diff --git a/src/docbkx/samples.xml b/src/docbkx/samples.xml index 6dafde8bb0..e5b3f3a458 100644 --- a/src/docbkx/samples.xml +++ b/src/docbkx/samples.xml @@ -3,74 +3,74 @@ Sample Applications +
+ Tutorial Sample + + The tutorial sample is a nice basic example to get you started. It uses + simple namespace configuration throughout. + + The compiled tutorial is included in the distribution ZIP file, + ready to be deployed into your web container. + The form-based + authentication mechanism is used, with the commonly-used + remember-me + authentication provider used to automatically remember the login using + cookies. + + We recommend you start with the tutorial sample, as the XML is + minimal and easy to follow. Most importantly, you can easily add + this one XML file (and its corresponding web.xml entries) to your existing + application. Only when this basic integration is achieved do we + suggest you attempt adding in method authorization or domain object + security. +
+
- Contacts + Contacts + + The Contacts Sample is quite an advanced example in that it + illustrates the more powerful features of domain object access control lists + in addition to basic application security. + - Included with Spring Security is a very simple application that - can demonstrate the basic security facilities provided by the system - (and confirm your Container Adapter is properly configured if you're - using one). - - If you build from Subversion, the Contacts sample application - includes three deployable versions: - spring-security-sample-contacts-filter.war is - configured with the HTTP Session Authentication approach. - spring-security-sample-contacts-ca.war is - configured to use a Container Adapter. Finally, - spring-security-sample-contacts-cas.war is designed - to work with a JA-SIG CAS server. If you're just wanting to see how - the sample application works, please use - spring-security-sample-contacts-filter.war - as it does not require special configuration of your container. This - is also the artifact included in official release ZIPs. - - To deploy, simply copy the relevant WAR file from Spring + To deploy, simply copy the WAR file from Spring Security distribution into your container’s webapps - directory. + directory. The war should be called spring-security-samples-contacts-2.0.0.war + (the appended version number will vary depending on what release you are using). + After starting your container, check the application can load. Visit - http://localhost:8080/spring-security-sample-contacts-filter + http://localhost:8080/contacts (or whichever URL is appropriate for your web container and the WAR - you deployed). A random contact should be displayed. Click "Refresh" - several times and you will see different contacts. The business method - that provides this random contact is not secured. + you deployed). Next, click "Debug". You will be prompted to authenticate, and a series of usernames and passwords are suggested on that page. Simply authenticate with any of these and view the resulting page. It should - contain a success message similar to the following: - -
- Context on SecurityContextHolder is of type: - org.springframework.security.context.SecurityContextImpl + contain a success message similar to the following: + + Authentication object is of type: org.springframework.security.providers.UsernamePasswordAuthenticationToken - The Context implements SecurityContext. + Authentication object as a String: + org.springframework.security.providers.UsernamePasswordAuthenticationToken@1f127853: + Principal: org.springframework.security.userdetails.User@b07ed00: + Username: rod; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; + credentialsNonExpired: true; AccountNonLocked: true; + Granted Authorities: ROLE_SUPERVISOR, ROLE_USER; Password: [PROTECTED]; Authenticated: true; + Details: org.springframework.security.ui.WebAuthenticationDetails@0: + RemoteIpAddress: 127.0.0.1; SessionId: k5qypsawgpwb; + Granted Authorities: ROLE_SUPERVISOR, ROLE_USER - Authentication object is of type: - org.springframework.security.adapters.PrincipalSpringSecurityUserToken + Authentication object holds the following granted authorities: - Authentication object as a String: - org.springframework.security.adapters.PrincipalSpringSecurityUserToken@e9a7c2: - Username: rod; Password: [PROTECTED]; Authenticated: true; Granted - Authorities: ROLE_TELLER, ROLE_SUPERVISOR + ROLE_SUPERVISOR (getAuthority(): ROLE_SUPERVISOR) + ROLE_USER (getAuthority(): ROLE_USER) - Authentication object holds the following granted - authorities: - - ROLE_TELLER (getAuthority(): ROLE_TELLER) - - ROLE_SUPERVISOR (getAuthority(): ROLE_SUPERVISOR) - - SUCCESS! Your [container adapter|web filter] appears to be - properly configured! -
- - If you receive a different message, and deployed - spring-security-sample-contacts-ca.war, check you - have properly configured your Container Adapter as described elsewhere - in this reference guide. + SUCCESS! Your web filters appear to be properly configured! + + Once you successfully receive the above message, return to the sample application's home page and click "Manage". You can then try @@ -79,20 +79,13 @@ ROLE_SUPERVISOR are granted access to delete their contacts. Behind the scenes, the MethodSecurityInterceptor is securing the business - objects. If you're using or - spring-security-sample-contacts-cas.war, the - spring-security-sample-contacts-filter.war - FilterSecurityInterceptor is also securing the HTTP - requests. If using either of these WARs, be sure to try visiting - http://localhost:8080/contacts/secure/super, which - will demonstrate access being denied by the - FilterSecurityInterceptor. Note the sample - application enables you to modify the access control lists associated + objects. + The application allows you to modify the access control lists associated with different contacts. Be sure to give this a try and understand how - it works by reviewing the sample application's application context XML - files. - - The Contacts sample application also include a + it works by reviewing the application context XML files. + +
-
Tutorial Sample - - - Whilst the Contacts - Sample is quite advanced in that it illustrates the more - powerful features of domain object access control lists and so on, - sometimes you just want to start with a nice basic example. The - tutorial sample is intended to provide this for you. - - The compiled tutorial is included in the distribution ZIP file, - ready to be deployed into your web container. Authentication is - handled by the DaoAuthenticationProvider, using the - in-memory - UserDetailsService that sources information from - the users.properties file located in the WAR's - /WEB-INF directory. The form-based - authentication mechanism is used, with the commonly-used - remember-me - authentication provider used to automatically remember the login using - cookies. - - In terms of authorization, to keep things simple we've - configured the tutorial to only perform some basic web filter - authorization. We've wired two common pre-invocation access decision voters, - being the RoleVoter and - AuthenticatedVoter, such that - ROLE_* configuration attributes and - IS_AUTHENTICATED_* configuration attributes may be - used. Of course, it's extremely easy to add in other providers, with - most users probably starting with some services-layer security using - MethodSecurityInterceptor. - - We recommend you start with the tutorial sample, as the XML is - minimal and easy to follow. All of the needed filters are configured properly, and using - best practise. Most importantly, you can easily this one XML file (and - its corresponding web.xml entries) to your existing - application. Only when this basic integration is achieved do we - suggest you attempt adding in method authorization or domain object - security. -
+ \ No newline at end of file