71 lines
3.0 KiB
Plaintext
71 lines
3.0 KiB
Plaintext
===============================================================================
|
|
ACEGI SECURITY SYSTEM FOR SPRING - UPGRADING FROM 0.5 TO 0.6
|
|
===============================================================================
|
|
|
|
The following should help most casual users of the project update their
|
|
applications:
|
|
|
|
- Locate and remove all property references to
|
|
DaoAuthenticationProvider.key and
|
|
DaoAuthenticationProvider.refreshTokenInterval.
|
|
|
|
- If you are using DaoAuthenticationProvider and either (i) you are using
|
|
container adapters or (ii) your code relies on the Authentication object
|
|
having its getPrincipal() return a String, you must set the new
|
|
DaoAuthenticationProvider property, forcePrincipalAsString, to true.
|
|
By default DaoAuthenticationProvider returns an Authentication object
|
|
containing the relevant User, which allows access to additional properties.
|
|
Where possible, we recommend you change your code to something like this,
|
|
so that you can leave forcePrincipalAsString to the false default:
|
|
|
|
String username = authentication.getPrincipal();
|
|
if (authentication.getPrincipal() instanceof User) {
|
|
username = ((User) authentication.getPrincipal()).getUsername();
|
|
}
|
|
|
|
- The signature of AuthenticationDaos have changed. In concrete
|
|
implementations, modify the User to UserDetails, as shown below:
|
|
|
|
public User loadUserByUsername(String username)
|
|
throws UsernameNotFoundException, DataAccessException {
|
|
|
|
to:
|
|
|
|
public UserDetails loadUserByUsername(String username)
|
|
throws UsernameNotFoundException, DataAccessException {
|
|
|
|
Existing concrete implementations would be returning User, which implements
|
|
UserDetails, so no further code changes should be required.
|
|
|
|
- Similar signature changes (User -> UserDetails) are also required to any
|
|
custom implementations of UserCache and SaltSource.
|
|
|
|
- Any custom event listeners relying on AuthenticationEvent should note a
|
|
UserDetails is now provided in the AuthenticationEvent (not a User).
|
|
|
|
- CAS users should note the CasAuthoritiesPopulator interface signature has
|
|
changed. Most CAS users will be using DaoCasAuthoritiesPopulator, so this
|
|
change is unlikely to require any action.
|
|
|
|
- Please check your web.xml for whether you are using AutoIntegrationFilter.
|
|
Previously this class was loaded directly by web.xml as a filter. It is
|
|
now recommended to load it via FilterToBeanProxy and define it as a
|
|
bean in your application context. This usually involves making the entry
|
|
in web.xml match the following:
|
|
|
|
<filter>
|
|
<filter-name>Acegi Security System for Spring Auto Integration Filter</filter-name>
|
|
<filter-class>net.sf.acegisecurity.util.FilterToBeanProxy</filter-class>
|
|
<init-param>
|
|
<param-name>targetClass</param-name>
|
|
<param-value>net.sf.acegisecurity.ui.AutoIntegrationFilter</param-value>
|
|
</init-param>
|
|
</filter>
|
|
|
|
Then add the following to applicationContext.xml:
|
|
|
|
<bean id="autoIntegrationFilter" class="net.sf.acegisecurity.ui.AutoIntegrationFilter" />
|
|
|
|
|
|
$Id$
|