diff --git a/src/docbkx/common-auth-services.xml b/src/docbkx/common-auth-services.xml
index 7df31f778a..1130261c2f 100644
--- a/src/docbkx/common-auth-services.xml
+++ b/src/docbkx/common-auth-services.xml
@@ -227,7 +227,8 @@
guide.
- UserDetails and Associated Types
+
+ UserDetails and Associated Types
As mentioned in the first part of the reference guide, most
@@ -311,14 +312,16 @@
- JDBC Authentication
+
+ JDBC Authentication
+
Spring Security also includes a
UserDetailsService that can obtain authentication
information from a JDBC data source. Internally Spring JDBC is used,
so it avoids the complexity of a fully-featured object relational
mapper (ORM) just to store user details. If your application does
use an ORM tool, you might prefer to write a custom
- UserDetailsService to reuse the mapping files
+ UserDetailsService to reuse the mapping files
you've probably already created. Returning to
JdbcDaoImpl, an example configuration is shown
below:
@@ -332,30 +335,49 @@
-
+
]]>
You can use different relational database management systems
by modifying the DriverManagerDataSource shown
above. You can also use a global data source obtained from JNDI, as
- per normal Spring options. Irrespective of the database used and how
+ per normal Spring options.
+
+
+
+ Default User Database Schema
+
+ Irrespective of the database you are using and how
a DataSource is obtained, a standard schema must
- be used as indicated in dbinit.txt. You can
- download this file from the Spring Security web site.
+ be in place. The DDL for an HSQL database instance would be:
+
+ CREATE TABLE users (
+ username VARCHAR(50) NOT NULL PRIMARY KEY,
+ password VARCHAR(50) NOT NULL,
+ enabled BIT NOT NULL
+ );
+
+ CREATE TABLE authorities (
+ username VARCHAR(50) NOT NULL,
+ authority VARCHAR(50) NOT NULL
+ );
+
+ ALTER TABLE authorities ADD CONSTRAINT fk_authorities_users foreign key (username) REFERENCES users(username);
+
+
- If your default schema is unsuitable for your needs,
- JdbcDaoImpl provides two properties that allow
- customisation of the SQL statements. You may also subclass the
- JdbcDaoImpl if further customisation is
- necessary. Please refer to the JavaDocs for details, although please
- note that the class is not intended for complex custom subclasses.
- If you have complex needs (such as a special schema or would like a
- certain UserDetails implementation returned),
+ If the default schema is unsuitable for your needs,
+ JdbcDaoImpl provides properties that allow
+ customisation of the SQL statements. Please refer to the JavaDocs for
+ details, but note that the class is not intended for complex custom subclasses.
+ If you have a complex schema or would like a
+ custom UserDetails implementation returned,
you'd be better off writing your own
UserDetailsService. The base implementation
provided with Spring Security is intended for typical situations,
- and does not offer infinite configuration flexibility.
+ rather than catering for all possible requirements.
+
@@ -371,11 +393,13 @@
sessions.
To use concurrent session support, you'll need to add the
- following to web.xml:
-
- <listener>
-<listener-class>org.springframework.security.ui.session.HttpSessionEventPublisher</listener-class>
-</listener>
+ following to web.xml:
+
+<listener>
+ <listener-class>org.springframework.security.ui.session.HttpSessionEventPublisher</listener-class>
+</listener>
+
+
In addition, you will need to add the
org.springframework.security.concurrent.ConcurrentSessionFilter
@@ -391,11 +415,11 @@
ApplicationEvent to be published to the Spring
ApplicationContext every time a
HttpSession commences or terminates. This is
- critical, as it allows the SessionRegistryImpl to
+ critical, as it allows the SessionRegistryImpl to
be notified when a session ends.
You will also need to wire up the
- ConcurrentSessionControllerImpl and refer to it
+ ConcurrentSessionControllerImpl and refer to it
from your ProviderManager bean: