2d27b28199
Set version to 3.0.8.CI-SNAPSHOT.
2011-09-05 23:04:06 +01:00
714ee3e960
Set version to 3.0.7.RELEASE.
2011-09-05 23:03:17 +01:00
ee74c4ced2
SEC-1803: Add check in AbstractAuthenticationTargetUrlRequestHandler for null targetUrlParameter before attempting to read it from the request. Prevents NPE when targetUrlParameter is not set.
2011-08-29 13:47:31 +01:00
102027a44c
SEC-1804: Updated Javadoc wrt immutability of User class.
2011-08-25 11:10:41 +01:00
799a43d72e
SEC-1804: Update InMemoryDaoImpl to use User class directly and create a copy. Otherwise credentials are cleared on cached user instances.
2011-08-25 11:09:02 +01:00
3dc4158f7d
Set version to 3.0.7.CI-SNAPSHOT
2011-08-19 12:52:39 -07:00
62f70f17ff
Set project release version to 3.0.6.RELEASE
2011-08-19 12:47:55 -07:00
4b0fbe1606
Remove session timeout check in tutorial sample.
2011-08-19 12:47:06 -07:00
a8bce41876
SEC-1795: Fix possible NPEs in AclImpl.equals()
2011-08-19 12:03:04 -07:00
cea1f4499f
SEC-1686: Upgrade to Spring 3.0.6
2011-08-19 10:15:48 -07:00
c19a5ffd73
SEC-1796: Check for annotated annotations at class/interface level. Previously only the specific security annotation was checked for. By delegating to Spring's AnnotationUtils, custom annotations carrying the security annotation are also detected.
2011-08-12 14:36:42 +01:00
594ee9515e
Taglib test fixes to take latest SFW changes into account.
2011-08-11 23:44:01 +01:00
a087e828a6
SEC-1790: Disable use of spring-security-redirect by default for SimpleUrlLogoutSuccesshandler.
2011-08-05 16:54:35 +01:00
5238ba0e26
SEC-1790: Reject redirect locations containing CR or LF.
2011-07-29 16:34:48 +01:00
887e3361d2
SEC-1750: Make sure RunAs replacement is constrained to the SecurityContext of the current thread.
2011-07-29 16:32:40 +01:00
a24570ae06
SEC-1744: Do not trust authorities contained in the authentication request in JaasAuthenticationProvider.
2011-07-29 16:32:40 +01:00
ba719dc0e1
SEC-1741: Modify ContextPropagatingRemoteInvocation to pass a simple combination of principal/credentials as Strings, rather than serializing the whole SecurityContext object from the client.
2011-07-29 16:32:40 +01:00
28e70db8f2
SEC-1742: Deprecate use of extraInformation field in AuthenticationException, making it transient and removing any sensitive data in UserDetails objects which are stored in it.
2011-07-29 16:32:40 +01:00
84031c6001
SEC-1792: Fixed NullPointerException in RunAsUserToken#toString()
2011-07-29 10:00:37 -05:00
ca2af8bc59
SEC-1770: Call refreshLastRequest on the session registry rather than the SessionInformation object to make sure it works with alternative SessionRegistry implementations.
2011-07-13 20:57:18 +01:00
6f59805ef3
SEC-1782: Javadoc correction for LdapAuthenticationProvider.
2011-07-12 01:51:42 +01:00
f359bed596
SEC-1777: Corrected log in HttpSessionSecurityContextRepository to reference itself instead of HttpSessionContextIntegrationFilter
2011-07-09 19:27:59 -05:00
0f1ae574ab
SEC-1776: Corrected typo in manual
2011-07-09 19:26:29 -05:00
cb7a94af88
SEC-1768: Use AopProxyUtils.ultimateTargetClass to cater for situation where security interceptor is applied to a proxy.
2011-06-18 14:46:28 +01:00
9b8d2719a6
SEC-1686: Up required minimum version to 3.0.6 in version check.
2011-06-18 14:45:23 +01:00
73b67da3a8
SEC-1762: Fix input value assertion check for targetUrlParameter.
2011-06-17 13:43:15 +01:00
b5546d1d29
SEC-1764: Remove use of Java 6 method Arrays.copyOfRange.
2011-06-15 11:18:26 +01:00
70ca0d1a39
SEC-1764: Ensure password encoders use UTF-8 charset when creating strings from byte arrays.
2011-06-14 20:15:34 +01:00
7a5a062cd0
SEC-1764: Backport Utf8 encoder to 3.0.x
2011-06-14 20:11:03 +01:00
977da0da1f
SEC-1733: Support explicit zero netmask correctly.
2011-06-07 16:47:22 +01:00
dfbc938e99
Added note in namespace docs on mismatch between using filters="none" and other attributes.
2011-06-06 12:37:52 +01:00
d5f1f6cbff
SEC-1757: Updated tutorial sample to state that listing of accounts is allowed by anyone and to display accounts for the different types of access to posting to Accounts
2011-06-02 21:20:27 -05:00
a2cdbab50c
SEC-1747: Upgrade to Spring LDAP 1.3.1
2011-05-17 23:40:07 +01:00
1833b234a5
SEC-1722: Correct javadoc
2011-04-22 11:51:46 +01:00
6c97fccc91
SEC-1700: Allow for case where JAAS config is not a simple file, but may be a jar resource, for example.
2011-04-20 14:53:22 +01:00
2888f2b86f
SEC-1720: Avoid bean-creation side-effects in ContextSourceSettingPostProcessor.
2011-04-20 13:00:56 +01:00
04d42211b1
SEC-1705: Make sure a single OpenIDAuthenticationFilter bean is created by the namespace. Likewise for UsernamePasswordAuthenticationFilter.
2011-03-31 22:03:27 +01:00
6a87a5f1a1
SEC-1703: Updated namespace for intercept-url
2011-03-29 21:59:07 -05:00
f6b21880a2
SEC-1703: Updated cas custom-filter@ref to match example bean id and custom-filter@position to be CAS_FILTER
2011-03-29 20:18:01 -05:00
198d5d0482
SEC-1701: Trim claimed identity parameter value before submitting to OpenID4Java.
2011-03-25 19:11:34 +00:00
acee3e2593
SEC-1698: Update documentation to use correct package for RequestHeaderAuthenticationFilter
2011-03-16 23:53:47 -05:00
b87dabe1ac
SEC-1683: Corrected typo
2011-02-28 15:44:53 +00:00
f509193604
Update Base64 implementation to include fixes (using diff) from the original up to version 2.3.7.
2011-02-16 15:58:28 +00:00
11a091f051
SEC-1680: Revert accidental updates to 3.0.x namespace appendix.
2011-02-16 15:01:15 +00:00
8e48658efb
SEC-1675: Added missing "body-content" elements to taglib descriptor.
2011-02-14 21:31:15 +00:00
afd556412e
SEC-1672: Provide error message when ambiguous configuration of intercept-url contains attributes filters=none and (access or requires-channel)
2011-02-09 20:37:03 -06:00
187a530760
SEC-1670: Take account of JNDI CompositeName escaping in value of SearchResult.getName() when performing a search for a user entry in SpringSecurityLdapTemplate.
2011-02-03 18:00:03 +00:00
1b6587a5d4
SEC-1666: Use constant time comparison for sensitive data.
...
Constant time comparison helps to mitigate timing attacks. See the following link for more information
* http://rdist.root.org/2010/07/19/exploiting-remote-timing-attacks/
* http://en.wikipedia.org/wiki/Timing_attack for more information.
2011-01-31 23:21:38 -06:00
ece824fca2
SEC-1592: Updated CasAuthenticationFilter so that it does not continue FilterChain when handling proxy requests.
...
The fix moves CommonUtils.readAndRespondToProxyReceptorRequest into CasAuthenticationFilter.attemptAuthentication. This makes sense since
The CAS server is authenticating that the proxy url is valid (i.e. it exists and the SSL handshake succeeds). It also allows the FilterChain
to not be processed by returning a null Authentication.
2011-01-27 10:49:24 -06:00
e3644e2d27
SEC-1661: Use a DistinguishedName to wrap the search base to avoid the need for JNDI escaping.
2011-01-26 17:20:54 +00:00
Luke Taylor