diff --git a/src/docbkx/common-auth-services.xml b/src/docbkx/common-auth-services.xml index 7df31f778a..1130261c2f 100644 --- a/src/docbkx/common-auth-services.xml +++ b/src/docbkx/common-auth-services.xml @@ -227,7 +227,8 @@ guide. -
UserDetails and Associated Types +
+ UserDetails and Associated Types As mentioned in the first part of the reference guide, most @@ -311,14 +312,16 @@
- JDBC Authentication + + JDBC Authentication + Spring Security also includes a UserDetailsService that can obtain authentication information from a JDBC data source. Internally Spring JDBC is used, so it avoids the complexity of a fully-featured object relational mapper (ORM) just to store user details. If your application does use an ORM tool, you might prefer to write a custom - UserDetailsService to reuse the mapping files + UserDetailsService to reuse the mapping files you've probably already created. Returning to JdbcDaoImpl, an example configuration is shown below: @@ -332,30 +335,49 @@ - + ]]> You can use different relational database management systems by modifying the DriverManagerDataSource shown above. You can also use a global data source obtained from JNDI, as - per normal Spring options. Irrespective of the database used and how + per normal Spring options. + + +
+ Default User Database Schema + + Irrespective of the database you are using and how a DataSource is obtained, a standard schema must - be used as indicated in dbinit.txt. You can - download this file from the Spring Security web site. + be in place. The DDL for an HSQL database instance would be: + + CREATE TABLE users ( + username VARCHAR(50) NOT NULL PRIMARY KEY, + password VARCHAR(50) NOT NULL, + enabled BIT NOT NULL + ); + + CREATE TABLE authorities ( + username VARCHAR(50) NOT NULL, + authority VARCHAR(50) NOT NULL + ); + + ALTER TABLE authorities ADD CONSTRAINT fk_authorities_users foreign key (username) REFERENCES users(username); + + - If your default schema is unsuitable for your needs, - JdbcDaoImpl provides two properties that allow - customisation of the SQL statements. You may also subclass the - JdbcDaoImpl if further customisation is - necessary. Please refer to the JavaDocs for details, although please - note that the class is not intended for complex custom subclasses. - If you have complex needs (such as a special schema or would like a - certain UserDetails implementation returned), + If the default schema is unsuitable for your needs, + JdbcDaoImpl provides properties that allow + customisation of the SQL statements. Please refer to the JavaDocs for + details, but note that the class is not intended for complex custom subclasses. + If you have a complex schema or would like a + custom UserDetails implementation returned, you'd be better off writing your own UserDetailsService. The base implementation provided with Spring Security is intended for typical situations, - and does not offer infinite configuration flexibility. + rather than catering for all possible requirements. +
@@ -371,11 +393,13 @@ sessions. To use concurrent session support, you'll need to add the - following to web.xml: - - <listener> -<listener-class>org.springframework.security.ui.session.HttpSessionEventPublisher</listener-class> -</listener> + following to web.xml: + +<listener> + <listener-class>org.springframework.security.ui.session.HttpSessionEventPublisher</listener-class> +</listener> + + In addition, you will need to add the org.springframework.security.concurrent.ConcurrentSessionFilter @@ -391,11 +415,11 @@ ApplicationEvent to be published to the Spring ApplicationContext every time a HttpSession commences or terminates. This is - critical, as it allows the SessionRegistryImpl to + critical, as it allows the SessionRegistryImpl to be notified when a session ends. You will also need to wire up the - ConcurrentSessionControllerImpl and refer to it + ConcurrentSessionControllerImpl and refer to it from your ProviderManager bean: