Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-04 09:17:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-1160: Renaming of authentication filters and entry points and associated doc changes

Browse Source
This commit is contained in:
Luke Taylor
2009-05-12 05:37:11 +00:00
parent 5a03e842bd
commit a8215fa2cb
53 changed files with 1126 additions and 1061 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/docbkx/appendix-namespace.xml
+9 -9
View File
@@ -83,7 +83,7 @@
</para>
<para>
If enabled this will add a <classname>SessionFixationProtectionFilter</classname> to the stack. The session fixation protection
options on namespace-created instances of <classname>AbstractProcessingFilter</classname> will also be set appropriately.
options on namespace-created instances of <classname>AbstractAuthenticationProcessingFilter</classname> will also be set appropriately.
</para>
</section>
@@ -206,8 +206,8 @@
<section xml:id="nsa-form-login">
<title>The <literal>&lt;form-login&gt;</literal> Element</title>
<para>
Used to add an <classname>AuthenticationProcessingFilter</classname> to the filter stack and an
<classname>AuthenticationProcessingFilterEntryPoint</classname> to the application context to provide authentication
Used to add an <classname>UsernamePasswordAuthenticationProcessingFilter</classname> to the filter stack and an
<classname>LoginUrlAuthenticationEntryPoint</classname> to the application context to provide authentication
on demand. This will always take precedence over other namespace-created entry points.
If no attributes are supplied, a login page will be generated automatically at the URL "/spring-security-login"
<footnote><para>This feature is really just provided for convenience and is not intended for production (where a
@@ -221,7 +221,7 @@
<title><literal>login-page</literal></title>
<para>
The URL that should be used to render the login page. Maps to the <literal>loginFormUrl</literal>
property of the <classname>AuthenticationProcessingFilterEntryPoint</classname>. Defaults to
property of the <classname>LoginUrlAuthenticationEntryPoint</classname>. Defaults to
"/spring-security-login".
</para>
</section>
@@ -229,14 +229,14 @@
<section>
<title><literal>login-processing-url</literal></title>
<para>
Maps to the <literal>filterProcessesUrl</literal> property of <classname>AuthenticationProcessingFilter</classname>.
Maps to the <literal>filterProcessesUrl</literal> property of <classname>UsernamePasswordAuthenticationProcessingFilter</classname>.
The default value is "/j_spring_security_check".
</para>
</section>
<section>
<title><literal>default-target-url</literal></title>
<para>Maps to the <literal>defaultTargetUrl</literal> property of <classname>AuthenticationProcessingFilter</classname>. If
<para>Maps to the <literal>defaultTargetUrl</literal> property of <classname>UsernamePasswordAuthenticationProcessingFilter</classname>. If
not set, the default value is "/" (the application root). A user will be taken to this URL after logging in, provided they
were not asked to login while attempting to access a secured resource, when they will be taken to the originally requested URL.
</para>
@@ -247,14 +247,14 @@
<para>
If set to "true", the user will always start at the value given by <literal>default-target-url</literal>, regardless of how
they arrived at the login page. Maps to the <literal>alwaysUseDefaultTargetUrl</literal> property of
<classname>AuthenticationProcessingFilter</classname>. Default value is "false".
<classname>UsernamePasswordAuthenticationProcessingFilter</classname>. Default value is "false".
</para>
</section>
<section>
<title><literal>authentication-failure-url</literal></title>
<para>
Maps to the <literal>authenticationFailureUrl</literal> property of <classname>AuthenticationProcessingFilter</classname>.
Maps to the <literal>authenticationFailureUrl</literal> property of <classname>UsernamePasswordAuthenticationProcessingFilter</classname>.
Defines the URL the browser will be redirected to on login failure. Defaults to "/spring_security_login?login_error", which will
be automatically handled by the automatic login page generator, re-rendering the login page with an error message.
</para>
@@ -425,7 +425,7 @@
<title>The <literal>&lt;openid-login&gt;</literal> Element</title>
<para>
Similar to <literal>&lt;form-login&gt;</literal> and has the same attributes. The default value for <literal>login-processing-url</literal>
is "/j_spring_openid_security_check". An <classname>OpenIDAuthenticationProcessingFilter</classname> and <classname>OpenIDAuthenticationProvider</classname>
is "/j_spring_openid_security_check". An <classname>OpenIDUsernamePasswordAuthenticationProcessingFilter</classname> and <classname>OpenIDAuthenticationProvider</classname>
will be registered. The latter requires a reference to a <interfacename>UserDetailsService</interfacename>. Again, this can be
specified by Id, using the <literal>user-service-ref</literal> attribute, or will be located automatically in the application context.
</para>
src/docbkx/cas-auth-provider.xml
+1 -1
View File
@@ -316,7 +316,7 @@
</para>
<para>The <literal>CasProcessingFilter</literal> has very similar
properties to the <literal>AuthenticationProcessingFilter</literal>
properties to the <literal>UsernamePasswordAuthenticationProcessingFilter</literal>
(used for form-based logins). Each property is
self-explanatory. Note that we've also used the namespace syntax
for setting up an alias to the authentication mnager, since the
src/docbkx/channel-security.xml
+1 -1
View File
@@ -119,7 +119,7 @@
<classname>ChannelProcessingFilter</classname> with form-based login,
please ensure that your login page is set to
<literal>REQUIRES_SECURE_CHANNEL</literal>, and that the
<literal>AuthenticationProcessingFilterEntryPoint.forceHttps</literal>
<literal>LoginUrlAuthenticationEntryPoint.forceHttps</literal>
property is <literal>true</literal>.</para>
</section>
src/docbkx/common-auth-services.xml
+2 -2
View File
@@ -67,7 +67,7 @@
guide - although they are correct in the above example.</para>
<para>In our example we have the
<literal>AuthenticationProcessingFilter</literal> and
<literal>UsernamePasswordAuthenticationProcessingFilter</literal> and
<literal>BasicProcessingFilter</literal> being used. These are the
"authentication mechanisms" that respond to form-based authentication
and BASIC HTTP header-based authentication respectively (we discussed
@@ -197,7 +197,7 @@
</bean>
<bean id="authenticationProcessingFilterEntryPoint"
class="org.springframework.security.web.authentication.AuthenticationProcessingFilterEntryPoint">
class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
<property name="loginFormUrl" value="/login.jsp"/>
<property name="forceHttps">< value="false"/>
</bean>]]></programlisting></para>
src/docbkx/form-authentication.xml
+5 -5
View File
@@ -6,7 +6,7 @@
<para>HTTP Form Authentication involves using the
<literal>AuthenticationProcessingFilter</literal> to process a login
<literal>UsernamePasswordAuthenticationProcessingFilter</literal> to process a login
form. This is the most common way for an application to authenticate end
users. Form-based authentication is entirely compatible with the DAO
and JAAS authentication providers.</para>
@@ -19,10 +19,10 @@
<literal>j_password</literal> input fields, and posts to a URL that is
monitored by the filter (by default
<literal>/j_spring_security_check</literal>). You should add an
<literal>AuthenticationProcessingFilter</literal> to your application context:
<literal>UsernamePasswordAuthenticationProcessingFilter</literal> to your application context:
<programlisting><![CDATA[
<bean id="authenticationProcessingFilter"
class="org.springframework.security.web.authentication.AuthenticationProcessingFilter">
class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationProcessingFilter">
<property name="authenticationManager" ref="authenticationManager"/>
<property name="authenticationFailureUrl" value="/login.jsp?login_error=1"/>
<property name="defaultTargetUrl" value="/"/>
@@ -36,7 +36,7 @@
<literal>authenticationFailureUrl</literal>. The
<literal>AuthenticationException</literal> will be placed into the
<literal>HttpSession</literal> attribute indicated by
<literal>AbstractProcessingFilter.SPRING_SECURITY_LAST_EXCEPTION_KEY</literal>,
<literal>AbstractAuthenticationProcessingFilter.SPRING_SECURITY_LAST_EXCEPTION_KEY</literal>,
enabling a reason to be provided to the user on the error page.</para>
<para>If authentication is successful, the resulting
@@ -46,7 +46,7 @@
<para>Once the <classname>SecurityContextHolder</classname> has been
updated, the browser will need to be redirected to the target URL which
is usually indicated by the <literal>HttpSession</literal> attribute stored under
<literal>AbstractProcessingFilter.SPRING_SECURITY_TARGET_URL_KEY</literal>.
<literal>AbstractAuthenticationProcessingFilter.SPRING_SECURITY_TARGET_URL_KEY</literal>.
This attribute is automatically set by the
<classname>ExceptionTranslationFilter</classname> when an
<literal>AuthenticationException</literal> occurs, so that after login
src/docbkx/namespace-config.xml
+3 -3
View File
@@ -395,7 +395,7 @@
at particular locations or use a Spring Security filter for which there isn't currently a
namespace configuration option (CAS, for example). Or you might want to use a customized
version of a standard namespace filter, such as the
<literal>AuthenticationProcessingFilter</literal> which is created by the
<literal>UsernamePasswordAuthenticationProcessingFilter</literal> which is created by the
<literal>&lt;form-login&gt;</literal> element, taking advantage of some of the extra
configuration options which are available by using defining the bean directly. How can you
do this with namespace configuration, since the filter chain is not directly exposed? </para>
@@ -453,7 +453,7 @@
</row>
<row>
<entry> AUTHENTICATION_PROCESSING_FILTER </entry>
<entry><literal>AuthenticationProcessingFilter</literal></entry>
<entry><literal>UsernamePasswordAuthenticationProcessingFilter</literal></entry>
<entry><literal>http/form-login</literal></entry>
</row>
<row>
@@ -691,7 +691,7 @@
you can then use this name elsewhere in your application context. <programlisting><![CDATA[
<security:authentication-manager alias="authenticationManager"/>
<bean id="customizedFormLoginFilter" class="org.springframework.security.web.authentication.AuthenticationProcessingFilter">
<bean id="customizedFormLoginFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationProcessingFilter">
<security:custom-filter position="AUTHENTICATION_PROCESSING_FILTER "/>
<property name="authenticationManager" ref="authenticationManager"/>
...
src/docbkx/preauth.xml
+1 -1
View File
@@ -109,7 +109,7 @@
</para>
</section>
<section>
<title>PreAuthenticatedProcessingFilterEntryPoint</title>
<title>Http403ForbiddenEntryPoint</title>
<para>
The <interfacename>AuthenticationEntryPoint</interfacename> was discussed in the <link xlink:href="#tech-auth-entry-point">technical
overview</link> chapter. Normally it is responsible for kick-starting the authentication process for an unauthenticated user
src/docbkx/remember-me-authentication.xml
+5 -5
View File
@@ -92,8 +92,8 @@
<para>Remember-me authentication is not used with basic
authentication, given it is often not used with
<literal>HttpSession</literal>s. Remember-me is used with
<literal>AuthenticationProcessingFilter</literal>, and is implemented
via hooks in the <literal>AbstractProcessingFilter</literal>
<literal>UsernamePasswordAuthenticationProcessingFilter</literal>, and is implemented
via hooks in the <literal>AbstractAuthenticationProcessingFilter</literal>
superclass. The hooks will invoke a concrete
<interfacename>RememberMeServices</interfacename> at the appropriate times. The
interface looks like this:
@@ -104,7 +104,7 @@
</programlisting>
Please refer to the JavaDocs for a fuller discussion on what the
methods do, although note at this stage that
<literal>AbstractProcessingFilter</literal> only calls the
<literal>AbstractAuthenticationProcessingFilter</literal> only calls the
<literal>loginFail()</literal> and <literal>loginSuccess()</literal>
methods. The <literal>autoLogin()</literal> method is called by
<classname>RememberMeProcessingFilter</classname> whenever the
@@ -156,13 +156,13 @@
]]>
</programlisting>Don't forget to add your
<interfacename>RememberMeServices</interfacename> implementation to your
<literal>AuthenticationProcessingFilter.setRememberMeServices()</literal>
<literal>UsernamePasswordAuthenticationProcessingFilter.setRememberMeServices()</literal>
property, include the
<literal>RememberMeAuthenticationProvider</literal> in your
<literal>AuthenticationManager.setProviders()</literal> list, and add
<classname>RememberMeProcessingFilter</classname> into your
<classname>FilterChainProxy</classname> (typically immediately after your
<literal>AuthenticationProcessingFilter</literal>).</para>
<literal>UsernamePasswordAuthenticationProcessingFilter</literal>).</para>
</section>
<section>
<title>PersistentTokenBasedRememberMeServices</title>
src/docbkx/secured-objects.xml
+3 -3
View File
@@ -192,7 +192,7 @@ public void afterPropertiesSet() throws Exception {
</bean>
<bean id="authenticationEntryPoint"
class="org.springframework.security.web.authentication.AuthenticationProcessingFilterEntryPoint">
class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
<property name="loginFormUrl" value="/acegilogin.jsp"/>
<property name="forceHttps" value="false"/>
</bean>
@@ -222,13 +222,13 @@ public void afterPropertiesSet() throws Exception {
authenticated. The class handles presenting the appropriate response
to the user so that authentication can begin. Three concrete
implementations are provided with Spring Security:
<classname>AuthenticationProcessingFilterEntryPoint</classname> for
<classname>LoginUrlAuthenticationEntryPoint</classname> for
commencing a form-based authentication,
<literal>BasicProcessingFilterEntryPoint</literal> for commencing a
HTTP Basic authentication process, and
<literal>CasProcessingFilterEntryPoint</literal> for commencing a
JA-SIG Central Authentication Service (CAS) login. The
<classname>AuthenticationProcessingFilterEntryPoint</classname> and
<classname>LoginUrlAuthenticationEntryPoint</classname> and
<literal>CasProcessingFilterEntryPoint</literal> have optional
properties related to forcing the use of HTTPS, so please refer to the
JavaDocs if you require this.</para>
src/docbkx/siteminder-auth-provider.xml
+2 -2
View File
@@ -8,7 +8,7 @@
Associates.</para>
<para>Spring Security provides a filter,
<literal>SiteminderAuthenticationProcessingFilter</literal> and
<literal>SiteminderUsernamePasswordAuthenticationProcessingFilter</literal> and
provider, <literal>SiteminderAuthenticationProvider</literal> that can
be used to process requests that have been pre-authenticated by
Siteminder. This filter assumes that you're using Siteminder for
@@ -39,7 +39,7 @@
example:</para>
<para><programlisting>&lt;bean id="authenticationProcessingFilter"
class="org.springframework.security.ui.webapp.SiteminderAuthenticationProcessingFilter"&gt;
class="org.springframework.security.ui.webapp.SiteminderUsernamePasswordAuthenticationProcessingFilter"&gt;
&lt;property name="authenticationManager"&gt;&lt;ref bean="authenticationManager"/&gt;&lt;/property&gt;
&lt;property name="authenticationFailureUrl"&gt;&lt;value&gt;/login.jsp?login_error=1&lt;/value&gt;&lt;/property&gt;
&lt;property name="defaultTargetUrl"&gt;&lt;value&gt;/security.do?method=getMainMenu&lt;/value&gt;&lt;/property&gt;
src/docbkx/springsecurity.xml
+2 -2
View File
@@ -4,7 +4,7 @@
<info><title>Spring Security</title><subtitle>Reference Documentation</subtitle><author>
<personname>Ben Alex, Luke Taylor</personname>
</author>
<releaseinfo>2.0.x</releaseinfo>
<releaseinfo>3.0.0.M1</releaseinfo>
</info>
<toc/>
<preface xml:id="preface">
@@ -65,7 +65,7 @@
<partintro>
<para>The later parts of this guide provide an in-depth discussion of the framework
architecture and implementation classes, an understanding of which is important if you need
to do any serious customization. In this part, we'll introduce Spring Security 2.0, give a
to do any serious customization. In this part, we'll introduce Spring Security 3.0, give a
brief overview of the project's history and take a slightly gentler look at how to get
started using the framework. In particular, we'll look at namespace configuration which
provides a much simpler way of securing your application compared to the traditional Spring
src/docbkx/supporting-infrastructure.xml
+1 -1
View File
@@ -239,7 +239,7 @@
<listitem>
<para>Authentication processing mechanisms -
<literal>AuthenticationProcessingFilter</literal>,
<literal>UsernamePasswordAuthenticationProcessingFilter</literal>,
<literal>CasProcessingFilter</literal>,
<literal>BasicProcessingFilter, HttpRequestIntegrationFilter,
JbossIntegrationFilter</literal> etc - so that the
src/docbkx/technical-overview.xml
+1 -1
View File
@@ -503,7 +503,7 @@ if (obj instanceof UserDetails) {
A "configuration attribute" can be thought of as a String that has special meaning to the classes used by
<classname>AbstractSecurityInterceptor</classname>. They may be simple role names or have more complex meaning, depending on the
how sophisticated the <interfacename>AccessDecisionManager</interfacename> implementation is.
The <classname>AbstractSecurityInterceptor</classname> is configured with an <interfacename>ObjectDefinitionSource</interfacename> which
The <classname>AbstractSecurityInterceptor</classname> is configured with a <interfacename>SecurityMetadataSource</interfacename> which
it uses to look up the attributes for a secure object. Usually this configuration will be hidden from the user. Configuration
attributes will be entered as annotations on secured methods, or as access attributes on secured URLs (using the
namespace <literal>&lt;intercept-url&gt;</literal> syntax).