To complete this tutorial, you will require a servlet container (such as Tomcat) and a general understanding of using Spring without Acegi Security. The Petclinic @@ -14,11 +15,13 @@ only try to learn one thing at a time, and start with Spring/Petclinic before Acegi Security.
-+You will also need to download:
Unzip both files. After unzipping Acegi Security, you'll need to unzip the @@ -29,7 +32,83 @@ unzipped WAR, not the original ZIP). There is no need to setup any environment variables to complete the tutorial.
-+We now need to put some extra files into Petclinic. The following commands should work: +
+mkdir %spring%\samples\petclinic\war\WEB-INF\lib +copy %acegi%\acegilogin.jsp %spring%\samples\petclinic\war +copy %acegi%\accessDenied.jsp %spring%\samples\petclinic\war +copy %acegi%\WEB-INF\users.properties %spring%\samples\petclinic\war\WEB-INF +copy %acegi%\WEB-INF\applicationContext-acegi-security.xml %spring%\samples\petclinic\war\WEB-INF +copy %acegi%\WEB-INF\lib\acegi-security-1.0.0.jar %spring%\samples\petclinic\war\WEB-INF\lib +copy %acegi%\WEB-INF\lib\oro-2.0.8.jar %spring%\samples\petclinic\war\WEB-INF\lib +copy %acegi%\WEB-INF\lib\commons-codec-1.3.jar %spring%\samples\petclinic\war\WEB-INF\lib ++ + +
Edit %spring%\samples\petclinic\war\WEB-INF\web.xml and insert the following block of code. +
+<filter> + <filter-name>Acegi Filter Chain Proxy</filter-name> + <filter-class>org.acegisecurity.util.FilterToBeanProxy</filter-class> + <init-param> + <param-name>targetClass</param-name> + <param-value>org.acegisecurity.util.FilterChainProxy</param-value> + </init-param> +</filter> + +<filter-mapping> + <filter-name>Acegi Filter Chain Proxy</filter-name> + <url-pattern>/*</url-pattern> +</filter-mapping> ++Next, locate the "contextConfigLocation" parameter, and add a new line into the existing param-value. +The resulting block will look like this: +
+<context-param> + <param-name>contextConfigLocation</param-name> + <param-value> + /WEB-INF/applicationContext-jdbc.xml + /WEB-INF/applicationContext-acegi-security.xml + </param-value> +</context-param> ++ + +
+To make it easier to experiment with the application, now edit +%spring%\samples\petclinic\war\WEB-INF\jsp\footer.jsp. Add a new "logout" link, as shown: +
+<table style="width:100%"><tr> + <td><A href="<c:url value="/welcome.htm"/>">Home</A></td> + <td><A href="<c:url value="/j_acegi_logout"/>">Logout</A></td> + <td style="text-align:right;color:silver">PetClinic :: a Spring Framework demonstration</td> +</tr></table> ++ + +
+Our last step is to specify which URLs require authorization and which do not. Let's +edit %spring%\samples\petclinic\war\WEB-INF\applicationContext-acegi-security.xml. +Locate the bean definition for FilterSecurityInterceptor. Edit its objectDefinitionSource +property so that it reflects the following: +
+<property name="objectDefinitionSource"> + <value> + CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON + PATTERN_TYPE_APACHE_ANT + /acegilogin.jsp=IS_AUTHENTICATED_ANONYMOUSLY + /**=IS_AUTHENTICATED_REMEMBERED + </value> +</property> ++ + +
Start the Hypersonic server (this is just normal Petclinic configuration):
@@ -46,88 +125,11 @@ build setupDB-
Edit %spring%\samples\petclinic\war\WEB-INF\web.xml and insert the following block of code. -
- <filter> - <filter-name>Acegi Filter Chain Proxy</filter-name> - <filter-class>org.acegisecurity.util.FilterToBeanProxy</filter-class> - <init-param> - <param-name>targetClass</param-name> - <param-value>org.acegisecurity.util.FilterChainProxy</param-value> - </init-param> - </filter> - - <filter-mapping> - <filter-name>Acegi Filter Chain Proxy</filter-name> - <url-pattern>/*</url-pattern> - </filter-mapping> --Next, locate the "contextConfigLocation" parameter, and add a new line into the existing param-value. -The resulting block will look like this: -
-<context-param> - <param-name>contextConfigLocation</param-name> - <param-value> - /WEB-INF/applicationContext-jdbc.xml - /WEB-INF/applicationContext-acegi-security.xml - </param-value> -</context-param> -- - -
-We now need to put some extra files into Petclinic. The following commands should work: -
-copy %acegi%\acegilogin.jsp %spring%\samples\petclinic\war -copy %acegi%\WEB-INF\users.properties %spring%\samples\petclinic\war\WEB-INF -copy %acegi%\WEB-INF\applicationContext-acegi-security.xml %spring%\samples\petclinic\war\WEB-INF -copy %acegi%\WEB-INF\lib\acegi-security-1.0.0.jar %spring%\samples\petclinic\war\WEB-INF\lib -copy %acegi%\WEB-INF\lib\oro-2.0.8.jar %spring%\samples\petclinic\war\WEB-INF\lib -copy %acegi%\WEB-INF\lib\commons-codec-1.3.jar %spring%\samples\petclinic\war\WEB-INF\lib -- - -
-To make it easier to experiment with the application, let's edit -%spring%\samples\petclinic\war\WEB-INF\jsp\footer.jsp. Add a new "logout" link, as shown: -
- <table style="width:100%"><tr> - <td><A href="<c:url value="/welcome.htm"/>">Home</A></td> - <td><A href="<c:url value="/j_acegi_logout"/>">Logout</A></td> - <td style="text-align:right;color:silver">PetClinic :: a Spring Framework demonstration</td> - </tr></table> - -- - - -
-Our last step is to specify which URLs require authorization and which do not. Let's -edit %spring%\samples\petclinic\war\WEB-INF\applicationContext-acegi-security.xml. -Scroll to the bottom and locate the bean definition for FilterSecurityInterceptor. -Edit its objectDefinitionSource property so that it reflects the following: -
- <property name="objectDefinitionSource"> - <value> - CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON - PATTERN_TYPE_APACHE_ANT - /acegilogin.jsp=IS_AUTHENTICATED_ANONYMOUSLY - /**=IS_AUTHENTICATED_REMEMBERED - </value> - </property> --
-Use the Ant build and deploy to your servlet container: +Use Petclinic's Ant build script and deploy to your servlet container:
cd %spring%\samples\petclinic build warfile @@ -138,12 +140,83 @@ copy dist\petclinic.war %TOMCAT_HOME%\webappsFinally, start your container and try to visit the home page. Your request should be intercepted and you will be forced to login.
+Optional Bonus: Securing the Middle Tier
++Whilst you've now secured your web requests, you might want to stop users +from being able to add clinic visits unless authorized. We'll make it so +you need to hold ROLE_SUPERVISOR to add a clinic visit. +
+ ++In %spring%\samples\petclinic\war\WEB-INF\applicationContext-jdbc.xml, locate +the TransactionProxyFactoryBean definition. Add an additional property after +the existing "preInterceptors" property: +
+<property name="postInterceptors" ref="methodSecurityInterceptor"/> ++ + ++Finally, we need to add in the referred-to "methodSecurityInterceptor" bean definition. +So pop an extra bean definition in, as shown below: +
+<bean id="methodSecurityInterceptor" class="org.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor"> + <property name="authenticationManager"><ref bean="authenticationManager"/></property> + <property name="accessDecisionManager"> + <bean class="org.acegisecurity.vote.AffirmativeBased"> + <property name="allowIfAllAbstainDecisions" value="false"/> + <property name="decisionVoters"> + <list> + <bean class="org.acegisecurity.vote.RoleVoter"/> + <bean class="org.acegisecurity.vote.AuthenticatedVoter"/> + </list> + </property> + </bean> + </property> + <property name="objectDefinitionSource"> + <value> + org.springframework.samples.petclinic.Clinic.*=IS_AUTHENTICATED_REMEMBERED + org.springframework.samples.petclinic.Clinic.storeVisit=ROLE_SUPERVISOR + </value> + </property> +</bean> ++ + ++Redeploy your web application. Use the earlier process to do that. Be careful to +ensure that the old Petclinic WAR is replaced by the new Petclinic WAR in your +servlet container. Login as "marissa", who has ROLE_SUPERVISOR. You will be able to +then view a customer and add a visit. Logout, then login as anyone other than Marissa. +You will receive an access denied error when you attempt to add a visit. +
+ ++To clean things up a bit, you might want to wrap up by hiding the "add visit" link +unless you are authorized to use it. Acegi Security provides a tag library to help +you do that. Edit %spring%\samples\petclinic\war\WEB-INF\jsp\owner.jsp. Add +the following line to the top of the file: +
+<%@ taglib prefix="authz" uri="http://acegisecurity.org/authz" %> ++Next, scroll down and find the link to "add visit". Modify it as follows: ++<authz:authorize ifAllGranted="ROLE_SUPERVISOR"> + <FORM method=GET action="<c:url value="/addVisit.htm"/>" name="formVisitPet<c:out value="${pet.id}"/>"> + <INPUT type="hidden" name="petId" value="<c:out value="${pet.id}"/>"/> + <INPUT type="submit" value="Add Visit"/> + </FORM> +</authz:authorize> ++ +What now?
These steps can be applied to your own application. Although we do suggest that you visit http://acegisecurity.org and in particular review the "Suggested Steps" for getting started with Acegi -Security.
- +Security. The suggested steps are optimized for learning Acegi Security quickly +and applying it to your own projects. It also includes realistic time estimates +for each step so you can plan your integration activities.