From f54831f2b5a939eb10d475fbcb43aac096903b9d Mon Sep 17 00:00:00 2001 From: Luke Taylor Date: Sat, 6 Feb 2010 18:01:34 +0000 Subject: [PATCH] SEC-1398: Minor changes to method security annotation information in namespace chapter. Added some explanation of the different annotation types and their suitability. --- docs/manual/src/docbook/namespace-config.xml | 34 +++++++++++++------- 1 file changed, 22 insertions(+), 12 deletions(-) diff --git a/docs/manual/src/docbook/namespace-config.xml b/docs/manual/src/docbook/namespace-config.xml index 43a62e69da..019024c780 100644 --- a/docs/manual/src/docbook/namespace-config.xml +++ b/docs/manual/src/docbook/namespace-config.xml @@ -620,21 +620,21 @@ List<OpenIDAttribute> attributes = token.getAttributes();The
Method Security From version 2.0 onwards Spring Security has improved support substantially for adding - security to your service layer methods. It provides support for JSR-250 security as well as - the framework's original @Secured annotation. From 3.0 you can also make - use of new expression-based annotations. You can apply - security to a single bean, using the intercept-methods element to decorate - the bean declaration, or you can secure multiple beans across the entire service layer using - the AspectJ style pointcuts. + security to your service layer methods. It provides support for JSR-250 annotation security as + well as the framework's original @Secured annotation. From 3.0 you can also + make use of new expression-based annotations. You can + apply security to a single bean, using the intercept-methods element to + decorate the bean declaration, or you can secure multiple beans across the entire service + layer using the AspectJ style pointcuts.
The <literal><global-method-security></literal> Element This element is used to enable annotation-based security in your application (by setting the appropriate attributes on the element), and also to group together security pointcut declarations which will be applied across your entire application context. You should only declare one <global-method-security> element. The - following declaration would enable support for both Spring Security's - @Secured, and JSR-250 annotations: + following declaration would enable support for Spring Security's + @Secured: ]]> Adding an annotation to a method (on an class or interface) would then limit the access to that method accordingly. Spring Security's native annotation support defines a @@ -652,8 +652,14 @@ List<OpenIDAttribute> attributes = token.getAttributes();The @Secured("ROLE_TELLER") public Account post(Account account, double amount); } - - To use the new expression-based syntax, you would use Support + for JSR-250 annotations can be enabled using + ]]> + These are standards-based and allow simple role-based constraints to be + applied but do not have the power Spring Security's native annotations. + To use the new expression-based syntax, you would use + ]]>and the equivalent Java code would be @@ -668,7 +674,11 @@ List<OpenIDAttribute> attributes = token.getAttributes();The @PreAuthorize("hasAuthority('ROLE_TELLER')") public Account post(Account account, double amount); } - + Expression-based + annotations are a good choice if you need to define simple rules that go beyond checking the + role names against the user's list of authorities. You can enable more than one type of + annotation in the same application, but you should avoid mixing annotations types in the + same interface or class to avoid confusion.
Adding Security Pointcuts using <literal>protect-pointcut</literal> The use of protect-pointcut is particularly powerful, as it allows