176 lines
13 KiB
XML
176 lines
13 KiB
XML
<?xml version="1.0" encoding="ISO-8859-1"?>
|
|
<document><properties><title>Acegi Security System for Spring</title></properties><body><section name=""><b></b><center><b>What is Acegi Security?</b></center></section><section name=""><br></br><p>
|
|
Acegi Security is a powerful, flexible security solution for enterprise software,
|
|
with a particular emphasis on applications that use
|
|
<a href="http://www.springframework.org/">Spring</a>. Using Acegi Security provides your
|
|
applications with comprehensive authentication, authorization, instance-based access control,
|
|
channel security and human user detection capabilities.
|
|
</p><br></br></section><section name=""><b></b><center><b>Key Features</b></center></section><section name=""><br></br><ul>
|
|
<li><b>Stable and mature.</b> Acegi Security 1.0.0 was released in May 2006 after
|
|
more than two and a half years of use in large production software projects, 70,000+ downloads
|
|
and hundreds of community contributions.
|
|
In terms of release numbering, we also use the <a href="http://apr.apache.org/versioning.html">Apache APR Project
|
|
Versioning Guidelines</a> so that you can easily identify release
|
|
compatibility.<br></br><br></br>
|
|
</li><li><b>Well documented:</b> All APIs are fully documented using
|
|
<a href="http://acegisecurity.sourceforge.net/multiproject/acegi-security/apidocs/index.html">JavaDoc</a>,
|
|
with almost 100 pages of
|
|
<a href="reference.html">Reference Guide</a> documentation providing an easy-to-follow
|
|
introduction. Even more documentation is provided on this web site, as
|
|
shown in the left hand navigation sidebar.<br></br><br></br>
|
|
</li><li><b>Fast results:</b> View our <a href="suggested.html">suggested steps</a>
|
|
for the fastest way to develop complex, security-compliant applications.<br></br><br></br>
|
|
</li><li><b>Enterprise-wide single sign on:</b> Using JA-SIG's open
|
|
source <a href="http://www.ja-sig.org/products/cas/">Central Authentication
|
|
Service</a> (CAS), the Acegi Security can participate
|
|
in an enterprise-wide single sign on environment. You no longer need
|
|
every web application to have its own authentication database. Nor are
|
|
you restricted to single sign on across a single web container. Advanced
|
|
single sign on features like proxy support and forced refresh of logins
|
|
are supported by both CAS and Acegi Security.<br></br><br></br>
|
|
</li><li><b>Reuses your Spring expertise:</b> We use Spring application
|
|
contexts for all configuration, which should help Spring developers get
|
|
up-to-speed nice and quickly.<br></br><br></br>
|
|
</li><li><b>Domain object instance security:</b> In many applications it's
|
|
desirable to define Access Control Lists (ACLs) for individual domain
|
|
object instances. We provide a comprehensive ACL package with features
|
|
including integer bit masking, permission inheritence (including
|
|
blocking), a JDBC-backed ACL repository, caching and a pluggable,
|
|
interface-driven design.<br></br><br></br>
|
|
</li><li><b>Non-intrusive setup:</b> The entire security system can operate
|
|
within a single web application using the provided filters. There is no
|
|
need to make special changes or deploy libraries to your Servlet or EJB
|
|
container.<br></br><br></br>
|
|
</li><li><b>Full (but optional) container integration:</b> The credential
|
|
collection and authorization capabilities of your Servlet or EJB
|
|
container can be fully utilised via included "container adapters". We
|
|
currently support Catalina (Tomcat), Jetty, JBoss and Resin, with
|
|
additional containers easily added.<br></br><br></br>
|
|
</li><li><b>Keeps your objects free of security code:</b> Many applications
|
|
need to secure data at the bean level based on any combination of
|
|
parameters (user, time of day, authorities held, method being invoked,
|
|
parameter on method being invoked....). This package gives you this
|
|
flexibility without adding security code to your Spring business
|
|
objects.<br></br><br></br>
|
|
</li><li><b>After invocation security:</b> Acegi Security can not only protect
|
|
methods from being invoked in the first place, but it can also
|
|
deal with the objects returned from the methods. Included implementations
|
|
of after invocation security can throw an exception or mutate the returned
|
|
object based on ACLs.<br></br><br></br>
|
|
</li><li><b>Secures your HTTP requests as well:</b> In addition to securing
|
|
your beans, the project also secures your HTTP requests. No longer is it
|
|
necessary to rely on web.xml security constraints. Best of all, your
|
|
HTTP requests can now be secured by your choice of regular expressions
|
|
or Apache Ant paths, along with pluggable authentication, authorization
|
|
and run-as replacement managers.<br></br><br></br>
|
|
</li><li><b>Channel security:</b> Acegi Security can
|
|
automatically redirect requests across an appropriate transport channel.
|
|
Whilst flexible enough to support any of your "channel" requirements (eg
|
|
the remote user is a human, not a robot), a common channel security
|
|
feature is to ensure your secure pages will only be available over
|
|
HTTPS, and your public pages only over HTTP. Acegi Security also
|
|
supports unusual port combinations (including if accessed via an
|
|
intermediate server like Apache) and pluggable transport decision
|
|
managers.<br></br><br></br>
|
|
</li><li><b>Supports HTTP BASIC authentication:</b> Perfect for remoting
|
|
protocols or those web applications that prefer a simple browser pop-up
|
|
(rather than a form login), Acegi Security can directly process HTTP
|
|
BASIC authentication requests as per RFC 1945.<br></br><br></br>
|
|
</li><li><b>Supports HTTP Digest authentication:</b> For greater security than
|
|
offered by BASIC authentcation, Acegi Security also supports Digest Authentication
|
|
(which never sends the user's password across the wire). Digest Authentication
|
|
is widely supported by modern browsers. Acegi Security's implementation complies
|
|
with both RFC 2617 and RFC 2069.<br></br><br></br>
|
|
</li><li><b>Computer Associates Siteminder support:</b> Authentication can be
|
|
delegated through to CA's Siteminder solution, which is common in large
|
|
corporate environments.<br></br><br></br>
|
|
</li><li><b>X509 (Certificate) support:</b> Acegi Security can easily read
|
|
client-side X509 certificates for authenticating users.<br></br><br></br>
|
|
</li><li><b>LDAP Support:</b> Do you have an LDAP directory? Acegi Security can
|
|
happily authenticate against it.<br></br><br></br>
|
|
</li><li><b>Tag library support:</b> Your JSP files can use our taglib
|
|
to ensure that protected content like links and messages are only
|
|
displayed to users holding the appropriate granted authorities. The taglib
|
|
also fully integrates with Acegi Security's ACL services, and
|
|
obtaining extra information about the logged-in principal.<br></br><br></br>
|
|
</li><li><b>Configuration via IoC XML, Commons Attributes, or JDK 5 Annotations:</b> You
|
|
select the method used to configure your security environment. The
|
|
project supports configuration via Spring application contexts, as well
|
|
as Jakarta Commons Attributes and Java 5's annotations feature. Some users
|
|
(such as those building content management systems) pull configuration data
|
|
from a database, which exemplifies Acegi Security's flexible configuration
|
|
metadata system.<br></br><br></br>
|
|
</li><li><b>Various authentication backends:</b> We include the ability to
|
|
retrieve your user and granted authority definitions from an XML
|
|
file, JDBC datasource or Properties file. Alternatively, you can implement the
|
|
single-method UserDetailsService interface and obtain authentication details from
|
|
anywhere you like.<br></br><br></br>
|
|
</li><li><b>Event support:</b> Building upon Spring's
|
|
<code>ApplicationEvent</code> services, you can write your own listeners
|
|
for authentication-related events, along with authorisation-related events.
|
|
This enables you to implement account lockout and audit log systems, with
|
|
complete decoupling from Acegi Security code.<br></br><br></br>
|
|
</li><li><b>Easy integration with existing databases:</b> Our implementations
|
|
have been designed to make it very easy to use your existing
|
|
authentication schema and data (without modification). Of course,
|
|
you can also provide your own Data Access Object if you wish.<br></br><br></br>
|
|
</li><li><b>Caching:</b> Acegi Security integrates with Spring's <a href="http://ehcache.sourceforge.net/">EHCACHE</a> factory.
|
|
This flexibility means your database (or other authentication
|
|
repository) is not repeatedly queried for authentication
|
|
information.<br></br><br></br>
|
|
</li><li><b>Pluggable architecture:</b> Every critical aspect of the package
|
|
has been modelled using high cohesion, loose coupling, interface-driven
|
|
design principles. You can easily replace, customise or extend parts of
|
|
the package.<br></br><br></br>
|
|
</li><li><b>Startup-time validation:</b> Every critical object dependency and
|
|
configuration parameter is validated at application context startup
|
|
time. Security configuration errors are therefore detected early and
|
|
corrected quickly.<br></br><br></br>
|
|
</li><li><b>Remoting support:</b> Does your project use a rich client? Not a
|
|
problem. Acegi Security integrates with standard Spring remoting
|
|
protocols, because it automatically processes the HTTP BASIC
|
|
authentication headers they present. Add our BASIC authentication filter
|
|
to your web.xml and you're done. You can also easily use RMI or Digest
|
|
authentication for your rich clients with a simple configuration statement.<br></br><br></br>
|
|
</li><li><b>Advanced password encoding:</b> Of course, passwords in your
|
|
authentication repository need not be in plain text. We support both SHA
|
|
and MD5 encoding, and also pluggable "salt" providers to maximise
|
|
password security. Acegi Security doesn't even need to see the password
|
|
if your backend can use a bind-based strategy for authentication (such as
|
|
an LDAP directory, or a database login).<br></br><br></br>
|
|
</li><li><b>Run-as replacement:</b> The system fully supports
|
|
temporarily replacing the authenticated principal for the duration of the web
|
|
request or bean invocation. This enables you to build public-facing
|
|
object tiers with different security configurations than your backend
|
|
objects.<br></br><br></br>
|
|
</li><li><b>Transparent security propagation:</b> Acegi Security can automatically
|
|
transfer its core authentication information from one machine to another,
|
|
using a variety of protocols including RMI and Spring's HttpInvoker.<br></br><br></br>
|
|
</li><li><b>Compatible with HttpServletRequest's security methods:</b> Even though
|
|
Acegi Security can deliver authentication using a range of pluggable mechanisms
|
|
(most of which require no web container configuration), we allow you to access
|
|
the resulting Authentication object via the getRemoteUser() and other
|
|
security methods on HttpServletRequest.<br></br><br></br>
|
|
</li><li><b>Unit tests:</b> A must-have of any quality security project, unit
|
|
tests are included. Our unit test coverage is very high, as shown in the
|
|
<a href="multiproject/acegi-security/clover/index.html">coverage report</a>.<br></br><br></br>
|
|
</li><li><b>Built by Maven:</b> This assists you in effectively reusing the Acegi
|
|
Security artifacts in your own Maven-based projects.<br></br><br></br>
|
|
</li><li><b>Supports your own unit tests:</b> We provide a number of classes
|
|
that assist with your own unit testing of secured business objects. For
|
|
example, you can change the authentication identity and its associated
|
|
granted authorities directly within your test methods.<br></br><br></br>
|
|
</li><li><b>Peer reviewed:</b> Whilst nothing is ever completely secure,
|
|
using an open source security package leverages the continuous design
|
|
and code quality improvements that emerge from peer review.<br></br><br></br>
|
|
</li><li><b>Community:</b> Well-known for its supportive community, Acegi Security
|
|
has an active group of developers and users. Visit our project resources (below)
|
|
to access these services.<br></br><br></br>
|
|
</li><li><b>Apache license.</b> You can confidently use Acegi Security in your project.<br></br><br></br></li></ul><br></br><b>
|
|
<hr></hr>
|
|
|
|
</b><center><b>Project Resources</b></center></section><section name=""><br></br><center>
|
|
<a href="http://forum.springframework.org/"><b>Support Forums</b></a><br></br><br></br>
|
|
<a href="mail-lists.html"><b>Developer Mailing List</b></a><br></br><br></br>
|
|
<a href="downloads.html"><b>Downloads</b></a>
|
|
</center></section></body></document> |