8cbe232fbf
SEC-1480: Add simple equals and hashcode methods based on DN value to LdapUserDetailsImpl to allow its use as a map key (in SessionRegistry, for example).
2010-05-15 02:29:56 +01:00
5ac106808e
Remove outdated scm information from pom.xml.
2010-04-28 20:16:40 +01:00
8c605516b3
SEC-1463: Change namespace user-service parser to store username in lower-case when building map for in-memory UserDetailsService. Lookups are supposed to be case-insensitive with this class.
2010-04-24 16:42:00 +01:00
e6e168f127
SEC-1456: Set rtexprvalue=true for "url" attribute in access tag to allow dynamic values (such as URL of current page).
2010-04-21 17:29:27 +01:00
6d6c2d31ef
SEC-1462: Only apply session fixation protection strategy if request.isRequestedSessionIdValid() returns true. We don't need to create a new session if the current one already has a different Id from the client.
2010-04-20 18:04:56 +01:00
8f6aecac9b
Clarify that multiple authentication-provider elements can be used in combination.
2010-04-17 15:25:37 +01:00
0760bb947b
SEC-1458: Remove logger field in HttpSessionEventPublisher in favour of direct lookup. Prevents early initialization of logging system when listener is initialized.
2010-04-16 16:13:41 +01:00
9d2e2ca11d
SEC-1232: Add config dependency to maven build for aspectj sample.
2010-03-31 19:59:19 +01:00
6354c7e052
SEC-1232: GlobalMethodSecurityBeanDefinitionParser support for mode='aspectj'
...
AspectJ sample application context also updated to use this syntax.
2010-03-31 17:41:23 +01:00
42cdaa0ce2
Latest gradle syntax updates.
2010-03-31 17:12:00 +01:00
eda60b72b1
SEC-1448: Fixed failure to resolve generic method argument names in MethodSecurityEvaluationContext.
...
Changed to use AopUtils.getMostSpecificMethod() when obtaining the method on which the parameter resolution should be performed. Also added better error handling and log warning when parameter names cannot be resolved. The exception will then be a SpEL one, rather than a NPE.
2010-03-27 17:22:38 +00:00
0d198d42ae
SEC-1444: Fix JNDI escaping problems in LDAP authentication.
...
CompositeName adds quotes to names which contain a forward slash ("/") character. These are automatically removed by Spring LDAP's DistinguishedName, but only if they are at the ends of the String. Since we were preprending the base to the (quoted) DN, resulting in something like ["cn=joe/b",ou=people], this was causing problems with the DN value returned from the search. Additionally, the bind succeeds when a DN is used with a slash, but the subsequent call to getAttributes() fails. This call now passes in a DistinguishedName for the user DN instance instead of a String.
2010-03-27 15:30:45 +00:00
f000aaa7e8
SEC-1440: Implement support for separate entry-point-ref on htt-basic namespace element. Changes ported from master branch.
2010-03-26 14:06:12 +00:00
634e340d80
Update schema version to 3.0.3
2010-03-26 13:53:56 +00:00
4c8e9e2d7e
SEC-1450: Replace use of ClassUtils.getMostSpecificMethod() in AbstractFallbackMethodDefinitionSource with AopUtils.getMostSpecificMethod() equivalent.
...
Ensures protect-pointcut expressions match methods with generic parameters.
2010-03-24 21:03:45 +00:00
e518adbef1
SEC-1443: Modify Jsr250Voter to handle multiple "RolesAllowed" roles.
...
It now votes to abstain if there are no Jsr250 attributes present. If any are found, it will either deny or grant access. For multiple "RoleAllowed" attributes, access will be granted if any user authority matches or denied if no match is found.
2010-03-22 16:26:49 +00:00
59b69f6f48
SEC-1434: Remove use of BeanDefinition of type java.lang.String which causes problems in Google App Engine.
...
This results in the method BeanUtils.findEditorByConvention attempting to get hold of the system classloader which isn't allowed by the security manager in GAE.
2010-03-16 02:22:36 +00:00
b8e50c0933
SEC-1439: Make getters and setters public on HttpRequestResponseHolder.
...
Necessary to allow use of custom SecurityContextRepository.(cherry picked from commit d5df53f1db
2010-03-12 15:54:12 +00:00
677576ea8b
SEC-1429: Fix test. Wasn't setting allowSessionCreation=false on failure handler.
2010-03-11 02:30:37 +00:00
91153df78d
SEC-1262: Added new (replacement) AspectJ interceptor which wraps the JoinPoint in a MethodInvocation adapter to provide compatibility with classes which only support MethodInvocation instances.
...
Also deprecated the existing AspectJ interceptors. This will also allow future simplification of the AbstractMethodSecurityMetadataSource, as it no longer needs to support JoinPoints.
2010-03-11 02:15:35 +00:00
1b0ac9c785
Porting of gradle changes from master.
2010-03-11 02:15:02 +00:00
8c9159f273
Added repo for aws-maen 3.0.0 dep
2010-03-06 01:41:38 +00:00
4c8b0faa88
Upgrade aws-maven to 3.0.0.RELEASE (mvn 2.2.x compatible)
2010-03-05 18:03:59 +00:00
5a5b62e2cb
SEC-1429: Removed cached authentication from session after successful authentication.(cherry picked from commit 43f0e11106)
2010-03-05 00:11:08 +00:00
6ac8588144
Fix to Javadoc for AbstractAuthenticationProcessingFilter.(cherry picked from commit a3263753d9)
2010-03-04 22:07:30 +00:00
5690f1c581
SEC-1428: Check if response has been committed before redirecting to target URL in AbstractAuthenticationTargetUrlRequestHandler.
2010-03-04 22:00:37 +00:00
87cf27ab7c
SEC-1429: Move logic for saving of AuthenticationException into the SimpleUrlAuthenticationFailurehandler from AbstractAuthenticationProcessingFilter. It will also now use request scope if configured to do a forward instead of a redirect.
2010-03-04 21:49:38 +00:00
41e06152b3
SEC-1420: JSP for itest of authentication tags with and without escaping.
2010-03-04 01:44:54 +00:00
a7e21318bf
SEC-1425: Replace use of Java 1.6 String.isEmpty().
2010-03-04 00:52:54 +00:00
bc6aae132b
SEC-1420: Add htmlEscape attribute to authentication JSP tag.
...
This allows HTML escaping to be disabled if required.
2010-03-04 00:47:59 +00:00
b46ae6ac62
SEC-1425: Add check for empty cookie in AbstractRememberMeServices.
...
Prevents ArrayOutOfBoundsException later when processing the tokeniszed cookie.
2010-02-28 14:00:43 +00:00
317da55cd0
SEC-1423: Cache PointcutExpression instances in ProtectPointcutPostProcessor for more efficient startup.
2010-02-26 17:50:45 +00:00
9e751e22c8
Refactoring to remove remaining circular dependencies indicated by structure101.
2010-02-26 17:50:14 +00:00
4d65b35827
Minor gradle 0.9 syntax change.
2010-02-26 17:49:32 +00:00
9831980bc2
Update versions to 3.0.3.CI-SNAPSHOT.
2010-02-26 15:04:43 +00:00
44f45d21f0
3.0.2 release. Update version in build files.
2010-02-19 01:22:21 +00:00
d2b2ca3bc6
SEC-1387: Use a transient object as the advice monitor, rather than a Serializable.
...
No need for an anonymous inner class.
2010-02-19 01:02:22 +00:00
97d04b73c1
Upgrade to Spring 3.0.1.
2010-02-19 00:53:38 +00:00
10dc72b017
SEC-1387: Support serialization of security advised beans.
...
MethodSecurityMetadataSourceAdvisor now takes the SecurityMetadataSource bean name as an extra constructor argument and re-obtains the bean from the BeanFactory in its readObject method. Beans that are advised using <global-method-security> should therefore now be serializable.
2010-02-19 00:53:14 +00:00
14ae36ac3b
SEC-1412: Modify DefaultSavedRequest to ignore If-Not-Matched header.
...
The browser (or at least Firefox) does not send it after a redirect, and it causes problems with Spring's ShallowEtagHeaderFilter if it is stored and returned by the saved request.
2010-02-18 00:32:49 +00:00
9bdc012c69
Minor corrections to Session Management chapter of ref manual.
2010-02-18 00:32:48 +00:00
c0579230b2
Correct package names in ref manual docbook. Minor change to namespace appendix.
2010-02-18 00:32:48 +00:00
5b5934144a
Avoid infinite loop in InterceptMethodsBeanDefinitionDecoratorTests when upgrading to Spring 3.0.1.
...
Converted test target to implement ApplicationListener<SessionCreatedEvent> so that it doesn't receive events from its own interceptor (which are in turn intercepted).
2010-02-16 00:03:15 +00:00
bd635edc31
SEC-1410: Makes sure usernames which are OpenID https identities are detected as well as http ones.
...
Using ":" as the token delimiter means we accidentally mistake the URL for two tokens. This had previously been fixed for http URLs but not https ones.
2010-02-15 22:46:18 +00:00
1719bdebeb
Changed classes output dir names in core modules for better display in structure diagram
2010-02-15 02:23:40 +00:00
c1133d1ef3
Removed unused import in DelegatingAuthenticationEntryPoint and corrected test class name.
2010-02-14 23:31:31 +00:00
d30e31d816
Remove unnecessary @SuppressWarnings and inline dependency from ELRequestMatcher (util package) to core ExpressionUtils.
2010-02-14 23:29:27 +00:00
dbee91002e
Deprecate EncryptionUtils.
2010-02-14 23:27:29 +00:00
c12c43da9e
Javadoc fixes.
2010-02-14 23:27:09 +00:00
36612377e2
Replace package.html with package-info.java files, creating new ones where missing and updating outdated contents.
2010-02-14 23:23:23 +00:00
Luke Taylor