaced $author$ stuff in javadocs with Ray Krueger
2004-12-09 22:35:53 +00:00
41310f26a6
Missed a DOCUMENT ME! spot...
2004-12-09 22:29:12 +00:00
3eb6149877
New LoginExceptionResolver interface and base implementation to handle LoginExceptions thrown in the Jaas API. I am commiting this now so that it isn't lost, while a PropertyEditor based solution is investigated.
2004-12-09 22:09:35 +00:00
c5900cab9c
Added a ContextHolderAwareRequestWrapper to integrate with getRemoteUser() and isUserInRole(String). Thanks to Orlando Garcia Carmona ("paramosyermos" on Spring forums).
2004-12-05 06:11:18 +00:00
e3b9920d9c
Fix default query string to remove ambiguous columns. Thanks to Aaron Tang.
2004-12-05 05:30:06 +00:00
89ba20f057
Fix Tomcat compatibility issue where HttpSession unavailable during "logoff". Thanks to Aaron Tang.
2004-12-05 05:29:25 +00:00
82ed7253d4
Refactor AbstractFilterInvocationDefinitionSource to use a standard URL String in its lookup method, rather than a full FilterInvocation. This will make it easier for views (taglibs etc) to access URI security details without needing to construct a MockFilterInvocation.
2004-12-05 05:04:52 +00:00
76c82db196
Refactor EH-CACHE integration classes to work with Spring IoC provided Cache rather than manage our own cache internally.
2004-12-05 04:37:05 +00:00
41b41ba316
Expand test coverage. Clover via Maven (without excluding appropriate patterns like *Exception and debug messages) has modified coverage from 77.2% to 95%.
2004-12-03 06:46:41 +00:00
07e2037251
Find target domain object argument in a manner that works if nulls are presented for the domain object argument.
2004-12-03 06:43:17 +00:00
e75fc613b1
Gracefully handle null ContextHolder / Authentication etc.
2004-12-03 06:42:26 +00:00
7a4a46cc7b
General refactoring of taglibs.
2004-12-03 06:41:48 +00:00
1b660d4d5b
Handle usernames that are empty Strings.
2004-12-03 06:41:02 +00:00
ab6df6cfce
Make InternalMethodInvocation package protected for better unit test support.
2004-12-03 06:40:11 +00:00
f73fc735c2
Improve startup error detection and eliminate unnecessary checks for null application context.
2004-12-03 06:39:07 +00:00
4c1c7dcff5
Fix bugs.
2004-12-03 06:38:10 +00:00
22f8cd0c44
Improve null handling.
2004-12-01 02:55:01 +00:00
3a0e43337c
Improve test coverage and error detection at startup time.
2004-12-01 02:22:24 +00:00
699f97929a
Fix bug where class should delegate to setDetails method - not set the details directly.
2004-12-01 02:09:15 +00:00
89eed486e2
Add alwaysUseDefaultTargetUrl feature to AbstractProcessingFilter.
2004-11-22 21:38:14 +00:00
b0f6c5179a
Documentation improvement
2004-11-20 10:28:01 +00:00
a159d89ffd
Initial commit.
2004-11-20 05:24:16 +00:00
4ca1e2fd99
Add logging.
2004-11-20 04:10:05 +00:00
f251436a99
Improve logging and enable ACL determination to use an Object obtained from an internal method of the located processDomainObjectClass.
2004-11-20 04:09:14 +00:00
61580d1973
Move RMI context propagation support classes to core, and rename and document to more clearly reflect function.
2004-11-20 04:07:47 +00:00
ba16c01b90
Add toString() method so more informative when context propagation takes place, such as via ContextPropagatingRemoteInvocation.
2004-11-20 04:06:47 +00:00
58306157df
*** empty log message ***
2004-11-19 22:20:49 +00:00
177c00556d
Support just creating the acl_object_identity, without necessarily an acl_permission as well.
2004-11-16 12:22:43 +00:00
af5917b685
Added BasicAclExtendedDao interface and JdbcExtendedDaoImpl for ACL CRUD.
2004-11-15 13:04:12 +00:00
bc9a599bf7
Remove noisy logging.
2004-11-15 02:43:21 +00:00
d6beb9804f
Place authz taglib in correct JAR location (META-INF).
2004-11-15 01:46:23 +00:00
612971e134
Initial commit of a concrete AfterInvocationManager.
2004-11-15 01:45:03 +00:00
694bdb603d
Initial commit.
2004-11-15 01:44:20 +00:00
5f6aa9c49e
Refactoring to support "after invocation" processing.
2004-11-15 01:43:48 +00:00
03a530b36b
Improve JavaDocs.
2004-11-15 01:42:47 +00:00
d639e5c02f
Expand logging.
2004-11-15 01:41:45 +00:00
9972c69408
Support Authentication.getPrincipal() of UserDetails and improve logging.
2004-11-15 01:40:18 +00:00
e462c5a201
Minor polishing.
2004-11-15 01:36:41 +00:00
68dc38841f
Add an Authentication and Acl taglib.
2004-11-15 00:46:18 +00:00
70a9c76f69
Remove unnecessary console output from tests.
2004-11-15 00:37:00 +00:00
ef2e45df77
Update tests to support incompatible collaborator detection now in AbstractSecurityInterceptor.
2004-11-15 00:36:12 +00:00
e83c66bb37
Expand test coverage so GrantedAuthorityEffectiveAclsResolver properly handles Authentication with a principal of type UserDetails.
2004-11-15 00:34:32 +00:00
695948c31d
Remove unused import.
2004-11-12 01:07:59 +00:00
f1d993f47b
Made BasicAclProvider to only respond to specified ACL object requests.
2004-11-09 21:09:14 +00:00
cd56f2ed4a
Moved from test to main
2004-11-03 22:35:12 +00:00
8cf6867cba
Moved name to subprojects
2004-11-01 20:05:42 +00:00
fde59c2f29
Ad mock method implementation now we're using HttpSession.removeAttribute().
2004-10-30 23:32:53 +00:00
565c2e580b
Remove debug messages.
2004-10-30 23:32:28 +00:00
d27fb49803
*** empty log message ***
2004-10-30 22:49:58 +00:00
55624cf5dd
Moved resources from java dir to resources dir
2004-10-30 22:49:12 +00:00
928498b53d
Removed AutoIntegrationFilter
2004-10-30 22:45:35 +00:00
b25a6e002b
*** empty log message ***
2004-10-30 17:15:54 +00:00
89f6fcf5c9
Refactor to use an application context, thus enabling event publishing and use of DefaultAdvisorAutoProxyCreator.
2004-10-30 06:09:09 +00:00
537a58d754
Added net.sf.acegisecurity.intercept.event package.
2004-10-30 06:07:17 +00:00
26f5f1a9b3
Add the AccessDeniedException to the HttpSession as per http://forum.springframework.org/viewtopic.php?t=1515 .
2004-10-30 03:06:05 +00:00
21f29bbbb3
Fix JRun rejection of null in httpSession.setAttribute() as per http://livedocs.macromedia.com/jrun/4/javadocs/jrun/servlet/session/JRunSession.html .
...
Discussed at http://forum.springframework.org/viewtopic.php?t=1417 .
2004-10-30 02:56:01 +00:00
73349bf8f8
Add convenience method so subclasses can specify Authentication.setDetails().
2004-10-30 01:19:22 +00:00
7b0145fba7
Initial AspectJ support.
2004-10-18 06:41:20 +00:00
992cf44b36
Refactor MethodDefinitionMap to use Method, not MethodInvocation. Refactor AbstractSecurityInterceptor to not force use of Throwable. Move AOP Alliance based MethodSecurityInterceptor to separate package.
2004-10-18 06:38:44 +00:00
ba163d51ae
Documentation correction.
2004-10-17 07:56:19 +00:00
f123e9c333
Make MethodDefinitionMap query interfaces defined by secure objects, to properly support MethodDefinitionSourceAdvisor.
2004-10-15 03:47:53 +00:00
8ec0d89fe4
Improve documentation for abstract contract.
2004-10-15 03:17:57 +00:00
8d973af603
Added MethodDefinitionSourceAdvisor for performance and autoproxying.
2004-10-15 00:29:24 +00:00
333fe84ee8
Clarify interface contract for ObjectDefinitionSource when no ConfigAttributes exist for a given secure object invocation, plus unit tests and fixes for concrete implementations. Thanks to Sean Radford for spotting the inconsistency.
2004-09-11 06:14:58 +00:00
8a32fde12a
Additional convenience methods as suggested by Sean Radford.
2004-09-11 06:13:54 +00:00
defc79c283
Minor Javadoc correction.
2004-09-06 20:06:42 +00:00
ec166e086b
Refactored UsernamePasswordAuthenticationToken.getDetails() to Object.
2004-09-01 21:19:05 +00:00
fa2920baa7
Ensure delegate is not null before calling destroy method.
2004-09-01 21:03:34 +00:00
d7c98f95ca
Made FilterToBeanProxy compatible with ContextLoaderServlet (lazy initialisation on first HTTP request).
2004-09-01 02:37:55 +00:00
1a92434914
Add support for password-validating DAOs, such as LDAP. Contributed by Karel Miarka.
2004-08-30 01:24:12 +00:00
aaebd3ef5a
Added DaoAuthenticationProvider.hideUserNotFoundExceptions property. Defaults to true, so BadCredentialsException is thrown instead of UsernameNotFoundException if a user cannot be found.
2004-08-26 23:19:00 +00:00
5cd65887d5
Improved ConfigAttributeEditor so it trims preceding and trailing spaces.
2004-08-25 21:43:00 +00:00
3f87849f31
Fixed GrantedAuthorityEffectiveAclsResolver if null ACLs provided to method.
2004-08-23 02:03:46 +00:00
Ray Krueger
Ben Alex
Luke Taylor
Carlos Sanchez