From ebf4603028cccd90e99958a23a8acab06315278e Mon Sep 17 00:00:00 2001 From: Ben Alex Date: Fri, 30 Apr 2004 00:20:00 +0000 Subject: [PATCH] Quick-start assistance. --- readme.txt | 8 ++ samples/quick-start/.cvsignore | 5 + samples/quick-start/readme.txt | 51 ++++++++++ .../quick-start/war-root/WEB-INF/.cvsignore | 2 + .../war-root/WEB-INF/applicationContext.xml | 98 +++++++++++++++++++ .../WEB-INF/lib/acegi-security.jar.txt | 15 +++ samples/quick-start/war-root/WEB-INF/web.xml | 56 +++++++++++ samples/quick-start/war-root/acegilogin.jsp | 42 ++++++++ samples/quick-start/war-root/logoff.jsp | 3 + samples/quick-start/war-root/secure/debug.jsp | 47 +++++++++ 10 files changed, 327 insertions(+) create mode 100644 samples/quick-start/.cvsignore create mode 100644 samples/quick-start/readme.txt create mode 100644 samples/quick-start/war-root/WEB-INF/.cvsignore create mode 100644 samples/quick-start/war-root/WEB-INF/applicationContext.xml create mode 100644 samples/quick-start/war-root/WEB-INF/lib/acegi-security.jar.txt create mode 100644 samples/quick-start/war-root/WEB-INF/web.xml create mode 100644 samples/quick-start/war-root/acegilogin.jsp create mode 100644 samples/quick-start/war-root/logoff.jsp create mode 100644 samples/quick-start/war-root/secure/debug.jsp diff --git a/readme.txt b/readme.txt index fbfa52f184..db3d9cd534 100644 --- a/readme.txt +++ b/readme.txt @@ -28,6 +28,14 @@ DOCUMENTATION Please refer to the Reference Guide, which is located in the docs/reference directory. In addition, JavaDocs are located in the docs/api directory. +------------------------------------------------------------------------------- +ADDING ACEGI SECURITY TO YOUR OWN APPLICATION +------------------------------------------------------------------------------- + +Take a look in samples/quick-start. There we give you the fragments to add to +your existing web.xml and applicationContext.xml, along with a couple of files +that need to be added to your WAR file. + ------------------------------------------------------------------------------- OBTAINING SUPPORT ------------------------------------------------------------------------------- diff --git a/samples/quick-start/.cvsignore b/samples/quick-start/.cvsignore new file mode 100644 index 0000000000..13350339d1 --- /dev/null +++ b/samples/quick-start/.cvsignore @@ -0,0 +1,5 @@ +classes +dist +api +build.properties +temporary diff --git a/samples/quick-start/readme.txt b/samples/quick-start/readme.txt new file mode 100644 index 0000000000..7871006d8b --- /dev/null +++ b/samples/quick-start/readme.txt @@ -0,0 +1,51 @@ +=============================================================================== + QUICK-START SAMPLE +=============================================================================== + +Acegi Security's flexibility can be a bit daunting. Because projects only have +so much budget, and people only have so much time, often the complexity of +getting started can seem too high a price to pay. The quick-start sample is +designed to provide you the basic building blocks needed to be added to your +existing application. + +Quick-start is not executable or deployable. It's just a convenient, simple +place where you can see what needs to be added to your web application's +existing files and directories. + +What you _will_ need to change in the quick-start configuration: + +- It protects a /secure directory from HTTP requests. The /secure directory + is included (along with a debug.jsp you might find useful), but can be + deleted as soon as you are up and running. You'll need to setup your own + URLs to protect in the applicationContext.xml. Search for the + FilterInvocationInterceptor bean. + +What you _may_ need to change in the quick-start configuration: + +- It uses an in-memory list of users as your authentication repository. This + means you edit the XML file to add users, change their roles etc. If you'd + prefer to use a database, remove the InMemoryDaoImpl from the + applicationContext.xml, and add in a JdbcDaoImpl bean. For an example of + using the JdbcDaoImpl, search the reference guide. + +What does this buy you? Not a great deal more than using the Servlet spec +(although we do support regular expressions and Ant paths for URL matching)! +Seriously, you can use the Servlet spec to protect URLs, so why bother? +The quick-start sample provides you the BASE security building blocks for +your application. Whilst there's nothing wrong with using it instead of the +Servlet spec security just for the better path support or avoiding the +multitude of container authentication configurations, most people will use it +because this foundation allows you to simply tweak configuration if you wish +to: + +- Protect your business beans (search for MethodSecurityInterceptor in docs) +- Use enterprise-wide single sign on (see CAS section in docs) +- Use custom authorization voters (see Authorization section in docs) +- Deploy custom authentication providers (see Authentication section in docs) +- Perform BASIC authentication (search for BasicProcessingFilter in docs) +- Automate HTTPS redirection (see Channel Security section in docs) + +Good luck! Don't forget we're happy to help. See the end of the docs for +contact details. + +$Id$ diff --git a/samples/quick-start/war-root/WEB-INF/.cvsignore b/samples/quick-start/war-root/WEB-INF/.cvsignore new file mode 100644 index 0000000000..86e9501ee1 --- /dev/null +++ b/samples/quick-start/war-root/WEB-INF/.cvsignore @@ -0,0 +1,2 @@ +lib + diff --git a/samples/quick-start/war-root/WEB-INF/applicationContext.xml b/samples/quick-start/war-root/WEB-INF/applicationContext.xml new file mode 100644 index 0000000000..c242534750 --- /dev/null +++ b/samples/quick-start/war-root/WEB-INF/applicationContext.xml @@ -0,0 +1,98 @@ + + + + + + + + + + + + + + marissa=koala,ROLE_TELLER,ROLE_SUPERVISOR + dianne=emu,ROLE_TELLER + scott=wombat,ROLE_TELLER + peter=opal,disabled,ROLE_TELLER + + + + + + + + + + + + CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON + PATTERN_TYPE_APACHE_ANT + /secure/**=ROLE_SUPERVISOR + + + + + + + + + + my_password + + + + my_run_as_password + + + + my_run_as_password + + + + + + + + + + + + + + + false + + + + + + + + + + /acegilogin.jsp?login_error=1 + / + /j_acegi_security_check + + + + + + + + + /acegilogin.jsp + false + + + diff --git a/samples/quick-start/war-root/WEB-INF/lib/acegi-security.jar.txt b/samples/quick-start/war-root/WEB-INF/lib/acegi-security.jar.txt new file mode 100644 index 0000000000..84f1d4d34e --- /dev/null +++ b/samples/quick-start/war-root/WEB-INF/lib/acegi-security.jar.txt @@ -0,0 +1,15 @@ +You'll need to copy acegi-security.jar into your WEB-INF/lib directory. +You can find the JAR in the /dist directory of any ZIP distribution. + +Acegi-security.jar requires the following JARs in WEB-INF/lib: + +commons-logging.jar +commons-codec.jar +commons-collections.jar +jakarta-oro.jar +spring.jar + +Most of the above JARs are included with Spring. Those that are not are +definitely included in the Acegi Security "with dependencies" release ZIP. + +$Id$ diff --git a/samples/quick-start/war-root/WEB-INF/web.xml b/samples/quick-start/war-root/WEB-INF/web.xml new file mode 100644 index 0000000000..055a243688 --- /dev/null +++ b/samples/quick-start/war-root/WEB-INF/web.xml @@ -0,0 +1,56 @@ + + + + + + + + + + + + + Acegi Authentication Processing Filter + net.sf.acegisecurity.util.FilterToBeanProxy + + targetClass + net.sf.acegisecurity.ui.webapp.AuthenticationProcessingFilter + + + + + Acegi Security System for Spring Auto Integration Filter + net.sf.acegisecurity.ui.AutoIntegrationFilter + + + + Acegi HTTP Request Security Filter + net.sf.acegisecurity.util.FilterToBeanProxy + + targetClass + net.sf.acegisecurity.intercept.web.SecurityEnforcementFilter + + + + + Acegi Authentication Processing Filter + /* + + + + Acegi Security System for Spring Auto Integration Filter + /* + + + + Acegi HTTP Request Security Filter + /* + + + diff --git a/samples/quick-start/war-root/acegilogin.jsp b/samples/quick-start/war-root/acegilogin.jsp new file mode 100644 index 0000000000..f1f6a5ade0 --- /dev/null +++ b/samples/quick-start/war-root/acegilogin.jsp @@ -0,0 +1,42 @@ +<%@ taglib prefix='c' uri='http://java.sun.com/jstl/core' %> +<%@ page import="net.sf.acegisecurity.ui.AbstractProcessingFilter" %> +<%@ page import="net.sf.acegisecurity.AuthenticationException" %> + + + + Login + + + +

Login

+ +

If you've used the standardInMemoryDaoImpl config, try these users: +

+

username marissa, password koala (granted ROLE_SUPERVISOR) +

username dianne, password emu (not a supervisor) +

username scott, password wombat (not a supervisor) +

+ + <%-- this form-login-page form is also used as the + form-error-page to ask for a login again. + --%> + + + Your login attempt was not successful, try again.

+ Reason: <%= ((AuthenticationException) session.getAttribute(AbstractProcessingFilter.ACEGI_SECURITY_LAST_EXCEPTION_KEY)).getMessage() %> + + + +

+ + + + + + +
User:
Password:
+ +
+ + + diff --git a/samples/quick-start/war-root/logoff.jsp b/samples/quick-start/war-root/logoff.jsp new file mode 100644 index 0000000000..6384a8a022 --- /dev/null +++ b/samples/quick-start/war-root/logoff.jsp @@ -0,0 +1,3 @@ +<%session.invalidate(); +response.sendRedirect("index.jsp"); +%> \ No newline at end of file diff --git a/samples/quick-start/war-root/secure/debug.jsp b/samples/quick-start/war-root/secure/debug.jsp new file mode 100644 index 0000000000..47f12d3353 --- /dev/null +++ b/samples/quick-start/war-root/secure/debug.jsp @@ -0,0 +1,47 @@ +<%@ page import="net.sf.acegisecurity.context.Context" %> +<%@ page import="net.sf.acegisecurity.context.ContextHolder" %> +<%@ page import="net.sf.acegisecurity.context.SecureContext" %> +<%@ page import="net.sf.acegisecurity.Authentication" %> +<%@ page import="net.sf.acegisecurity.GrantedAuthority" %> +<%@ page import="net.sf.acegisecurity.adapters.AuthByAdapter" %> + +<% Context context = ContextHolder.getContext(); +if (context != null) { %> + Context on ContextHolder is of type: <%= context.getClass().getName() %>

+ +<% if (context instanceof SecureContext) { %> + The Context implements SecureContext.

+<% SecureContext sc = (SecureContext) context; + + Authentication auth = sc.getAuthentication(); + if (auth != null) { %> + Authentication object is of type: <%= auth.getClass().getName() %>

+ Authentication object as a String: <%= auth.toString() %>

+ + Authentication object holds the following granted authorities:

+<% GrantedAuthority[] granted = auth.getAuthorities(); + for (int i = 0; i < granted.length; i++) { %> + <%= granted[i].toString() %> (getAuthority(): <%= granted[i].getAuthority() %>)
+<% } + + if (auth instanceof AuthByAdapter) { %> +
SUCCESS! Your container adapter appears to be properly configured!

+<% } else { %> +
SUCCESS! Your web filter appears to be properly configured!
+<% } + + } else { %> + Authentication object is null.
+ This is an error and your container adapter will not operate properly until corrected.

+<% } + } else { %> + ContextHolder does not contain a SecureContext.
+ This is an error and your container adapter will not operate properly until corrected.

+<% } +} else { %> + ContextHolder on ContextHolder is null.
+ This indicates improper setup of the container adapter. Refer to the reference documentation.
+ Also ensure the correct subclass of AbstractMvcIntegrationInterceptor is being used for your container.
+<%} +%> +