Acegi Security System for Spring

This is the Maven generated site for the Acegi-Security project. It is generated as part of an automated daily build. We intend to expand the information on Acegi which is available here but for the moment, your best starting point for documentation is Ben Alex's original reference guide which provides a comprehensive overview.

For more information on running the build with Maven, see the build section of the getting started guide.

The main other area of interest at the moment is the generated reports section. These are produced by the build on a daily basis and include complete Javadoc and source cross-reference.

Mission Statement

To provide comprehensive security services for The Spring Framework.

Key Features

It is ready NOW. As explained in the reference guide, the API is now quite stable. We also use the Apache APR Project Versioning Guidelines so you can identify backward compatibility.
Easy to use: View our samples/quick-start directory for XML you can simply copy and paste into applicationContext.xml and web.xml. From there it's easy to customise Acegi Security to your unique security needs.
Enterprise-wide single sign on: Using Yale University's open source Central Authentication Service (CAS), the Acegi Security System for Spring can participate in an enterprise-wide single sign on environment. You no longer need every web application to have its own authentication database. Nor are you restricted to single sign on across a single web container. Advanced single sign on features like proxy support and forced refresh of logins are supported by both CAS and Acegi Security.
Reuses your Spring expertise: We use Spring application contexts for all configuration, which should help Spring developers get up-to-speed nice and quickly.
Domain object instance security: In many applications it's desirable to define Access Control Lists (ACLs) for individual domain object instances. We provide a comprehensive ACL package with features including integer bit masking, permission inheritence (including blocking), a JDBC-backed ACL repository, caching and a pluggable, interface-driven design.
Non-intrusive setup: The entire security system can operate within a single web application using the provided filters. There is no need to make special changes or deploy libraries to your Servlet or EJB container.
Full (but optional) container integration: The credential collection and authorization capabilities of your Servlet or EJB container can be fully utilised via included "container adapters". We currently support Catalina (Tomcat), Jetty, JBoss and Resin, with additional containers easily added.
Keeps your objects free of security code: Many applications need to secure data at the bean level based on any combination of parameters (user, time of day, authorities held, method being invoked, parameter on method being invoked....). This package gives you this flexibility without adding security code to your Spring business objects.
Secures your HTTP requests as well: In addition to securing your beans, the project also secures your HTTP requests. No longer is it necessary to rely on web.xml security constraints. Best of all, your HTTP requests can now be secured by your choice of regular expressions or Apache Ant paths, along with pluggable authentication, authorization and run-as replacement managers.
Channel security: The Acegi Security System for Spring can automatically redirect requests across an appropriate transport channel. Whilst flexible enough to support any of your "channel" requirements (eg the remote user is a human, not a robot), a common channel security feature is to ensure your secure pages will only be available over HTTPS, and your public pages only over HTTP. Acegi Security also supports unusual port combinations and pluggable transport decision managers.
Supports HTTP BASIC authentication: Perfect for remoting protocols or those web applications that prefer a simple browser pop-up (rather than a form login), Acegi Security can directly process HTTP BASIC authentication requests as per RFC 1945.
Convenient security taglib: Your JSP files can use our taglib to ensure that protected content like links and messages are only displayed to users holding the appropriate granted authorities.
Application context or attribute-based configuration: You select the method used to configure your security environment. The project supports configuration via Spring application contexts as well as Jakarta Commons Attributes.
Various authentication backends: We include the ability to retrieve your user and granted authority definitions from either an XML file or JDBC datasource. Alternatively, you can implement the single-method DAO interface and obtain authentication details from anywhere you like.
Event support: Building upon Spring's ApplicationEvent services, you can write your own listeners for login, invalid password and account disabled events. This enables you to implement account lockout and audit log systems, with complete decoupling from Acegi Security code.
Easy integration with existing databases: Our implementations have been designed to make it very easy to use your existing authentication schema and data (without modification).
Caching: Use our EHCACHE wrapper to cache your authentication information, or plug in your own cache implementation. This flexibility means your database (or other authentication repository) is not repeatedly queried for authentication information.
Pluggable architecture: Every critical aspect of the package has been modelled using high cohesion, loose coupling, interface-driven design principles. You can easily replace, customise or extend parts of the package.
Startup-time validation: Every critical object dependency and configuration parameter is validated at application context startup time. Security configuration errors are therefore detected early and corrected quickly.
Remoting support: Does your project use a rich client? Not a problem. Acegi Security integrates with standard Spring remoting protocols, because it automatically processes the HTTP BASIC authentication headers they present. Add our BASIC authentication filter to your web.xml and you're done.
Advanced password encoding: Of course, passwords in your authentication repository need not be in plain text. We support both SHA and MD5 encoding, and also pluggable "salt" providers to maximise password security.
Run-as replacement: The security system fully supports temporarily replacing the authenticated user for the duration of the web request or bean invocation. This enables you to build public-facing object tiers with different security configurations than your backend objects.
Unit tests: A must-have of any quality security project, unit tests are included. Clover coverage is currently 98.3%.
Container integration tests: To ensure the security project properly operates with major container versions, we provide an integration test system that deploys those containers from scratch and fully tests our sample web application from the perspective of a HTTP client.
Supports your own unit tests: We provide a number of classes that assist with your own unit testing of secured business objects. For example, you can change the authentication identity and its associated granted authorities directly within your test methods.
Peer reviewed: Whilst nothing is ever completely secure, using an open source security package leverages the continuous design and code quality improvements that emerge from peer review.
Thorough documentation: All APIs are fully documented using JavaDoc, with a 40+ page reference guide providing an easy-to-follow introduction.
Apache license.

Project Resources

Support Forums

Downloads

Public Maven Build (Javadocs, Source Code etc)

Browse CVS

Development Mailing List

Subscribe Here

Gmane Archive

Mail-archive.com Archive