Luke Taylor
8cbe232fbf
SEC-1480: Add simple equals and hashcode methods based on DN value to LdapUserDetailsImpl to allow its use as a map key (in SessionRegistry, for example).
2010-05-15 02:29:56 +01:00
Luke Taylor
5ac106808e
Remove outdated scm information from pom.xml.
2010-04-28 20:16:40 +01:00
Luke Taylor
8c605516b3
SEC-1463: Change namespace user-service parser to store username in lower-case when building map for in-memory UserDetailsService. Lookups are supposed to be case-insensitive with this class.
2010-04-24 16:42:00 +01:00
Luke Taylor
e6e168f127
SEC-1456: Set rtexprvalue=true for "url" attribute in access tag to allow dynamic values (such as URL of current page).
2010-04-21 17:29:27 +01:00
Luke Taylor
6d6c2d31ef
SEC-1462: Only apply session fixation protection strategy if request.isRequestedSessionIdValid() returns true. We don't need to create a new session if the current one already has a different Id from the client.
2010-04-20 18:04:56 +01:00
Luke Taylor
8f6aecac9b
Clarify that multiple authentication-provider elements can be used in combination.
2010-04-17 15:25:37 +01:00
Luke Taylor
0760bb947b
SEC-1458: Remove logger field in HttpSessionEventPublisher in favour of direct lookup. Prevents early initialization of logging system when listener is initialized.
2010-04-16 16:13:41 +01:00
Luke Taylor
9d2e2ca11d
SEC-1232: Add config dependency to maven build for aspectj sample.
2010-03-31 19:59:19 +01:00
Luke Taylor
6354c7e052
SEC-1232: GlobalMethodSecurityBeanDefinitionParser support for mode='aspectj'
...
AspectJ sample application context also updated to use this syntax.
2010-03-31 17:41:23 +01:00
Luke Taylor
42cdaa0ce2
Latest gradle syntax updates.
2010-03-31 17:12:00 +01:00
Luke Taylor
eda60b72b1
SEC-1448: Fixed failure to resolve generic method argument names in MethodSecurityEvaluationContext.
...
Changed to use AopUtils.getMostSpecificMethod() when obtaining the method on which the parameter resolution should be performed. Also added better error handling and log warning when parameter names cannot be resolved. The exception will then be a SpEL one, rather than a NPE.
2010-03-27 17:22:38 +00:00
Luke Taylor
0d198d42ae
SEC-1444: Fix JNDI escaping problems in LDAP authentication.
...
CompositeName adds quotes to names which contain a forward slash ("/") character. These are automatically removed by Spring LDAP's DistinguishedName, but only if they are at the ends of the String. Since we were preprending the base to the (quoted) DN, resulting in something like ["cn=joe/b",ou=people], this was causing problems with the DN value returned from the search. Additionally, the bind succeeds when a DN is used with a slash, but the subsequent call to getAttributes() fails. This call now passes in a DistinguishedName for the user DN instance instead of a String.
2010-03-27 15:30:45 +00:00
Luke Taylor
f000aaa7e8
SEC-1440: Implement support for separate entry-point-ref on htt-basic namespace element. Changes ported from master branch.
2010-03-26 14:06:12 +00:00
Luke Taylor
634e340d80
Update schema version to 3.0.3
2010-03-26 13:53:56 +00:00
Luke Taylor
4c8e9e2d7e
SEC-1450: Replace use of ClassUtils.getMostSpecificMethod() in AbstractFallbackMethodDefinitionSource with AopUtils.getMostSpecificMethod() equivalent.
...
Ensures protect-pointcut expressions match methods with generic parameters.
2010-03-24 21:03:45 +00:00
Luke Taylor
e518adbef1
SEC-1443: Modify Jsr250Voter to handle multiple "RolesAllowed" roles.
...
It now votes to abstain if there are no Jsr250 attributes present. If any are found, it will either deny or grant access. For multiple "RoleAllowed" attributes, access will be granted if any user authority matches or denied if no match is found.
2010-03-22 16:26:49 +00:00
Luke Taylor
59b69f6f48
SEC-1434: Remove use of BeanDefinition of type java.lang.String which causes problems in Google App Engine.
...
This results in the method BeanUtils.findEditorByConvention attempting to get hold of the system classloader which isn't allowed by the security manager in GAE.
2010-03-16 02:22:36 +00:00
Luke Taylor
b8e50c0933
SEC-1439: Make getters and setters public on HttpRequestResponseHolder.
...
Necessary to allow use of custom SecurityContextRepository.(cherry picked from commit d5df53f1dbfcbe274656cce4e7a2e064f8db1597)
2010-03-12 15:54:12 +00:00
Luke Taylor
677576ea8b
SEC-1429: Fix test. Wasn't setting allowSessionCreation=false on failure handler.
2010-03-11 02:30:37 +00:00
Luke Taylor
91153df78d
SEC-1262: Added new (replacement) AspectJ interceptor which wraps the JoinPoint in a MethodInvocation adapter to provide compatibility with classes which only support MethodInvocation instances.
...
Also deprecated the existing AspectJ interceptors. This will also allow future simplification of the AbstractMethodSecurityMetadataSource, as it no longer needs to support JoinPoints.
2010-03-11 02:15:35 +00:00
Luke Taylor
1b0ac9c785
Porting of gradle changes from master.
2010-03-11 02:15:02 +00:00
Luke Taylor
8c9159f273
Added repo for aws-maen 3.0.0 dep
2010-03-06 01:41:38 +00:00
Luke Taylor
4c8b0faa88
Upgrade aws-maven to 3.0.0.RELEASE (mvn 2.2.x compatible)
2010-03-05 18:03:59 +00:00
Luke Taylor
5a5b62e2cb
SEC-1429: Removed cached authentication from session after successful authentication.(cherry picked from commit 43f0e111067dec72f2a496ad7d9df9fc10de43dc)
2010-03-05 00:11:08 +00:00
Luke Taylor
6ac8588144
Fix to Javadoc for AbstractAuthenticationProcessingFilter.(cherry picked from commit a3263753d93bba781471135448c4de5564fe464a)
2010-03-04 22:07:30 +00:00
Luke Taylor
5690f1c581
SEC-1428: Check if response has been committed before redirecting to target URL in AbstractAuthenticationTargetUrlRequestHandler.
2010-03-04 22:00:37 +00:00
Luke Taylor
87cf27ab7c
SEC-1429: Move logic for saving of AuthenticationException into the SimpleUrlAuthenticationFailurehandler from AbstractAuthenticationProcessingFilter. It will also now use request scope if configured to do a forward instead of a redirect.
2010-03-04 21:49:38 +00:00
Luke Taylor
41e06152b3
SEC-1420: JSP for itest of authentication tags with and without escaping.
2010-03-04 01:44:54 +00:00
Luke Taylor
a7e21318bf
SEC-1425: Replace use of Java 1.6 String.isEmpty().
2010-03-04 00:52:54 +00:00
Luke Taylor
bc6aae132b
SEC-1420: Add htmlEscape attribute to authentication JSP tag.
...
This allows HTML escaping to be disabled if required.
2010-03-04 00:47:59 +00:00
Luke Taylor
b46ae6ac62
SEC-1425: Add check for empty cookie in AbstractRememberMeServices.
...
Prevents ArrayOutOfBoundsException later when processing the tokeniszed cookie.
2010-02-28 14:00:43 +00:00
Luke Taylor
317da55cd0
SEC-1423: Cache PointcutExpression instances in ProtectPointcutPostProcessor for more efficient startup.
2010-02-26 17:50:45 +00:00
Luke Taylor
9e751e22c8
Refactoring to remove remaining circular dependencies indicated by structure101.
2010-02-26 17:50:14 +00:00
Luke Taylor
4d65b35827
Minor gradle 0.9 syntax change.
2010-02-26 17:49:32 +00:00
Luke Taylor
9831980bc2
Update versions to 3.0.3.CI-SNAPSHOT.
2010-02-26 15:04:43 +00:00
Luke Taylor
44f45d21f0
3.0.2 release. Update version in build files.
2010-02-19 01:22:21 +00:00
Luke Taylor
d2b2ca3bc6
SEC-1387: Use a transient object as the advice monitor, rather than a Serializable.
...
No need for an anonymous inner class.
2010-02-19 01:02:22 +00:00
Luke Taylor
97d04b73c1
Upgrade to Spring 3.0.1.
2010-02-19 00:53:38 +00:00
Luke Taylor
10dc72b017
SEC-1387: Support serialization of security advised beans.
...
MethodSecurityMetadataSourceAdvisor now takes the SecurityMetadataSource bean name as an extra constructor argument and re-obtains the bean from the BeanFactory in its readObject method. Beans that are advised using <global-method-security> should therefore now be serializable.
2010-02-19 00:53:14 +00:00
Luke Taylor
14ae36ac3b
SEC-1412: Modify DefaultSavedRequest to ignore If-Not-Matched header.
...
The browser (or at least Firefox) does not send it after a redirect, and it causes problems with Spring's ShallowEtagHeaderFilter if it is stored and returned by the saved request.
2010-02-18 00:32:49 +00:00
Luke Taylor
9bdc012c69
Minor corrections to Session Management chapter of ref manual.
2010-02-18 00:32:48 +00:00
Luke Taylor
c0579230b2
Correct package names in ref manual docbook. Minor change to namespace appendix.
2010-02-18 00:32:48 +00:00
Luke Taylor
5b5934144a
Avoid infinite loop in InterceptMethodsBeanDefinitionDecoratorTests when upgrading to Spring 3.0.1.
...
Converted test target to implement ApplicationListener<SessionCreatedEvent> so that it doesn't receive events from its own interceptor (which are in turn intercepted).
2010-02-16 00:03:15 +00:00
Luke Taylor
bd635edc31
SEC-1410: Makes sure usernames which are OpenID https identities are detected as well as http ones.
...
Using ":" as the token delimiter means we accidentally mistake the URL for two tokens. This had previously been fixed for http URLs but not https ones.
2010-02-15 22:46:18 +00:00
Luke Taylor
1719bdebeb
Changed classes output dir names in core modules for better display in structure diagram
2010-02-15 02:23:40 +00:00
Luke Taylor
c1133d1ef3
Removed unused import in DelegatingAuthenticationEntryPoint and corrected test class name.
2010-02-14 23:31:31 +00:00
Luke Taylor
d30e31d816
Remove unnecessary @SuppressWarnings and inline dependency from ELRequestMatcher (util package) to core ExpressionUtils.
2010-02-14 23:29:27 +00:00
Luke Taylor
dbee91002e
Deprecate EncryptionUtils.
2010-02-14 23:27:29 +00:00
Luke Taylor
c12c43da9e
Javadoc fixes.
2010-02-14 23:27:09 +00:00
Luke Taylor
36612377e2
Replace package.html with package-info.java files, creating new ones where missing and updating outdated contents.
2010-02-14 23:23:23 +00:00
