|
|
|
@@ -21,13 +21,13 @@
|
|
|
|
|
]]></programlisting> This is much simpler than wiring up the equivalent Apache Directory Server
|
|
|
|
|
beans. The most common alternative configuration requirements are supported by attributes on
|
|
|
|
|
the <literal>ldap-server</literal> element and the user is isolated from worrying about which
|
|
|
|
|
beans they need to create and what the bean property names are. <footnote>
|
|
|
|
|
<para>You can find out more about the use of the <literal>ldap-server</literal> element in
|
|
|
|
|
the chapter on <link xlink:href="#ldap">LDAP</link>.</para>
|
|
|
|
|
</footnote>. Use of a good XML editor while editing the application context file should
|
|
|
|
|
provide information on the attributes and elements that are available. We would recommend that
|
|
|
|
|
you try out the <link xlink:href="http://www.springsource.com/products/sts">SpringSource Tool
|
|
|
|
|
Suite</link> as it has special features for working with standard Spring namespaces. </para>
|
|
|
|
|
beans they need to create and what the bean property names are. <footnote><para>You can find
|
|
|
|
|
out more about the use of the <literal>ldap-server</literal> element in the chapter on
|
|
|
|
|
<link xlink:href="#ldap">LDAP</link>.</para></footnote>. Use of a good XML editor while
|
|
|
|
|
editing the application context file should provide information on the attributes and elements
|
|
|
|
|
that are available. We would recommend that you try out the <link
|
|
|
|
|
xlink:href="http://www.springsource.com/products/sts">SpringSource Tool Suite</link> as it
|
|
|
|
|
has special features for working with standard Spring namespaces. </para>
|
|
|
|
|
<para> To start using the security namespace in your application context, all you need to do is
|
|
|
|
|
add the schema declaration to your application context file: <programlisting language="xml">
|
|
|
|
|
<![CDATA[
|
|
|
|
@@ -61,41 +61,25 @@
|
|
|
|
|
<para> The namespace is designed to capture the most common uses of the framework and provide
|
|
|
|
|
a simplified and concise syntax for enabling them within an application. The design is based
|
|
|
|
|
around the large-scale dependencies within the framework, and can be divided up into the
|
|
|
|
|
following areas: <itemizedlist>
|
|
|
|
|
<listitem>
|
|
|
|
|
<para>
|
|
|
|
|
following areas: <itemizedlist><listitem><para>
|
|
|
|
|
<emphasis>Web/HTTP Security</emphasis> - the most complex part. Sets up the filters
|
|
|
|
|
and related service beans used to apply the framework authentication mechanisms, to
|
|
|
|
|
secure URLs, render login and error pages and much more.</para>
|
|
|
|
|
</listitem>
|
|
|
|
|
<listitem>
|
|
|
|
|
<para>
|
|
|
|
|
secure URLs, render login and error pages and much
|
|
|
|
|
more.</para></listitem><listitem><para>
|
|
|
|
|
<emphasis>Business Object (Method) Security</emphasis> - options for securing the
|
|
|
|
|
service layer.</para>
|
|
|
|
|
</listitem>
|
|
|
|
|
<listitem>
|
|
|
|
|
<para>
|
|
|
|
|
service layer.</para></listitem><listitem><para>
|
|
|
|
|
<emphasis>AuthenticationManager</emphasis> - handles authentication requests from
|
|
|
|
|
other parts of the framework.</para>
|
|
|
|
|
</listitem>
|
|
|
|
|
<listitem>
|
|
|
|
|
<para>
|
|
|
|
|
other parts of the framework.</para></listitem><listitem><para>
|
|
|
|
|
<emphasis>AccessDecisionManager</emphasis> - provides access decisions for web and
|
|
|
|
|
method security. A default one will be registered, but you can also choose to use a
|
|
|
|
|
custom one, declared using normal Spring bean syntax.</para>
|
|
|
|
|
</listitem>
|
|
|
|
|
<listitem>
|
|
|
|
|
<para>
|
|
|
|
|
custom one, declared using normal Spring bean
|
|
|
|
|
syntax.</para></listitem><listitem><para>
|
|
|
|
|
<emphasis>AuthenticationProvider</emphasis>s - mechanisms against which the
|
|
|
|
|
authentication manager authenticates users. The namespace provides supports for
|
|
|
|
|
several standard options and also a means of adding custom beans declared using a
|
|
|
|
|
traditional syntax. </para>
|
|
|
|
|
</listitem>
|
|
|
|
|
<listitem>
|
|
|
|
|
<para>
|
|
|
|
|
traditional syntax. </para></listitem><listitem><para>
|
|
|
|
|
<emphasis>UserDetailsService</emphasis> - closely related to authentication providers,
|
|
|
|
|
but often also required by other beans.</para>
|
|
|
|
|
</listitem>
|
|
|
|
|
but often also required by other beans.</para></listitem>
|
|
|
|
|
<!-- todo: diagram and link to other sections which describe the interfaces -->
|
|
|
|
|
</itemizedlist></para>
|
|
|
|
|
<para>We'll see how to configure these in the following sections.</para>
|
|
|
|
@@ -148,20 +132,20 @@
|
|
|
|
|
requirements for requests matching the given pattern. With the default configuration, this
|
|
|
|
|
is typically a comma-separated list of roles, one of which a user must have to be allowed to
|
|
|
|
|
make the request. Access-control in Spring Security is not limited to the use of simple
|
|
|
|
|
roles, however, and we'll see later how the interpretation can vary<footnote>
|
|
|
|
|
<para>The interpretation of the comma-separated values in the <literal>access</literal>
|
|
|
|
|
attribute depends on the implementation of the <link xlink:href="#ns-access-manager"
|
|
|
|
|
roles, however, and we'll see later how the interpretation can vary<footnote><para>The
|
|
|
|
|
interpretation of the comma-separated values in the <literal>access</literal> attribute
|
|
|
|
|
depends on the implementation of the <link xlink:href="#ns-access-manager"
|
|
|
|
|
>AccessDecisionManager</link> which is used. In Spring Security 3.0, the attribute can
|
|
|
|
|
also be populated with an <link xlink:href="#el-access">EL expression</link>.</para>
|
|
|
|
|
</footnote>.</para>
|
|
|
|
|
also be populated with an <link xlink:href="#el-access">EL
|
|
|
|
|
expression</link>.</para></footnote>.</para>
|
|
|
|
|
<note>
|
|
|
|
|
<para>You can use multiple <literal><intercept-url></literal> elements to define
|
|
|
|
|
different access requirements for different sets of URLs, but they will be evaluated in
|
|
|
|
|
the order listed and the first match will be used. So you must put the most specific
|
|
|
|
|
matches at the top. You can also add a <literal>method</literal> attribute to limit the
|
|
|
|
|
match to a particular HTTP method (<literal>GET</literal>, <literal>POST</literal>,
|
|
|
|
|
<literal>PUT</literal> etc.). For a pattern defined both with and without a method, the
|
|
|
|
|
method-specific match will take precedence regardless of ordering. </para>
|
|
|
|
|
<literal>PUT</literal> etc.). If a request matches multiple patterns, the
|
|
|
|
|
method-specific match will take precedence regardless of ordering.</para>
|
|
|
|
|
</note>
|
|
|
|
|
<para> To add some users, you can define a set of test data directly in the namespace: <programlisting language="xml"><![CDATA[
|
|
|
|
|
<authentication-manager>
|
|
|
|
@@ -184,8 +168,8 @@
|
|
|
|
|
<classname>DaoAuthenticationProvider</classname> bean and the
|
|
|
|
|
<literal><user-service></literal> element creates an
|
|
|
|
|
<classname>InMemoryDaoImpl</classname>. All <literal>authentication-provider</literal>
|
|
|
|
|
elements must be within the <literal>authentication-manager</literal> element, which
|
|
|
|
|
creates a <classname>ProviderManager</classname> and registers the authentication
|
|
|
|
|
elements must be children of the <literal><authentication-manager></literal> element,
|
|
|
|
|
which creates a <classname>ProviderManager</classname> and registers the authentication
|
|
|
|
|
providers with it. You can find more detailed information on the beans that are created in
|
|
|
|
|
the <link xlink:href="#appendix-namespace">namespace appendix</link>. It's worth
|
|
|
|
|
cross-checking this if you want to start understanding what the important classes in the
|
|
|
|
@@ -217,15 +201,14 @@
|
|
|
|
|
<logout />
|
|
|
|
|
</http>
|
|
|
|
|
]]></programlisting> These other elements are responsible for setting up form-login, basic
|
|
|
|
|
authentication and logout handling services respectively <footnote>
|
|
|
|
|
<para>In versions prior to 3.0, this list also included remember-me functionality. This
|
|
|
|
|
could cause some confusing errors with some configurations and was removed in 3.0. In
|
|
|
|
|
3.0, the addition of an <classname>AnonymousAuthenticationFilter</classname> is part
|
|
|
|
|
of the default <literal><http></literal> configuration, so the
|
|
|
|
|
<literal><anonymous /></literal> element is added regardless of whether
|
|
|
|
|
<literal>auto-config</literal> is enabled.</para>
|
|
|
|
|
</footnote> . They each have attributes which can be used to alter their behaviour.
|
|
|
|
|
</para>
|
|
|
|
|
authentication and logout handling services respectively <footnote><para>In versions prior
|
|
|
|
|
to 3.0, this list also included remember-me functionality. This could cause some
|
|
|
|
|
confusing errors with some configurations and was removed in 3.0. In 3.0, the addition
|
|
|
|
|
of an <classname>AnonymousAuthenticationFilter</classname> is part of the default
|
|
|
|
|
<literal><http></literal> configuration, so the <literal><anonymous
|
|
|
|
|
/></literal> element is added regardless of whether <literal>auto-config</literal>
|
|
|
|
|
is enabled.</para></footnote> . They each have attributes which can be used to alter
|
|
|
|
|
their behaviour. </para>
|
|
|
|
|
</section>
|
|
|
|
|
<section xml:id="ns-form-and-basic">
|
|
|
|
|
<title>Form and Basic Login Options</title>
|
|
|
|
@@ -246,16 +229,15 @@
|
|
|
|
|
</programlisting> Note that you can still use <literal>auto-config</literal>. The
|
|
|
|
|
<literal>form-login</literal> element just overrides the default settings. Also note
|
|
|
|
|
that we've added an extra <literal>intercept-url</literal> element to say that any
|
|
|
|
|
requests for the login page should be available to anonymous users <footnote>
|
|
|
|
|
<para>See the chapter on <link xlink:href="#anonymous">anonymous authentication</link>
|
|
|
|
|
and also the <link xlink:href="#authz-authenticated-voter">AuthenticatedVoter</link>
|
|
|
|
|
class for more details on how the value
|
|
|
|
|
<literal>IS_AUTHENTICATED_ANONYMOUSLY</literal> is processed.</para>
|
|
|
|
|
</footnote>. Otherwise the request would be matched by the pattern <literal>/**</literal>
|
|
|
|
|
and it wouldn't be possible to access the login page itself! This is a common
|
|
|
|
|
configuration error and will result in an infinite loop in the application. Spring
|
|
|
|
|
Security will emit a warning in the log if your login page appears to be secured. It is
|
|
|
|
|
also possible to have all requests matching a particular pattern bypass the security
|
|
|
|
|
requests for the login page should be available to anonymous users <footnote><para>See the
|
|
|
|
|
chapter on <link xlink:href="#anonymous">anonymous authentication</link> and also the
|
|
|
|
|
<link xlink:href="#authz-authenticated-voter">AuthenticatedVoter</link> class for
|
|
|
|
|
more details on how the value <literal>IS_AUTHENTICATED_ANONYMOUSLY</literal> is
|
|
|
|
|
processed.</para></footnote>. Otherwise the request would be matched by the pattern
|
|
|
|
|
<literal>/**</literal> and it wouldn't be possible to access the login page itself! This
|
|
|
|
|
is a common configuration error and will result in an infinite loop in the application.
|
|
|
|
|
Spring Security will emit a warning in the log if your login page appears to be secured.
|
|
|
|
|
It is also possible to have all requests matching a particular pattern bypass the security
|
|
|
|
|
filter chain completely: <programlisting language="xml"><
Luke Taylor