[maven-release-plugin] copy for tag spring-security-parent-2.0.0

acl/pom.xml

@@ -3,13 +3,13 @@
     <parent>
         <artifactId>spring-security-parent</artifactId>
         <groupId>org.springframework.security</groupId>
-        <version>2.0.4</version>
+        <version>2.0.0</version>
     </parent>
     <modelVersion>4.0.0</modelVersion>
     <groupId>org.springframework.security</groupId>
     <artifactId>spring-security-acl</artifactId>
     <name>Spring Security - ACL module</name>
-    <packaging>bundle</packaging>
+    <version>2.0.0</version>
 
     <dependencies>
         <dependency>
@@ -24,13 +24,6 @@
             <classifier>tests</classifier>
             <scope>test</scope>
         </dependency>
-        <dependency>
-            <groupId>org.springframework.security</groupId>
-            <artifactId>spring-security-core</artifactId>
-            <version>${project.version}</version>
-            <classifier>tests</classifier>
-            <scope>test</scope>
-        </dependency>
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-jdbc</artifactId>
@@ -51,29 +44,4 @@
             <scope>test</scope>
         </dependency>
     </dependencies>
-    
-    <properties>
-        <spring.osgi.export>
-            org.springframework.security.*;version=${pom.version.osgi}
-        </spring.osgi.export>
-            
-        <spring.osgi.import>
-            net.sf.ehcache.*;version="[1.4.1, 2.0.0)";resolution:=optional,
-            org.springframework.security.*;version="[${pom.version.osgi},${pom.version.osgi}]",
-            org.springframework.context.*;version="${spring.version.osgi}",
-            org.springframework.dao.*;version="${spring.version.osgi}";resolution:=optional,
-            org.springframework.jdbc.*;version="${spring.version.osgi}";resolution:=optional,
-            org.springframework.transaction.support.*;version="${spring.version.osgi}";resolution:=optional,
-            org.springframework.util.*;version="${spring.version.osgi}",
-            org.apache.commons.logging.*;version="[1.1.1, 2.0.0)",
-            javax.sql.*
-        </spring.osgi.import>
-
-        <spring.osgi.private.pkg>
-            !org.springframework.security.*
-        </spring.osgi.private.pkg>
-
-        <spring.osgi.symbolic.name>org.springframework.security.acls</spring.osgi.symbolic.name>        
-    </properties>    
-    
 </project>

acl/src/main/java/org/springframework/security/acls/domain/AbstractPermission.java

@@ -1,59 +0,0 @@
-package org.springframework.security.acls.domain;
-
-import org.springframework.security.acls.AclFormattingUtils;
-import org.springframework.security.acls.Permission;
-
-/**
- * Provides an abstract superclass for {@link Permission} implementations.
- * 
- * @author Ben Alex
- * @since 2.0.3
- * @see AbstractRegisteredPermission
- * 
- */
-public abstract class AbstractPermission implements Permission {
-
-    //~ Instance fields ================================================================================================
-
-    protected char code;
-    protected int mask;
-
-    //~ Constructors ===================================================================================================
-
-    protected AbstractPermission(int mask, char code) {
-        this.mask = mask;
-        this.code = code;
-    }
-
-    //~ Methods ========================================================================================================
-
-    public final boolean equals(Object arg0) {
-        if (arg0 == null) {
-            return false;
-        }
-
-        if (!(arg0 instanceof Permission)) {
-            return false;
-        }
-
-        Permission rhs = (Permission) arg0;
-
-        return (this.mask == rhs.getMask());
-    }
-
-    public final int getMask() {
-        return mask;
-    }
-
-    public String getPattern() {
-        return AclFormattingUtils.printBinary(mask, code);
-    }
-
-    public final String toString() {
-        return this.getClass().getSimpleName() + "[" + getPattern() + "=" + mask + "]";
-    }
-
-	public final int hashCode() {
-		return this.mask;
-	}
-}

acl/src/main/java/org/springframework/security/acls/domain/BasePermission.java

@@ -14,59 +14,157 @@
  */
 package org.springframework.security.acls.domain;
 
+import org.springframework.security.acls.AclFormattingUtils;
 import org.springframework.security.acls.Permission;
 
+import org.springframework.util.Assert;
+
+import java.lang.reflect.Field;
+
+import java.util.HashMap;
+import java.util.Map;
+
 
 /**
  * A set of standard permissions.
- * 
- * <p>
- * You may subclass this class to add additional permissions, or use this class as a guide
- * for creating your own permission classes.
- * </p>
- * 
+ *
  * @author Ben Alex
  * @version $Id$
  */
-public class BasePermission extends AbstractPermission {
+public final class BasePermission implements Permission {
+    //~ Static fields/initializers =====================================================================================
+
     public static final Permission READ = new BasePermission(1 << 0, 'R'); // 1
     public static final Permission WRITE = new BasePermission(1 << 1, 'W'); // 2
     public static final Permission CREATE = new BasePermission(1 << 2, 'C'); // 4
     public static final Permission DELETE = new BasePermission(1 << 3, 'D'); // 8
     public static final Permission ADMINISTRATION = new BasePermission(1 << 4, 'A'); // 16
-    
-	protected static DefaultPermissionFactory defaultPermissionFactory = new DefaultPermissionFactory();
+    private static Map locallyDeclaredPermissionsByInteger = new HashMap();
+    private static Map locallyDeclaredPermissionsByName = new HashMap();
 
-	/**
-     * Registers the public static permissions defined on this class. This is mandatory so
-     * that the static methods will operate correctly.
-     */
     static {
-    	registerPermissionsFor(BasePermission.class);
+        Field[] fields = BasePermission.class.getDeclaredFields();
+
+        for (int i = 0; i < fields.length; i++) {
+            try {
+                Object fieldValue = fields[i].get(null);
+
+                if (BasePermission.class.isAssignableFrom(fieldValue.getClass())) {
+                    // Found a BasePermission static field
+                    BasePermission perm = (BasePermission) fieldValue;
+                    locallyDeclaredPermissionsByInteger.put(new Integer(perm.getMask()), perm);
+                    locallyDeclaredPermissionsByName.put(fields[i].getName(), perm);
+                }
+            } catch (Exception ignore) {}
+        }
     }
 
-    protected BasePermission(int mask, char code) {
-    	super(mask, code);
+    //~ Instance fields ================================================================================================
+
+    private char code;
+    private int mask;
+
+    //~ Constructors ===================================================================================================
+
+    private BasePermission(int mask, char code) {
+        this.mask = mask;
+        this.code = code;
     }
 
-    protected final static void registerPermissionsFor(Class subClass) {
-    	defaultPermissionFactory.registerPublicPermissions(subClass);
-    }
-    
-    public final static Permission buildFromMask(int mask) {
-        return defaultPermissionFactory.buildFromMask(mask);
+    //~ Methods ========================================================================================================
+
+    /**
+     * Dynamically creates a <code>CumulativePermission</code> or <code>BasePermission</code> representing the
+     * active bits in the passed mask.
+     *
+     * @param mask to build
+     *
+     * @return a Permission representing the requested object
+     */
+    public static Permission buildFromMask(int mask) {
+        if (locallyDeclaredPermissionsByInteger.containsKey(new Integer(mask))) {
+            // The requested mask has an exactly match against a statically-defined BasePermission, so return it
+            return (Permission) locallyDeclaredPermissionsByInteger.get(new Integer(mask));
+        }
+
+        // To get this far, we have to use a CumulativePermission
+        CumulativePermission permission = new CumulativePermission();
+
+        for (int i = 0; i < 32; i++) {
+            int permissionToCheck = 1 << i;
+
+            if ((mask & permissionToCheck) == permissionToCheck) {
+                Permission p = (Permission) locallyDeclaredPermissionsByInteger.get(new Integer(permissionToCheck));
+                Assert.state(p != null,
+                    "Mask " + permissionToCheck + " does not have a corresponding static BasePermission");
+                permission.set(p);
+            }
+        }
+
+        return permission;
     }
 
-    public final static Permission[] buildFromMask(int[] masks) {
-        return defaultPermissionFactory.buildFromMask(masks);
+    public static Permission[] buildFromMask(int[] masks) {
+        if ((masks == null) || (masks.length == 0)) {
+            return new Permission[0];
+        }
+
+        Permission[] permissions = new Permission[masks.length];
+
+        for (int i = 0; i < masks.length; i++) {
+            permissions[i] = buildFromMask(masks[i]);
+        }
+
+        return permissions;
     }
 
-    public final static Permission buildFromName(String name) {
-    	return defaultPermissionFactory.buildFromName(name);
+    public static Permission buildFromName(String name) {
+        Assert.isTrue(locallyDeclaredPermissionsByName.containsKey(name), "Unknown permission '" + name + "'");
+
+        return (Permission) locallyDeclaredPermissionsByName.get(name);
     }
 
-    public final static Permission[] buildFromName(String[] names) {
-        return defaultPermissionFactory.buildFromName(names);
+    public static Permission[] buildFromName(String[] names) {
+        if ((names == null) || (names.length == 0)) {
+            return new Permission[0];
+        }
+
+        Permission[] permissions = new Permission[names.length];
+
+        for (int i = 0; i < names.length; i++) {
+            permissions[i] = buildFromName(names[i]);
+        }
+
+        return permissions;
     }
 
-}
+    public boolean equals(Object arg0) {
+        if (arg0 == null) {
+            return false;
+        }
+
+        if (!(arg0 instanceof Permission)) {
+            return false;
+        }
+
+        Permission rhs = (Permission) arg0;
+
+        return (this.mask == rhs.getMask());
+    }
+
+    public int getMask() {
+        return mask;
+    }
+
+    public String getPattern() {
+        return AclFormattingUtils.printBinary(mask, code);
+    }
+
+    public String toString() {
+        return "BasePermission[" + getPattern() + "=" + mask + "]";
+    }
+
+	public int hashCode() {
+		return this.mask;
+	}
+}

acl/src/main/java/org/springframework/security/acls/domain/CumulativePermission.java

@@ -19,21 +19,20 @@ import org.springframework.security.acls.Permission;
 
 
 /**
- * Represents a <code>Permission</code> that is constructed at runtime from other permissions.
- * 
- * <p>Methods return <code>this</code>, in order to facilitate method chaining.</p>
+ * Represents a <code>Permission</code> that is constructed at runtime from other permissions.<p>Methods return
+ * <code>this</code>, in order to facilitate method chaining.</p>
  *
  * @author Ben Alex
  * @version $Id$
  */
-public class CumulativePermission extends AbstractPermission {
+public class CumulativePermission implements Permission {
+    //~ Instance fields ================================================================================================
 
     private String pattern = THIRTY_TWO_RESERVED_OFF;
+    private int mask = 0;
+
+    //~ Methods ========================================================================================================
 
-    public CumulativePermission() {
-    	super(0, ' ');
-    }
-    
     public CumulativePermission clear(Permission permission) {
         this.mask &= ~permission.getMask();
         this.pattern = AclFormattingUtils.demergePatterns(this.pattern, permission.getPattern());
@@ -47,16 +46,43 @@ public class CumulativePermission extends AbstractPermission {
 
         return this;
     }
+
     
+    public boolean equals(Object arg0) {
+        if (arg0 == null)
+        {
+            return false;
+        }
+        
+        if (!(arg0 instanceof Permission)) {
+            return false;
+        }
+
+        Permission rhs = (Permission) arg0;
+
+        return (this.mask == rhs.getMask());
+    }
+
+	public int hashCode() {
+		return this.mask;
+	}
+
+	public int getMask() {
+        return this.mask;
+    }
+
+    public String getPattern() {
+        return this.pattern;
+    }
+
     public CumulativePermission set(Permission permission) {
         this.mask |= permission.getMask();
         this.pattern = AclFormattingUtils.mergePatterns(this.pattern, permission.getPattern());
 
         return this;
     }
-    
-    public String getPattern() {
-        return this.pattern;
-    }
 
+    public String toString() {
+        return "CumulativePermission[" + pattern + "=" + this.mask + "]";
+    }
 }

acl/src/main/java/org/springframework/security/acls/domain/DefaultPermissionFactory.java

@@ -1,127 +0,0 @@
-package org.springframework.security.acls.domain;
-
-import java.lang.reflect.Field;
-import java.util.HashMap;
-import java.util.Map;
-
-import org.springframework.security.acls.Permission;
-import org.springframework.security.acls.jdbc.LookupStrategy;
-import org.springframework.util.Assert;
-
-/**
- * Default implementation of {@link PermissionFactory}.
- * 
- * <p>
- * Generally this class will be used by a {@link Permission} instance, as opposed to being dependency
- * injected into a {@link LookupStrategy} or similar. Nevertheless, the latter mode of operation is
- * fully supported (in which case your {@link Permission} implementations probably should extend
- * {@link AbstractPermission} instead of {@link AbstractRegisteredPermission}).
- * </p>
- * 
- * @author Ben Alex
- * @since 2.0.3
- *
- */
-public class DefaultPermissionFactory implements PermissionFactory {
-    private Map registeredPermissionsByInteger = new HashMap();
-    private Map registeredPermissionsByName = new HashMap();
-
-    /**
-     * Permit registration of a {@link DefaultPermissionFactory} class. The class must provide
-     * public static fields of type {@link Permission} to represent the possible permissions.
-     * 
-     * @param clazz a {@link Permission} class with public static fields to register
-     */
-    public void registerPublicPermissions(Class clazz) {
-        Assert.notNull(clazz, "Class required");
-        Assert.isAssignable(Permission.class, clazz);
-        
-    	Field[] fields = clazz.getFields();
-
-        for (int i = 0; i < fields.length; i++) {
-            try {
-                Object fieldValue = fields[i].get(null);
-
-                if (Permission.class.isAssignableFrom(fieldValue.getClass())) {
-                    // Found a Permission static field
-                    Permission perm = (Permission) fieldValue;
-                    String permissionName = fields[i].getName();
-                    
-                    registerPermission(perm, permissionName);
-                }
-            } catch (Exception ignore) {}
-        }
-    }
-
-	public void registerPermission(Permission perm, String permissionName) {
-		Assert.notNull(perm, "Permission required");
-		Assert.hasText(permissionName, "Permission name required");
-		
-		Integer mask = new Integer(perm.getMask());
-
-		// Ensure no existing Permission uses this integer or code
-		Assert.isTrue(!registeredPermissionsByInteger.containsKey(mask), "An existing Permission already provides mask " + mask);
-		Assert.isTrue(!registeredPermissionsByName.containsKey(permissionName), "An existing Permission already provides name '" + permissionName + "'");
-		
-		// Register the new Permission
-		registeredPermissionsByInteger.put(mask, perm);
-		registeredPermissionsByName.put(permissionName, perm);
-	}
-    
-    public Permission buildFromMask(int mask) {
-        if (registeredPermissionsByInteger.containsKey(new Integer(mask))) {
-            // The requested mask has an exactly match against a statically-defined Permission, so return it
-            return (Permission) registeredPermissionsByInteger.get(new Integer(mask));
-        }
-
-        // To get this far, we have to use a CumulativePermission
-        CumulativePermission permission = new CumulativePermission();
-
-        for (int i = 0; i < 32; i++) {
-            int permissionToCheck = 1 << i;
-
-            if ((mask & permissionToCheck) == permissionToCheck) {
-                Permission p = (Permission) registeredPermissionsByInteger.get(new Integer(permissionToCheck));
-                Assert.state(p != null, "Mask " + permissionToCheck + " does not have a corresponding static Permission");
-                permission.set(p);
-            }
-        }
-
-        return permission;
-    }
-
-    public Permission[] buildFromMask(int[] masks) {
-        if ((masks == null) || (masks.length == 0)) {
-            return new Permission[0];
-        }
-
-        Permission[] permissions = new Permission[masks.length];
-
-        for (int i = 0; i < masks.length; i++) {
-            permissions[i] = buildFromMask(masks[i]);
-        }
-
-        return permissions;
-    }
-
-    public Permission buildFromName(String name) {
-        Assert.isTrue(registeredPermissionsByName.containsKey(name), "Unknown permission '" + name + "'");
-
-        return (Permission) registeredPermissionsByName.get(name);
-    }
-
-    public Permission[] buildFromName(String[] names) {
-        if ((names == null) || (names.length == 0)) {
-            return new Permission[0];
-        }
-
-        Permission[] permissions = new Permission[names.length];
-
-        for (int i = 0; i < names.length; i++) {
-            permissions[i] = buildFromName(names[i]);
-        }
-
-        return permissions;
-    }
-    
-}

acl/src/main/java/org/springframework/security/acls/domain/PermissionFactory.java

@@ -1,24 +0,0 @@
-package org.springframework.security.acls.domain;
-
-import org.springframework.security.acls.Permission;
-
-/**
- * Provides a simple mechanism to retrieve {@link Permission} instances from integer masks.
- * 
- * @author Ben Alex
- * @since 2.0.3
- * 
- */
-public interface PermissionFactory {
-
-	/**
-	 * Dynamically creates a <code>CumulativePermission</code> or <code>BasePermission</code> representing the
-	 * active bits in the passed mask.
-	 *
-	 * @param mask to build
-	 *
-	 * @return a Permission representing the requested object
-	 */
-	public abstract Permission buildFromMask(int mask);
-
-}

acl/src/main/java/org/springframework/security/acls/jdbc/BasicLookupStrategy.java

@@ -18,14 +18,12 @@ import java.lang.reflect.Field;
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
-import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Iterator;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
-import java.util.Vector;
 
 import javax.sql.DataSource;
 
@@ -51,7 +49,6 @@ import org.springframework.security.acls.sid.PrincipalSid;
 import org.springframework.security.acls.sid.Sid;
 import org.springframework.security.util.FieldUtils;
 import org.springframework.util.Assert;
-import org.springframework.util.StringUtils;
 
 
 /**
@@ -76,7 +73,7 @@ public final class BasicLookupStrategy implements LookupStrategy {
 
     //~ Constructors ===================================================================================================
 
-    /**
+/**
      * Constructor accepting mandatory arguments
      *
      * @param dataSource to access the database
@@ -100,30 +97,30 @@ public final class BasicLookupStrategy implements LookupStrategy {
     private static String computeRepeatingSql(String repeatingSql, int requiredRepetitions) {
         Assert.isTrue(requiredRepetitions >= 1, "Must be => 1");
 
-        String startSql = "select acl_object_identity.object_id_identity, " 
-	        + "acl_entry.ace_order,  "
-	        + "acl_object_identity.id as acl_id, " 
-	        + "acl_object_identity.parent_object, "
-	        + "acl_object_identity.entries_inheriting, " 
-	        + "acl_entry.id as ace_id, "
-	        + "acl_entry.mask,  "
-	        + "acl_entry.granting,  "
-	        + "acl_entry.audit_success, " 
-	        + "acl_entry.audit_failure,  "
-	        + "acl_sid.principal as ace_principal, " 
-	        + "acl_sid.sid as ace_sid,  "
-	        + "acli_sid.principal as acl_principal, " 
-	        + "acli_sid.sid as acl_sid, "
-	        + "acl_class.class " 
-	        + "from acl_object_identity " 
-	        + "left join acl_sid acli_sid on  acli_sid.id = acl_object_identity.owner_sid " 
-	        + "left join acl_class on acl_class.id = acl_object_identity.object_id_class   "
-	        + "left join acl_entry on acl_object_identity.id = acl_entry.acl_object_identity " 
-	        + "left join acl_sid on acl_entry.sid = acl_sid.id  "
+        String startSql = "select ACL_OBJECT_IDENTITY.OBJECT_ID_IDENTITY, " 
+	        + "ACL_ENTRY.ACE_ORDER,  "
+	        + "ACL_OBJECT_IDENTITY.ID as ACL_ID, " 
+	        + "ACL_OBJECT_IDENTITY.PARENT_OBJECT, "
+	        + "ACL_OBJECT_IDENTITY.ENTRIES_INHERITING, " 
+	        + "ACL_ENTRY.ID as ACE_ID, "
+	        + "ACL_ENTRY.MASK,  "
+	        + "ACL_ENTRY.GRANTING,  "
+	        + "ACL_ENTRY.AUDIT_SUCCESS, " 
+	        + "ACL_ENTRY.AUDIT_FAILURE,  "
+	        + "ACL_SID.PRINCIPAL as ACE_PRINCIPAL, " 
+	        + "ACL_SID.SID as ACE_SID,  "
+	        + "ACLI_SID.PRINCIPAL as ACL_PRINCIPAL, " 
+	        + "ACLI_SID.SID as ACL_SID, "
+	        + "ACL_CLASS.CLASS " 
+	        + "from ACL_OBJECT_IDENTITY " 
+	        + "left join ACL_SID ACLI_SID on  ACLI_SID.ID = ACL_OBJECT_IDENTITY.OWNER_SID " 
+	        + "left join ACL_CLASS on ACL_CLASS.ID = ACL_OBJECT_IDENTITY.OBJECT_ID_CLASS   "
+	        + "left join ACL_ENTRY on ACL_OBJECT_IDENTITY.ID = ACL_ENTRY.ACL_OBJECT_IDENTITY " 
+	        + "left join ACL_SID on ACL_ENTRY.SID = ACL_SID.ID  "
 	        + "where ( ";
 
-        String endSql = ") order by acl_object_identity.object_id_identity" 
-        	+ " asc, acl_entry.ace_order asc";
+        String endSql = ") order by ACL_OBJECT_IDENTITY.OBJECT_ID_IDENTITY" 
+        	+ " asc, ACL_ENTRY.ACE_ORDER asc";
 
         StringBuffer sqlStringBuffer = new StringBuffer();
         sqlStringBuffer.append(startSql);
@@ -175,33 +172,14 @@ public final class BasicLookupStrategy implements LookupStrategy {
                 auditLogger, parent, null, inputAcl.isEntriesInheriting(), inputAcl.getOwner());
 
         // Copy the "aces" from the input to the destination
-        Field fieldAces = FieldUtils.getField(AclImpl.class, "aces");
-        Field fieldAcl = FieldUtils.getField(AccessControlEntryImpl.class, "acl");
-        
+        Field field = FieldUtils.getField(AclImpl.class, "aces");
+
         try {
-         	fieldAces.setAccessible(true);
-            fieldAcl.setAccessible(true);
-
-            // Obtain the "aces" from the input ACL
-            Iterator i = ((List) fieldAces.get(inputAcl)).iterator();
-
-            // Create a list in which to store the "aces" for the "result" AclImpl instance
-            List acesNew = new ArrayList();
-
-            // Iterate over the "aces" input and replace each nested AccessControlEntryImpl.getAcl() with the new "result" AclImpl instance
-            // This ensures StubAclParent instances are removed, as per SEC-951
-            while(i.hasNext()) {
-	            AccessControlEntryImpl ace = (AccessControlEntryImpl) i.next();
-	            fieldAcl.set(ace, result);
-	            acesNew.add(ace);
-            }
-            
-            // Finally, now that the "aces" have been converted to have the "result" AclImpl instance, modify the "result" AclImpl instance
-            fieldAces.set(result, acesNew);
+            field.setAccessible(true);
+            field.set(result, field.get(inputAcl));
         } catch (IllegalAccessException ex) {
-            throw new IllegalStateException("Could not obtain or set AclImpl or AccessControlEntryImpl fields");
+            throw new IllegalStateException("Could not obtain or set AclImpl.ace field");
         }
-        
 
         return result;
     }
@@ -218,30 +196,30 @@ public final class BasicLookupStrategy implements LookupStrategy {
      */
     private void convertCurrentResultIntoObject(Map acls, ResultSet rs)
         throws SQLException {
-        Long id = new Long(rs.getLong("acl_id"));
+        Long id = new Long(rs.getLong("ACL_ID"));
 
         // If we already have an ACL for this ID, just create the ACE
         AclImpl acl = (AclImpl) acls.get(id);
 
         if (acl == null) {
             // Make an AclImpl and pop it into the Map
-            ObjectIdentity objectIdentity = new ObjectIdentityImpl(rs.getString("class"),
-                    new Long(rs.getLong("object_id_identity")));
+            ObjectIdentity objectIdentity = new ObjectIdentityImpl(rs.getString("CLASS"),
+                    new Long(rs.getLong("OBJECT_ID_IDENTITY")));
 
             Acl parentAcl = null;
-            long parentAclId = rs.getLong("parent_object");
+            long parentAclId = rs.getLong("PARENT_OBJECT");
 
             if (parentAclId != 0) {
                 parentAcl = new StubAclParent(new Long(parentAclId));
             }
 
-            boolean entriesInheriting = rs.getBoolean("entries_inheriting");
+            boolean entriesInheriting = rs.getBoolean("ENTRIES_INHERITING");
             Sid owner;
 
-            if (rs.getBoolean("acl_principal")) {
-                owner = new PrincipalSid(rs.getString("acl_sid"));
+            if (rs.getBoolean("ACL_PRINCIPAL")) {
+                owner = new PrincipalSid(rs.getString("ACL_SID"));
             } else {
-                owner = new GrantedAuthoritySid(rs.getString("acl_sid"));
+                owner = new GrantedAuthoritySid(rs.getString("ACL_SID"));
             }
 
             acl = new AclImpl(objectIdentity, id, aclAuthorizationStrategy, auditLogger, parentAcl, null,
@@ -251,21 +229,20 @@ public final class BasicLookupStrategy implements LookupStrategy {
 
         // Add an extra ACE to the ACL (ORDER BY maintains the ACE list order)
         // It is permissable to have no ACEs in an ACL (which is detected by a null ACE_SID)
-        if (rs.getString("ace_sid") != null) {
-            Long aceId = new Long(rs.getLong("ace_id"));
+        if (rs.getString("ACE_SID") != null) {
+            Long aceId = new Long(rs.getLong("ACE_ID"));
             Sid recipient;
 
-            if (rs.getBoolean("ace_principal")) {
-                recipient = new PrincipalSid(rs.getString("ace_sid"));
+            if (rs.getBoolean("ACE_PRINCIPAL")) {
+                recipient = new PrincipalSid(rs.getString("ACE_SID"));
             } else {
-                recipient = new GrantedAuthoritySid(rs.getString("ace_sid"));
+                recipient = new GrantedAuthoritySid(rs.getString("ACE_SID"));
             }
 
-            int mask = rs.getInt("mask");
-			Permission permission = convertMaskIntoPermission(mask);
-            boolean granting = rs.getBoolean("granting");
-            boolean auditSuccess = rs.getBoolean("audit_success");
-            boolean auditFailure = rs.getBoolean("audit_failure");
+            Permission permission = BasePermission.buildFromMask(rs.getInt("MASK"));
+            boolean granting = rs.getBoolean("GRANTING");
+            boolean auditSuccess = rs.getBoolean("AUDIT_SUCCESS");
+            boolean auditFailure = rs.getBoolean("AUDIT_FAILURE");
 
             AccessControlEntryImpl ace = new AccessControlEntryImpl(aceId, acl, recipient, permission, granting,
                     auditSuccess, auditFailure);
@@ -287,10 +264,6 @@ public final class BasicLookupStrategy implements LookupStrategy {
         }
     }
 
-	protected Permission convertMaskIntoPermission(int mask) {
-		return BasePermission.buildFromMask(mask);
-	}
-
     /**
      * Looks up a batch of <code>ObjectIdentity</code>s directly from the database.<p>The caller is responsible
      * for optimization issues, such as selecting the identities to lookup, ensuring the cache doesn't contain them
@@ -310,7 +283,7 @@ public final class BasicLookupStrategy implements LookupStrategy {
 
         // Make the "acls" map contain all requested objectIdentities
         // (including markers to each parent in the hierarchy)
-        String sql = computeRepeatingSql("(acl_object_identity.object_id_identity = ? and acl_class.class = ?)",
+        String sql = computeRepeatingSql("(ACL_OBJECT_IDENTITY.OBJECT_ID_IDENTITY = ? and ACL_CLASS.CLASS = ?)",
                 objectIdentities.length);
 
         Set parentsToLookup = (Set) jdbcTemplate.query(sql,
@@ -320,10 +293,10 @@ public final class BasicLookupStrategy implements LookupStrategy {
                     for (int i = 0; i < objectIdentities.length; i++) {
                         // Determine prepared statement values for this iteration
                         String javaType = objectIdentities[i].getJavaType().getName();
+                        Assert.isInstanceOf(Long.class, objectIdentities[i].getIdentifier(),
+                            "This class requires ObjectIdentity.getIdentifier() to be a Long");
 
-                        // No need to check for nulls, as guaranteed non-null by ObjectIdentity.getIdentifier() interface contract
-                        String identifier = objectIdentities[i].getIdentifier().toString();
-                        long id = (Long.valueOf(identifier)).longValue();
+                        long id = ((Long) objectIdentities[i].getIdentifier()).longValue();
 
                         // Inject values
                         ps.setLong((2 * i) + 1, id);
@@ -365,7 +338,7 @@ public final class BasicLookupStrategy implements LookupStrategy {
         Assert.notNull(acls, "ACLs are required");
         Assert.notEmpty(findNow, "Items to find now required");
 
-        String sql = computeRepeatingSql("(acl_object_identity.id = ?)", findNow.size());
+        String sql = computeRepeatingSql("(ACL_OBJECT_IDENTITY.ID = ?)", findNow.size());
 
         Set parentsToLookup = (Set) jdbcTemplate.query(sql,
             new PreparedStatementSetter() {
@@ -500,7 +473,7 @@ public final class BasicLookupStrategy implements LookupStrategy {
                 convertCurrentResultIntoObject(acls, rs);
 
                 // Figure out if this row means we need to lookup another parent
-                long parentId = rs.getLong("parent_object");
+                long parentId = rs.getLong("PARENT_OBJECT");
 
                 if (parentId != 0) {
                     // See if it's already in the "acls"

acl/src/main/java/org/springframework/security/acls/jdbc/JdbcAclService.java

@@ -53,11 +53,11 @@ public class JdbcAclService implements AclService {
     //~ Static fields/initializers =====================================================================================
 
     protected static final Log log = LogFactory.getLog(JdbcAclService.class);
-    private static final String selectAclObjectWithParent = "select obj.object_id_identity as obj_id, class.class as class "
-        + "from acl_object_identity obj, acl_object_identity parent, acl_class class "
-        + "where obj.parent_object = parent.id and obj.object_id_class = class.id "
-        + "and parent.object_id_identity = ? and parent.object_id_class = ("
-        + "select id FROM acl_class where acl_class.class = ?)";
+    private static final String selectAclObjectWithParent = "SELECT obj.object_id_identity obj_id, class.class class "
+        + "FROM acl_object_identity obj, acl_object_identity parent, acl_class class "
+        + "WHERE obj.parent_object = parent.id AND obj.object_id_class = class.id "
+        + "AND parent.object_id_identity = ? AND parent.object_id_class = ("
+        + "SELECT id FROM acl_class WHERE acl_class.class = ?)";
 
     //~ Instance fields ================================================================================================
 

acl/src/main/java/org/springframework/security/acls/jdbc/JdbcMutableAclService.java

@@ -62,23 +62,23 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
 
 	private boolean foreignKeysInDatabase = true;
     private AclCache aclCache;
-    private String deleteEntryByObjectIdentityForeignKey = "delete from acl_entry where acl_object_identity=?";
-    private String deleteObjectIdentityByPrimaryKey = "delete from acl_object_identity where id=?";
-    private String classIdentityQuery = "call identity()"; // should be overridden for postgres : select currval('acl_class_seq')
-    private String sidIdentityQuery = "call identity()"; // should be overridden for postgres : select currval('acl_siq_seq')
-    private String insertClass = "insert into acl_class (class) values (?)";
-    private String insertEntry = "insert into acl_entry "
+    private String deleteClassByClassNameString = "DELETE FROM acl_class WHERE class=?";
+    private String deleteEntryByObjectIdentityForeignKey = "DELETE FROM acl_entry WHERE acl_object_identity=?";
+    private String deleteObjectIdentityByPrimaryKey = "DELETE FROM acl_object_identity WHERE id=?";
+    private String identityQuery = "call identity()";
+    private String insertClass = "INSERT INTO acl_class (class) VALUES (?)";
+    private String insertEntry = "INSERT INTO acl_entry "
         + "(acl_object_identity, ace_order, sid, mask, granting, audit_success, audit_failure)"
-        + "values (?, ?, ?, ?, ?, ?, ?)";
-    private String insertObjectIdentity = "insert into acl_object_identity "
-        + "(object_id_class, object_id_identity, owner_sid, entries_inheriting) " + "values (?, ?, ?, ?)";
-    private String insertSid = "insert into acl_sid (principal, sid) values (?, ?)";
-    private String selectClassPrimaryKey = "select id from acl_class where class=?";
-    private String selectObjectIdentityPrimaryKey = "select acl_object_identity.id from acl_object_identity, acl_class "
-        + "where acl_object_identity.object_id_class = acl_class.id and acl_class.class=? "
+        + "VALUES (?, ?, ?, ?, ?, ?, ?)";
+    private String insertObjectIdentity = "INSERT INTO acl_object_identity "
+        + "(object_id_class, object_id_identity, owner_sid, entries_inheriting) " + "VALUES (?, ?, ?, ?)";
+    private String insertSid = "INSERT INTO acl_sid (principal, sid) VALUES (?, ?)";
+    private String selectClassPrimaryKey = "SELECT id FROM acl_class WHERE class=?";
+    private String selectObjectIdentityPrimaryKey = "SELECT acl_object_identity.id FROM acl_object_identity, acl_class "
+        + "WHERE acl_object_identity.object_id_class = acl_class.id and acl_class.class=? "
         + "and acl_object_identity.object_id_identity = ?";
-    private String selectSidPrimaryKey = "select id from acl_sid where principal=? and sid=?";
-    private String updateObjectIdentity = "update acl_object_identity set "
+    private String selectSidPrimaryKey = "SELECT id FROM acl_sid WHERE principal=? AND sid=?";
+    private String updateObjectIdentity = "UPDATE acl_object_identity SET "
         + "parent_object = ?, owner_sid = ?, entries_inheriting = ?" + " where id = ?";
 
     //~ Constructors ===================================================================================================
@@ -177,7 +177,7 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
                 jdbcTemplate.update(insertClass, new Object[] {clazz.getName()});
                 Assert.isTrue(TransactionSynchronizationManager.isSynchronizationActive(),
                         "Transaction must be running");
-                classId = new Long(jdbcTemplate.queryForLong(classIdentityQuery));
+                classId = new Long(jdbcTemplate.queryForLong(identityQuery));
             }
         } else {
             classId = (Long) classIds.iterator().next();
@@ -222,7 +222,7 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
                 jdbcTemplate.update(insertSid, new Object[] {new Boolean(principal), sidName});
                 Assert.isTrue(TransactionSynchronizationManager.isSynchronizationActive(),
                         "Transaction must be running");
-                sidId = new Long(jdbcTemplate.queryForLong(sidIdentityQuery));
+                sidId = new Long(jdbcTemplate.queryForLong(identityQuery));
             }
         } else {
             sidId = (Long) sidIds.iterator().next();
@@ -381,15 +381,11 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
         }
     }
 
-	public void setClassIdentityQuery(String identityQuery) {
+	public void setIdentityQuery(String identityQuery) {
 		Assert.hasText(identityQuery, "New identity query is required");
-		this.classIdentityQuery = identityQuery;
+		this.identityQuery = identityQuery;
 	}
 
-	public void setSidIdentityQuery(String identityQuery) {
-		Assert.hasText(identityQuery, "New identity query is required");
-		this.sidIdentityQuery = identityQuery;
-	}
 	/**
 	 * @param foreignKeysInDatabase if false this class will perform additional FK constrain checking, which may
 	 * cause deadlocks (the default is true, so deadlocks are avoided but the database is expected to enforce FKs)

acl/src/main/java/org/springframework/security/acls/objectidentity/ObjectIdentityImpl.java

@@ -15,7 +15,6 @@
 package org.springframework.security.acls.objectidentity;
 
 import org.springframework.security.acls.IdentityUnavailableException;
-import org.springframework.security.acls.jdbc.LookupStrategy;
 
 import org.springframework.util.Assert;
 import org.springframework.util.ClassUtils;
@@ -98,12 +97,6 @@ public class ObjectIdentityImpl implements ObjectIdentity {
     /**
      * Important so caching operates properly.<P>Considers an object of the same class equal if it has the same
      * <code>classname</code> and <code>id</code> properties.</p>
-     * 
-     * <p>
-     * Note that this class uses string equality for the identifier field, which ensures it better supports
-     * differences between {@link LookupStrategy} requirements and the domain object represented by this
-     * <code>ObjectIdentityImpl</code>.
-     * </p>
      *
      * @param arg0 object to compare
      *
@@ -120,7 +113,7 @@ public class ObjectIdentityImpl implements ObjectIdentity {
 
         ObjectIdentityImpl other = (ObjectIdentityImpl) arg0;
 
-        if (this.getIdentifier().toString().equals(other.getIdentifier().toString()) && this.getJavaType().equals(other.getJavaType())) {
+        if (this.getIdentifier().equals(other.getIdentifier()) && this.getJavaType().equals(other.getJavaType())) {
             return true;
         }
 

acl/src/main/java/org/springframework/security/afterinvocation/AbstractAclProvider.java

@@ -34,20 +34,20 @@ import org.springframework.util.Assert;
 
 
 /**
- * Abstract {@link AfterInvocationProvider} which provides commonly-used ACL-related services.
+ * DOCUMENT ME!
  *
- * @author Ben Alex
- * @version $Id$
+ * @author $author$
+ * @version $Revision$
   */
 public abstract class AbstractAclProvider implements AfterInvocationProvider {
     //~ Instance fields ================================================================================================
 
-    protected AclService aclService;
-    protected Class processDomainObjectClass = Object.class;
-    protected ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy = new ObjectIdentityRetrievalStrategyImpl();
-    protected SidRetrievalStrategy sidRetrievalStrategy = new SidRetrievalStrategyImpl();
-    protected String processConfigAttribute;
-    protected Permission[] requirePermission = {BasePermission.READ};
+    private AclService aclService;
+    private Class processDomainObjectClass = Object.class;
+    private ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy = new ObjectIdentityRetrievalStrategyImpl();
+    private SidRetrievalStrategy sidRetrievalStrategy = new SidRetrievalStrategyImpl();
+    private String processConfigAttribute;
+    private Permission[] requirePermission = {BasePermission.READ};
 
     //~ Constructors ===================================================================================================
 

acl/src/test/java/org/springframework/security/acls/domain/PermissionTests.java

@@ -22,7 +22,7 @@ import org.springframework.security.acls.Permission;
 
 
 /**
- * Tests classes associated with Permission.
+ * Tests BasePermission and CumulativePermission.
  *
  * @author Ben Alex
  * @version $Id${date}
@@ -32,12 +32,6 @@ public class PermissionTests {
 
     //~ Methods ========================================================================================================
 
-    @Test
-    public void basePermissionTest() {
-    	Permission p = BasePermission.buildFromName("WRITE");
-    	assertNotNull(p);
-    }
-
     @Test
     public void expectedIntegerValues() {
         assertEquals(1, BasePermission.READ.getMask());
@@ -69,9 +63,9 @@ public class PermissionTests {
         assertEquals("CumulativePermission[...............................R=1]",
                 new CumulativePermission().set(BasePermission.READ).toString());
 
-        System.out.println("A =  " + new CumulativePermission().set(SpecialPermission.ENTER).set(BasePermission.ADMINISTRATION).toString());
-        assertEquals("CumulativePermission[..........................EA....=48]",
-                new CumulativePermission().set(SpecialPermission.ENTER).set(BasePermission.ADMINISTRATION).toString());
+        System.out.println("A =  " + new CumulativePermission().set(BasePermission.ADMINISTRATION).toString());
+        assertEquals("CumulativePermission[...........................A....=16]",
+                new CumulativePermission().set(BasePermission.ADMINISTRATION).toString());
 
         System.out.println("RA = "
                 + new CumulativePermission().set(BasePermission.ADMINISTRATION).set(BasePermission.READ).toString());

acl/src/test/java/org/springframework/security/acls/domain/SpecialPermission.java

@@ -1,40 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-import org.springframework.security.acls.Permission;
-
-
-/**
- * A test permission.
- * 
- * @author Ben Alex
- * @version $Id$
- */
-public class SpecialPermission extends BasePermission {
-    public static final Permission ENTER = new SpecialPermission(1 << 5, 'E'); // 32
-    
-    /**
-     * Registers the public static permissions defined on this class. This is mandatory so
-     * that the static methods will operate correctly.
-     */
-    static {
-    	registerPermissionsFor(SpecialPermission.class);
-    }
-
-    protected SpecialPermission(int mask, char code) {
-    	super(mask, code);
-    }
-}

acl/src/test/java/org/springframework/security/acls/jdbc/BasicLookupStrategyTests.java

@@ -120,8 +120,7 @@ public class BasicLookupStrategyTests {
     public void testAclsRetrievalWithDefaultBatchSize() throws Exception {
         ObjectIdentity topParentOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(100));
         ObjectIdentity middleParentOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(101));
-        // Deliberately use an integer for the child, to reproduce bug report in SEC-819
-        ObjectIdentity childOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Integer(102));
+        ObjectIdentity childOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(102));
 
         Map map = this.strategy.readAclsById(new ObjectIdentity[] { topParentOid, middleParentOid, childOid }, null);
         checkEntries(topParentOid, middleParentOid, childOid, map);
@@ -129,7 +128,7 @@ public class BasicLookupStrategyTests {
 
     @Test
     public void testAclsRetrievalFromCacheOnly() throws Exception {
-        ObjectIdentity topParentOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Integer(100));
+        ObjectIdentity topParentOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(100));
         ObjectIdentity middleParentOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(101));
         ObjectIdentity childOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(102));
 
@@ -146,7 +145,7 @@ public class BasicLookupStrategyTests {
     @Test
     public void testAclsRetrievalWithCustomBatchSize() throws Exception {
         ObjectIdentity topParentOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(100));
-        ObjectIdentity middleParentOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Integer(101));
+        ObjectIdentity middleParentOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(101));
         ObjectIdentity childOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(102));
 
         // Set a batch size to allow multiple database queries in order to retrieve all acls
@@ -228,7 +227,7 @@ public class BasicLookupStrategyTests {
         jdbcTemplate.execute(query);
         
         ObjectIdentity topParentOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(100));
-        ObjectIdentity middleParentOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Integer(101));
+        ObjectIdentity middleParentOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(101));
         ObjectIdentity childOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(102));
         ObjectIdentity middleParent2Oid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(103));
         
@@ -261,8 +260,8 @@ public class BasicLookupStrategyTests {
 
         ObjectIdentity grandParentOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(104));
         ObjectIdentity parent1Oid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(105));
-        ObjectIdentity parent2Oid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Integer(106));
-        ObjectIdentity childOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Integer(107));
+        ObjectIdentity parent2Oid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(106));
+        ObjectIdentity childOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(107));
 
         // First lookup only child, thus populating the cache with grandParent, parent1 and child
         Permission[] checkPermission = new Permission[] { BasePermission.READ };
@@ -291,4 +290,21 @@ public class BasicLookupStrategyTests {
         Assert.assertTrue(foundParent2Acl.isGranted(checkPermission, sids, false));
     }
     
+    @Test
+    public void testAclsWithDifferentSerializableTypesAsObjectIdentities() throws Exception {
+        String query = "INSERT INTO acl_object_identity(ID,OBJECT_ID_CLASS,OBJECT_ID_IDENTITY,PARENT_OBJECT,OWNER_SID,ENTRIES_INHERITING) VALUES (4,2,104,null,1,1);"
+                + "INSERT INTO acl_entry(ID,ACL_OBJECT_IDENTITY,ACE_ORDER,SID,MASK,GRANTING,AUDIT_SUCCESS,AUDIT_FAILURE) VALUES (5,4,0,1,1,1,0,0)";
+        jdbcTemplate.execute(query);
+
+        ObjectIdentity oid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Integer(104));
+        Sid[] sids = new Sid[] { new PrincipalSid("ben") };
+        ObjectIdentity[] childOids = new ObjectIdentity[] { oid };
+        
+        try {
+            Map foundAcls = strategy.readAclsById(childOids, sids);
+            Assert.fail("It should have thrown IllegalArgumentException");
+        } catch(IllegalArgumentException expected) {
+            Assert.assertTrue(true);
+        }
+    }
 }

acl/src/test/java/org/springframework/security/acls/jdbc/JdbcAclServiceTests.java

@@ -97,7 +97,7 @@ public class JdbcAclServiceTests extends AbstractTransactionalDataSourceSpringCo
 
         ObjectIdentity topParentOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(100));
         ObjectIdentity middleParentOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(101));
-        ObjectIdentity childOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Integer(102));
+        ObjectIdentity childOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(102));
 
         MutableAcl topParent = jdbcMutableAclService.createAcl(topParentOid);
         MutableAcl middleParent = jdbcMutableAclService.createAcl(middleParentOid);
@@ -337,7 +337,7 @@ public class JdbcAclServiceTests extends AbstractTransactionalDataSourceSpringCo
 
         ObjectIdentity topParentOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(100));
         ObjectIdentity middleParentOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(101));
-        ObjectIdentity childOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Integer(102));
+        ObjectIdentity childOid = new ObjectIdentityImpl("org.springframework.security.TargetObject", new Long(102));
         
         // Remove the child and check all related database rows were removed accordingly
         jdbcMutableAclService.deleteAcl(childOid, false);

acl/src/test/java/org/springframework/security/acls/sid/SidTests.java

@@ -53,7 +53,7 @@ public class SidTests extends TestCase {
         }
 
         try {
-            Authentication authentication = new TestingAuthenticationToken(null, "password");
+            Authentication authentication = new TestingAuthenticationToken(null, "password", null);
             Sid principalSid = new PrincipalSid(authentication);
             Assert.fail("It should have thrown IllegalArgumentException");
         }
@@ -62,7 +62,7 @@ public class SidTests extends TestCase {
         }
 
         try {
-            Authentication authentication = new TestingAuthenticationToken("johndoe", "password");
+            Authentication authentication = new TestingAuthenticationToken("johndoe", "password", null);
             Sid principalSid = new PrincipalSid(authentication);
             Assert.assertTrue(true);
         }
@@ -128,15 +128,15 @@ public class SidTests extends TestCase {
     }
 
     public void testPrincipalSidEquals() throws Exception {
-        Authentication authentication = new TestingAuthenticationToken("johndoe", "password");
+        Authentication authentication = new TestingAuthenticationToken("johndoe", "password", null);
         Sid principalSid = new PrincipalSid(authentication);
 
         Assert.assertFalse(principalSid.equals(null));
         Assert.assertFalse(principalSid.equals("DIFFERENT_TYPE_OBJECT"));
         Assert.assertTrue(principalSid.equals(principalSid));
         Assert.assertTrue(principalSid.equals(new PrincipalSid(authentication)));
-        Assert.assertTrue(principalSid.equals(new PrincipalSid(new TestingAuthenticationToken("johndoe", null))));
-        Assert.assertFalse(principalSid.equals(new PrincipalSid(new TestingAuthenticationToken("scott", null))));
+        Assert.assertTrue(principalSid.equals(new PrincipalSid(new TestingAuthenticationToken("johndoe", null, null))));
+        Assert.assertFalse(principalSid.equals(new PrincipalSid(new TestingAuthenticationToken("scott", null, null))));
         Assert.assertTrue(principalSid.equals(new PrincipalSid("johndoe")));
         Assert.assertFalse(principalSid.equals(new PrincipalSid("scott")));
     }
@@ -156,13 +156,14 @@ public class SidTests extends TestCase {
     }
 
     public void testPrincipalSidHashCode() throws Exception {
-        Authentication authentication = new TestingAuthenticationToken("johndoe", "password");
+        Authentication authentication = new TestingAuthenticationToken("johndoe", "password", null);
         Sid principalSid = new PrincipalSid(authentication);
 
         Assert.assertTrue(principalSid.hashCode() == new String("johndoe").hashCode());
         Assert.assertTrue(principalSid.hashCode() == new PrincipalSid("johndoe").hashCode());
         Assert.assertTrue(principalSid.hashCode() != new PrincipalSid("scott").hashCode());
-        Assert.assertTrue(principalSid.hashCode() != new PrincipalSid(new TestingAuthenticationToken("scott", "password")).hashCode());
+        Assert.assertTrue(principalSid.hashCode() != new PrincipalSid(new TestingAuthenticationToken("scott", "password",
+                null)).hashCode());
     }
 
     public void testGrantedAuthoritySidHashCode() throws Exception {
@@ -176,7 +177,7 @@ public class SidTests extends TestCase {
     }
 
     public void testGetters() throws Exception {
-        Authentication authentication = new TestingAuthenticationToken("johndoe", "password");
+        Authentication authentication = new TestingAuthenticationToken("johndoe", "password", null);
         PrincipalSid principalSid = new PrincipalSid(authentication);
         GrantedAuthority ga = new GrantedAuthorityImpl("ROLE_TEST");
         GrantedAuthoritySid gaSid = new GrantedAuthoritySid(ga);

adapters/catalina/pom.xml

@@ -3,7 +3,7 @@
   <parent>
     <groupId>org.springframework.security</groupId>
     <artifactId>spring-security-adapters</artifactId>
-    <version>2.0.4</version>
+    <version>2.0.0</version>
   </parent>
   <artifactId>spring-security-catalina</artifactId>
   <name>Spring Security - Catalina adapter</name>

adapters/jboss/pom.xml

@@ -3,7 +3,7 @@
   <parent>
     <groupId>org.springframework.security</groupId>
     <artifactId>spring-security-adapters</artifactId>
-    <version>2.0.4</version>
+    <version>2.0.0</version>
   </parent>
   <artifactId>spring-security-jboss</artifactId>
   <name>Spring Security - JBoss adapter</name>

adapters/jboss/src/main/java/org/springframework/security/adapters/jboss/JbossSpringSecurityLoginModule.java

@@ -57,7 +57,7 @@ import javax.security.auth.login.LoginException;
  * which is subsequently available from <code>java:comp/env/security/subject</code>.</p>
  *
  * @author Ben Alex
- * @author Sergio Bern
+ * @author Sergio Bern�
  * @version $Id:JbossSpringSecurityLoginModule.java 2151 2007-09-22 11:54:13Z luke_t $
  */
 public class JbossSpringSecurityLoginModule extends AbstractServerLoginModule {

adapters/jetty/pom.xml

@@ -3,7 +3,7 @@
   <parent>
     <groupId>org.springframework.security</groupId>
     <artifactId>spring-security-adapters</artifactId>
-    <version>2.0.4</version>
+    <version>2.0.0</version>
   </parent>
   <artifactId>spring-security-jetty</artifactId>
   <name>Spring Security - Jetty adapter</name>

adapters/pom.xml

@@ -3,7 +3,7 @@
   <parent>
     <groupId>org.springframework.security</groupId>
     <artifactId>spring-security-parent</artifactId>
-    <version>2.0.4</version>
+    <version>2.0.0</version>
   </parent>
   <artifactId>spring-security-adapters</artifactId>
   <name>Spring Security - Adapters</name>

adapters/resin/pom.xml

@@ -3,7 +3,7 @@
   <parent>
     <groupId>org.springframework.security</groupId>
     <artifactId>spring-security-adapters</artifactId>
-    <version>2.0.4</version>
+    <version>2.0.0</version>
   </parent>
   <artifactId>spring-security-resin</artifactId>
   <name>Spring Security - Resin adapter</name>

cas/pom.xml

@@ -3,11 +3,11 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-parent</artifactId>
-        <version>2.0.4</version>
+        <version>2.0.0</version>
     </parent>
     <artifactId>spring-security-cas-client</artifactId>
     <name>Spring Security - CAS support</name>
-    <packaging>bundle</packaging>
+    <packaging>jar</packaging>
 
     <dependencies>
         <dependency>
@@ -15,13 +15,6 @@
             <artifactId>spring-security-core</artifactId>
             <version>${project.version}</version>
         </dependency>
-        <dependency>
-            <groupId>org.springframework.security</groupId>
-            <artifactId>spring-security-core</artifactId>
-            <version>${project.version}</version>
-            <classifier>tests</classifier>
-            <scope>test</scope>
-        </dependency>    
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-dao</artifactId>
@@ -38,7 +31,7 @@
         <dependency>
             <groupId>org.jasig.cas</groupId>
             <artifactId>cas-client-core</artifactId>
-            <version>3.1.3</version>
+            <version>3.1.1</version>
         </dependency>
         <dependency>
             <groupId>net.sf.ehcache</groupId>
@@ -46,29 +39,4 @@
             <optional>true</optional>
         </dependency>
     </dependencies>
-    
-    <properties>
-      	<spring.osgi.export>
-      	    org.springframework.security.*;version=${pom.version.osgi}
-      	</spring.osgi.export>
-            
-    	<spring.osgi.import>
-    	    org.springframework.security.*;version="[${pom.version.osgi},${pom.version.osgi}]",
-            org.springframework.beans.*;version="${spring.version.osgi}",
-            org.springframework.context.*;version="${spring.version.osgi}",
-            org.springframework.dao.*;version="${spring.version.osgi}";resolution:=optional,
-            org.springframework.util.*;version="${spring.version.osgi}",
-            javax.servlet.*;version="[2.4.0, 3.0.0)";resolution:=optional,
-            net.sf.ehcache.*;version="[1.4.1, 2.0.0)";resolution:=optional,
-            org.apache.commons.logging.*;version="[1.1.1, 2.0.0)",
-            org.jasig.cas.client.*;version="[3.1.3, 4.0.0)"
-    	</spring.osgi.import>
-
-    	<spring.osgi.private.pkg>
-    	    !org.springframework.security.*
-    	</spring.osgi.private.pkg>
-
-    	<spring.osgi.symbolic.name>org.springframework.security.cas</spring.osgi.symbolic.name>        
-    </properties>    
-    
 </project>

cas/src/main/java/org/springframework/security/ui/cas/CasProcessingFilter.java

@@ -15,11 +15,6 @@
 
 package org.springframework.security.ui.cas;
 
-import java.io.IOException;
-
-import org.jasig.cas.client.proxy.ProxyGrantingTicketStorage;
-import org.jasig.cas.client.util.CommonUtils;
-import org.jasig.cas.client.validation.TicketValidator;
 import org.springframework.security.Authentication;
 import org.springframework.security.AuthenticationException;
 
@@ -29,7 +24,6 @@ import org.springframework.security.ui.AbstractProcessingFilter;
 import org.springframework.security.ui.FilterChainOrder;
 
 import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
 
 
 /**
@@ -44,11 +38,7 @@ import javax.servlet.http.HttpServletResponse;
  *  <p>The configured <code>AuthenticationManager</code> is expected to provide a provider that can recognise
  * <code>UsernamePasswordAuthenticationToken</code>s containing this special <code>principal</code> name, and process
  * them accordingly by validation with the CAS server.</p>
- * <p>By configuring a shared {@link ProxyGrantingTicketStorage} between the {@link TicketValidator} and the CasProcessingFilter
- * one can have the CasProcessingFilter handle the proxying requirements for CAS.  In addition, the URI endpoint for the proxying
- * would also need to be configured (i.e. the part after protocol, hostname, and port).
- * 
- * <p><b>Do not use this class directly.</b> Instead configure <code>web.xml</code> to use the {@link
+ *  <p><b>Do not use this class directly.</b> Instead configure <code>web.xml</code> to use the {@link
  * org.springframework.security.util.FilterToBeanProxy}.</p>
  *
  * @author Ben Alex
@@ -67,17 +57,8 @@ public class CasProcessingFilter extends AbstractProcessingFilter {
      */
     public static final String CAS_STATELESS_IDENTIFIER = "_cas_stateless_";
 
-    /**
-     * The last portion of the receptor url, i.e. /proxy/receptor
-     */
-    private String proxyReceptorUrl;
-    
-    /**
-     * The backing storage to store ProxyGrantingTicket requests.
-     */
-    private ProxyGrantingTicketStorage proxyGrantingTicketStorage;
+    //~ Methods ========================================================================================================
 
-    //~ Methods ========================================================================================================  
     public Authentication attemptAuthentication(final HttpServletRequest request)
         throws AuthenticationException {
         final String username = CAS_STATEFUL_IDENTIFIER;
@@ -106,35 +87,4 @@ public class CasProcessingFilter extends AbstractProcessingFilter {
     public int getOrder() {
         return FilterChainOrder.CAS_PROCESSING_FILTER;
     }
-    
-
-    /**
-     * Overridden to provide proxying capabilities.
-     */
-	protected boolean requiresAuthentication(final HttpServletRequest request,
-			final HttpServletResponse response) {
-		final String requestUri = request.getRequestURI();
-
-        if (CommonUtils.isEmpty(this.proxyReceptorUrl) || !requestUri.endsWith(this.proxyReceptorUrl) || this.proxyGrantingTicketStorage == null) {
-        	return super.requiresAuthentication(request, response);
-        }
-
-        try {
-        	CommonUtils.readAndRespondToProxyReceptorRequest(request, response, this.proxyGrantingTicketStorage);
-        	return false;
-        } catch (final IOException e) {
-        	return super.requiresAuthentication(request, response);
-        }
-	}
-
-	public final void setProxyReceptorUrl(final String proxyReceptorUrl) {
-		this.proxyReceptorUrl = proxyReceptorUrl;
-	}
-
-	public final void setProxyGrantingTicketStorage(
-			final ProxyGrantingTicketStorage proxyGrantingTicketStorage) {
-		this.proxyGrantingTicketStorage = proxyGrantingTicketStorage;
-	}
-	
-	
 }

cas/src/main/java/org/springframework/security/ui/cas/CasProcessingFilterEntryPoint.java

@@ -30,14 +30,12 @@ import org.springframework.util.Assert;
 
 
 /**
- * Used by the <code>ExceptionTranslationFilter</code> to commence authentication via the JA-SIG Central
- * Authentication Service (CAS).
- * <p>
- * The user's browser will be redirected to the JA-SIG CAS enterprise-wide login page. 
- * This page is specified by the <code>loginUrl</code> property. Once login is complete, the CAS login page will
+ * Used by the <code>SecurityEnforcementFilter</code> to commence authentication via the JA-SIG Central
+ * Authentication Service (CAS).<P>The user's browser will be redirected to the JA-SIG CAS enterprise-wide login
+ * page. This page is specified by the <code>loginUrl</code> property. Once login is complete, the CAS login page will
  * redirect to the page indicated by the <code>service</code> property. The <code>service</code> is a HTTP URL
  * belonging to the current application. The <code>service</code> URL is monitored by the {@link CasProcessingFilter},
- * which will validate the CAS login was successful.
+ * which will validate the CAS login was successful.</p>
  *
  * @author Ben Alex
  * @author Scott Battaglia
@@ -67,8 +65,8 @@ public class CasProcessingFilterEntryPoint implements AuthenticationEntryPoint,
     }
 
     public void commence(final ServletRequest servletRequest, final ServletResponse servletResponse,
-    		final AuthenticationException authenticationException) throws IOException, ServletException {
-
+        final AuthenticationException authenticationException)
+        throws IOException, ServletException {
         final HttpServletResponse response = (HttpServletResponse) servletResponse;
         final String urlEncodedService = CommonUtils.constructServiceUrl(null, response, this.serviceProperties.getService(), null, "ticket", this.encodeServiceUrlWithSessionId);
         final String redirectUrl = CommonUtils.constructRedirectUrl(this.loginUrl, "service", urlEncodedService, this.serviceProperties.isSendRenew(), false);

cas/src/main/java/org/springframework/security/ui/cas/ServiceProperties.java

@@ -21,10 +21,9 @@ import org.springframework.util.Assert;
 
 /**
  * Stores properties related to this CAS service.
- * <p>
- * Each web application capable of processing CAS tickets is known as a service.
+ * <p>Each web application capable of processing CAS tickets is known as a service.
  * This class stores the properties that are relevant to the local CAS service, being the application
- * that is being secured by Spring Security.
+ * that is being secured by Spring Security.</p>
  *
  * @author Ben Alex
  * @version $Id$
@@ -43,8 +42,7 @@ public class ServiceProperties implements InitializingBean {
 
     /**
      * Represents the service the user is authenticating to.
-     * <p>
-     * This service is the callback URL belonging to the local Spring Security System for Spring secured application.
+     * <p>This service is the callback URL belonging to the local Spring Security System for Spring secured application.
      * For example,
      * <pre>
      * https://www.mycompany.com/application/j_spring_cas_security_check
@@ -58,12 +56,10 @@ public class ServiceProperties implements InitializingBean {
 
     /**
      * Indicates whether the <code>renew</code> parameter should be sent to the CAS login URL and CAS
-     * validation URL.
-     * <p>
-     * If <code>true</code>, it will force CAS to authenticate the user again (even if the
+     * validation URL.<p>If <code>true</code>, it will force CAS to authenticate the user again (even if the
      * user has previously authenticated). During ticket validation it will require the ticket was generated as a
      * consequence of an explicit login. High security applications would probably set this to <code>true</code>.
-     * Defaults to <code>false</code>, providing automated single sign on.
+     * Defaults to <code>false</code>, providing automated single sign on.</p>
      *
      * @return whether to send the <code>renew</code> parameter to CAS
      */

core-tiger/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-parent</artifactId>
-        <version>2.0.4</version>
+        <version>2.0.0</version>
     </parent>
     <packaging>bundle</packaging>    
     <artifactId>spring-security-core-tiger</artifactId>
@@ -15,18 +15,6 @@
             <artifactId>spring-security-core</artifactId>
             <version>${project.version}</version>
         </dependency>
-        <dependency>
-            <groupId>org.springframework.security</groupId>
-            <artifactId>spring-security-core</artifactId>
-            <version>${project.version}</version>
-            <classifier>tests</classifier>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.springframework</groupId>
-            <artifactId>spring-remoting</artifactId>
-            <scope>test</scope>
-        </dependency> 
         <dependency>
             <groupId>org.aspectj</groupId>
             <artifactId>aspectjrt</artifactId>
@@ -37,6 +25,20 @@
             <artifactId>aspectjweaver</artifactId>
             <optional>true</optional>
         </dependency>
+        <dependency>
+            <groupId>org.springframework</groupId>
+            <artifactId>spring-core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework</groupId>
+            <artifactId>spring-aop</artifactId>
+            <version>${spring.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework</groupId>
+            <artifactId>spring-support</artifactId>
+            <scope>runtime</scope>
+        </dependency>
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-jdbc</artifactId>
@@ -59,6 +61,26 @@
                     <target>1.5</target>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.felix</groupId>
+                <artifactId>maven-bundle-plugin</artifactId>
+                <version>${felix.version}</version>
+                <extensions>true</extensions>
+                <configuration>
+                    <instructions>
+                        <Bundle-SymbolicName>org.springframework.bundle.security.core.tiger</Bundle-SymbolicName>
+                        <Export-Package>org.springframework.security.*;version=${pom.version}</Export-Package>
+                        <Private-Package>!org.springframework.security.*</Private-Package>
+                        <Implementation-Title>${pom.name}</Implementation-Title>
+                        <Implementation-Version>${pom.version}</Implementation-Version>
+                        <Import-Package>
+                            org.springframework*;resolution:=optional;version="[2.0,2.6)",
+                            *;resolution:=optional
+                        </Import-Package>
+                    </instructions>
+                    <excludeDependencies>true</excludeDependencies>                    
+                </configuration>
+            </plugin>
         </plugins>
     </build>
     <reporting>
@@ -72,26 +94,4 @@
             </plugin>
         </plugins>
     </reporting>
-
-    <properties>
-      	<spring.osgi.export>
-      	    org.springframework.security.*;version=${pom.version}
-      	</spring.osgi.export>
-            
-    	<spring.osgi.import>
-    	    javax.annotation.*;version="[1.0.0, 2.0.0)",
-    	    org.springframework.security.*;version="[${pom.version.osgi},${pom.version.osgi}]",
-    	    org.springframework.core.*;version="${spring.version.osgi}"
-    	</spring.osgi.import>
-
-    	<spring.osgi.private.pkg>
-    	    !org.springframework.security.*
-    	</spring.osgi.private.pkg>
-    	
-    	<spring.osgi.include.res>
-    	    src/main/resources
-    	</spring.osgi.include.res>
-
-    	<spring.osgi.symbolic.name>org.springframework.security.annotation</spring.osgi.symbolic.name>        
-    </properties>    
 </project>

core-tiger/src/test/java/org/springframework/security/annotation/BusinessService.java

@@ -39,10 +39,8 @@ public interface BusinessService {
     public void someUserMethod1();
 
     @Secured({"ROLE_USER"})
-    @RolesAllowed({"ROLE_USER"})
+    @RolesAllowed({"ROLE_USER"})    
     public void someUserMethod2();
-
-    public int someOther(String s);
-
+    
     public int someOther(int input);
 }

core-tiger/src/test/java/org/springframework/security/annotation/BusinessServiceImpl.java

@@ -26,11 +26,7 @@ public class BusinessServiceImpl<E extends Entity> implements BusinessService {
         return entity;
     }
 
-    public int someOther(String s) {
-        return 0;
-    }
-
-    public int someOther(int input) {
-        return input;
-    }
+	public int someOther(int input) {
+		return input;
+	}
 }

core-tiger/src/test/java/org/springframework/security/annotation/Jsr250BusinessServiceImpl.java

@@ -27,11 +27,7 @@ public class Jsr250BusinessServiceImpl implements BusinessService {
     public void someAdminMethod() {
     }
 
-    public int someOther(String input) {
-        return 0;
-    }
-
     public int someOther(int input) {
-        return input;
-    }
-}
+		return input;
+	}
+}

core-tiger/src/test/java/org/springframework/security/config/GlobalMethodSecurityBeanDefinitionParserTests.java

@@ -1,12 +1,9 @@
 package org.springframework.security.config;
 
-import static org.junit.Assert.*;
-import static org.springframework.security.config.ConfigTestUtils.*;
-
 import org.junit.After;
+import org.junit.Before;
 import org.junit.Test;
-import org.springframework.beans.factory.parsing.BeanDefinitionParsingException;
-import org.springframework.context.support.AbstractXmlApplicationContext;
+import org.springframework.context.support.ClassPathXmlApplicationContext;
 import org.springframework.security.AccessDeniedException;
 import org.springframework.security.AuthenticationCredentialsNotFoundException;
 import org.springframework.security.GrantedAuthority;
@@ -14,50 +11,39 @@ import org.springframework.security.GrantedAuthorityImpl;
 import org.springframework.security.annotation.BusinessService;
 import org.springframework.security.context.SecurityContextHolder;
 import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
-import org.springframework.security.userdetails.UserDetailsService;
-import org.springframework.security.util.InMemoryXmlApplicationContext;
 
 /**
  * @author Ben Alex
- * @author Luke Taylor
  * @version $Id$
  */
 public class GlobalMethodSecurityBeanDefinitionParserTests {
-    private AbstractXmlApplicationContext appContext;
+    private ClassPathXmlApplicationContext appContext;
 
     private BusinessService target;
 
+    @Before
     public void loadContext() {
-        setContext(
-                "<b:bean id='target' class='org.springframework.security.annotation.BusinessServiceImpl'/>" +
-                "<global-method-security>" +
-                "    <protect-pointcut expression='execution(* *.someUser*(..))' access='ROLE_USER'/>" +
-                "    <protect-pointcut expression='execution(* *.someAdmin*(..))' access='ROLE_ADMIN'/>" +
-                "</global-method-security>" + ConfigTestUtils.AUTH_PROVIDER_XML
-                    );
+        appContext = new ClassPathXmlApplicationContext("org/springframework/security/config/global-method-security.xml");
         target = (BusinessService) appContext.getBean("target");
-   }
+    }
 
     @After
     public void closeAppContext() {
         if (appContext != null) {
             appContext.close();
-            appContext = null;
         }
         SecurityContextHolder.clearContext();
-        target = null;
     }
 
     @Test(expected=AuthenticationCredentialsNotFoundException.class)
     public void targetShouldPreventProtectedMethodInvocationWithNoContext() {
-        loadContext();
         target.someUserMethod1();
     }
 
     @Test
     public void targetShouldAllowProtectedMethodInvocationWithCorrectRole() {
-        loadContext();
-        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("user", "password");
+        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test", "Password",
+                new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_USER")});
         SecurityContextHolder.getContext().setAuthentication(token);
 
         target.someUserMethod1();
@@ -65,124 +51,10 @@ public class GlobalMethodSecurityBeanDefinitionParserTests {
 
     @Test(expected=AccessDeniedException.class)
     public void targetShouldPreventProtectedMethodInvocationWithIncorrectRole() {
-        loadContext();
         UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test", "Password",
                 new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_SOMEOTHERROLE")});
         SecurityContextHolder.getContext().setAuthentication(token);
 
         target.someAdminMethod();
     }
-
-    @Test
-    public void doesntInterfereWithBeanPostProcessing() {
-        setContext(
-                "<b:bean id='myUserService' class='org.springframework.security.config.PostProcessedMockUserDetailsService'/>" +
-                "<global-method-security />" +
-                "<authentication-provider user-service-ref='myUserService'/>" +
-                "<b:bean id='beanPostProcessor' class='org.springframework.security.config.MockUserServiceBeanPostProcessor'/>"
-        );
-
-        PostProcessedMockUserDetailsService service = (PostProcessedMockUserDetailsService)appContext.getBean("myUserService");
-
-        assertEquals("Hello from the post processor!", service.getPostProcessorWasHere());
-    }
-
-    @Test(expected=AccessDeniedException.class)
-    public void worksWithAspectJAutoproxy() {
-        setContext(
-                "<global-method-security>" +
-                "  <protect-pointcut expression='execution(* org.springframework.security.config.*Service.*(..))'" +
-                "       access='ROLE_SOMETHING' />" +
-                "</global-method-security>" +
-                "<b:bean id='myUserService' class='org.springframework.security.config.PostProcessedMockUserDetailsService'/>" +
-                "<aop:aspectj-autoproxy />" +
-                "<authentication-provider user-service-ref='myUserService'/>"
-        );
-
-        UserDetailsService service = (UserDetailsService) appContext.getBean("myUserService");
-        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test", "Password",
-                new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_SOMEOTHERROLE")});
-        SecurityContextHolder.getContext().setAuthentication(token);
-
-        service.loadUserByUsername("notused");
-    }
-
-    @Test
-    public void supportsMethodArgumentsInPointcut() {
-        setContext(
-                "<b:bean id='target' class='org.springframework.security.annotation.BusinessServiceImpl'/>" +
-                "<global-method-security>" +
-                "   <protect-pointcut expression='execution(* org.springframework.security.annotation.BusinessService.someOther(String))' access='ROLE_ADMIN'/>" +
-                "   <protect-pointcut expression='execution(* org.springframework.security.annotation.BusinessService.*(..))' access='ROLE_USER'/>" +
-                "</global-method-security>" + ConfigTestUtils.AUTH_PROVIDER_XML
-        );
-        SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken("user", "password"));
-        target = (BusinessService) appContext.getBean("target");
-        // someOther(int) should not be matched by someOther(String), but should require ROLE_USER
-        target.someOther(0);
-
-        try {
-            // String version should required admin role
-            target.someOther("somestring");
-            fail("Expected AccessDeniedException");
-        } catch (AccessDeniedException expected) {
-        }
-    }
-
-    @Test
-    public void supportsBooleanPointcutExpressions() {
-        setContext(
-                "<b:bean id='target' class='org.springframework.security.annotation.BusinessServiceImpl'/>" +
-                "<global-method-security>" +
-                "   <protect-pointcut expression=" +
-                "     'execution(* org.springframework.security.annotation.BusinessService.*(..)) " +
-                "       and not execution(* org.springframework.security.annotation.BusinessService.someOther(String)))' " +
-                "               access='ROLE_USER'/>" +
-                "</global-method-security>" + ConfigTestUtils.AUTH_PROVIDER_XML
-        );
-        target = (BusinessService) appContext.getBean("target");
-        // String method should not be protected
-        target.someOther("somestring");
-
-        // All others should require ROLE_USER
-        try {
-            target.someOther(0);
-            fail("Expected AuthenticationCredentialsNotFoundException");
-        } catch (AuthenticationCredentialsNotFoundException expected) {
-        }
-
-        SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken("user", "password"));
-        target.someOther(0);
-    }
-
-    @Test(expected=BeanDefinitionParsingException.class)
-    public void duplicateElementCausesError() {
-        setContext(
-                "<global-method-security />" +
-                "<global-method-security />"
-        );
-    }
-
-    @Test(expected=AccessDeniedException.class)
-    public void worksWithoutTargetOrClass() {
-        setContext(
-                "<global-method-security secured-annotations='enabled'/>" +
-                "<b:bean id='businessService' class='org.springframework.remoting.httpinvoker.HttpInvokerProxyFactoryBean'>" +
-                "    <b:property name='serviceUrl' value='http://localhost:8080/SomeService'/>" +
-                "    <b:property name='serviceInterface' value='org.springframework.security.annotation.BusinessService'/>" +
-                "</b:bean>" + AUTH_PROVIDER_XML
-                );
-
-        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test", "Password",
-                new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_SOMEOTHERROLE")});
-        SecurityContextHolder.getContext().setAuthentication(token);
-        target = (BusinessService) appContext.getBean("businessService");
-        target.someUserMethod1();
-    }
-
-    private void setContext(String context) {
-        appContext = new InMemoryXmlApplicationContext(context);
-    }
 }
-
-

core-tiger/src/test/java/org/springframework/security/config/Jsr250AnnotationDrivenBeanDefinitionParserTests.java

@@ -3,6 +3,7 @@ package org.springframework.security.config;
 import org.junit.After;
 import org.junit.Before;
 import org.junit.Test;
+import org.springframework.context.support.ClassPathXmlApplicationContext;
 import org.springframework.security.AccessDeniedException;
 import org.springframework.security.AuthenticationCredentialsNotFoundException;
 import org.springframework.security.GrantedAuthority;
@@ -10,23 +11,19 @@ import org.springframework.security.GrantedAuthorityImpl;
 import org.springframework.security.annotation.BusinessService;
 import org.springframework.security.context.SecurityContextHolder;
 import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
-import org.springframework.security.util.InMemoryXmlApplicationContext;
 
 /**
  * @author Luke Taylor
  * @version $Id$
  */
 public class Jsr250AnnotationDrivenBeanDefinitionParserTests {
-    private InMemoryXmlApplicationContext appContext;
+    private ClassPathXmlApplicationContext appContext;
 
     private BusinessService target;
 
     @Before
     public void loadContext() {
-        appContext = new InMemoryXmlApplicationContext(
-                "<b:bean id='target' class='org.springframework.security.annotation.Jsr250BusinessServiceImpl'/>" +
-                "<global-method-security jsr250-annotations='enabled'/>" + ConfigTestUtils.AUTH_PROVIDER_XML
-                );
+        appContext = new ClassPathXmlApplicationContext("/org/springframework/security/config/jsr250-annotated-method-security.xml");
         target = (BusinessService) appContext.getBean("target");
     }
 
@@ -51,7 +48,7 @@ public class Jsr250AnnotationDrivenBeanDefinitionParserTests {
 
         target.someOther(0);
     }
-
+    
     @Test
     public void targetShouldAllowProtectedMethodInvocationWithCorrectRole() {
         UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test", "Password",
@@ -69,4 +66,4 @@ public class Jsr250AnnotationDrivenBeanDefinitionParserTests {
 
         target.someAdminMethod();
     }
-}
+}

core-tiger/src/test/java/org/springframework/security/config/SecuredAnnotationDrivenBeanDefinitionParserTests.java

@@ -3,6 +3,7 @@ package org.springframework.security.config;
 import org.junit.After;
 import org.junit.Before;
 import org.junit.Test;
+import org.springframework.context.support.ClassPathXmlApplicationContext;
 import org.springframework.security.AccessDeniedException;
 import org.springframework.security.AuthenticationCredentialsNotFoundException;
 import org.springframework.security.GrantedAuthority;
@@ -10,23 +11,19 @@ import org.springframework.security.GrantedAuthorityImpl;
 import org.springframework.security.annotation.BusinessService;
 import org.springframework.security.context.SecurityContextHolder;
 import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
-import org.springframework.security.util.InMemoryXmlApplicationContext;
 
 /**
  * @author Ben Alex
  * @version $Id$
  */
 public class SecuredAnnotationDrivenBeanDefinitionParserTests {
-    private InMemoryXmlApplicationContext appContext;
+    private ClassPathXmlApplicationContext appContext;
 
     private BusinessService target;
 
     @Before
     public void loadContext() {
-        appContext = new InMemoryXmlApplicationContext(
-                "<b:bean id='target' class='org.springframework.security.annotation.Jsr250BusinessServiceImpl'/>" +
-                "<global-method-security secured-annotations='enabled'/>" + ConfigTestUtils.AUTH_PROVIDER_XML
-                );
+        appContext = new ClassPathXmlApplicationContext("org/springframework/security/config/secured-annotated-method-security.xml");
         target = (BusinessService) appContext.getBean("target");
     }
 

core-tiger/src/test/resources/log4j.properties

@@ -1,12 +0,0 @@
-# Logging
-#
-# $Id: log4j.properties 2385 2007-12-20 20:53:26Z luke_t $
-
-log4j.rootCategory=DEBUG, stdout
-
-log4j.appender.stdout=org.apache.log4j.ConsoleAppender
-log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
-log4j.appender.stdout.layout.ConversionPattern=%d %p %c - %m%n
-
-log4j.category.org.springframework.security=DEBUG
-

core-tiger/src/test/resources/org/springframework/security/config/global-method-security.xml

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<b:beans xmlns="http://www.springframework.org/schema/security"
+    xmlns:b="http://www.springframework.org/schema/beans"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
+http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd">
+
+    <b:bean id="target" class="org.springframework.security.annotation.BusinessServiceImpl"/>
+
+	<global-method-security>
+		<protect-pointcut expression="execution(* *.someUser*(..))" access="ROLE_USER"/>
+		<protect-pointcut expression="execution(* *.someAdmin*(..))" access="ROLE_ADMIN"/>
+	</global-method-security>
+
+    <authentication-provider>
+        <user-service>
+            <user name="bob" password="bobspassword" authorities="ROLE_A,ROLE_B" />
+            <user name="bill" password="billspassword" authorities="ROLE_A,ROLE_B,AUTH_OTHER" />
+        </user-service>
+    </authentication-provider>
+
+</b:beans>

core-tiger/src/test/resources/org/springframework/security/config/jsr250-annotated-method-security.xml

@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<b:beans xmlns="http://www.springframework.org/schema/security"
+    xmlns:b="http://www.springframework.org/schema/beans"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
+http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd">
+
+    <b:bean id="target" class="org.springframework.security.annotation.Jsr250BusinessServiceImpl"/>
+
+	<global-method-security jsr250-annotations="enabled"/>
+
+    <authentication-provider>
+        <user-service>
+            <user name="bob" password="bobspassword" authorities="ROLE_A,ROLE_B" />
+            <user name="bill" password="billspassword" authorities="ROLE_A,ROLE_B,AUTH_OTHER" />
+        </user-service>
+    </authentication-provider>
+
+</b:beans>

core-tiger/src/test/resources/org/springframework/security/config/secured-annotated-method-security.xml

@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<b:beans xmlns="http://www.springframework.org/schema/security"
+    xmlns:b="http://www.springframework.org/schema/beans"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
+http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd">
+
+    <b:bean id="target" class="org.springframework.security.annotation.Jsr250BusinessServiceImpl"/>
+
+	<global-method-security secured-annotations="enabled"/>
+
+    <authentication-provider>
+        <user-service>
+            <user name="bob" password="bobspassword" authorities="ROLE_A,ROLE_B" />
+            <user name="bill" password="billspassword" authorities="ROLE_A,ROLE_B,AUTH_OTHER" />
+        </user-service>
+    </authentication-provider>
+
+</b:beans>

core/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-parent</artifactId>
-        <version>2.0.4</version>
+        <version>2.0.0</version>
     </parent>
     <packaging>bundle</packaging>
     <artifactId>spring-security-core</artifactId>
@@ -141,58 +141,34 @@
             <optional>true</optional>
         </dependency>
     </dependencies>
-    
-    <properties>
-      	<spring.osgi.export>
-      	    org.springframework.security.*;version=${pom.version}
-      	</spring.osgi.export>
 
-    	<spring.osgi.import>
-    	    !com.ibm.websphere.security,
-            javax.servlet.*;version="[2.4.0, 3.0.0)";resolution:=optional,
-            net.sf.ehcache.*;version="[1.4.1, 2.0.0)";resolution:=optional,
-            org.aopalliance.*;version="[1.0.0, 2.0.0)",
-            org.apache.commons.codec.*;version="[1.3.0, 2.0.0)",
-            org.apache.commons.collections.*;version="[3.2.0, 4.0.0)",
-            org.apache.commons.lang.*;version="[2.1.0, 3.0.0)",
-            org.apache.commons.logging.*;version="[1.1.1, 2.0.0)",
-            org.apache.directory.server.configuration.*;version="[1.0.2, 2.0.0)";resolution:=optional,
-            org.apache.directory.server.core.*;version="[1.0.2, 2.0.0)";resolution:=optional,
-            org.apache.directory.server.protocol.*;version="[1.0.2, 2.0.0)";resolution:=optional,
-            org.aspectj.*;version="[1.5.4, 2.0.0)";resolution:=optional,
-            org.jaxen.*;version="[1.1.1, 2.0.0)";resolution:=optional,
-            org.springframework.aop.*;version="${spring.version.osgi}",
-            org.springframework.beans.*;version="${spring.version.osgi}",
-            org.springframework.context.*;version="${spring.version.osgi}",
-            org.springframework.core.*;version="${spring.version.osgi}",
-            org.springframework.dao.*;version="${spring.version.osgi}";resolution:=optional,
-            org.springframework.jdbc.*;version="${spring.version.osgi}";resolution:=optional,
-            org.springframework.ldap.*;version="[1.2.1.A, 2.0.0)";resolution:=optional,
-            org.springframework.metadata.*;version="${spring.version.osgi}",
-            org.springframework.mock.*;version="${spring.version.osgi}";resolution:=optional,
-            org.springframework.remoting.*;version="${spring.version.osgi}";resolution:=optional,
-            org.springframework.util.*;version="${spring.version.osgi}",
-            org.springframework.web.*;version="${spring.version.osgi}";resolution:=optional,
-            javax.crypto.*,
-            javax.naming.*,
-            javax.rmi.*,
-            javax.security.*,
-            javax.sql.*,
-            javax.xml.parsers.*,
-            org.w3c.dom.*,
-            org.xml.sax.*,            
-        	*;resolution:=optional    	    
-    	</spring.osgi.import>
-
-    	<spring.osgi.private.pkg>
-    	    !org.springframework.security.*
-    	</spring.osgi.private.pkg>
-<!--    	
-    	<spring.osgi.include.res>
-    	    src/main/resources
-    	</spring.osgi.include.res>
--->
-    	<spring.osgi.symbolic.name>org.springframework.security.core</spring.osgi.symbolic.name>        
-    </properties>
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.felix</groupId>
+                <artifactId>maven-bundle-plugin</artifactId>
+                <version>${felix.version}</version>
+                <extensions>true</extensions>
+                <configuration>
+                    <instructions>
+                        <Bundle-SymbolicName>org.springframework.bundle.security.core</Bundle-SymbolicName>
+                        <Export-Package>org.springframework.security.*;version=${pom.version}</Export-Package>
+                        <Private-Package>!org.springframework.security.*</Private-Package>
+                        <Implementation-Title>${pom.name}</Implementation-Title>
+                        <Implementation-Version>${pom.version}</Implementation-Version>
+                        <Import-Package>
+                            org.springframework*;resolution:=optional;version="[2.0,2.6)",
+                        	*;resolution:=optional
+                        </Import-Package>
+<!--                         
+                        <Embed-Dependency>
+                        	*;scope=compile|runtime;inline=true
+                        </Embed-Dependency>
+ -->                        
+                    </instructions>
+                </configuration>
+            </plugin>            
+        </plugins>
+    </build>
 
 </project>

core/src/main/java/org/springframework/security/ConfigAttributeDefinition.java

@@ -158,7 +158,8 @@ public class ConfigAttributeDefinition implements Serializable {
      * Allows <code>AccessDecisionManager</code>s and other classes to loop through every configuration attribute
      * associated with a target secure object.
      *
-     * @return the configuration attributes stored in this instance.
+     * @return all the configuration attributes stored by the instance, or <code>null</code> if an
+     *         <code>Iterator</code> is unavailable
      */
     public Collection getConfigAttributes() {
         return this.configAttributes;

core/src/main/java/org/springframework/security/GrantedAuthorityImpl.java

@@ -21,13 +21,8 @@ import org.springframework.util.Assert;
 
 
 /**
- * Basic concrete implementation of a {@link GrantedAuthority}.
- * 
- * <p>
- * Stores a <code>String</code> representation of an authority granted to  the {@link Authentication} object.
- * <p>
- * If compared to a custom authority which returns null from {@link #getAuthority}, the <tt>compareTo</tt> 
- * method will return -1, so the custom authority will take precedence.
+ * Basic concrete implementation of a {@link GrantedAuthority}.<p>Stores a <code>String</code> representation of an
+ * authority granted to  the {@link Authentication} object.</p>
  *
  * @author Ben Alex
  * @version $Id$
@@ -41,6 +36,7 @@ public class GrantedAuthorityImpl implements GrantedAuthority, Serializable {
     //~ Constructors ===================================================================================================
 
     public GrantedAuthorityImpl(String role) {
+        super();
         Assert.hasText(role, "A granted authority textual representation is required");
         this.role = role;
     }
@@ -75,13 +71,8 @@ public class GrantedAuthorityImpl implements GrantedAuthority, Serializable {
 
 	public int compareTo(Object o) {
 		if (o != null && o instanceof GrantedAuthority) {
-			String rhsRole = ((GrantedAuthority) o).getAuthority();
-			
-			if (rhsRole == null) {
-				return -1;
-			}
-			
-			return role.compareTo(rhsRole);
+			GrantedAuthority rhs = (GrantedAuthority) o;
+			return this.role.compareTo(rhs.getAuthority());
 		}
 		return -1;
 	}

core/src/main/java/org/springframework/security/authoritymapping/MapBasedAttributes2GrantedAuthoritiesMapper.java

@@ -1,167 +0,0 @@
-package org.springframework.security.authoritymapping;
-
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.HashMap;
-import java.util.Iterator;
-import java.util.List;
-import java.util.Map;
-import java.util.StringTokenizer;
-
-import org.springframework.beans.factory.InitializingBean;
-import org.springframework.security.GrantedAuthority;
-import org.springframework.security.GrantedAuthorityImpl;
-import org.springframework.util.Assert;
-import org.springframework.util.StringUtils;
-
-
-/**
- * <p>
- * This class implements the Attributes2GrantedAuthoritiesMapper and
- * MappableAttributesRetriever interfaces based on the supplied Map.
- * It supports both one-to-one and one-to-many mappings. The granted
- * authorities to map to can be supplied either as a String or as a
- * GrantedAuthority object.
- * </p>
- * @author Ruud Senden
- */
-public class MapBasedAttributes2GrantedAuthoritiesMapper implements Attributes2GrantedAuthoritiesMapper, MappableAttributesRetriever, InitializingBean {
-	private Map attributes2grantedAuthoritiesMap = null;
-	private String stringSeparator = ",";
-	private String[] mappableAttributes = null;
-
-	/**
-	 * Check whether all properties have been set to correct values, and do some preprocessing.
-	 */
-	public void afterPropertiesSet() {
-		Assert.notEmpty(attributes2grantedAuthoritiesMap,"A non-empty attributes2grantedAuthoritiesMap must be supplied");
-		attributes2grantedAuthoritiesMap = preProcessMap(attributes2grantedAuthoritiesMap);
-		try {
-			mappableAttributes = (String[])attributes2grantedAuthoritiesMap.keySet().toArray(new String[]{});
-		} catch ( ArrayStoreException ase ) {
-			throw new IllegalArgumentException("attributes2grantedAuthoritiesMap contains non-String objects as keys");
-		}
-	}
-
-	/**
-	 * Preprocess the given map
-	 * @param orgMap The map to process
-	 * @return the processed Map
-	 */
-	private Map preProcessMap(Map orgMap) {
-		Map result = new HashMap(orgMap.size());
-		Iterator it = orgMap.entrySet().iterator();
-		while ( it.hasNext() ) {
-			Map.Entry entry = (Map.Entry)it.next();
-			result.put(entry.getKey(),getGrantedAuthorityCollection(entry.getValue()));
-		}
-		return result;
-	}
-
-	/**
-	 * Convert the given value to a collection of Granted Authorities
-	 *
-	 * @param value
-	 *            The value to convert to a GrantedAuthority Collection
-	 * @return Collection containing the GrantedAuthority Collection
-	 */
-	private Collection getGrantedAuthorityCollection(Object value) {
-		Collection result = new ArrayList();
-		addGrantedAuthorityCollection(result,value);
-		return result;
-	}
-
-	/**
-	 * Convert the given value to a collection of Granted Authorities,
-	 * adding the result to the given result collection.
-	 *
-	 * @param value
-	 *            The value to convert to a GrantedAuthority Collection
-	 * @return Collection containing the GrantedAuthority Collection
-	 */
-	private void addGrantedAuthorityCollection(Collection result, Object value) {
-		if ( value != null ) {
-			if ( value instanceof Collection ) {
-				addGrantedAuthorityCollection(result,(Collection)value);
-			} else if ( value instanceof Object[] ) {
-				addGrantedAuthorityCollection(result,(Object[])value);
-			} else if ( value instanceof String ) {
-				addGrantedAuthorityCollection(result,(String)value);
-			} else if ( value instanceof GrantedAuthority ) {
-				result.add(value);
-			} else {
-				throw new IllegalArgumentException("Invalid object type: "+value.getClass().getName());
-			}
-		}
-	}
-
-	private void addGrantedAuthorityCollection(Collection result, Collection value) {
-		Iterator it = value.iterator();
-		while ( it.hasNext() ) {
-			addGrantedAuthorityCollection(result,it.next());
-		}
-	}
-
-	private void addGrantedAuthorityCollection(Collection result, Object[] value) {
-		for ( int i = 0 ; i < value.length ; i++ ) {
-			addGrantedAuthorityCollection(result,value[i]);
-		}
-	}
-
-	private void addGrantedAuthorityCollection(Collection result, String value) {
-		StringTokenizer st = new StringTokenizer(value,stringSeparator,false);
-		while ( st.hasMoreTokens() ) {
-			String nextToken = st.nextToken();
-			if ( StringUtils.hasText(nextToken) ) {
-				result.add(new GrantedAuthorityImpl(nextToken));
-			}
-		}
-	}
-
-	/**
-	 * Map the given array of attributes to Spring Security GrantedAuthorities.
-	 */
-	public GrantedAuthority[] getGrantedAuthorities(String[] attributes) {
-		List gaList = new ArrayList();
-		for (int i = 0; i < attributes.length; i++) {
-			Collection c = (Collection)attributes2grantedAuthoritiesMap.get(attributes[i]);
-			if ( c != null ) { gaList.addAll(c); }
-		}
-		GrantedAuthority[] result = new GrantedAuthority[gaList.size()];
-		result = (GrantedAuthority[])gaList.toArray(result);
-		return result;
-	}
-
-	/**
-	 * @return Returns the attributes2grantedAuthoritiesMap.
-	 */
-	public Map getAttributes2grantedAuthoritiesMap() {
-		return attributes2grantedAuthoritiesMap;
-	}
-	/**
-	 * @param attributes2grantedAuthoritiesMap The attributes2grantedAuthoritiesMap to set.
-	 */
-	public void setAttributes2grantedAuthoritiesMap(Map attributes2grantedAuthoritiesMap) {
-		this.attributes2grantedAuthoritiesMap = attributes2grantedAuthoritiesMap;
-	}
-
-	/**
-	 *
-	 * @see org.springframework.security.authoritymapping.MappableAttributesRetriever#getMappableAttributes()
-	 */
-	public String[] getMappableAttributes() {
-		return mappableAttributes;
-	}
-	/**
-	 * @return Returns the stringSeparator.
-	 */
-	public String getStringSeparator() {
-		return stringSeparator;
-	}
-	/**
-	 * @param stringSeparator The stringSeparator to set.
-	 */
-	public void setStringSeparator(String stringSeparator) {
-		this.stringSeparator = stringSeparator;
-	}
-}

core/src/main/java/org/springframework/security/authoritymapping/SimpleAttributes2GrantedAuthoritiesMapper.java

@@ -90,7 +90,7 @@ public class SimpleAttributes2GrantedAuthoritiesMapper implements Attributes2Gra
         return attributePrefix == null ? "" : attributePrefix;
     }
 
-    public void setAttributePrefix(String string) {
+    public void seAttributePrefix(String string) {
         attributePrefix = string;
     }
 

core/src/main/java/org/springframework/security/concurrent/ConcurrentSessionControllerImpl.java

@@ -158,8 +158,4 @@ public class ConcurrentSessionControllerImpl implements ConcurrentSessionControl
     public void setSessionRegistry(SessionRegistry sessionRegistry) {
         this.sessionRegistry = sessionRegistry;
     }
-
-	public SessionRegistry getSessionRegistry() {
-		return sessionRegistry;
-	}
 }

core/src/main/java/org/springframework/security/concurrent/ConcurrentSessionFilter.java

@@ -21,7 +21,6 @@ import org.springframework.security.ui.FilterChainOrder;
 import org.springframework.security.ui.SpringSecurityFilter;
 import org.springframework.security.ui.logout.LogoutHandler;
 import org.springframework.security.ui.logout.SecurityContextLogoutHandler;
-import org.springframework.security.util.UrlUtils;
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.util.Assert;
 
@@ -61,7 +60,6 @@ public class ConcurrentSessionFilter extends SpringSecurityFilter implements Ini
 
     public void afterPropertiesSet() throws Exception {
         Assert.notNull(sessionRegistry, "SessionRegistry required");
-        Assert.isTrue(UrlUtils.isValidRedirectUrl(expiredUrl), expiredUrl + " isn't a valid redirect URL");
     }
 
     public void doFilterHttp(HttpServletRequest request, HttpServletResponse response, FilterChain chain)

core/src/main/java/org/springframework/security/config/AbstractUserDetailsServiceBeanDefinitionParser.java

@@ -23,12 +23,12 @@ public abstract class AbstractUserDetailsServiceBeanDefinitionParser implements
 	/**  UserDetailsService bean Id. For use in a stateful context (i.e. in AuthenticationProviderBDP) */
 	private String id;
 	
-	protected abstract String getBeanClassName(Element element);
+	protected abstract Class getBeanClass(Element element);
 	
     protected abstract void doParse(Element element, ParserContext parserContext, BeanDefinitionBuilder builder);	
 	
 	public BeanDefinition parse(Element element, ParserContext parserContext) {
-		BeanDefinitionBuilder builder = BeanDefinitionBuilder.rootBeanDefinition(getBeanClassName(element)); 
+		BeanDefinitionBuilder builder = BeanDefinitionBuilder.rootBeanDefinition(getBeanClass(element)); 
 		
 		doParse(element, parserContext, builder);
 		

core/src/main/java/org/springframework/security/config/AnonymousBeanDefinitionParser.java

@@ -3,7 +3,6 @@ package org.springframework.security.config;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.beans.factory.config.BeanDefinition;
-import org.springframework.beans.factory.config.RuntimeBeanReference;
 import org.springframework.beans.factory.parsing.BeanComponentDefinition;
 import org.springframework.beans.factory.support.ManagedList;
 import org.springframework.beans.factory.support.RootBeanDefinition;
@@ -61,16 +60,16 @@ public class AnonymousBeanDefinitionParser implements BeanDefinitionParser {
         filter.getPropertyValues().addPropertyValue("userAttribute", username + "," + grantedAuthority);
         filter.getPropertyValues().addPropertyValue(ATT_KEY, key);
 
+        BeanDefinition authManager = ConfigUtils.registerProviderManagerIfNecessary(parserContext);
         RootBeanDefinition provider = new RootBeanDefinition(AnonymousAuthenticationProvider.class);
         provider.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
         provider.setSource(source);
         provider.getPropertyValues().addPropertyValue(ATT_KEY, key);
-        
-        parserContext.getRegistry().registerBeanDefinition(BeanIds.ANONYMOUS_AUTHENTICATION_PROVIDER, provider);
-        ConfigUtils.addAuthenticationProvider(parserContext, BeanIds.ANONYMOUS_AUTHENTICATION_PROVIDER);
+
+        ManagedList authMgrProviderList = (ManagedList) authManager.getPropertyValues().getPropertyValue("providers").getValue();
+        authMgrProviderList.add(provider);
 
         parserContext.getRegistry().registerBeanDefinition(BeanIds.ANONYMOUS_PROCESSING_FILTER, filter);
-        ConfigUtils.addHttpFilter(parserContext, new RuntimeBeanReference(BeanIds.ANONYMOUS_PROCESSING_FILTER));
         parserContext.registerComponent(new BeanComponentDefinition(filter, BeanIds.ANONYMOUS_PROCESSING_FILTER));
         
         return null;

core/src/main/java/org/springframework/security/config/AuthenticationManagerBeanDefinitionParser.java

@@ -1,52 +1,32 @@
 package org.springframework.security.config;
 
-import org.springframework.beans.factory.support.RootBeanDefinition;
 import org.springframework.beans.factory.xml.BeanDefinitionParser;
 import org.springframework.beans.factory.xml.ParserContext;
 import org.springframework.beans.factory.config.BeanDefinition;
-import org.springframework.beans.factory.config.RuntimeBeanReference;
 import org.springframework.util.StringUtils;
 
 import org.w3c.dom.Element;
 
 /**
- * Registers an alias name for the default ProviderManager used by the namespace
+ * Just registers an alias name for the default ProviderManager used by the namespace
  * configuration, allowing users to reference it in their beans and clearly see where the name is
- * coming from. Also allows the ConcurrentSessionController to be set on the ProviderManager.
+ * coming from.
  *
  * @author Luke Taylor
  * @version $Id$
  */
 public class AuthenticationManagerBeanDefinitionParser implements BeanDefinitionParser {
-    private static final String ATT_SESSION_CONTROLLER_REF = "session-controller-ref";
-	private static final String ATT_ALIAS = "alias";
+    private static final String ATT_ALIAS = "alias";
 
     public BeanDefinition parse(Element element, ParserContext parserContext) {
-    	ConfigUtils.registerProviderManagerIfNecessary(parserContext);
-    	
         String alias = element.getAttribute(ATT_ALIAS);
 
         if (!StringUtils.hasText(alias)) {
             parserContext.getReaderContext().error(ATT_ALIAS + " is required.", element );
         }
-        
-        String sessionControllerRef = element.getAttribute(ATT_SESSION_CONTROLLER_REF);
-        
-        if (StringUtils.hasText(sessionControllerRef)) {
-        	BeanDefinition authManager = parserContext.getRegistry().getBeanDefinition(BeanIds.AUTHENTICATION_MANAGER);
-            ConfigUtils.setSessionControllerOnAuthenticationManager(parserContext, 
-            		BeanIds.CONCURRENT_SESSION_CONTROLLER, element);
-        	authManager.getPropertyValues().addPropertyValue("sessionController", 
-        			new RuntimeBeanReference(sessionControllerRef));
-            RootBeanDefinition sessionRegistryInjector = new RootBeanDefinition(SessionRegistryInjectionBeanPostProcessor.class);
-            sessionRegistryInjector.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
-            sessionRegistryInjector.getConstructorArgumentValues().addGenericArgumentValue(sessionControllerRef);
-        	
-        	parserContext.getRegistry().registerBeanDefinition(BeanIds.SESSION_REGISTRY_INJECTION_POST_PROCESSOR, sessionRegistryInjector);
-        }
 
         parserContext.getRegistry().registerAlias(BeanIds.AUTHENTICATION_MANAGER, alias);
 
         return null;
-    }    
+    }
 }

core/src/main/java/org/springframework/security/config/AuthenticationProviderBeanDefinitionParser.java

@@ -94,7 +94,7 @@ class AuthenticationProviderBeanDefinitionParser implements BeanDefinitionParser
         parserContext.getRegistry().registerBeanDefinition(name , cacheResolver);
         parserContext.registerComponent(new BeanComponentDefinition(cacheResolver, name));
         
-        ConfigUtils.addAuthenticationProvider(parserContext, id);        
+        ConfigUtils.getRegisteredProviders(parserContext).add(new RuntimeBeanReference(id));        
         
         return null;
     }

core/src/main/java/org/springframework/security/config/BasicAuthenticationBeanDefinitionParser.java

@@ -41,7 +41,6 @@ public class BasicAuthenticationBeanDefinitionParser implements BeanDefinitionPa
 
 	    parserContext.getRegistry().registerBeanDefinition(BeanIds.BASIC_AUTHENTICATION_FILTER,
 	            filterBuilder.getBeanDefinition());
-	    ConfigUtils.addHttpFilter(parserContext, new RuntimeBeanReference(BeanIds.BASIC_AUTHENTICATION_FILTER));
 	    parserContext.registerComponent(new BeanComponentDefinition(filterBuilder.getBeanDefinition(), 
 	    		BeanIds.BASIC_AUTHENTICATION_FILTER));
 	    return null;

core/src/main/java/org/springframework/security/config/BeanIds.java

@@ -16,11 +16,8 @@ public abstract class BeanIds {
     /** Package protected as end users shouldn't really be using this BFPP directly */
 	static final String INTERCEPT_METHODS_BEAN_FACTORY_POST_PROCESSOR = "_interceptMethodsBeanfactoryPP";
     static final String CONTEXT_SOURCE_SETTING_POST_PROCESSOR = "_contextSettingPostProcessor";
-    static final String ENTRY_POINT_INJECTION_POST_PROCESSOR = "_entryPointInjectionBeanPostProcessor";
-    static final String USER_DETAILS_SERVICE_INJECTION_POST_PROCESSOR = "_userServiceInjectionPostProcessor";
-    static final String SESSION_REGISTRY_INJECTION_POST_PROCESSOR = "_sessionRegistryInjectionPostProcessor";    
+    static final String HTTP_POST_PROCESSOR = "_httpConfigBeanFactoryPostProcessor";
     static final String FILTER_CHAIN_POST_PROCESSOR = "_filterChainProxyPostProcessor";
-    static final String FILTER_LIST = "_filterChainList";
 
     public static final String JDBC_USER_DETAILS_MANAGER = "_jdbcUserDetailsManager";
 	public static final String USER_DETAILS_SERVICE = "_userDetailsService";
@@ -33,7 +30,6 @@ public abstract class BeanIds {
 	public static final String CONCURRENT_SESSION_CONTROLLER = "_concurrentSessionController";
 	public static final String ACCESS_MANAGER = "_accessManager";
 	public static final String AUTHENTICATION_MANAGER = "_authenticationManager";
-	public static final String AFTER_INVOCATION_MANAGER = "_afterInvocationManager";	
 	public static final String FORM_LOGIN_FILTER = "_formLoginFilter";
 	public static final String FORM_LOGIN_ENTRY_POINT = "_formLoginEntryPoint";
 	public static final String OPEN_ID_FILTER = "_openIDFilter";
@@ -42,7 +38,6 @@ public abstract class BeanIds {
 	public static final String MAIN_ENTRY_POINT = "_mainEntryPoint";	
 	public static final String FILTER_CHAIN_PROXY = "_filterChainProxy";
 	public static final String HTTP_SESSION_CONTEXT_INTEGRATION_FILTER = "_httpSessionContextIntegrationFilter";
-	public static final String LDAP_AUTHENTICATION_PROVIDER = "_ldapAuthenticationProvider";	
 	public static final String LOGOUT_FILTER = "_logoutFilter";
 	public static final String EXCEPTION_TRANSLATION_FILTER = "_exceptionTranslationFilter";
 	public static final String FILTER_SECURITY_INTERCEPTOR = "_filterSecurityInterceptor";
@@ -50,12 +45,10 @@ public abstract class BeanIds {
 	public static final String CHANNEL_DECISION_MANAGER = "_channelDecisionManager";
 	public static final String REMEMBER_ME_FILTER = "_rememberMeFilter";
 	public static final String REMEMBER_ME_SERVICES = "_rememberMeServices";
-	public static final String REMEMBER_ME_AUTHENTICATION_PROVIDER = "_rememberMeAuthenticationProvider";
 	public static final String DEFAULT_LOGIN_PAGE_GENERATING_FILTER = "_defaultLoginPageFilter";
 	public static final String SECURITY_CONTEXT_HOLDER_AWARE_REQUEST_FILTER = "_securityContextHolderAwareRequestFilter";
 	public static final String SESSION_FIXATION_PROTECTION_FILTER = "_sessionFixationProtectionFilter";	
 	public static final String METHOD_SECURITY_INTERCEPTOR = "_methodSecurityInterceptor";
-	public static final String METHOD_SECURITY_INTERCEPTOR_POST_PROCESSOR = "_methodSecurityInterceptorPostProcessor";	
 	public static final String METHOD_DEFINITION_SOURCE_ADVISOR = "_methodDefinitionSourceAdvisor";
 	public static final String PROTECT_POINTCUT_POST_PROCESSOR = "_protectPointcutPostProcessor";
 	public static final String DELEGATING_METHOD_DEFINITION_SOURCE = "_delegatingMethodDefinitionSource";
@@ -65,7 +58,7 @@ public abstract class BeanIds {
     public static final String CONTEXT_SOURCE = "_securityContextSource";
     public static final String PORT_MAPPER = "_portMapper";
     public static final String X509_FILTER = "_x509ProcessingFilter";
-    public static final String X509_AUTH_PROVIDER = "_x509AuthenticationProvider";
+    public static final String X509_AUTH_PROVIDER = "_x509AuthenitcationProvider";
     public static final String PRE_AUTH_ENTRY_POINT = "_preAuthenticatedProcessingFilterEntryPoint";
     public static final String REMEMBER_ME_SERVICES_INJECTION_POST_PROCESSOR = "_rememberMeServicesInjectionBeanPostProcessor";
 }

core/src/main/java/org/springframework/security/config/ConcurrentSessionsBeanDefinitionParser.java

@@ -29,8 +29,7 @@ public class ConcurrentSessionsBeanDefinitionParser implements BeanDefinitionPar
     static final String ATT_EXPIRY_URL = "expired-url";
     static final String ATT_MAX_SESSIONS = "max-sessions";
     static final String ATT_EXCEPTION_IF_MAX_EXCEEDED = "exception-if-maximum-exceeded";
-    static final String ATT_SESSION_REGISTRY_ALIAS = "session-registry-alias";
-    static final String ATT_SESSION_REGISTRY_REF = "session-registry-ref";
+    static final String ATT_SESSION_REGISTRY_ALIAS = "session-registry-alias";    
 	
     public BeanDefinition parse(Element element, ParserContext parserContext) {
     	CompositeComponentDefinition compositeDef =
@@ -39,43 +38,25 @@ public class ConcurrentSessionsBeanDefinitionParser implements BeanDefinitionPar
     	
     	BeanDefinitionRegistry beanRegistry = parserContext.getRegistry();
 
-        String sessionRegistryId = element.getAttribute(ATT_SESSION_REGISTRY_REF);
-        
-        if (!StringUtils.hasText(sessionRegistryId)) {        	
-            RootBeanDefinition sessionRegistry = new RootBeanDefinition(SessionRegistryImpl.class);        
-            beanRegistry.registerBeanDefinition(BeanIds.SESSION_REGISTRY, sessionRegistry);
-            parserContext.registerComponent(new BeanComponentDefinition(sessionRegistry, BeanIds.SESSION_REGISTRY));
-            sessionRegistryId = BeanIds.SESSION_REGISTRY;
-        } else {
-        	// Register the default ID as an alias so that things like session fixation filter can access it
-        	beanRegistry.registerAlias(sessionRegistryId, BeanIds.SESSION_REGISTRY);
-        }
-
-        String registryAlias = element.getAttribute(ATT_SESSION_REGISTRY_ALIAS);
-        if (StringUtils.hasText(registryAlias)) {
-        	beanRegistry.registerAlias(sessionRegistryId, registryAlias);
-        }    	
-
+        RootBeanDefinition sessionRegistry = new RootBeanDefinition(SessionRegistryImpl.class);
         BeanDefinitionBuilder filterBuilder =
                 BeanDefinitionBuilder.rootBeanDefinition(ConcurrentSessionFilter.class);
-        filterBuilder.addPropertyValue("sessionRegistry", new RuntimeBeanReference(sessionRegistryId));
+        BeanDefinitionBuilder controllerBuilder
+                = BeanDefinitionBuilder.rootBeanDefinition(ConcurrentSessionControllerImpl.class);
+        controllerBuilder.addPropertyValue("sessionRegistry", new RuntimeBeanReference(BeanIds.SESSION_REGISTRY));
+        filterBuilder.addPropertyValue("sessionRegistry", new RuntimeBeanReference(BeanIds.SESSION_REGISTRY));
 
         Object source = parserContext.extractSource(element);
         filterBuilder.setSource(source);
         filterBuilder.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
-
+        controllerBuilder.setSource(source);
+        controllerBuilder.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
+        
         String expiryUrl = element.getAttribute(ATT_EXPIRY_URL);
 
         if (StringUtils.hasText(expiryUrl)) {
-        	ConfigUtils.validateHttpRedirect(expiryUrl, parserContext, source);
             filterBuilder.addPropertyValue("expiredUrl", expiryUrl);
-        }        
-
-        BeanDefinitionBuilder controllerBuilder
-        	= BeanDefinitionBuilder.rootBeanDefinition(ConcurrentSessionControllerImpl.class);
-        controllerBuilder.setSource(source);
-        controllerBuilder.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);        
-        controllerBuilder.addPropertyValue("sessionRegistry", new RuntimeBeanReference(sessionRegistryId));
+        }
 
         String maxSessions = element.getAttribute(ATT_MAX_SESSIONS);
 
@@ -90,14 +71,22 @@ public class ConcurrentSessionsBeanDefinitionParser implements BeanDefinitionPar
         }
 
         BeanDefinition controller = controllerBuilder.getBeanDefinition();
+        beanRegistry.registerBeanDefinition(BeanIds.SESSION_REGISTRY, sessionRegistry);
+        parserContext.registerComponent(new BeanComponentDefinition(sessionRegistry, BeanIds.SESSION_REGISTRY));
         
+        String registryAlias = element.getAttribute(ATT_SESSION_REGISTRY_ALIAS);
+        if (StringUtils.hasText(registryAlias)) {
+        	beanRegistry.registerAlias(BeanIds.SESSION_REGISTRY, registryAlias);
+        }
+
         beanRegistry.registerBeanDefinition(BeanIds.CONCURRENT_SESSION_CONTROLLER, controller);
         parserContext.registerComponent(new BeanComponentDefinition(controller, BeanIds.CONCURRENT_SESSION_CONTROLLER));
         beanRegistry.registerBeanDefinition(BeanIds.CONCURRENT_SESSION_FILTER, filterBuilder.getBeanDefinition());
         parserContext.registerComponent(new BeanComponentDefinition(filterBuilder.getBeanDefinition(), BeanIds.CONCURRENT_SESSION_FILTER));
-        ConfigUtils.addHttpFilter(parserContext, new RuntimeBeanReference(BeanIds.CONCURRENT_SESSION_FILTER));
         
-        ConfigUtils.setSessionControllerOnAuthenticationManager(parserContext, BeanIds.CONCURRENT_SESSION_CONTROLLER, element);
+        BeanDefinition providerManager = ConfigUtils.registerProviderManagerIfNecessary(parserContext);
+
+        providerManager.getPropertyValues().addPropertyValue("sessionController", controller);
         
         parserContext.popAndRegisterContainingComponent();
         

core/src/main/java/org/springframework/security/config/ConfigUtils.java

@@ -1,26 +1,23 @@
 package org.springframework.security.config;
 
-import java.util.ArrayList;
-import java.util.List;
+import java.util.Map;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
-import org.springframework.beans.BeanMetadataElement;
-import org.springframework.beans.MutablePropertyValues;
-import org.springframework.beans.PropertyValue;
 import org.springframework.beans.factory.config.BeanDefinition;
+import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
 import org.springframework.beans.factory.config.RuntimeBeanReference;
 import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.support.ManagedList;
 import org.springframework.beans.factory.support.RootBeanDefinition;
 import org.springframework.beans.factory.xml.ParserContext;
-import org.springframework.security.afterinvocation.AfterInvocationProviderManager;
-import org.springframework.security.util.UrlUtils;
+import org.springframework.security.AuthenticationManager;
+import org.springframework.security.providers.ProviderManager;
+import org.springframework.security.userdetails.UserDetailsService;
 import org.springframework.security.vote.AffirmativeBased;
 import org.springframework.security.vote.AuthenticatedVoter;
 import org.springframework.security.vote.RoleVoter;
 import org.springframework.util.StringUtils;
-import org.w3c.dom.Element;
 
 /**
  * Utility methods used internally by the Spring Security namespace configuration code.
@@ -77,107 +74,57 @@ public abstract class ConfigUtils {
      * using the <security:provider /> tag or by other beans which have a dependency on the
      * authentication manager.
      */
-    static void registerProviderManagerIfNecessary(ParserContext parserContext) {
+    static BeanDefinition registerProviderManagerIfNecessary(ParserContext parserContext) {
         if(parserContext.getRegistry().containsBeanDefinition(BeanIds.AUTHENTICATION_MANAGER)) {
-            return;
+            return parserContext.getRegistry().getBeanDefinition(BeanIds.AUTHENTICATION_MANAGER);
         }
 
-        BeanDefinition authManager = new RootBeanDefinition(NamespaceAuthenticationManager.class);
-        authManager.getPropertyValues().addPropertyValue("providerBeanNames", new ArrayList());
+        BeanDefinition authManager = new RootBeanDefinition(ProviderManager.class);
+        authManager.getPropertyValues().addPropertyValue("providers", new ManagedList());
         parserContext.getRegistry().registerBeanDefinition(BeanIds.AUTHENTICATION_MANAGER, authManager);
+
+        return authManager;
     }
 
-    static void addAuthenticationProvider(ParserContext parserContext, String beanName) {
-        registerProviderManagerIfNecessary(parserContext);
-        BeanDefinition authManager = parserContext.getRegistry().getBeanDefinition(BeanIds.AUTHENTICATION_MANAGER);
-        ((ArrayList) authManager.getPropertyValues().getPropertyValue("providerBeanNames").getValue()).add(beanName);
-    }
-    
-	static ManagedList getRegisteredAfterInvocationProviders(ParserContext parserContext) {
-		BeanDefinition manager = registerAfterInvocationProviderManagerIfNecessary(parserContext);
-		return (ManagedList) manager.getPropertyValues().getPropertyValue("providers").getValue();
-	}    
-    
-    private static BeanDefinition registerAfterInvocationProviderManagerIfNecessary(ParserContext parserContext) {
-        if(parserContext.getRegistry().containsBeanDefinition(BeanIds.AFTER_INVOCATION_MANAGER)) {
-            return parserContext.getRegistry().getBeanDefinition(BeanIds.AFTER_INVOCATION_MANAGER);
-        }
-
-        BeanDefinition manager = new RootBeanDefinition(AfterInvocationProviderManager.class);
-        manager.getPropertyValues().addPropertyValue("providers", new ManagedList());
-        parserContext.getRegistry().registerBeanDefinition(BeanIds.AFTER_INVOCATION_MANAGER, manager);
-
-        return manager;
-	}
-
-	private static void registerFilterChainPostProcessorIfNecessary(ParserContext pc) {
-    	if (pc.getRegistry().containsBeanDefinition(BeanIds.FILTER_CHAIN_POST_PROCESSOR)) {
-    		return;
-    	}
-        // Post processor specifically to assemble and order the filter chain immediately before the FilterChainProxy is initialized.
-        RootBeanDefinition filterChainPostProcessor = new RootBeanDefinition(FilterChainProxyPostProcessor.class);
-        filterChainPostProcessor.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
-        pc.getRegistry().registerBeanDefinition(BeanIds.FILTER_CHAIN_POST_PROCESSOR, filterChainPostProcessor);
-        RootBeanDefinition filterList = new RootBeanDefinition(FilterChainList.class);
-        filterList.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
-        pc.getRegistry().registerBeanDefinition(BeanIds.FILTER_LIST, filterList);
-    }
-    
-    static void addHttpFilter(ParserContext pc, BeanMetadataElement filter) {
-    	registerFilterChainPostProcessorIfNecessary(pc);
-    	
-    	RootBeanDefinition filterList = (RootBeanDefinition) pc.getRegistry().getBeanDefinition(BeanIds.FILTER_LIST);
-    	
-    	ManagedList filters;
-    	MutablePropertyValues pvs = filterList.getPropertyValues();
-    	if (pvs.contains("filters")) {
-    		filters = (ManagedList) pvs.getPropertyValue("filters").getValue();
-    	} else {
-    		filters = new ManagedList();
-    		pvs.addPropertyValue("filters", filters);
-    	}
-    	
-    	filters.add(filter);
-    }
 
     /**
-     * Bean which holds the list of filters which are maintained in the context and modified by calls to 
-     * addHttpFilter. The post processor retrieves these before injecting the list into the FilterChainProxy.
+     * Obtains a user details service for use in RememberMeServices etc. Will return a caching version
+     * if available so should not be used for beans which need to separate the two. 
      */
-    public static class FilterChainList {
-    	List filters;
-
-		public List getFilters() {
-			return filters;
-		}
-
-		public void setFilters(List filters) {
-			this.filters = filters;
-		}
-    }
-    
-    /**
-     * Checks the value of an XML attribute which represents a redirect URL.
-     * If not empty or starting with "$" (potential placeholder), "/" or "http" it will raise an error. 
-     */
-    static void validateHttpRedirect(String url, ParserContext pc, Object source) {
-    	if (UrlUtils.isValidRedirectUrl(url) || url.startsWith("$")) {
-    		return;
-    	}
-    	pc.getReaderContext().warning(url + " is not a valid redirect URL (must start with '/' or http(s))", source);
-    }
-    
-    static void setSessionControllerOnAuthenticationManager(ParserContext pc, String beanName, Element sourceElt) {
-    	registerProviderManagerIfNecessary(pc);
-    	BeanDefinition authManager = pc.getRegistry().getBeanDefinition(BeanIds.AUTHENTICATION_MANAGER);
-        PropertyValue pv = authManager.getPropertyValues().getPropertyValue("sessionController");
+    static RuntimeBeanReference getUserDetailsService(ConfigurableListableBeanFactory bf) {
+        String[] services = bf.getBeanNamesForType(CachingUserDetailsService.class, false, false);
         
-        if (pv != null && pv.getValue() != null) {
-        	pc.getReaderContext().error("A session controller has already been set on the authentication manager. " +
-        			"The <concurrent-session-control> element isn't compatible with a custom session controller", 
-        			pc.extractSource(sourceElt));
+        if (services.length == 0) {
+        	services = bf.getBeanNamesForType(UserDetailsService.class);
         }
-        
-        authManager.getPropertyValues().addPropertyValue("sessionController", new RuntimeBeanReference(beanName));
+
+        if (services.length == 0) {
+            throw new IllegalArgumentException("No UserDetailsService registered.");
+
+        } else if (services.length > 1) {
+            throw new IllegalArgumentException("More than one UserDetailsService registered. Please" +
+                    "use a specific Id in your configuration");
+        }
+
+        return new RuntimeBeanReference(services[0]);
+    }
+
+    private static AuthenticationManager getAuthenticationManager(ConfigurableListableBeanFactory bf) {
+        Map authManagers = bf.getBeansOfType(AuthenticationManager.class);
+
+        if (authManagers.size() == 0) {
+            throw new IllegalArgumentException("No AuthenticationManager registered. " +
+                    "Make sure you have configured at least one AuthenticationProvider?");
+
+        } else if (authManagers.size() > 1) {
+            throw new IllegalArgumentException("More than one AuthenticationManager registered.");
+        }
+
+        return (AuthenticationManager) authManagers.values().toArray()[0];
+    }
+
+    static ManagedList getRegisteredProviders(ParserContext parserContext) {
+        BeanDefinition authManager = registerProviderManagerIfNecessary(parserContext);
+        return (ManagedList) authManager.getPropertyValues().getPropertyValue("providers").getValue();
     }
 }

core/src/main/java/org/springframework/security/config/CustomAfterInvocationProviderBeanDefinitionDecorator.java

@@ -1,24 +0,0 @@
-package org.springframework.security.config;
-
-import org.springframework.beans.factory.config.BeanDefinitionHolder;
-import org.springframework.beans.factory.xml.BeanDefinitionDecorator;
-import org.springframework.beans.factory.xml.ParserContext;
-import org.w3c.dom.Node;
-
-/**
- * Adds the decorated {@link org.springframework.security.afterinvocation.AfterInvocationProvider} to the 
- * AfterInvocationProviderManager's list.
- *
- * @author Luke Taylor
- * @version $Id$
- * @since 2.0
- */
-public class CustomAfterInvocationProviderBeanDefinitionDecorator implements BeanDefinitionDecorator {
-
-	public BeanDefinitionHolder decorate(Node node, BeanDefinitionHolder holder, ParserContext parserContext) {
-        ConfigUtils.getRegisteredAfterInvocationProviders(parserContext).add(holder.getBeanDefinition());
-
-        return holder;
-	}
-
-}

core/src/main/java/org/springframework/security/config/CustomAuthenticationProviderBeanDefinitionDecorator.java

@@ -3,7 +3,6 @@ package org.springframework.security.config;
 import org.springframework.beans.factory.xml.BeanDefinitionDecorator;
 import org.springframework.beans.factory.xml.ParserContext;
 import org.springframework.beans.factory.config.BeanDefinitionHolder;
-import org.springframework.beans.factory.config.RuntimeBeanReference;
 
 import org.w3c.dom.Node;
 
@@ -17,7 +16,7 @@ import org.w3c.dom.Node;
  */
 public class CustomAuthenticationProviderBeanDefinitionDecorator implements BeanDefinitionDecorator {
     public BeanDefinitionHolder decorate(Node node, BeanDefinitionHolder holder, ParserContext parserContext) {
-        ConfigUtils.addAuthenticationProvider(parserContext, holder.getBeanName());
+        ConfigUtils.getRegisteredProviders(parserContext).add(holder.getBeanDefinition());
 
         return holder;
     }

core/src/main/java/org/springframework/security/config/Elements.java

@@ -13,7 +13,6 @@ abstract class Elements {
 	public static final String JDBC_USER_SERVICE = "jdbc-user-service";
 	public static final String FILTER_CHAIN_MAP = "filter-chain-map";
 	public static final String INTERCEPT_METHODS = "intercept-methods";
-    public static final String INTERCEPT_URL = "intercept-url";	
 	public static final String AUTHENTICATION_PROVIDER = "authentication-provider";
 	public static final String HTTP = "http";
 	public static final String LDAP_PROVIDER = "ldap-authentication-provider";
@@ -36,7 +35,6 @@ abstract class Elements {
     public static final String PORT_MAPPING = "port-mapping";
     public static final String CUSTOM_FILTER = "custom-filter";
     public static final String CUSTOM_AUTH_PROVIDER = "custom-authentication-provider";
-    public static final String CUSTOM_AFTER_INVOCATION_PROVIDER = "custom-after-invocation-provider";    
     public static final String X509 = "x509";
 	public static final String FILTER_INVOCATION_DEFINITION_SOURCE = "filter-invocation-definition-source";
     public static final String LDAP_PASSWORD_COMPARE = "password-compare";

core/src/main/java/org/springframework/security/config/EntryPointInjectionBeanPostProcessor.java

@@ -1,59 +0,0 @@
-package org.springframework.security.config;
-
-import java.util.Map;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.beans.BeansException;
-import org.springframework.beans.factory.BeanFactory;
-import org.springframework.beans.factory.BeanFactoryAware;
-import org.springframework.beans.factory.config.BeanPostProcessor;
-import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
-import org.springframework.security.ui.AuthenticationEntryPoint;
-import org.springframework.security.ui.ExceptionTranslationFilter;
-import org.springframework.util.Assert;
-
-/**
- * 
- * @author Luke Taylor
- * @since 2.0.2
- */
-public class EntryPointInjectionBeanPostProcessor implements BeanPostProcessor, BeanFactoryAware {
-    private final Log logger = LogFactory.getLog(getClass());
-    private ConfigurableListableBeanFactory beanFactory;	
-
-	public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException {
-        if (!BeanIds.EXCEPTION_TRANSLATION_FILTER.equals(beanName)) {
-        	return bean;
-        }
-        
-        logger.info("Selecting AuthenticationEntryPoint for use in ExceptionTranslationFilter");
-        
-        ExceptionTranslationFilter etf = (ExceptionTranslationFilter) beanFactory.getBean(BeanIds.EXCEPTION_TRANSLATION_FILTER); 
-
-        Object entryPoint = null;
-        
-        if (beanFactory.containsBean(BeanIds.MAIN_ENTRY_POINT)) {
-            entryPoint = beanFactory.getBean(BeanIds.MAIN_ENTRY_POINT);
-            logger.info("Using main configured AuthenticationEntryPoint.");
-        } else {
-            Map entryPoints = beanFactory.getBeansOfType(AuthenticationEntryPoint.class);
-            Assert.isTrue(entryPoints.size() != 0, "No AuthenticationEntryPoint instances defined");
-            Assert.isTrue(entryPoints.size() == 1, "More than one AuthenticationEntryPoint defined in context");
-            entryPoint = entryPoints.values().toArray()[0];
-        }
-        
-        logger.info("Using bean '" + entryPoint + "' as the entry point.");
-        etf.setAuthenticationEntryPoint((AuthenticationEntryPoint) entryPoint);
-		
-		return bean;
-	}	
-	
-	public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
-		return bean;
-	}
-
-	public void setBeanFactory(BeanFactory beanFactory) throws BeansException {
-		this.beanFactory = (ConfigurableListableBeanFactory) beanFactory;
-	}
-}

core/src/main/java/org/springframework/security/config/FilterChainProxyPostProcessor.java

@@ -2,6 +2,7 @@ package org.springframework.security.config;
 
 import java.util.ArrayList;
 import java.util.Collections;
+import java.util.Iterator;
 import java.util.List;
 import java.util.Map;
 
@@ -16,21 +17,8 @@ import org.springframework.beans.factory.ListableBeanFactory;
 import org.springframework.beans.factory.config.BeanPostProcessor;
 import org.springframework.core.OrderComparator;
 import org.springframework.core.Ordered;
-import org.springframework.security.ConfigAttributeDefinition;
-import org.springframework.security.config.ConfigUtils.FilterChainList;
-import org.springframework.security.context.HttpSessionContextIntegrationFilter;
-import org.springframework.security.intercept.web.DefaultFilterInvocationDefinitionSource;
-import org.springframework.security.intercept.web.FilterSecurityInterceptor;
-import org.springframework.security.providers.anonymous.AnonymousAuthenticationToken;
-import org.springframework.security.providers.anonymous.AnonymousProcessingFilter;
-import org.springframework.security.ui.ExceptionTranslationFilter;
-import org.springframework.security.ui.SessionFixationProtectionFilter;
-import org.springframework.security.ui.basicauth.BasicProcessingFilter;
-import org.springframework.security.ui.webapp.AuthenticationProcessingFilter;
-import org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint;
-import org.springframework.security.ui.webapp.DefaultLoginPageGeneratingFilter;
 import org.springframework.security.util.FilterChainProxy;
-import org.springframework.security.wrapper.SecurityContextHolderAwareRequestFilter;
+import org.springframework.util.Assert;
 
 /**
  * 
@@ -41,161 +29,70 @@ import org.springframework.security.wrapper.SecurityContextHolderAwareRequestFil
 public class FilterChainProxyPostProcessor implements BeanPostProcessor, BeanFactoryAware {
     private Log logger = LogFactory.getLog(getClass());
     
-    private ListableBeanFactory beanFactory;
-    
+    private ListableBeanFactory beanFactory;    
+
     public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException {
-        if(!BeanIds.FILTER_CHAIN_PROXY.equals(beanName)) {
+        if(!beanName.equals(BeanIds.FILTER_CHAIN_PROXY)) {
             return bean;
         }
         
         FilterChainProxy filterChainProxy = (FilterChainProxy) bean;
-        FilterChainList filterList = (FilterChainList) beanFactory.getBean(BeanIds.FILTER_LIST);
-        
-        List filters = new ArrayList(filterList.getFilters());
-        Collections.sort(filters, new OrderComparator());
-        
-        logger.info("Checking sorted filter chain: " + filters);
-        
-        for(int i=0; i < filters.size(); i++) {
-            Ordered filter = (Ordered)filters.get(i);
+        // Set the default match
+        List defaultFilterChain = orderFilters(beanFactory);
 
-            if (i > 0) {
-                Ordered previous = (Ordered)filters.get(i-1);
-                if (filter.getOrder() == previous.getOrder()) {
-                    throw new SecurityConfigurationException("Filters '" + unwrapFilter(filter) + "' and '" + 
-                            unwrapFilter(previous) + "' have the same 'order' value. When using custom filters, " +
-                            		"please make sure the positions do not conflict with default filters. " +
-                            		"Alternatively you can disable the default filters by removing the corresponding " +
-                            		"child elements from <http> and avoiding the use of <http auto-config='true'>.");
-                }
-            }
-        }
-
-        logger.info("Filter chain...");        
-        for (int i=0; i < filters.size(); i++) {
-        // Remove the ordered wrapper from the filter and put it back in the chain at the same position.
-            Filter filter = unwrapFilter(filters.get(i));
-            logger.info("[" + i + "] - " + filter);            
-            filters.set(i, filter);
-        }
-        
-        checkFilterStack(filters);
-        
         // Note that this returns a copy
         Map filterMap = filterChainProxy.getFilterChainMap();
-        filterMap.put(filterChainProxy.getMatcher().getUniversalMatchPattern(), filters);
+        String allUrlsMatch = filterChainProxy.getMatcher().getUniversalMatchPattern();
+
+        filterMap.put(allUrlsMatch, defaultFilterChain);
         filterChainProxy.setFilterChainMap(filterMap);
-        
-        checkLoginPageIsntProtected(filterChainProxy);
-        
-        logger.info("FilterChainProxy: " + filterChainProxy);
+
+        logger.info("Configured filter chain(s): " + filterChainProxy);        
 
         return bean;
     }
-    
-    /**
-     * Checks the filter list for possible errors and logs them
-     */
-    private void checkFilterStack(List filters) {
-        checkForDuplicates(HttpSessionContextIntegrationFilter.class, filters);
-        checkForDuplicates(AuthenticationProcessingFilter.class, filters);
-        checkForDuplicates(SessionFixationProtectionFilter.class, filters);
-        checkForDuplicates(BasicProcessingFilter.class, filters);
-        checkForDuplicates(SecurityContextHolderAwareRequestFilter.class, filters);
-        checkForDuplicates(ExceptionTranslationFilter.class, filters);
-        checkForDuplicates(FilterSecurityInterceptor.class, filters);
-    }
-    
-    private void checkForDuplicates(Class clazz, List filters) {
-        for (int i=0; i < filters.size(); i++) {
-            Filter f1 = (Filter)filters.get(i);
-            if (clazz.isAssignableFrom(f1.getClass())) {
-                // Found the first one, check remaining for another
-                for (int j=i+1; j < filters.size(); j++) {
-                    Filter f2 = (Filter)filters.get(j);
-                    if (clazz.isAssignableFrom(f2.getClass())) {
-                        logger.warn("Possible error: Filters at position " + i + " and " + j + " are both " +
-                                "instances of " + clazz.getName());
-                        return;
-                    }
-                }
-            }
-        }
-    }
-    
-    /* Checks for the common error of having a login page URL protected by the security interceptor */
-    private void checkLoginPageIsntProtected(FilterChainProxy fcp) {
-        ExceptionTranslationFilter etf = (ExceptionTranslationFilter) beanFactory.getBean(BeanIds.EXCEPTION_TRANSLATION_FILTER);
-        
-        if (etf.getAuthenticationEntryPoint() instanceof AuthenticationProcessingFilterEntryPoint) {
-            String loginPage = 
-                ((AuthenticationProcessingFilterEntryPoint)etf.getAuthenticationEntryPoint()).getLoginFormUrl();
-            List filters = fcp.getFilters(loginPage);
-            logger.info("Checking whether login URL '" + loginPage + "' is accessible with your configuration");
-                        
-            if (filters == null || filters.isEmpty()) {
-                logger.debug("Filter chain is empty for the login page");
-                return;
-            }
-            
-            if (loginPage.equals(DefaultLoginPageGeneratingFilter.DEFAULT_LOGIN_PAGE_URL) &&
-                    beanFactory.containsBean(BeanIds.DEFAULT_LOGIN_PAGE_GENERATING_FILTER)) {
-                logger.debug("Default generated login page is in use");
-                return;
-            }
-            
-            FilterSecurityInterceptor fsi = 
-                    ((FilterSecurityInterceptor)beanFactory.getBean(BeanIds.FILTER_SECURITY_INTERCEPTOR));
-            DefaultFilterInvocationDefinitionSource fids = 
-                    (DefaultFilterInvocationDefinitionSource) fsi.getObjectDefinitionSource();
-            ConfigAttributeDefinition cad = fids.lookupAttributes(loginPage, "POST");
-            
-            if (cad == null) {
-                logger.debug("No access attributes defined for login page URL");
-                if (fsi.isRejectPublicInvocations()) {
-                    logger.warn("FilterSecurityInterceptor is configured to reject public invocations." +
-                    		" Your login page may not be accessible.");
-                }
-                return;
+
+    private List orderFilters(ListableBeanFactory beanFactory) {
+        Map filters = beanFactory.getBeansOfType(Filter.class);
+
+        Assert.notEmpty(filters, "No filters found in app context!");
+
+        Iterator ids = filters.keySet().iterator();
+
+        List orderedFilters = new ArrayList();
+
+        while (ids.hasNext()) {
+            String id = (String) ids.next();
+            Filter filter = (Filter) filters.get(id);
+
+            if (filter instanceof FilterChainProxy) {
+                continue;
             }
 
-            if (!beanFactory.containsBean(BeanIds.ANONYMOUS_PROCESSING_FILTER)) {
-                logger.warn("The login page is being protected by the filter chain, but you don't appear to have" +
-                		" anonymous authentication enabled. This is almost certainly an error.");
-                return;
+            // Filters must be Spring security filters or wrapped using <custom-filter>
+            if (!filter.getClass().getName().startsWith("org.springframework.security")) {
+                continue;
             }
-            
-            // Simulate an anonymous access with the supplied attributes.
-            AnonymousProcessingFilter anonPF = (AnonymousProcessingFilter) beanFactory.getBean(BeanIds.ANONYMOUS_PROCESSING_FILTER);
-            AnonymousAuthenticationToken token = 
-                    new AnonymousAuthenticationToken("key", anonPF.getUserAttribute().getPassword(), 
-                            anonPF.getUserAttribute().getAuthorities());
-            try {
-                fsi.getAccessDecisionManager().decide(token, new Object(), cad);
-            } catch (Exception e) {
-                logger.warn("Anonymous access to the login page doesn't appear to be enabled. This is almost certainly " +
-                        "an error. Please check your configuration allows unauthenticated access to the configured " +
-                        "login page. (Simulated access was rejected: " + e + ")");
+
+            if (!(filter instanceof Ordered)) {
+                logger.info("Filter " + id + " doesn't implement the Ordered interface, skipping it.");
+                continue;
             }
+
+            orderedFilters.add(filter);
         }
-    }
-    
-    /** 
-     * Returns the delegate filter of a wrapper, or the unchanged filter if it isn't wrapped. 
-     */
-    private Filter unwrapFilter(Object filter) {
-        if (filter instanceof OrderedFilterBeanDefinitionDecorator.OrderedFilterDecorator) {
-            return ((OrderedFilterBeanDefinitionDecorator.OrderedFilterDecorator)filter).getDelegate();
-        }
-        
-        return (Filter) filter;
-    }
+
+        Collections.sort(orderedFilters, new OrderComparator());
+
+        return orderedFilters;
+    }    
 
     public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
         return bean;
     }
 
-	public void setBeanFactory(BeanFactory beanFactory) throws BeansException {
-		this.beanFactory = (ListableBeanFactory) beanFactory;
-	}
+    public void setBeanFactory(BeanFactory beanFactory) throws BeansException {
+        this.beanFactory = (ListableBeanFactory) beanFactory;
+    }
+
 }

core/src/main/java/org/springframework/security/config/FilterInvocationDefinitionSourceBeanDefinitionParser.java

@@ -44,8 +44,8 @@ public class FilterInvocationDefinitionSourceBeanDefinitionParser extends Abstra
         UrlMatcher matcher = HttpSecurityBeanDefinitionParser.createUrlMatcher(element);
         boolean convertPathsToLowerCase = (matcher instanceof AntUrlPathMatcher) && matcher.requiresLowerCaseUrl();
         
-        LinkedHashMap requestMap = 
-        HttpSecurityBeanDefinitionParser.parseInterceptUrlsForFilterInvocationRequestMap(interceptUrls,  
+        LinkedHashMap requestMap = new LinkedHashMap();
+        HttpSecurityBeanDefinitionParser.parseInterceptUrlsForFilterInvocationRequestMap(interceptUrls, requestMap, 
                 convertPathsToLowerCase, parserContext);
         
         builder.addConstructorArg(matcher);

core/src/main/java/org/springframework/security/config/FormLoginBeanDefinitionParser.java

@@ -1,6 +1,5 @@
 package org.springframework.security.config;
 
-import org.springframework.beans.PropertyValue;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.beans.factory.config.RuntimeBeanReference;
 import org.springframework.beans.factory.support.BeanDefinitionBuilder;
@@ -47,7 +46,7 @@ public class FormLoginBeanDefinitionParser implements BeanDefinitionParser {
     	this.filterClassName = filterClassName;
     }
 
-    public BeanDefinition parse(Element elt, ParserContext pc) {
+    public BeanDefinition parse(Element elt, ParserContext parserContext) {
         String loginUrl = null;
         String defaultTargetUrl = null;
         String authenticationFailureUrl = null;
@@ -55,57 +54,30 @@ public class FormLoginBeanDefinitionParser implements BeanDefinitionParser {
         
         Object source = null;
 
-        // Copy values from the session fixation protection filter        
-        final Boolean sessionFixationProtectionEnabled = 
-            new Boolean(pc.getRegistry().containsBeanDefinition(BeanIds.SESSION_FIXATION_PROTECTION_FILTER));
-        Boolean migrateSessionAttributes = Boolean.FALSE;
-        
-        if (sessionFixationProtectionEnabled.booleanValue()) {
-            PropertyValue pv = 
-                    pc.getRegistry().getBeanDefinition(BeanIds.SESSION_FIXATION_PROTECTION_FILTER)
-                        .getPropertyValues().getPropertyValue("migrateSessionAttributes");
-            migrateSessionAttributes = (Boolean)pv.getValue(); 
-        }        
-        
         if (elt != null) {
-        	source = pc.extractSource(elt);
             loginUrl = elt.getAttribute(ATT_LOGIN_URL);
-            ConfigUtils.validateHttpRedirect(loginUrl, pc, source);
             defaultTargetUrl = elt.getAttribute(ATT_FORM_LOGIN_TARGET_URL);
-            ConfigUtils.validateHttpRedirect(defaultTargetUrl, pc, source);
             authenticationFailureUrl = elt.getAttribute(ATT_FORM_LOGIN_AUTHENTICATION_FAILURE_URL);
-            ConfigUtils.validateHttpRedirect(authenticationFailureUrl, pc, source);
             alwaysUseDefault = elt.getAttribute(ATT_ALWAYS_USE_DEFAULT_TARGET_URL);
             loginPage = elt.getAttribute(ATT_LOGIN_PAGE);
             
             if (!StringUtils.hasText(loginPage)) {
             	loginPage = null;
             }
-            ConfigUtils.validateHttpRedirect(loginPage, pc, source);
-            
+            source = parserContext.extractSource(elt);
         }
 
-        ConfigUtils.registerProviderManagerIfNecessary(pc);
+        ConfigUtils.registerProviderManagerIfNecessary(parserContext);
         
         filterBean = createFilterBean(loginUrl, defaultTargetUrl, alwaysUseDefault, loginPage, authenticationFailureUrl);
         filterBean.setSource(source);
         filterBean.getPropertyValues().addPropertyValue("authenticationManager",
                 new RuntimeBeanReference(BeanIds.AUTHENTICATION_MANAGER));
         
-        filterBean.getPropertyValues().addPropertyValue("invalidateSessionOnSuccessfulAuthentication", 
-                sessionFixationProtectionEnabled);
-        filterBean.getPropertyValues().addPropertyValue("migrateInvalidatedSessionAttributes", 
-                migrateSessionAttributes);            
-        
-        if (pc.getRegistry().containsBeanDefinition(BeanIds.REMEMBER_ME_SERVICES)) {
+        if (parserContext.getRegistry().containsBeanDefinition(BeanIds.REMEMBER_ME_SERVICES)) {
             filterBean.getPropertyValues().addPropertyValue("rememberMeServices", 
                     new RuntimeBeanReference(BeanIds.REMEMBER_ME_SERVICES) );
         }
-        
-        if (pc.getRegistry().containsBeanDefinition(BeanIds.SESSION_REGISTRY)) {
-            filterBean.getPropertyValues().addPropertyValue("sessionRegistry", 
-                    new RuntimeBeanReference(BeanIds.SESSION_REGISTRY));
-        }
 
         BeanDefinitionBuilder entryPointBuilder =
                 BeanDefinitionBuilder.rootBeanDefinition(AuthenticationProcessingFilterEntryPoint.class);

core/src/main/java/org/springframework/security/config/GlobalMethodSecurityBeanDefinitionParser.java

@@ -20,6 +20,7 @@ import org.springframework.security.intercept.method.MapBasedMethodDefinitionSou
 import org.springframework.security.intercept.method.ProtectPointcutPostProcessor;
 import org.springframework.security.intercept.method.aopalliance.MethodDefinitionSourceAdvisor;
 import org.springframework.security.intercept.method.aopalliance.MethodSecurityInterceptor;
+import org.springframework.util.Assert;
 import org.springframework.util.ClassUtils;
 import org.springframework.util.StringUtils;
 import org.springframework.util.xml.DomUtils;
@@ -47,26 +48,67 @@ class GlobalMethodSecurityBeanDefinitionParser implements BeanDefinitionParser {
     		parserContext.getReaderContext().error("Cannot locate '" + className + "'", element);
     	}
     }
-
+    
     public BeanDefinition parse(Element element, ParserContext parserContext) {
-        Object source = parserContext.extractSource(element);
-        // The list of method metadata delegates
-        ManagedList delegates = new ManagedList();
-        
-        boolean jsr250Enabled = registerAnnotationBasedMethodDefinitionSources(element, parserContext, delegates);
-        
-        MapBasedMethodDefinitionSource mapBasedMethodDefinitionSource = new MapBasedMethodDefinitionSource();
-        delegates.add(mapBasedMethodDefinitionSource);
-        
-        // Now create a Map<String, ConfigAttribute> for each <protect-pointcut> sub-element        
-        Map pointcutMap = parseProtectPointcuts(parserContext, 
-                DomUtils.getChildElementsByTagName(element, Elements.PROTECT_POINTCUT));
-        
-        if (pointcutMap.size() > 0) {
-            registerProtectPointcutPostProcessor(parserContext, pointcutMap, mapBasedMethodDefinitionSource, source);
+    	boolean useJsr250 = "enabled".equals(element.getAttribute(ATT_USE_JSR250));
+        boolean useSecured = "enabled".equals(element.getAttribute(ATT_USE_SECURED));
+
+        // Check the required classes are present
+        if (useSecured) {
+        	validatePresent(SECURED_METHOD_DEFINITION_SOURCE_CLASS, element, parserContext);
+        	validatePresent(SECURED_DEPENDENCY_CLASS, element, parserContext);
+        }
+
+        if (useJsr250) {
+        	validatePresent(JSR_250_SECURITY_METHOD_DEFINITION_SOURCE_CLASS, element, parserContext);
+        	validatePresent(JSR_250_VOTER_CLASS, element, parserContext);
         }
         
-        registerDelegatingMethodDefinitionSource(parserContext, delegates, source);
+        // Now create a Map<String, ConfigAttribute> for each <protect-pointcut> sub-element
+        Map pointcutMap = new LinkedHashMap();
+        List protect = DomUtils.getChildElementsByTagName(element, Elements.PROTECT_POINTCUT);
+
+        for (Iterator i = protect.iterator(); i.hasNext();) {
+            Element childElt = (Element) i.next();
+            String accessConfig = childElt.getAttribute(ATT_ACCESS);
+            String expression = childElt.getAttribute(ATT_EXPRESSION);
+            Assert.hasText(accessConfig, "Access configuration required for '" + childElt + "'");
+            Assert.hasText(expression, "Expression required for '" + childElt + "'");
+            
+            ConfigAttributeDefinition def = new ConfigAttributeDefinition(StringUtils.commaDelimitedListToStringArray(accessConfig));
+            pointcutMap.put(expression, def);
+        }
+
+        MapBasedMethodDefinitionSource mapBasedMethodDefinitionSource = new MapBasedMethodDefinitionSource();
+        
+        // Now create and populate our ProtectPointcutBeanPostProcessor, if needed
+        if (pointcutMap.size() > 0) {
+            RootBeanDefinition ppbp = new RootBeanDefinition(ProtectPointcutPostProcessor.class);
+            ppbp.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
+            ppbp.setSource(parserContext.extractSource(element));
+            ppbp.getConstructorArgumentValues().addGenericArgumentValue(mapBasedMethodDefinitionSource);
+            ppbp.getPropertyValues().addPropertyValue("pointcutMap", pointcutMap);
+            parserContext.getRegistry().registerBeanDefinition(BeanIds.PROTECT_POINTCUT_POST_PROCESSOR, ppbp);
+        }
+        
+        // Create our list of method metadata delegates
+        ManagedList delegates = new ManagedList();
+        delegates.add(mapBasedMethodDefinitionSource);
+        
+        if (useSecured) {
+            delegates.add(BeanDefinitionBuilder.rootBeanDefinition(SECURED_METHOD_DEFINITION_SOURCE_CLASS).getBeanDefinition());
+        }
+        
+        if (useJsr250) {
+            delegates.add(BeanDefinitionBuilder.rootBeanDefinition(JSR_250_SECURITY_METHOD_DEFINITION_SOURCE_CLASS).getBeanDefinition());            
+        }
+        
+    	// Register our DelegatingMethodDefinitionSource
+        RootBeanDefinition delegatingMethodDefinitionSource = new RootBeanDefinition(DelegatingMethodDefinitionSource.class);
+        delegatingMethodDefinitionSource.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
+        delegatingMethodDefinitionSource.setSource(parserContext.extractSource(element));
+        delegatingMethodDefinitionSource.getPropertyValues().addPropertyValue("methodDefinitionSources", delegates);
+        parserContext.getRegistry().registerBeanDefinition(BeanIds.DELEGATING_METHOD_DEFINITION_SOURCE, delegatingMethodDefinitionSource);
         
         // Register the applicable AccessDecisionManager, handling the special JSR 250 voter if being used
         String accessManagerId = element.getAttribute(ATT_ACCESS_MGR);
@@ -74,94 +116,17 @@ class GlobalMethodSecurityBeanDefinitionParser implements BeanDefinitionParser {
         if (!StringUtils.hasText(accessManagerId)) {
             ConfigUtils.registerDefaultAccessManagerIfNecessary(parserContext);
 
-            if (jsr250Enabled) {
+            if (useJsr250) {
                 ConfigUtils.addVoter(new RootBeanDefinition(JSR_250_VOTER_CLASS, null, null), parserContext);                
             }
 
             accessManagerId = BeanIds.ACCESS_MANAGER;
         }
-        
-        registerMethodSecurityInterceptor(parserContext, accessManagerId, source);
-        
-        registerAdvisor(parserContext, source);
 
-        AopNamespaceUtils.registerAutoProxyCreatorIfNecessary(parserContext, element);
-        
-        return null;
-    }
-    
-    /**
-     * Checks whether JSR-250 and/or Secured annotations are enabled and adds the appropriate 
-     * MethodDefinitionSource delegates if required. 
-     */
-    private boolean registerAnnotationBasedMethodDefinitionSources(Element element, ParserContext pc, ManagedList delegates) {
-        boolean useJsr250 = "enabled".equals(element.getAttribute(ATT_USE_JSR250));
-        boolean useSecured = "enabled".equals(element.getAttribute(ATT_USE_SECURED));
-        
-        // Check the required classes are present
-        if (useSecured) {
-            validatePresent(SECURED_METHOD_DEFINITION_SOURCE_CLASS, element, pc);
-            validatePresent(SECURED_DEPENDENCY_CLASS, element, pc);
-            delegates.add(BeanDefinitionBuilder.rootBeanDefinition(SECURED_METHOD_DEFINITION_SOURCE_CLASS).getBeanDefinition());
-        }
-
-        if (useJsr250) {
-            validatePresent(JSR_250_SECURITY_METHOD_DEFINITION_SOURCE_CLASS, element, pc);
-            validatePresent(JSR_250_VOTER_CLASS, element, pc);
-            delegates.add(BeanDefinitionBuilder.rootBeanDefinition(JSR_250_SECURITY_METHOD_DEFINITION_SOURCE_CLASS).getBeanDefinition());           
-        }
-        
-        return useJsr250;
-    }
-    
-    private void registerDelegatingMethodDefinitionSource(ParserContext parserContext, ManagedList delegates, Object source) {
-        if (parserContext.getRegistry().containsBeanDefinition(BeanIds.DELEGATING_METHOD_DEFINITION_SOURCE)) {
-            parserContext.getReaderContext().error("Duplicate <global-method-security> detected.", source);
-        }
-        RootBeanDefinition delegatingMethodDefinitionSource = new RootBeanDefinition(DelegatingMethodDefinitionSource.class);
-        delegatingMethodDefinitionSource.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
-        delegatingMethodDefinitionSource.setSource(source);
-        delegatingMethodDefinitionSource.getPropertyValues().addPropertyValue("methodDefinitionSources", delegates);
-        parserContext.getRegistry().registerBeanDefinition(BeanIds.DELEGATING_METHOD_DEFINITION_SOURCE, delegatingMethodDefinitionSource);        
-    }
-    
-    private void registerProtectPointcutPostProcessor(ParserContext parserContext, Map pointcutMap,
-            MapBasedMethodDefinitionSource mapBasedMethodDefinitionSource, Object source) {
-        RootBeanDefinition ppbp = new RootBeanDefinition(ProtectPointcutPostProcessor.class);
-        ppbp.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
-        ppbp.setSource(source);
-        ppbp.getConstructorArgumentValues().addGenericArgumentValue(mapBasedMethodDefinitionSource);
-        ppbp.getPropertyValues().addPropertyValue("pointcutMap", pointcutMap);
-        parserContext.getRegistry().registerBeanDefinition(BeanIds.PROTECT_POINTCUT_POST_PROCESSOR, ppbp);
-    }
-
-    private Map parseProtectPointcuts(ParserContext parserContext, List protectPointcutElts) {
-        Map pointcutMap = new LinkedHashMap();
-
-        for (Iterator i = protectPointcutElts.iterator(); i.hasNext();) {
-            Element childElt = (Element) i.next();
-            String accessConfig = childElt.getAttribute(ATT_ACCESS);
-            String expression = childElt.getAttribute(ATT_EXPRESSION);
-
-            if (!StringUtils.hasText(accessConfig)) {
-                parserContext.getReaderContext().error("Access configuration required", parserContext.extractSource(childElt));
-            }
-
-            if (!StringUtils.hasText(expression)) {
-                parserContext.getReaderContext().error("Pointcut expression required", parserContext.extractSource(childElt));
-            }
-
-            ConfigAttributeDefinition def = new ConfigAttributeDefinition(StringUtils.commaDelimitedListToStringArray(accessConfig));
-            pointcutMap.put(expression, def);
-        }
-
-        return pointcutMap;
-    }
-
-    private void registerMethodSecurityInterceptor(ParserContext parserContext, String accessManagerId, Object source) {
+        // MethodSecurityInterceptor
         RootBeanDefinition interceptor = new RootBeanDefinition(MethodSecurityInterceptor.class);
         interceptor.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
-        interceptor.setSource(source);
+        interceptor.setSource(parserContext.extractSource(element));
         
         interceptor.getPropertyValues().addPropertyValue("accessDecisionManager", new RuntimeBeanReference(accessManagerId));
         interceptor.getPropertyValues().addPropertyValue("authenticationManager", new RuntimeBeanReference(BeanIds.AUTHENTICATION_MANAGER));
@@ -169,17 +134,15 @@ class GlobalMethodSecurityBeanDefinitionParser implements BeanDefinitionParser {
         parserContext.getRegistry().registerBeanDefinition(BeanIds.METHOD_SECURITY_INTERCEPTOR, interceptor);
         parserContext.registerComponent(new BeanComponentDefinition(interceptor, BeanIds.METHOD_SECURITY_INTERCEPTOR));
         
-        parserContext.getRegistry().registerBeanDefinition(BeanIds.METHOD_SECURITY_INTERCEPTOR_POST_PROCESSOR,
-        		new RootBeanDefinition(MethodSecurityInterceptorPostProcessor.class));
-    }
-
-    private void registerAdvisor(ParserContext parserContext, Object source) {
+        // MethodDefinitionSourceAdvisor
         RootBeanDefinition advisor = new RootBeanDefinition(MethodDefinitionSourceAdvisor.class);
         advisor.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
-        advisor.setSource(source);
-        advisor.getConstructorArgumentValues().addGenericArgumentValue(BeanIds.METHOD_SECURITY_INTERCEPTOR);
-        advisor.getConstructorArgumentValues().addGenericArgumentValue(new RuntimeBeanReference(BeanIds.DELEGATING_METHOD_DEFINITION_SOURCE));
+        advisor.setSource(parserContext.extractSource(element));
+        advisor.getConstructorArgumentValues().addGenericArgumentValue(interceptor);
+        parserContext.getRegistry().registerBeanDefinition(BeanIds.METHOD_DEFINITION_SOURCE_ADVISOR, advisor);
 
-        parserContext.getRegistry().registerBeanDefinition(BeanIds.METHOD_DEFINITION_SOURCE_ADVISOR, advisor);        
-    }    
+        AopNamespaceUtils.registerAutoProxyCreatorIfNecessary(parserContext, element);
+        
+        return null;
+    }
 }

core/src/main/java/org/springframework/security/config/HttpSecurityBeanDefinitionParser.java

@@ -50,16 +50,16 @@ import org.w3c.dom.Element;
  * @version $Id$
  */
 public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
-    static final Log logger = LogFactory.getLog(HttpSecurityBeanDefinitionParser.class);
+	protected final Log logger = LogFactory.getLog(getClass());
 
     static final String ATT_REALM = "realm";
     static final String DEF_REALM = "Spring Security Application";
 
     static final String ATT_PATH_PATTERN = "pattern";
-
+    
     static final String ATT_SESSION_FIXATION_PROTECTION = "session-fixation-protection";
     static final String OPT_SESSION_FIXATION_NO_PROTECTION = "none";
-    static final String OPT_SESSION_FIXATION_CLEAN_SESSION = "newSession";
+    static final String OPT_SESSION_FIXATION_CLEAN_SESSION = "newSession";    
     static final String OPT_SESSION_FIXATION_MIGRATE_SESSION = "migrateSession";
 
     static final String ATT_PATH_TYPE = "path-type";
@@ -91,36 +91,72 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
     static final String ATT_SERVLET_API_PROVISION = "servlet-api-provision";
     static final String DEF_SERVLET_API_PROVISION = "true";
 
-    static final String ATT_ACCESS_MGR = "access-decision-manager-ref";
+    static final String ATT_ACCESS_MGR = "access-decision-manager-ref";    
     static final String ATT_USER_SERVICE_REF = "user-service-ref";
-
+    
     static final String ATT_ENTRY_POINT_REF = "entry-point-ref";
     static final String ATT_ONCE_PER_REQUEST = "once-per-request";
     static final String ATT_ACCESS_DENIED_PAGE = "access-denied-page";
+    
 
     public BeanDefinition parse(Element element, ParserContext parserContext) {
-        ConfigUtils.registerProviderManagerIfNecessary(parserContext);
-        final BeanDefinitionRegistry registry = parserContext.getRegistry();
-        final UrlMatcher matcher = createUrlMatcher(element);
-        final Object source = parserContext.extractSource(element);
-        // SEC-501 - should paths stored in request maps be converted to lower case
-        // true if Ant path and using lower case
-        final boolean convertPathsToLowerCase = (matcher instanceof AntUrlPathMatcher) && matcher.requiresLowerCaseUrl();
+        BeanDefinitionRegistry registry = parserContext.getRegistry();
+        RootBeanDefinition filterChainProxy = new RootBeanDefinition(FilterChainProxy.class);
+        RootBeanDefinition httpScif = new RootBeanDefinition(HttpSessionContextIntegrationFilter.class);
 
-        final List interceptUrlElts = DomUtils.getChildElementsByTagName(element, Elements.INTERCEPT_URL);
-        final Map filterChainMap =  new LinkedHashMap();
-        final LinkedHashMap channelRequestMap = new LinkedHashMap();
+        BeanDefinition portMapper = new PortMappingsBeanDefinitionParser().parse(
+                DomUtils.getChildElementByTagName(element, Elements.PORT_MAPPINGS), parserContext);
+        registry.registerBeanDefinition(BeanIds.PORT_MAPPER, portMapper);
 
-        registerFilterChainProxy(parserContext, filterChainMap, matcher, source);
+        RuntimeBeanReference portMapperRef = new RuntimeBeanReference(BeanIds.PORT_MAPPER);
 
-        parseInterceptUrlsForChannelSecurityAndFilterChain(interceptUrlElts, filterChainMap, channelRequestMap,
-                convertPathsToLowerCase, parserContext);
+        String createSession = element.getAttribute(ATT_CREATE_SESSION);
+        if (OPT_CREATE_SESSION_ALWAYS.equals(createSession)) {
+        	httpScif.getPropertyValues().addPropertyValue("allowSessionCreation", Boolean.TRUE);
+        	httpScif.getPropertyValues().addPropertyValue("forceEagerSessionCreation", Boolean.TRUE);
+        } else if (OPT_CREATE_SESSION_NEVER.equals(createSession)) {
+        	httpScif.getPropertyValues().addPropertyValue("allowSessionCreation", Boolean.FALSE);
+        	httpScif.getPropertyValues().addPropertyValue("forceEagerSessionCreation", Boolean.FALSE);
+        } else {
+        	createSession = DEF_CREATE_SESSION_IF_REQUIRED;
+        	httpScif.getPropertyValues().addPropertyValue("allowSessionCreation", Boolean.TRUE);
+        	httpScif.getPropertyValues().addPropertyValue("forceEagerSessionCreation", Boolean.FALSE);
+        }
 
-        boolean allowSessionCreation = registerHttpSessionIntegrationFilter(element, parserContext);
+        BeanDefinitionBuilder filterSecurityInterceptorBuilder
+                = BeanDefinitionBuilder.rootBeanDefinition(FilterSecurityInterceptor.class);
 
-        registerServletApiFilter(element, parserContext);
+        BeanDefinitionBuilder exceptionTranslationFilterBuilder
+                = BeanDefinitionBuilder.rootBeanDefinition(ExceptionTranslationFilter.class);
+        
+        String accessDeniedPage = element.getAttribute(ATT_ACCESS_DENIED_PAGE); 
+        if (StringUtils.hasText(accessDeniedPage)) {
+            AccessDeniedHandlerImpl accessDeniedHandler = new AccessDeniedHandlerImpl();
+            accessDeniedHandler.setErrorPage(accessDeniedPage);
+            exceptionTranslationFilterBuilder.addPropertyValue("accessDeniedHandler", accessDeniedHandler);
+        }
+        
 
-        // Set up the access manager reference for http
+        Map filterChainMap =  new LinkedHashMap();
+        
+        UrlMatcher matcher = createUrlMatcher(element);
+        
+        filterChainProxy.getPropertyValues().addPropertyValue("matcher", matcher);
+
+        // Add servlet-api integration filter if required
+        String provideServletApi = element.getAttribute(ATT_SERVLET_API_PROVISION);
+        if (!StringUtils.hasText(provideServletApi)) {
+        	provideServletApi = DEF_SERVLET_API_PROVISION;
+        }
+
+        if ("true".equals(provideServletApi)) {
+            parserContext.getRegistry().registerBeanDefinition(BeanIds.SECURITY_CONTEXT_HOLDER_AWARE_REQUEST_FILTER,
+                    new RootBeanDefinition(SecurityContextHolderAwareRequestFilter.class));
+        }
+
+        filterChainProxy.getPropertyValues().addPropertyValue("filterChainMap", filterChainMap);
+
+        // Set up the access manager and authentication manager references for http
         String accessManagerId = element.getAttribute(ATT_ACCESS_MGR);
 
         if (!StringUtils.hasText(accessManagerId)) {
@@ -128,30 +164,91 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
             accessManagerId = BeanIds.ACCESS_MANAGER;
         }
 
-        // Register the portMapper. A default will always be created, even if no element exists.
-        BeanDefinition portMapper = new PortMappingsBeanDefinitionParser().parse(
-                DomUtils.getChildElementByTagName(element, Elements.PORT_MAPPINGS), parserContext);
-        registry.registerBeanDefinition(BeanIds.PORT_MAPPER, portMapper);
-
-        registerExceptionTranslationFilter(element, parserContext, allowSessionCreation);
-
-
-        if (channelRequestMap.size() > 0) {
-            // At least one channel requirement has been specified
-            registerChannelProcessingBeans(parserContext, matcher, channelRequestMap);
+        filterSecurityInterceptorBuilder.addPropertyValue("accessDecisionManager",
+                new RuntimeBeanReference(accessManagerId));
+        filterSecurityInterceptorBuilder.addPropertyValue("authenticationManager",
+                ConfigUtils.registerProviderManagerIfNecessary(parserContext));
+        
+        if ("true".equals(element.getAttribute(ATT_ONCE_PER_REQUEST))) {
+        	filterSecurityInterceptorBuilder.addPropertyValue("observeOncePerRequest", Boolean.TRUE);
         }
 
-        registerFilterSecurityInterceptor(element, parserContext, matcher, accessManagerId,
-                parseInterceptUrlsForFilterInvocationRequestMap(interceptUrlElts, convertPathsToLowerCase, parserContext));
+        // SEC-501 - should paths stored in request maps be converted to lower case
+        // true if Ant path and using lower case
+        boolean convertPathsToLowerCase = (matcher instanceof AntUrlPathMatcher) && matcher.requiresLowerCaseUrl();
+        
+        LinkedHashMap channelRequestMap = new LinkedHashMap();
+        LinkedHashMap filterInvocationDefinitionMap = new LinkedHashMap();
+                
+        List interceptUrlElts = DomUtils.getChildElementsByTagName(element, "intercept-url");
+        parseInterceptUrlsForChannelSecurityAndFilterChain(interceptUrlElts, filterChainMap, channelRequestMap, 
+                convertPathsToLowerCase, parserContext);
+        parseInterceptUrlsForFilterInvocationRequestMap(interceptUrlElts, filterInvocationDefinitionMap, 
+                convertPathsToLowerCase, parserContext);
 
-        boolean sessionControlEnabled = registerConcurrentSessionControlBeansIfRequired(element, parserContext);
+        DefaultFilterInvocationDefinitionSource interceptorFilterInvDefSource =
+            new DefaultFilterInvocationDefinitionSource(matcher, filterInvocationDefinitionMap);
+        DefaultFilterInvocationDefinitionSource channelFilterInvDefSource =
+            new DefaultFilterInvocationDefinitionSource(matcher, channelRequestMap);
 
-        registerSessionFixationProtectionFilter(parserContext, element.getAttribute(ATT_SESSION_FIXATION_PROTECTION),
-                sessionControlEnabled);
+        filterSecurityInterceptorBuilder.addPropertyValue("objectDefinitionSource", interceptorFilterInvDefSource);
+        
+        
+        // Check if we need to register the channel processing beans
+        if (channelRequestMap.size() > 0) {
+            // At least one channel requirement has been specified
+            RootBeanDefinition channelFilter = new RootBeanDefinition(ChannelProcessingFilter.class);
+            channelFilter.getPropertyValues().addPropertyValue("channelDecisionManager",
+                    new RuntimeBeanReference(BeanIds.CHANNEL_DECISION_MANAGER));
+
+            channelFilter.getPropertyValues().addPropertyValue("filterInvocationDefinitionSource",
+                    channelFilterInvDefSource);
+            RootBeanDefinition channelDecisionManager = new RootBeanDefinition(ChannelDecisionManagerImpl.class);
+            ManagedList channelProcessors = new ManagedList(3);
+            RootBeanDefinition secureChannelProcessor = new RootBeanDefinition(SecureChannelProcessor.class);
+            RootBeanDefinition retryWithHttp = new RootBeanDefinition(RetryWithHttpEntryPoint.class);
+            RootBeanDefinition retryWithHttps = new RootBeanDefinition(RetryWithHttpsEntryPoint.class);
+            retryWithHttp.getPropertyValues().addPropertyValue("portMapper", portMapperRef);
+            retryWithHttps.getPropertyValues().addPropertyValue("portMapper", portMapperRef);
+            secureChannelProcessor.getPropertyValues().addPropertyValue("entryPoint", retryWithHttps);
+            RootBeanDefinition inSecureChannelProcessor = new RootBeanDefinition(InsecureChannelProcessor.class);
+            inSecureChannelProcessor.getPropertyValues().addPropertyValue("entryPoint", retryWithHttp);
+            channelProcessors.add(secureChannelProcessor);
+            channelProcessors.add(inSecureChannelProcessor);
+            channelDecisionManager.getPropertyValues().addPropertyValue("channelProcessors", channelProcessors);
+
+            registry.registerBeanDefinition(BeanIds.CHANNEL_PROCESSING_FILTER, channelFilter);
+            registry.registerBeanDefinition(BeanIds.CHANNEL_DECISION_MANAGER, channelDecisionManager);
+        }
+
+        Element sessionControlElt = DomUtils.getChildElementByTagName(element, Elements.CONCURRENT_SESSIONS);
+        if (sessionControlElt != null) {
+            new ConcurrentSessionsBeanDefinitionParser().parse(sessionControlElt, parserContext);
+            logger.info("Concurrent session filter in use, setting 'forceEagerSessionCreation' to true");
+            httpScif.getPropertyValues().addPropertyValue("forceEagerSessionCreation", Boolean.TRUE);
+        }
+
+        String sessionFixationAttribute = element.getAttribute(ATT_SESSION_FIXATION_PROTECTION);
+        
+        if(!StringUtils.hasText(sessionFixationAttribute)) {
+        	sessionFixationAttribute = OPT_SESSION_FIXATION_MIGRATE_SESSION;
+        }
+        
+        if (!sessionFixationAttribute.equals(OPT_SESSION_FIXATION_NO_PROTECTION)) {
+        	BeanDefinitionBuilder sessionFixationFilter = 
+        		BeanDefinitionBuilder.rootBeanDefinition(SessionFixationProtectionFilter.class);
+        	sessionFixationFilter.addPropertyValue("migrateSessionAttributes", 
+        			Boolean.valueOf(sessionFixationAttribute.equals(OPT_SESSION_FIXATION_MIGRATE_SESSION)));
+        	if (sessionControlElt != null) {
+        		sessionFixationFilter.addPropertyReference("sessionRegistry", BeanIds.SESSION_REGISTRY);
+        	}
+        	parserContext.getRegistry().registerBeanDefinition(BeanIds.SESSION_FIXATION_PROTECTION_FILTER, 
+        			sessionFixationFilter.getBeanDefinition());
+        }        
 
         boolean autoConfig = false;
         if ("true".equals(element.getAttribute(ATT_AUTO_CONFIG))) {
-            autoConfig = true;
+        	autoConfig = true;
         }
 
         Element anonymousElt = DomUtils.getChildElementByTagName(element, Elements.ANONYMOUS);
@@ -159,332 +256,170 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
             new AnonymousBeanDefinitionParser().parse(anonymousElt, parserContext);
         }
 
-        parseRememberMeAndLogout(element, autoConfig, parserContext);
-
-        parseBasicFormLoginAndOpenID(element, parserContext, autoConfig, allowSessionCreation);
+        // Parse remember me before logout as RememberMeServices is also a LogoutHandler implementation.
+        Element rememberMeElt = DomUtils.getChildElementByTagName(element, Elements.REMEMBER_ME);
+        if (rememberMeElt != null || autoConfig) {
+            new RememberMeBeanDefinitionParser().parse(rememberMeElt, parserContext);
+            // Post processor to inject RememberMeServices into filters which need it
+            RootBeanDefinition rememberMeInjectionPostProcessor = new RootBeanDefinition(RememberMeServicesInjectionBeanPostProcessor.class);
+            rememberMeInjectionPostProcessor.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
+            registry.registerBeanDefinition(BeanIds.REMEMBER_ME_SERVICES_INJECTION_POST_PROCESSOR, rememberMeInjectionPostProcessor);            
+        }
+        
+        Element logoutElt = DomUtils.getChildElementByTagName(element, Elements.LOGOUT);
+        if (logoutElt != null || autoConfig) {
+            new LogoutBeanDefinitionParser().parse(logoutElt, parserContext);
+        }
+        
+        parseBasicFormLoginAndOpenID(element, parserContext, autoConfig);
 
         Element x509Elt = DomUtils.getChildElementByTagName(element, Elements.X509);
         if (x509Elt != null) {
             new X509BeanDefinitionParser().parse(x509Elt, parserContext);
         }
 
-        // Register the post processors which will tie up the loose ends in the configuration once the app context has been created and all beans are available.
-        RootBeanDefinition postProcessor = new RootBeanDefinition(EntryPointInjectionBeanPostProcessor.class);
-        postProcessor.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
-        registry.registerBeanDefinition(BeanIds.ENTRY_POINT_INJECTION_POST_PROCESSOR, postProcessor);
-        RootBeanDefinition postProcessor2 = new RootBeanDefinition(UserDetailsServiceInjectionBeanPostProcessor.class);
-        postProcessor2.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
-        registry.registerBeanDefinition(BeanIds.USER_DETAILS_SERVICE_INJECTION_POST_PROCESSOR, postProcessor2);
+        registry.registerBeanDefinition(BeanIds.FILTER_CHAIN_PROXY, filterChainProxy);
+        registry.registerAlias(BeanIds.FILTER_CHAIN_PROXY, BeanIds.SPRING_SECURITY_FILTER_CHAIN);
+        registry.registerBeanDefinition(BeanIds.HTTP_SESSION_CONTEXT_INTEGRATION_FILTER, httpScif);
+        registry.registerBeanDefinition(BeanIds.EXCEPTION_TRANSLATION_FILTER, exceptionTranslationFilterBuilder.getBeanDefinition());
+        registry.registerBeanDefinition(BeanIds.FILTER_SECURITY_INTERCEPTOR, filterSecurityInterceptorBuilder.getBeanDefinition());
 
+        // Register the post processor which will tie up the loose ends in the configuration once the app context has been created and all beans are available.
+        RootBeanDefinition postProcessor = new RootBeanDefinition(HttpSecurityConfigPostProcessor.class);
+        postProcessor.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
+        registry.registerBeanDefinition(BeanIds.HTTP_POST_PROCESSOR, postProcessor);
+        
+        // Post processor specifically to assemble and order the filter chain immediately before the FilterChainProxy is initialized.
+        RootBeanDefinition filterChainPostProcessor = new RootBeanDefinition(FilterChainProxyPostProcessor.class);
+        filterChainPostProcessor.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
+        registry.registerBeanDefinition(BeanIds.FILTER_CHAIN_POST_PROCESSOR, filterChainPostProcessor);
+        
         return null;
     }
-
-    private void parseRememberMeAndLogout(Element elt, boolean autoConfig, ParserContext pc) {
-        // Parse remember me before logout as RememberMeServices is also a LogoutHandler implementation.
-        Element rememberMeElt = DomUtils.getChildElementByTagName(elt, Elements.REMEMBER_ME);
-        String rememberMeServices = null;
-
-        if (rememberMeElt != null || autoConfig) {
-            RememberMeBeanDefinitionParser rmbdp = new RememberMeBeanDefinitionParser();
-            rmbdp.parse(rememberMeElt, pc);
-            rememberMeServices = rmbdp.getServicesName();
-            // Post processor to inject RememberMeServices into filters which need it
-            RootBeanDefinition rememberMeInjectionPostProcessor = new RootBeanDefinition(RememberMeServicesInjectionBeanPostProcessor.class);
-            rememberMeInjectionPostProcessor.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
-            pc.getRegistry().registerBeanDefinition(BeanIds.REMEMBER_ME_SERVICES_INJECTION_POST_PROCESSOR, rememberMeInjectionPostProcessor);
-        }
-
-        Element logoutElt = DomUtils.getChildElementByTagName(elt, Elements.LOGOUT);
-        if (logoutElt != null || autoConfig) {
-            new LogoutBeanDefinitionParser(rememberMeServices).parse(logoutElt, pc);
-        }
-    }
-
-    private void registerFilterChainProxy(ParserContext pc, Map filterChainMap, UrlMatcher matcher, Object source) {
-        if (pc.getRegistry().containsBeanDefinition(BeanIds.FILTER_CHAIN_PROXY)) {
-            pc.getReaderContext().error("Duplicate <http> element detected", source);
-        }
-
-        RootBeanDefinition filterChainProxy = new RootBeanDefinition(FilterChainProxy.class);
-        filterChainProxy.setSource(source);
-        filterChainProxy.getPropertyValues().addPropertyValue("matcher", matcher);
-        filterChainProxy.getPropertyValues().addPropertyValue("stripQueryStringFromUrls", Boolean.valueOf(matcher instanceof AntUrlPathMatcher));
-        filterChainProxy.getPropertyValues().addPropertyValue("filterChainMap", filterChainMap);
-        pc.getRegistry().registerBeanDefinition(BeanIds.FILTER_CHAIN_PROXY, filterChainProxy);
-        pc.getRegistry().registerAlias(BeanIds.FILTER_CHAIN_PROXY, BeanIds.SPRING_SECURITY_FILTER_CHAIN);
-    }
-
-    private boolean registerHttpSessionIntegrationFilter(Element element, ParserContext pc) {
-        RootBeanDefinition httpScif = new RootBeanDefinition(HttpSessionContextIntegrationFilter.class);
-        boolean sessionCreationAllowed = true;
-
-        String createSession = element.getAttribute(ATT_CREATE_SESSION);
-        if (OPT_CREATE_SESSION_ALWAYS.equals(createSession)) {
-            httpScif.getPropertyValues().addPropertyValue("allowSessionCreation", Boolean.TRUE);
-            httpScif.getPropertyValues().addPropertyValue("forceEagerSessionCreation", Boolean.TRUE);
-        } else if (OPT_CREATE_SESSION_NEVER.equals(createSession)) {
-            httpScif.getPropertyValues().addPropertyValue("allowSessionCreation", Boolean.FALSE);
-            httpScif.getPropertyValues().addPropertyValue("forceEagerSessionCreation", Boolean.FALSE);
-            sessionCreationAllowed = false;
-        } else {
-            createSession = DEF_CREATE_SESSION_IF_REQUIRED;
-            httpScif.getPropertyValues().addPropertyValue("allowSessionCreation", Boolean.TRUE);
-            httpScif.getPropertyValues().addPropertyValue("forceEagerSessionCreation", Boolean.FALSE);
-        }
-
-        pc.getRegistry().registerBeanDefinition(BeanIds.HTTP_SESSION_CONTEXT_INTEGRATION_FILTER, httpScif);
-        ConfigUtils.addHttpFilter(pc, new RuntimeBeanReference(BeanIds.HTTP_SESSION_CONTEXT_INTEGRATION_FILTER));
-
-        return sessionCreationAllowed;
-    }
-
-    // Adds the servlet-api integration filter if required
-    private void registerServletApiFilter(Element element, ParserContext pc) {
-        String provideServletApi = element.getAttribute(ATT_SERVLET_API_PROVISION);
-        if (!StringUtils.hasText(provideServletApi)) {
-            provideServletApi = DEF_SERVLET_API_PROVISION;
-        }
-
-        if ("true".equals(provideServletApi)) {
-            pc.getRegistry().registerBeanDefinition(BeanIds.SECURITY_CONTEXT_HOLDER_AWARE_REQUEST_FILTER,
-                    new RootBeanDefinition(SecurityContextHolderAwareRequestFilter.class));
-            ConfigUtils.addHttpFilter(pc, new RuntimeBeanReference(BeanIds.SECURITY_CONTEXT_HOLDER_AWARE_REQUEST_FILTER));
-        }
-    }
-
-    private boolean registerConcurrentSessionControlBeansIfRequired(Element element, ParserContext parserContext) {
-        Element sessionControlElt = DomUtils.getChildElementByTagName(element, Elements.CONCURRENT_SESSIONS);
-        if (sessionControlElt == null) {
-            return false;
-        }
-
-        new ConcurrentSessionsBeanDefinitionParser().parse(sessionControlElt, parserContext);
-        logger.info("Concurrent session filter in use, setting 'forceEagerSessionCreation' to true");
-        BeanDefinition sessionIntegrationFilter = parserContext.getRegistry().getBeanDefinition(BeanIds.HTTP_SESSION_CONTEXT_INTEGRATION_FILTER);
-        sessionIntegrationFilter.getPropertyValues().addPropertyValue("forceEagerSessionCreation", Boolean.TRUE);
-        return true;
-    }
-
-    private void registerExceptionTranslationFilter(Element element, ParserContext pc, boolean allowSessionCreation) {
-        String accessDeniedPage = element.getAttribute(ATT_ACCESS_DENIED_PAGE);
-        ConfigUtils.validateHttpRedirect(accessDeniedPage, pc, pc.extractSource(element));
-        BeanDefinitionBuilder exceptionTranslationFilterBuilder
-            = BeanDefinitionBuilder.rootBeanDefinition(ExceptionTranslationFilter.class);
-        exceptionTranslationFilterBuilder.addPropertyValue("createSessionAllowed", new Boolean(allowSessionCreation));
-
-        if (StringUtils.hasText(accessDeniedPage)) {
-            AccessDeniedHandlerImpl accessDeniedHandler = new AccessDeniedHandlerImpl();
-            accessDeniedHandler.setErrorPage(accessDeniedPage);
-            exceptionTranslationFilterBuilder.addPropertyValue("accessDeniedHandler", accessDeniedHandler);
-        }
-
-        pc.getRegistry().registerBeanDefinition(BeanIds.EXCEPTION_TRANSLATION_FILTER, exceptionTranslationFilterBuilder.getBeanDefinition());
-        ConfigUtils.addHttpFilter(pc, new RuntimeBeanReference(BeanIds.EXCEPTION_TRANSLATION_FILTER));
-    }
-
-    private void registerFilterSecurityInterceptor(Element element, ParserContext pc, UrlMatcher matcher,
-            String accessManagerId, LinkedHashMap filterInvocationDefinitionMap) {
-        BeanDefinitionBuilder builder = BeanDefinitionBuilder.rootBeanDefinition(FilterSecurityInterceptor.class);
-
-        builder.addPropertyReference("accessDecisionManager", accessManagerId);
-        builder.addPropertyReference("authenticationManager", BeanIds.AUTHENTICATION_MANAGER);
-
-        if ("false".equals(element.getAttribute(ATT_ONCE_PER_REQUEST))) {
-            builder.addPropertyValue("observeOncePerRequest", Boolean.FALSE);
-        }
-
-        DefaultFilterInvocationDefinitionSource fids =
-            new DefaultFilterInvocationDefinitionSource(matcher, filterInvocationDefinitionMap);
-        fids.setStripQueryStringFromUrls(matcher instanceof AntUrlPathMatcher);
-
-        builder.addPropertyValue("objectDefinitionSource", fids);
-        pc.getRegistry().registerBeanDefinition(BeanIds.FILTER_SECURITY_INTERCEPTOR, builder.getBeanDefinition());
-        ConfigUtils.addHttpFilter(pc, new RuntimeBeanReference(BeanIds.FILTER_SECURITY_INTERCEPTOR));
-    }
-
-    private void registerChannelProcessingBeans(ParserContext pc, UrlMatcher matcher, LinkedHashMap channelRequestMap) {
-        RootBeanDefinition channelFilter = new RootBeanDefinition(ChannelProcessingFilter.class);
-        channelFilter.getPropertyValues().addPropertyValue("channelDecisionManager",
-                new RuntimeBeanReference(BeanIds.CHANNEL_DECISION_MANAGER));
-        DefaultFilterInvocationDefinitionSource channelFilterInvDefSource =
-            new DefaultFilterInvocationDefinitionSource(matcher, channelRequestMap);
-        channelFilterInvDefSource.setStripQueryStringFromUrls(matcher instanceof AntUrlPathMatcher);
-
-        channelFilter.getPropertyValues().addPropertyValue("filterInvocationDefinitionSource",
-                channelFilterInvDefSource);
-        RootBeanDefinition channelDecisionManager = new RootBeanDefinition(ChannelDecisionManagerImpl.class);
-        ManagedList channelProcessors = new ManagedList(3);
-        RootBeanDefinition secureChannelProcessor = new RootBeanDefinition(SecureChannelProcessor.class);
-        RootBeanDefinition retryWithHttp = new RootBeanDefinition(RetryWithHttpEntryPoint.class);
-        RootBeanDefinition retryWithHttps = new RootBeanDefinition(RetryWithHttpsEntryPoint.class);
-        RuntimeBeanReference portMapper = new RuntimeBeanReference(BeanIds.PORT_MAPPER);
-        retryWithHttp.getPropertyValues().addPropertyValue("portMapper", portMapper);
-        retryWithHttps.getPropertyValues().addPropertyValue("portMapper", portMapper);
-        secureChannelProcessor.getPropertyValues().addPropertyValue("entryPoint", retryWithHttps);
-        RootBeanDefinition inSecureChannelProcessor = new RootBeanDefinition(InsecureChannelProcessor.class);
-        inSecureChannelProcessor.getPropertyValues().addPropertyValue("entryPoint", retryWithHttp);
-        channelProcessors.add(secureChannelProcessor);
-        channelProcessors.add(inSecureChannelProcessor);
-        channelDecisionManager.getPropertyValues().addPropertyValue("channelProcessors", channelProcessors);
-
-        pc.getRegistry().registerBeanDefinition(BeanIds.CHANNEL_PROCESSING_FILTER, channelFilter);
-        ConfigUtils.addHttpFilter(pc, new RuntimeBeanReference(BeanIds.CHANNEL_PROCESSING_FILTER));
-        pc.getRegistry().registerBeanDefinition(BeanIds.CHANNEL_DECISION_MANAGER, channelDecisionManager);
-
-    }
-
-    private void registerSessionFixationProtectionFilter(ParserContext pc, String sessionFixationAttribute, boolean sessionControlEnabled) {
-        if(!StringUtils.hasText(sessionFixationAttribute)) {
-            sessionFixationAttribute = OPT_SESSION_FIXATION_MIGRATE_SESSION;
-        }
-
-        if (!sessionFixationAttribute.equals(OPT_SESSION_FIXATION_NO_PROTECTION)) {
-            BeanDefinitionBuilder sessionFixationFilter =
-                BeanDefinitionBuilder.rootBeanDefinition(SessionFixationProtectionFilter.class);
-            sessionFixationFilter.addPropertyValue("migrateSessionAttributes",
-                    Boolean.valueOf(sessionFixationAttribute.equals(OPT_SESSION_FIXATION_MIGRATE_SESSION)));
-            if (sessionControlEnabled) {
-                sessionFixationFilter.addPropertyReference("sessionRegistry", BeanIds.SESSION_REGISTRY);
-            }
-            pc.getRegistry().registerBeanDefinition(BeanIds.SESSION_FIXATION_PROTECTION_FILTER,
-                    sessionFixationFilter.getBeanDefinition());
-            ConfigUtils.addHttpFilter(pc, new RuntimeBeanReference(BeanIds.SESSION_FIXATION_PROTECTION_FILTER));
-        }
-    }
-
-    private void parseBasicFormLoginAndOpenID(Element element, ParserContext pc, boolean autoConfig, boolean allowSessionCreation) {
+    
+    private void parseBasicFormLoginAndOpenID(Element element, ParserContext parserContext, boolean autoConfig) {
         RootBeanDefinition formLoginFilter = null;
         RootBeanDefinition formLoginEntryPoint = null;
-        String formLoginPage = null;
+        String formLoginPage = null;        
         RootBeanDefinition openIDFilter = null;
         RootBeanDefinition openIDEntryPoint = null;
         String openIDLoginPage = null;
-
+    	
         String realm = element.getAttribute(ATT_REALM);
         if (!StringUtils.hasText(realm)) {
-            realm = DEF_REALM;
-        }
-
+        	realm = DEF_REALM;
+        }        
+        
         Element basicAuthElt = DomUtils.getChildElementByTagName(element, Elements.BASIC_AUTH);
         if (basicAuthElt != null || autoConfig) {
-            new BasicAuthenticationBeanDefinitionParser(realm).parse(basicAuthElt, pc);
-        }
-
-        Element formLoginElt = DomUtils.getChildElementByTagName(element, Elements.FORM_LOGIN);
-
+            new BasicAuthenticationBeanDefinitionParser(realm).parse(basicAuthElt, parserContext);
+        }        
+        
+    	Element formLoginElt = DomUtils.getChildElementByTagName(element, Elements.FORM_LOGIN);
+        
         if (formLoginElt != null || autoConfig) {
-            FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser("/j_spring_security_check",
-                    "org.springframework.security.ui.webapp.AuthenticationProcessingFilter");
-
-            parser.parse(formLoginElt, pc);
+        	FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser("/j_spring_security_check", 
+        			"org.springframework.security.ui.webapp.AuthenticationProcessingFilter");
+        	
+            parser.parse(formLoginElt, parserContext);
             formLoginFilter = parser.getFilterBean();
             formLoginEntryPoint = parser.getEntryPointBean();
             formLoginPage = parser.getLoginPage();
         }
-
+        
         Element openIDLoginElt = DomUtils.getChildElementByTagName(element, Elements.OPENID_LOGIN);
 
         if (openIDLoginElt != null) {
-            FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser("/j_spring_openid_security_check",
-                    "org.springframework.security.ui.openid.OpenIDAuthenticationProcessingFilter");
-
-            parser.parse(openIDLoginElt, pc);
+        	FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser("/j_spring_openid_security_check", 
+        			"org.springframework.security.ui.openid.OpenIDAuthenticationProcessingFilter");
+        	
+            parser.parse(openIDLoginElt, parserContext);
             openIDFilter = parser.getFilterBean();
             openIDEntryPoint = parser.getEntryPointBean();
             openIDLoginPage = parser.getLoginPage();
-
-            BeanDefinitionBuilder openIDProviderBuilder =
+            
+            BeanDefinitionBuilder openIDProviderBuilder = 
                 BeanDefinitionBuilder.rootBeanDefinition("org.springframework.security.providers.openid.OpenIDAuthenticationProvider");
-
+            
             String userService = openIDLoginElt.getAttribute(ATT_USER_SERVICE_REF);
-
+            
             if (StringUtils.hasText(userService)) {
                 openIDProviderBuilder.addPropertyReference("userDetailsService", userService);
             }
-
+            
             BeanDefinition openIDProvider = openIDProviderBuilder.getBeanDefinition();
-            pc.getRegistry().registerBeanDefinition(BeanIds.OPEN_ID_PROVIDER, openIDProvider);
-            ConfigUtils.addAuthenticationProvider(pc, BeanIds.OPEN_ID_PROVIDER);
+            ConfigUtils.getRegisteredProviders(parserContext).add(openIDProvider);
+            
+            parserContext.getRegistry().registerBeanDefinition(BeanIds.OPEN_ID_PROVIDER, openIDProvider);
         }
-
+        
         boolean needLoginPage = false;
-
+        
         if (formLoginFilter != null) {
-            needLoginPage = true;
-            formLoginFilter.getPropertyValues().addPropertyValue("allowSessionCreation", new Boolean(allowSessionCreation));
-            pc.getRegistry().registerBeanDefinition(BeanIds.FORM_LOGIN_FILTER, formLoginFilter);
-            ConfigUtils.addHttpFilter(pc, new RuntimeBeanReference(BeanIds.FORM_LOGIN_FILTER));
-            pc.getRegistry().registerBeanDefinition(BeanIds.FORM_LOGIN_ENTRY_POINT, formLoginEntryPoint);
-        }
+        	needLoginPage = true;
+	        parserContext.getRegistry().registerBeanDefinition(BeanIds.FORM_LOGIN_FILTER, formLoginFilter);
+	        parserContext.getRegistry().registerBeanDefinition(BeanIds.FORM_LOGIN_ENTRY_POINT, formLoginEntryPoint);
+        }        
 
         if (openIDFilter != null) {
-            needLoginPage = true;
-            openIDFilter.getPropertyValues().addPropertyValue("allowSessionCreation", new Boolean(allowSessionCreation));
-            pc.getRegistry().registerBeanDefinition(BeanIds.OPEN_ID_FILTER, openIDFilter);
-            ConfigUtils.addHttpFilter(pc, new RuntimeBeanReference(BeanIds.OPEN_ID_FILTER));
-            pc.getRegistry().registerBeanDefinition(BeanIds.OPEN_ID_ENTRY_POINT, openIDEntryPoint);
+        	needLoginPage = true;
+	        parserContext.getRegistry().registerBeanDefinition(BeanIds.OPEN_ID_FILTER, openIDFilter);
+	        parserContext.getRegistry().registerBeanDefinition(BeanIds.OPEN_ID_ENTRY_POINT, openIDEntryPoint);
         }
 
         // If no login page has been defined, add in the default page generator.
         if (needLoginPage && formLoginPage == null && openIDLoginPage == null) {
             logger.info("No login page configured. The default internal one will be used. Use the '"
                      + FormLoginBeanDefinitionParser.ATT_LOGIN_PAGE + "' attribute to set the URL of the login page.");
-            BeanDefinitionBuilder loginPageFilter =
-                BeanDefinitionBuilder.rootBeanDefinition(DefaultLoginPageGeneratingFilter.class);
-
+            BeanDefinitionBuilder loginPageFilter = 
+            	BeanDefinitionBuilder.rootBeanDefinition(DefaultLoginPageGeneratingFilter.class);
+            
             if (formLoginFilter != null) {
-                loginPageFilter.addConstructorArg(new RuntimeBeanReference(BeanIds.FORM_LOGIN_FILTER));
+            	loginPageFilter.addConstructorArg(new RuntimeBeanReference(BeanIds.FORM_LOGIN_FILTER));
             }
-
+            
             if (openIDFilter != null) {
-                loginPageFilter.addConstructorArg(new RuntimeBeanReference(BeanIds.OPEN_ID_FILTER));
+            	loginPageFilter.addConstructorArg(new RuntimeBeanReference(BeanIds.OPEN_ID_FILTER));
             }
 
-            pc.getRegistry().registerBeanDefinition(BeanIds.DEFAULT_LOGIN_PAGE_GENERATING_FILTER,
-                    loginPageFilter.getBeanDefinition());
-            ConfigUtils.addHttpFilter(pc, new RuntimeBeanReference(BeanIds.DEFAULT_LOGIN_PAGE_GENERATING_FILTER));
+            parserContext.getRegistry().registerBeanDefinition(BeanIds.DEFAULT_LOGIN_PAGE_GENERATING_FILTER, 
+            		loginPageFilter.getBeanDefinition());
         }
-
+        
         // We need to establish the main entry point.
         // First check if a custom entry point bean is set
         String customEntryPoint = element.getAttribute(ATT_ENTRY_POINT_REF);
-
+        
         if (StringUtils.hasText(customEntryPoint)) {
-            pc.getRegistry().registerAlias(customEntryPoint, BeanIds.MAIN_ENTRY_POINT);
+            parserContext.getRegistry().registerAlias(customEntryPoint, BeanIds.MAIN_ENTRY_POINT);
             return;
         }
-
+        
         // Basic takes precedence if explicit element is used and no others are configured
         if (basicAuthElt != null && formLoginElt == null && openIDLoginElt == null) {
-            pc.getRegistry().registerAlias(BeanIds.BASIC_AUTHENTICATION_ENTRY_POINT, BeanIds.MAIN_ENTRY_POINT);
-            return;
+        	parserContext.getRegistry().registerAlias(BeanIds.BASIC_AUTHENTICATION_ENTRY_POINT, BeanIds.MAIN_ENTRY_POINT);
+        	return;
         }
-
+        
         // If formLogin has been enabled either through an element or auto-config, then it is used if no openID login page
         // has been set
         if (formLoginFilter != null && openIDLoginPage == null) {
-            pc.getRegistry().registerAlias(BeanIds.FORM_LOGIN_ENTRY_POINT, BeanIds.MAIN_ENTRY_POINT);
-            return;
+        	parserContext.getRegistry().registerAlias(BeanIds.FORM_LOGIN_ENTRY_POINT, BeanIds.MAIN_ENTRY_POINT);
+        	return;        	
         }
-
-        // Otherwise use OpenID if enabled
+        
+        // Otherwise use OpenID
         if (openIDFilter != null && formLoginFilter == null) {
-            pc.getRegistry().registerAlias(BeanIds.OPEN_ID_ENTRY_POINT, BeanIds.MAIN_ENTRY_POINT);
-            return;
+        	parserContext.getRegistry().registerAlias(BeanIds.OPEN_ID_ENTRY_POINT, BeanIds.MAIN_ENTRY_POINT);
+        	return;        	
         }
-
-        // If X.509 has been enabled, use the preauth entry point.
-        if (DomUtils.getChildElementByTagName(element, Elements.X509) != null) {
-            pc.getRegistry().registerAlias(BeanIds.PRE_AUTH_ENTRY_POINT, BeanIds.MAIN_ENTRY_POINT);
-            return;
-        }
-
-        pc.getReaderContext().error("No AuthenticationEntryPoint could be established. Please " +
-                "make sure you have a login mechanism configured through the namespace (such as form-login) or " +
-                "specify a custom AuthenticationEntryPoint with the custom-entry-point-ref attribute ",
-                pc.extractSource(element));
+        
+        parserContext.getReaderContext().error("No AuthenticationEntryPoint could be established. Please" +
+        		"make sure you have a login mechanism configured through the namespace (such as form-login) or" +
+        		"specify a custom AuthenticationEntryPoint with the custom-entry-point-ref  ", 
+                parserContext.extractSource(element));
     }
-
+    
     static UrlMatcher createUrlMatcher(Element element) {
         String patternType = element.getAttribute(ATT_PATH_TYPE);
         if (!StringUtils.hasText(patternType)) {
@@ -518,8 +453,8 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
             }
             // Default for regex is no change
         }
-
-        return matcher;
+        
+        return matcher;        
     }
 
     /**
@@ -563,7 +498,7 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
                 editor.setAsText(channelConfigAttribute);
                 channelRequestMap.put(new RequestKey(path), (ConfigAttributeDefinition) editor.getValue());
             }
-
+            
             String filters = urlElt.getAttribute(ATT_FILTERS);
 
             if (StringUtils.hasText(filters)) {
@@ -576,9 +511,9 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
             }
         }
     }
-
-    static LinkedHashMap parseInterceptUrlsForFilterInvocationRequestMap(List urlElts,  boolean useLowerCasePaths, ParserContext parserContext) {
-        LinkedHashMap filterInvocationDefinitionMap = new LinkedHashMap();
+    
+    static void parseInterceptUrlsForFilterInvocationRequestMap(List urlElts, Map filterInvocationDefinitionMap, 
+            boolean useLowerCasePaths, ParserContext parserContext) {
 
         Iterator urlEltsIterator = urlElts.iterator();
         ConfigAttributeEditor editor = new ConfigAttributeEditor();
@@ -606,17 +541,9 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
             // Convert the comma-separated list of access attributes to a ConfigAttributeDefinition
             if (StringUtils.hasText(access)) {
                 editor.setAsText(access);
-                Object key = new RequestKey(path, method);
-
-                if (filterInvocationDefinitionMap.containsKey(key)) {
-                    logger.warn("Duplicate URL defined: " + key + ". The original attribute values will be overwritten");
-                }
-
-                filterInvocationDefinitionMap.put(key, editor.getValue());
+                filterInvocationDefinitionMap.put(new RequestKey(path, method), editor.getValue());
             }
         }
-
-        return filterInvocationDefinitionMap;
     }
-
+    
 }

core/src/main/java/org/springframework/security/config/HttpSecurityConfigPostProcessor.java

@@ -0,0 +1,150 @@
+package org.springframework.security.config;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.springframework.beans.BeansException;
+import org.springframework.beans.PropertyValue;
+import org.springframework.beans.factory.BeanFactory;
+import org.springframework.beans.factory.NoSuchBeanDefinitionException;
+import org.springframework.beans.factory.config.BeanDefinition;
+import org.springframework.beans.factory.config.BeanFactoryPostProcessor;
+import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
+import org.springframework.beans.factory.config.RuntimeBeanReference;
+import org.springframework.beans.factory.support.BeanDefinitionBuilder;
+import org.springframework.beans.factory.support.RootBeanDefinition;
+import org.springframework.core.Ordered;
+import org.springframework.security.ui.AuthenticationEntryPoint;
+import org.springframework.security.userdetails.UserDetailsByNameServiceWrapper;
+import org.springframework.util.Assert;
+
+/**
+ * Responsible for tying up the HTTP security configuration once all the beans are registered.
+ * This class does not actually instantiate any beans (for example, it should not call {@link BeanFactory#getBean(String)}).
+ * All the wiring up should be done using bean definitions or bean references to avoid this. This approach should avoid any
+ * conflict with other processors.
+ *
+ * @author Luke Taylor
+ * @author Ben Alex
+ * @version $Id$
+ * @since 2.0
+ */
+public class HttpSecurityConfigPostProcessor implements BeanFactoryPostProcessor, Ordered {
+    private Log logger = LogFactory.getLog(getClass());
+
+    public void postProcessBeanFactory(ConfigurableListableBeanFactory beanFactory) throws BeansException {
+        injectUserDetailsServiceIntoRememberMeServices(beanFactory);
+        injectUserDetailsServiceIntoX509Provider(beanFactory);
+        injectUserDetailsServiceIntoOpenIDProvider(beanFactory);
+        injectAuthenticationEntryPointIntoExceptionTranslationFilter(beanFactory);
+    }
+
+    private void injectUserDetailsServiceIntoRememberMeServices(ConfigurableListableBeanFactory bf) {
+        try {
+            BeanDefinition rememberMeServices = bf.getBeanDefinition(BeanIds.REMEMBER_ME_SERVICES);
+            PropertyValue pv = rememberMeServices.getPropertyValues().getPropertyValue("userDetailsService");
+
+            if (pv == null) {
+                rememberMeServices.getPropertyValues().addPropertyValue("userDetailsService",
+                    ConfigUtils.getUserDetailsService(bf));
+            } else {
+            	RuntimeBeanReference cachingUserService = getCachingUserService(bf, pv.getValue());
+            	
+            	if (cachingUserService != null) {
+            		rememberMeServices.getPropertyValues().addPropertyValue("userDetailsService", cachingUserService);
+            	}            	
+            }
+        } catch (NoSuchBeanDefinitionException e) {
+            // ignore
+        }
+    }
+
+    private void injectUserDetailsServiceIntoX509Provider(ConfigurableListableBeanFactory bf) {
+        try {
+            BeanDefinition x509AuthProvider = bf.getBeanDefinition(BeanIds.X509_AUTH_PROVIDER);
+            PropertyValue pv = x509AuthProvider.getPropertyValues().getPropertyValue("preAuthenticatedUserDetailsService");
+
+            if (pv == null) {
+            	BeanDefinitionBuilder preAuthUserService = BeanDefinitionBuilder.rootBeanDefinition(UserDetailsByNameServiceWrapper.class);
+            	preAuthUserService.addPropertyValue("userDetailsService", ConfigUtils.getUserDetailsService(bf));
+                x509AuthProvider.getPropertyValues().addPropertyValue("preAuthenticatedUserDetailsService",
+                        preAuthUserService.getBeanDefinition());
+            } else {
+            	RootBeanDefinition preAuthUserService = (RootBeanDefinition) pv.getValue();
+            	Object userService = 
+            		preAuthUserService.getPropertyValues().getPropertyValue("userDetailsService").getValue();
+            	
+            	RuntimeBeanReference cachingUserService = getCachingUserService(bf, userService);
+            	
+            	if (cachingUserService != null) {
+            		preAuthUserService.getPropertyValues().addPropertyValue("userDetailsService", cachingUserService);
+            	}
+            }
+        } catch (NoSuchBeanDefinitionException e) {
+            // ignore
+        }
+    }
+    
+    private void injectUserDetailsServiceIntoOpenIDProvider(ConfigurableListableBeanFactory beanFactory) {
+        try {
+            BeanDefinition openIDProvider = beanFactory.getBeanDefinition(BeanIds.OPEN_ID_PROVIDER);
+            PropertyValue pv = openIDProvider.getPropertyValues().getPropertyValue("userDetailsService");
+
+            if (pv == null) {
+                openIDProvider.getPropertyValues().addPropertyValue("userDetailsService",
+                    ConfigUtils.getUserDetailsService(beanFactory));
+            }
+        } catch (NoSuchBeanDefinitionException e) {
+            // ignore
+        }
+    }
+    
+    private RuntimeBeanReference getCachingUserService(ConfigurableListableBeanFactory bf, Object userServiceRef) {
+    	Assert.isInstanceOf(RuntimeBeanReference.class, userServiceRef, 
+    			"userDetailsService property value must be a RuntimeBeanReference");
+    	
+    	String id = ((RuntimeBeanReference)userServiceRef).getBeanName();
+    	// Overwrite with the caching version if available
+    	String cachingId = id + AbstractUserDetailsServiceBeanDefinitionParser.CACHING_SUFFIX;
+    	
+    	if (bf.containsBeanDefinition(cachingId)) {
+    		return new RuntimeBeanReference(cachingId);
+    	}
+    	
+    	return null;
+    }
+
+    /**
+     * Selects the entry point that should be used in ExceptionTranslationFilter. If an entry point has been
+     * set during parsing of form, openID and basic authentication information, or via a custom reference
+     * (using <tt>custom-entry-point</tt>, then that will be used. Otherwise there
+     * must be a single entry point bean and that will be used.
+     * 
+     * Todo: this could probably be more easily be done in a BeanPostProcessor for ExceptionTranslationFilter.
+     *
+     */
+    private void injectAuthenticationEntryPointIntoExceptionTranslationFilter(ConfigurableListableBeanFactory beanFactory) {
+        logger.info("Selecting AuthenticationEntryPoint for use in ExceptionTranslationFilter");        
+        
+        BeanDefinition etf =
+                beanFactory.getBeanDefinition(BeanIds.EXCEPTION_TRANSLATION_FILTER);
+        
+        String entryPoint = null;
+        
+        if (beanFactory.containsBean(BeanIds.MAIN_ENTRY_POINT)) {
+            entryPoint = BeanIds.MAIN_ENTRY_POINT;
+            logger.info("Using main configured AuthenticationEntryPoint set to " + BeanIds.MAIN_ENTRY_POINT);
+        } else {
+            String[] entryPoints = beanFactory.getBeanNamesForType(AuthenticationEntryPoint.class);
+            Assert.isTrue(entryPoints.length != 0, "No AuthenticationEntryPoint instances defined");
+            Assert.isTrue(entryPoints.length == 1, "More than one AuthenticationEntryPoint defined in context");
+            entryPoint = entryPoints[0];
+        }
+        
+        logger.info("Using bean '" + entryPoint + "' as the entry point.");
+        etf.getPropertyValues().addPropertyValue("authenticationEntryPoint", new RuntimeBeanReference(entryPoint));
+    }
+
+    public int getOrder() {
+        return HIGHEST_PRECEDENCE + 1;
+    }
+}

core/src/main/java/org/springframework/security/config/JdbcUserServiceBeanDefinitionParser.java

@@ -1,8 +1,10 @@
 package org.springframework.security.config;
 
+import org.springframework.security.userdetails.jdbc.JdbcUserDetailsManager;
 import org.springframework.util.StringUtils;
 import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.xml.ParserContext;
+import org.springframework.beans.factory.BeanDefinitionStoreException;
 
 import org.w3c.dom.Element;
 
@@ -15,30 +17,26 @@ public class JdbcUserServiceBeanDefinitionParser extends AbstractUserDetailsServ
 	static final String ATT_USERS_BY_USERNAME_QUERY = "users-by-username-query";
 	static final String ATT_AUTHORITIES_BY_USERNAME_QUERY = "authorities-by-username-query";
 	static final String ATT_GROUP_AUTHORITIES_QUERY = "group-authorities-by-username-query";
-	static final String ATT_ROLE_PREFIX = "role-prefix";
 
-    protected String getBeanClassName(Element element) {
-        return "org.springframework.security.userdetails.jdbc.JdbcUserDetailsManager";
+    protected Class getBeanClass(Element element) {
+        return JdbcUserDetailsManager.class;
     }
 
     protected void doParse(Element element, ParserContext parserContext, BeanDefinitionBuilder builder) {
+        // TODO: Set authenticationManager property
         String dataSource = element.getAttribute(ATT_DATA_SOURCE);
-
+        // An explicit dataSource was specified, so use it
         if (dataSource != null) {
             builder.addPropertyReference("dataSource", dataSource);
         } else {
-            parserContext.getReaderContext().error(ATT_DATA_SOURCE  + " is required for "
-                    + Elements.JDBC_USER_SERVICE, parserContext.extractSource(element));
+            // TODO: Have some sensible fallback if dataSource not specified, eg autowire
+            throw new BeanDefinitionStoreException(ATT_DATA_SOURCE  + " is required for "
+                    + Elements.JDBC_USER_SERVICE );
         }
         
         String usersQuery = element.getAttribute(ATT_USERS_BY_USERNAME_QUERY);
         String authoritiesQuery = element.getAttribute(ATT_AUTHORITIES_BY_USERNAME_QUERY);
         String groupAuthoritiesQuery = element.getAttribute(ATT_GROUP_AUTHORITIES_QUERY);
-        String rolePrefix = element.getAttribute(ATT_ROLE_PREFIX);
-        
-        if (StringUtils.hasText(rolePrefix)) {
-            builder.addPropertyValue("rolePrefix", rolePrefix);
-        }
         
         if (StringUtils.hasText(usersQuery)) {
             builder.addPropertyValue("usersByUsernameQuery", usersQuery);
@@ -50,7 +48,7 @@ public class JdbcUserServiceBeanDefinitionParser extends AbstractUserDetailsServ
         
         if (StringUtils.hasText(groupAuthoritiesQuery)) {
             builder.addPropertyValue("enableGroups", Boolean.TRUE);
-            builder.addPropertyValue("groupAuthoritiesByUsernameQuery", groupAuthoritiesQuery);
+            builder.addPropertyValue("authoritiesByUsernameQuery", groupAuthoritiesQuery);
         }
     }
 }

core/src/main/java/org/springframework/security/config/LdapConfigUtils.java

@@ -1,13 +1,14 @@
 package org.springframework.security.config;
 
-import org.springframework.beans.BeansException;
-import org.springframework.beans.factory.config.BeanDefinition;
+import org.springframework.security.ldap.SpringSecurityContextSource;
 import org.springframework.beans.factory.config.BeanFactoryPostProcessor;
 import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
 import org.springframework.beans.factory.support.BeanDefinitionRegistry;
 import org.springframework.beans.factory.support.RootBeanDefinition;
+import org.springframework.beans.BeansException;
 import org.springframework.core.Ordered;
-import org.springframework.security.ldap.SpringSecurityContextSource;
+
+import java.util.Map;
 
 /**
  * @author Luke Taylor
@@ -16,56 +17,35 @@ import org.springframework.security.ldap.SpringSecurityContextSource;
  */
 class LdapConfigUtils {
 
-    /** 
-     * Checks for the presence of a ContextSource instance. Also supplies the standard reference to any 
-     * unconfigured <ldap-authentication-provider> or <ldap-user-service> beans. This is 
-     * necessary in cases where the user has given the server a specific Id, but hasn't used
-     * the server-ref attribute to link this to the other ldap definitions. See SEC-799.
-     */
+    /** Checks for the presence of a ContextSource instance */
     private static class ContextSourceSettingPostProcessor implements BeanFactoryPostProcessor, Ordered {
-        /** If set to true, a bean parser has indicated that the default context source name needs to be set */  
-        private boolean defaultNameRequired;
-        
         public void postProcessBeanFactory(ConfigurableListableBeanFactory bf) throws BeansException {
-            String[] sources = bf.getBeanNamesForType(SpringSecurityContextSource.class);
+            Map beans = bf.getBeansOfType(SpringSecurityContextSource.class);
 
-            if (sources.length == 0) {
+            if (beans.size() == 0) {
                 throw new SecurityConfigurationException("No SpringSecurityContextSource instances found. Have you " +
                         "added an <" + Elements.LDAP_SERVER + " /> element to your application context?");
             }
-            
-            if (!bf.containsBean(BeanIds.CONTEXT_SOURCE) && defaultNameRequired) {
-                if (sources.length > 1) {
-                    throw new SecurityConfigurationException("More than one SpringSecurityContextSource instance found. " +
-                            "Please specify a specific server id using the 'server-ref' attribute when configuring your <" + 
-                            Elements.LDAP_PROVIDER + "> " + "or <" + Elements.LDAP_USER_SERVICE + ">.");
-                }
-                
-                bf.registerAlias(sources[0], BeanIds.CONTEXT_SOURCE);
-            }
-        }
-        
-        public void setDefaultNameRequired(boolean defaultNameRequired) {
-            this.defaultNameRequired = defaultNameRequired;
+
+//            else if (beans.size() > 1) {
+//                throw new SecurityConfigurationException("More than one SpringSecurityContextSource instance found. " +
+//                        "Please specify a specific server id when configuring your <" + Elements.LDAP_PROVIDER + "> " +
+//                        "or <" + Elements.LDAP_USER_SERVICE + ">.");
+//            }
         }
 
         public int getOrder() {
             return LOWEST_PRECEDENCE;
         }
     }
-    
-    static void registerPostProcessorIfNecessary(BeanDefinitionRegistry registry, boolean defaultNameRequired) {
+
+    static void registerPostProcessorIfNecessary(BeanDefinitionRegistry registry) {
         if (registry.containsBeanDefinition(BeanIds.CONTEXT_SOURCE_SETTING_POST_PROCESSOR)) {
-            if (defaultNameRequired) {
-                BeanDefinition bd = registry.getBeanDefinition(BeanIds.CONTEXT_SOURCE_SETTING_POST_PROCESSOR);
-                bd.getPropertyValues().addPropertyValue("defaultNameRequired", Boolean.valueOf(defaultNameRequired));
-            }
             return;
         }
 
-        BeanDefinition bd = new RootBeanDefinition(ContextSourceSettingPostProcessor.class); 
-        registry.registerBeanDefinition(BeanIds.CONTEXT_SOURCE_SETTING_POST_PROCESSOR, bd);
-        bd.getPropertyValues().addPropertyValue("defaultNameRequired", Boolean.valueOf(defaultNameRequired));
+        registry.registerBeanDefinition(BeanIds.CONTEXT_SOURCE_SETTING_POST_PROCESSOR,
+                new RootBeanDefinition(ContextSourceSettingPostProcessor.class));
     }
 
 }

core/src/main/java/org/springframework/security/config/LdapProviderBeanDefinitionParser.java

@@ -1,8 +1,11 @@
 package org.springframework.security.config;
 
+import org.springframework.security.ldap.search.FilterBasedLdapUserSearch;
+import org.springframework.security.providers.ldap.LdapAuthenticationProvider;
+import org.springframework.security.providers.ldap.authenticator.BindAuthenticator;
+import org.springframework.security.providers.ldap.authenticator.PasswordComparisonAuthenticator;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.beans.factory.config.RuntimeBeanReference;
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.support.RootBeanDefinition;
 import org.springframework.beans.factory.xml.BeanDefinitionParser;
 import org.springframework.beans.factory.xml.ParserContext;
@@ -24,19 +27,14 @@ public class LdapProviderBeanDefinitionParser implements BeanDefinitionParser {
     private Log logger = LogFactory.getLog(getClass());
   
     private static final String ATT_USER_DN_PATTERN = "user-dn-pattern";
-    private static final String ATT_USER_PASSWORD = "password-attribute";
-    private static final String ATT_HASH = PasswordEncoderParser.ATT_HASH; 
+    private static final String ATT_USER_PASSWORD= "password-attribute";
     
-    private static final String DEF_USER_SEARCH_FILTER = "uid={0}";
-    
-    private static final String PROVIDER_CLASS = "org.springframework.security.providers.ldap.LdapAuthenticationProvider";
-    private static final String BIND_AUTH_CLASS = "org.springframework.security.providers.ldap.authenticator.BindAuthenticator";
-    private static final String PASSWD_AUTH_CLASS = "org.springframework.security.providers.ldap.authenticator.PasswordComparisonAuthenticator";
+    private static final String DEF_USER_SEARCH_FILTER="uid={0}";
 
     public BeanDefinition parse(Element elt, ParserContext parserContext) {
         RuntimeBeanReference contextSource = LdapUserServiceBeanDefinitionParser.parseServerReference(elt, parserContext);
         
-        BeanDefinition searchBean = LdapUserServiceBeanDefinitionParser.parseSearchBean(elt, parserContext);
+        RootBeanDefinition searchBean = LdapUserServiceBeanDefinitionParser.parseSearchBean(elt, parserContext);
         String userDnPattern = elt.getAttribute(ATT_USER_DN_PATTERN);
         
         String[] userDnPatternArray = new String[0];
@@ -46,63 +44,49 @@ public class LdapProviderBeanDefinitionParser implements BeanDefinitionParser {
             // TODO: Validate the pattern and make sure it is a valid DN.
         } else if (searchBean == null) {
             logger.info("No search information or DN pattern specified. Using default search filter '" + DEF_USER_SEARCH_FILTER + "'");
-            BeanDefinitionBuilder searchBeanBuilder = BeanDefinitionBuilder.rootBeanDefinition(LdapUserServiceBeanDefinitionParser.LDAP_SEARCH_CLASS); 
-            searchBeanBuilder.setSource(elt);
-            searchBeanBuilder.addConstructorArg("");
-            searchBeanBuilder.addConstructorArg(DEF_USER_SEARCH_FILTER);
-            searchBeanBuilder.addConstructorArg(contextSource);
-            searchBean = searchBeanBuilder.getBeanDefinition();
+            searchBean = new RootBeanDefinition(FilterBasedLdapUserSearch.class);
+            searchBean.setSource(elt);
+            searchBean.getConstructorArgumentValues().addIndexedArgumentValue(0, "");
+            searchBean.getConstructorArgumentValues().addIndexedArgumentValue(1, DEF_USER_SEARCH_FILTER);
+            searchBean.getConstructorArgumentValues().addIndexedArgumentValue(2, contextSource);
         }
         
-        BeanDefinitionBuilder authenticatorBuilder = 
-        	BeanDefinitionBuilder.rootBeanDefinition(BIND_AUTH_CLASS);
+        RootBeanDefinition authenticator = new RootBeanDefinition(BindAuthenticator.class); 
         Element passwordCompareElt = DomUtils.getChildElementByTagName(elt, Elements.LDAP_PASSWORD_COMPARE);
-        
         if (passwordCompareElt != null) {
-        	authenticatorBuilder = 
-            	BeanDefinitionBuilder.rootBeanDefinition(PASSWD_AUTH_CLASS);
+            authenticator = new RootBeanDefinition(PasswordComparisonAuthenticator.class);
             
             String passwordAttribute = passwordCompareElt.getAttribute(ATT_USER_PASSWORD);
             if (StringUtils.hasText(passwordAttribute)) {
-            	authenticatorBuilder.addPropertyValue("passwordAttributeName", passwordAttribute);
+                authenticator.getPropertyValues().addPropertyValue("passwordAttributeName", passwordAttribute);
             }
             
             Element passwordEncoderElement = DomUtils.getChildElementByTagName(passwordCompareElt, Elements.PASSWORD_ENCODER);
-            String hash = passwordCompareElt.getAttribute(ATT_HASH);
             
             if (passwordEncoderElement != null) {
-                if (StringUtils.hasText(hash)) {
-                    parserContext.getReaderContext().warning("Attribute 'hash' cannot be used with 'password-encoder' and " +
-                            "will be ignored.", parserContext.extractSource(elt));
-                }
                 PasswordEncoderParser pep = new PasswordEncoderParser(passwordEncoderElement, parserContext);
-                authenticatorBuilder.addPropertyValue("passwordEncoder", pep.getPasswordEncoder());
+                authenticator.getPropertyValues().addPropertyValue("passwordEncoder", pep.getPasswordEncoder());
                 
                 if (pep.getSaltSource() != null) {
-                    parserContext.getReaderContext().warning("Salt source information isn't valid when used with LDAP", 
-                    		passwordEncoderElement);
+                    parserContext.getReaderContext().warning("Salt source information isn't valid when used with LDAP", passwordEncoderElement);
                 }
-            } else if (StringUtils.hasText(hash)) {
-                Class encoderClass = (Class) PasswordEncoderParser.ENCODER_CLASSES.get(hash);
-                authenticatorBuilder.addPropertyValue("passwordEncoder", new RootBeanDefinition(encoderClass));
             }
         }
         
-        authenticatorBuilder.addConstructorArg(contextSource);
-        authenticatorBuilder.addPropertyValue("userDnPatterns", userDnPatternArray);
+        authenticator.getConstructorArgumentValues().addGenericArgumentValue(contextSource);
+        authenticator.getPropertyValues().addPropertyValue("userDnPatterns", userDnPatternArray);
         
         if (searchBean != null) {
-        	authenticatorBuilder.addPropertyValue("userSearch", searchBean);
+            authenticator.getPropertyValues().addPropertyValue("userSearch", searchBean);
         }
                 
-        BeanDefinitionBuilder ldapProvider = BeanDefinitionBuilder.rootBeanDefinition(PROVIDER_CLASS);
-        ldapProvider.addConstructorArg(authenticatorBuilder.getBeanDefinition());
-        ldapProvider.addConstructorArg(LdapUserServiceBeanDefinitionParser.parseAuthoritiesPopulator(elt, parserContext));
-        ldapProvider.addPropertyValue("userDetailsContextMapper", 
-        		LdapUserServiceBeanDefinitionParser.parseUserDetailsClass(elt, parserContext));
-        parserContext.getRegistry().registerBeanDefinition(BeanIds.LDAP_AUTHENTICATION_PROVIDER, ldapProvider.getBeanDefinition());
-        
-        ConfigUtils.addAuthenticationProvider(parserContext, BeanIds.LDAP_AUTHENTICATION_PROVIDER);
+        RootBeanDefinition ldapProvider = new RootBeanDefinition(LdapAuthenticationProvider.class);
+        ldapProvider.getConstructorArgumentValues().addGenericArgumentValue(authenticator);
+        ldapProvider.getConstructorArgumentValues().addGenericArgumentValue(LdapUserServiceBeanDefinitionParser.parseAuthoritiesPopulator(elt, parserContext));
+
+        LdapConfigUtils.registerPostProcessorIfNecessary(parserContext.getRegistry());
+
+        ConfigUtils.getRegisteredProviders(parserContext).add(ldapProvider);
 
         return null;
     }

core/src/main/java/org/springframework/security/config/LdapServerBeanDefinitionParser.java

@@ -1,10 +1,6 @@
 package org.springframework.security.config;
 
-import javax.naming.directory.Attribute;
-import javax.naming.directory.Attributes;
-import javax.naming.directory.BasicAttribute;
-import javax.naming.directory.BasicAttributes;
-
+import org.springframework.security.ldap.DefaultSpringSecurityContextSource;
 import org.springframework.beans.factory.xml.BeanDefinitionParser;
 import org.springframework.beans.factory.xml.ParserContext;
 import org.springframework.beans.factory.xml.AbstractBeanDefinitionParser;
@@ -12,6 +8,7 @@ import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.beans.factory.support.RootBeanDefinition;
 import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.support.ManagedSet;
+import org.springframework.ldap.core.DirContextAdapter;
 import org.springframework.util.StringUtils;
 
 import org.w3c.dom.Element;
@@ -23,9 +20,7 @@ import org.apache.commons.logging.LogFactory;
  * @version $Id$
  */
 public class LdapServerBeanDefinitionParser implements BeanDefinitionParser {
-	private static final String CONTEXT_SOURCE_CLASS="org.springframework.security.ldap.DefaultSpringSecurityContextSource";
-	
-    private final Log logger = LogFactory.getLog(getClass());
+    private Log logger = LogFactory.getLog(getClass());
 
     /** Defines the Url of the ldap server to use. If not specified, an embedded apache DS instance will be created */
     private static final String ATT_URL = "url";
@@ -58,8 +53,7 @@ public class LdapServerBeanDefinitionParser implements BeanDefinitionParser {
         if (!StringUtils.hasText(url)) {
             contextSource = createEmbeddedServer(elt, parserContext);
         } else {
-            contextSource = new RootBeanDefinition();
-            contextSource.setBeanClassName(CONTEXT_SOURCE_CLASS);
+            contextSource = new RootBeanDefinition(DefaultSpringSecurityContextSource.class);
             contextSource.getConstructorArgumentValues().addIndexedArgumentValue(0, url);
         }
 
@@ -98,22 +92,17 @@ public class LdapServerBeanDefinitionParser implements BeanDefinitionParser {
      */
     private RootBeanDefinition createEmbeddedServer(Element element, ParserContext parserContext) {
         Object source = parserContext.extractSource(element);
-        BeanDefinitionBuilder configuration = 
-        	BeanDefinitionBuilder.rootBeanDefinition("org.apache.directory.server.configuration.MutableServerStartupConfiguration");
-        BeanDefinitionBuilder partition = 
-        	BeanDefinitionBuilder.rootBeanDefinition("org.apache.directory.server.core.partition.impl.btree.MutableBTreePartitionConfiguration");
+        BeanDefinitionBuilder configuration = BeanDefinitionBuilder.rootBeanDefinition("org.apache.directory.server.configuration.MutableServerStartupConfiguration");
+        BeanDefinitionBuilder partition = BeanDefinitionBuilder.rootBeanDefinition("org.apache.directory.server.core.partition.impl.btree.MutableBTreePartitionConfiguration");
         configuration.setSource(source);
         partition.setSource(source);
-        
-        Attributes rootAttributes = new BasicAttributes("dc", "springsecurity");
-        Attribute a = new BasicAttribute("objectClass");
-        a.add("top");
-        a.add("domain");
-        a.add("extensibleObject");
-        rootAttributes.put(a);
+
+        DirContextAdapter rootContext = new DirContextAdapter();
+        rootContext.setAttributeValues("objectClass", new String[] {"top", "domain", "extensibleObject"});
+        rootContext.setAttributeValue("dc", "springsecurity");
 
         partition.addPropertyValue("name", "springsecurity");
-        partition.addPropertyValue("contextEntry", rootAttributes);
+        partition.addPropertyValue("contextEntry", rootContext.getAttributes());
 
         String suffix = element.getAttribute(ATT_ROOT_SUFFIX);
 
@@ -142,15 +131,15 @@ public class LdapServerBeanDefinitionParser implements BeanDefinitionParser {
 
         String url = "ldap://127.0.0.1:" + port + "/" + suffix;
 
-        BeanDefinitionBuilder contextSource = BeanDefinitionBuilder.rootBeanDefinition(CONTEXT_SOURCE_CLASS);
-        contextSource.addConstructorArg(url);
-        contextSource.addPropertyValue("userDn", "uid=admin,ou=system");
-        contextSource.addPropertyValue("password", "secret");
+        RootBeanDefinition contextSource = new RootBeanDefinition(DefaultSpringSecurityContextSource.class);
+        contextSource.getConstructorArgumentValues().addIndexedArgumentValue(0, url);
+        contextSource.getPropertyValues().addPropertyValue("userDn", "uid=admin,ou=system");
+        contextSource.getPropertyValues().addPropertyValue("password", "secret");
 
         RootBeanDefinition apacheContainer = new RootBeanDefinition("org.springframework.security.config.ApacheDSContainer", null, null);
         apacheContainer.setSource(source);
         apacheContainer.getConstructorArgumentValues().addGenericArgumentValue(configuration.getBeanDefinition());
-        apacheContainer.getConstructorArgumentValues().addGenericArgumentValue(contextSource.getBeanDefinition());
+        apacheContainer.getConstructorArgumentValues().addGenericArgumentValue(contextSource);
 
         String ldifs = element.getAttribute(ATT_LDIF_FILE);
         if (!StringUtils.hasText(ldifs)) {
@@ -168,6 +157,6 @@ public class LdapServerBeanDefinitionParser implements BeanDefinitionParser {
 
         parserContext.getRegistry().registerBeanDefinition(BeanIds.EMBEDDED_APACHE_DS, apacheContainer);
 
-        return (RootBeanDefinition) contextSource.getBeanDefinition();
+        return contextSource;
     }
 }

core/src/main/java/org/springframework/security/config/LdapUserServiceBeanDefinitionParser.java

@@ -1,5 +1,8 @@
 package org.springframework.security.config;
 
+import org.springframework.security.userdetails.ldap.LdapUserDetailsService;
+import org.springframework.security.ldap.search.FilterBasedLdapUserSearch;
+import org.springframework.security.ldap.populator.DefaultLdapAuthoritiesPopulator;
 import org.springframework.beans.factory.xml.ParserContext;
 import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.support.RootBeanDefinition;
@@ -21,23 +24,12 @@ public class LdapUserServiceBeanDefinitionParser extends AbstractUserDetailsServ
 
     public static final String ATT_GROUP_SEARCH_FILTER = "group-search-filter";
     public static final String ATT_GROUP_SEARCH_BASE = "group-search-base";
-    public static final String ATT_GROUP_ROLE_ATTRIBUTE = "group-role-attribute";
+    public static final String ATT_GROUP_ROLE_ATTRIBUTE = "group-role-attribute";    
     public static final String DEF_GROUP_SEARCH_FILTER = "(uniqueMember={0})";
-    public static final String DEF_GROUP_SEARCH_BASE = "";
+    public static final String DEF_GROUP_SEARCH_BASE = "ou=groups";
 
-    static final String ATT_ROLE_PREFIX = "role-prefix";
-    static final String ATT_USER_CLASS = "user-details-class";
-    static final String OPT_PERSON = "person";
-    static final String OPT_INETORGPERSON = "inetOrgPerson";
-
-    public static final String LDAP_SEARCH_CLASS = "org.springframework.security.ldap.search.FilterBasedLdapUserSearch";
-    public static final String PERSON_MAPPER_CLASS = "org.springframework.security.userdetails.ldap.PersonContextMapper";
-    public static final String INET_ORG_PERSON_MAPPER_CLASS = "org.springframework.security.userdetails.ldap.InetOrgPersonContextMapper";
-    public static final String LDAP_USER_MAPPER_CLASS = "org.springframework.security.userdetails.ldap.LdapUserDetailsMapper";
-    public static final String LDAP_AUTHORITIES_POPULATOR_CLASS = "org.springframework.security.ldap.populator.DefaultLdapAuthoritiesPopulator";
-
-    protected String getBeanClassName(Element element) {
-        return "org.springframework.security.userdetails.ldap.LdapUserDetailsService";
+    protected Class getBeanClass(Element element) {
+        return LdapUserDetailsService.class;
     }
 
     protected void doParse(Element elt, ParserContext parserContext, BeanDefinitionBuilder builder) {
@@ -45,70 +37,56 @@ public class LdapUserServiceBeanDefinitionParser extends AbstractUserDetailsServ
         if (!StringUtils.hasText(elt.getAttribute(ATT_USER_SEARCH_FILTER))) {
             parserContext.getReaderContext().error("User search filter must be supplied", elt);
         }
-
+        
         builder.addConstructorArg(parseSearchBean(elt, parserContext));
         builder.addConstructorArg(parseAuthoritiesPopulator(elt, parserContext));
-        builder.addPropertyValue("userDetailsMapper", parseUserDetailsClass(elt, parserContext));
-    }
 
+        LdapConfigUtils.registerPostProcessorIfNecessary(parserContext.getRegistry());
+    }
+    
     static RootBeanDefinition parseSearchBean(Element elt, ParserContext parserContext) {
         String userSearchFilter = elt.getAttribute(ATT_USER_SEARCH_FILTER);
         String userSearchBase = elt.getAttribute(ATT_USER_SEARCH_BASE);
         Object source = parserContext.extractSource(elt);
-
+        
         if (StringUtils.hasText(userSearchBase)) {
             if(!StringUtils.hasText(userSearchFilter)) {
                 parserContext.getReaderContext().error(ATT_USER_SEARCH_BASE + " cannot be used without a " + ATT_USER_SEARCH_FILTER, source);
             }
         } else {
             userSearchBase = DEF_USER_SEARCH_BASE;
-        }
-
+        }        
+        
         if (!StringUtils.hasText(userSearchFilter)) {
             return null;
         }
-
-        BeanDefinitionBuilder searchBuilder = BeanDefinitionBuilder.rootBeanDefinition(LDAP_SEARCH_CLASS);
-        searchBuilder.setSource(source);
-        searchBuilder.addConstructorArg(userSearchBase);
-        searchBuilder.addConstructorArg(userSearchFilter);
-        searchBuilder.addConstructorArg(parseServerReference(elt, parserContext));
-
-        return (RootBeanDefinition) searchBuilder.getBeanDefinition();
+        
+        RootBeanDefinition search = new RootBeanDefinition(FilterBasedLdapUserSearch.class);
+        search.setSource(source);
+        search.getConstructorArgumentValues().addIndexedArgumentValue(0, userSearchBase);
+        search.getConstructorArgumentValues().addIndexedArgumentValue(1, userSearchFilter);
+        search.getConstructorArgumentValues().addIndexedArgumentValue(2, parseServerReference(elt, parserContext));
+        
+        return search;
     }
-
+    
     static RuntimeBeanReference parseServerReference(Element elt, ParserContext parserContext) {
         String server = elt.getAttribute(ATT_SERVER);
-        boolean requiresDefaultName = false;
 
         if (!StringUtils.hasText(server)) {
             server = BeanIds.CONTEXT_SOURCE;
-            requiresDefaultName = true;
         }
 
         RuntimeBeanReference contextSource = new RuntimeBeanReference(server);
         contextSource.setSource(parserContext.extractSource(elt));
-        LdapConfigUtils.registerPostProcessorIfNecessary(parserContext.getRegistry(), requiresDefaultName);
-
+        
         return contextSource;
     }
-
-    static RootBeanDefinition parseUserDetailsClass(Element elt, ParserContext parserContext) {
-        String userDetailsClass = elt.getAttribute(ATT_USER_CLASS);
-
-        if (OPT_PERSON.equals(userDetailsClass)) {
-            return new RootBeanDefinition(PERSON_MAPPER_CLASS, null, null);
-        } else if (OPT_INETORGPERSON.equals(userDetailsClass)) {
-            return new RootBeanDefinition(INET_ORG_PERSON_MAPPER_CLASS, null, null);
-        }
-        return new RootBeanDefinition(LDAP_USER_MAPPER_CLASS, null, null);
-    }
-
+    
     static RootBeanDefinition parseAuthoritiesPopulator(Element elt, ParserContext parserContext) {
         String groupSearchFilter = elt.getAttribute(ATT_GROUP_SEARCH_FILTER);
         String groupSearchBase = elt.getAttribute(ATT_GROUP_SEARCH_BASE);
         String groupRoleAttribute = elt.getAttribute(ATT_GROUP_ROLE_ATTRIBUTE);
-        String rolePrefix = elt.getAttribute(ATT_ROLE_PREFIX);
 
         if (!StringUtils.hasText(groupSearchFilter)) {
             groupSearchFilter = DEF_GROUP_SEARCH_FILTER;
@@ -117,25 +95,17 @@ public class LdapUserServiceBeanDefinitionParser extends AbstractUserDetailsServ
         if (!StringUtils.hasText(groupSearchBase)) {
             groupSearchBase = DEF_GROUP_SEARCH_BASE;
         }
-
-        BeanDefinitionBuilder populator = BeanDefinitionBuilder.rootBeanDefinition(LDAP_AUTHORITIES_POPULATOR_CLASS);
+        
+        RootBeanDefinition populator = new RootBeanDefinition(DefaultLdapAuthoritiesPopulator.class);
         populator.setSource(parserContext.extractSource(elt));
-        populator.addConstructorArg(parseServerReference(elt, parserContext));
-        populator.addConstructorArg(groupSearchBase);
-        populator.addPropertyValue("groupSearchFilter", groupSearchFilter);
-        populator.addPropertyValue("searchSubtree", Boolean.TRUE);
-
-        if (StringUtils.hasText(rolePrefix)) {
-            if ("none".equals(rolePrefix)) {
-                rolePrefix = "";
-            }
-            populator.addPropertyValue("rolePrefix", rolePrefix);
-        }
-
+        populator.getConstructorArgumentValues().addIndexedArgumentValue(0, parseServerReference(elt, parserContext));
+        populator.getConstructorArgumentValues().addIndexedArgumentValue(1, groupSearchBase);
+        populator.getPropertyValues().addPropertyValue("groupSearchFilter", groupSearchFilter);
+        
         if (StringUtils.hasLength(groupRoleAttribute)) {
-            populator.addPropertyValue("groupRoleAttribute", groupRoleAttribute);
+            populator.getPropertyValues().addPropertyValue("groupRoleAttribute", groupRoleAttribute);
         }
-
-        return (RootBeanDefinition) populator.getBeanDefinition();
+        
+        return populator;
     }
 }

core/src/main/java/org/springframework/security/config/LogoutBeanDefinitionParser.java

@@ -25,30 +25,21 @@ public class LogoutBeanDefinitionParser implements BeanDefinitionParser {
 
 	static final String ATT_LOGOUT_URL = "logout-url";
 	static final String DEF_LOGOUT_URL = "/j_spring_security_logout";
-	
-	String rememberMeServices;
-
-	public LogoutBeanDefinitionParser(String rememberMeServices) {
-		this.rememberMeServices = rememberMeServices;
-	}
 
 	public BeanDefinition parse(Element element, ParserContext parserContext) {
 		String logoutUrl = null;
         String logoutSuccessUrl = null;
         String invalidateSession = null;
 
-        BeanDefinitionBuilder builder = BeanDefinitionBuilder.rootBeanDefinition(LogoutFilter.class);
-
         if (element != null) {
-        	Object source = parserContext.extractSource(element);
-        	builder.setSource(source);
             logoutUrl = element.getAttribute(ATT_LOGOUT_URL);
-            ConfigUtils.validateHttpRedirect(logoutUrl, parserContext, source);
             logoutSuccessUrl = element.getAttribute(ATT_LOGOUT_SUCCESS_URL);
-            ConfigUtils.validateHttpRedirect(logoutSuccessUrl, parserContext, source);
             invalidateSession = element.getAttribute(ATT_INVALIDATE_SESSION);
         }
 
+        BeanDefinitionBuilder builder = BeanDefinitionBuilder.rootBeanDefinition(LogoutFilter.class);
+        builder.setSource(parserContext.extractSource(element));
+
         if (!StringUtils.hasText(logoutUrl)) {
         	logoutUrl = DEF_LOGOUT_URL;
         }
@@ -72,15 +63,14 @@ public class LogoutBeanDefinitionParser implements BeanDefinitionParser {
         }
         handlers.add(sclh);
 
-        if (rememberMeServices != null) {
-            handlers.add(new RuntimeBeanReference(rememberMeServices));
+        if (parserContext.getRegistry().containsBeanDefinition(BeanIds.REMEMBER_ME_SERVICES)) {
+            handlers.add(new RuntimeBeanReference(BeanIds.REMEMBER_ME_SERVICES));
         }
 
         builder.addConstructorArg(handlers);
 
         parserContext.getRegistry().registerBeanDefinition(BeanIds.LOGOUT_FILTER, builder.getBeanDefinition());
-        ConfigUtils.addHttpFilter(parserContext, new RuntimeBeanReference(BeanIds.LOGOUT_FILTER));
-        
+
         return null;
 	}
 }

core/src/main/java/org/springframework/security/config/MethodSecurityInterceptorPostProcessor.java

@@ -1,48 +0,0 @@
-package org.springframework.security.config;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.beans.BeansException;
-import org.springframework.beans.factory.BeanFactory;
-import org.springframework.beans.factory.BeanFactoryAware;
-import org.springframework.beans.factory.config.BeanPostProcessor;
-import org.springframework.security.AfterInvocationManager;
-import org.springframework.security.intercept.method.aopalliance.MethodSecurityInterceptor;
-
-/**
- * BeanPostProcessor which sets the AfterInvocationManager on the default MethodSecurityInterceptor,
- * if one has been configured. 
- * 
- * @author Luke Taylor
- * @version $Id$
- * 
- */
-public class MethodSecurityInterceptorPostProcessor implements BeanPostProcessor, BeanFactoryAware{
-    private Log logger = LogFactory.getLog(getClass());
-
-    private BeanFactory beanFactory;
-
-    public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException {
-        if(!BeanIds.METHOD_SECURITY_INTERCEPTOR.equals(beanName)) {
-            return bean;
-        }
-
-        MethodSecurityInterceptor interceptor = (MethodSecurityInterceptor) bean;
-
-        if (beanFactory.containsBean(BeanIds.AFTER_INVOCATION_MANAGER)) {
-        	logger.debug("Setting AfterInvocationManaer on MethodSecurityInterceptor");
-        	interceptor.setAfterInvocationManager((AfterInvocationManager) 
-        			beanFactory.getBean(BeanIds.AFTER_INVOCATION_MANAGER));
-        }
-
-        return bean;
-    }
-
-	public Object postProcessAfterInitialization(Object bean, String beanName) {
-		return bean;
-	}
-
-	public void setBeanFactory(BeanFactory beanFactory) throws BeansException {
-		this.beanFactory = beanFactory;
-	}
-}

core/src/main/java/org/springframework/security/config/NamespaceAuthenticationManager.java

@@ -1,59 +0,0 @@
-package org.springframework.security.config;
-
-import java.util.ArrayList;
-import java.util.Iterator;
-import java.util.List;
-
-import org.springframework.beans.factory.BeanFactory;
-import org.springframework.beans.factory.BeanFactoryAware;
-import org.springframework.security.providers.ProviderManager;
-import org.springframework.util.Assert;
-
-/**
- * Extended version of {@link ProviderManager the default authentication manager} which lazily initializes
- * the list of {@link AuthenticationProvider}s. This prevents some of the issues that have occurred with 
- * namespace configuration where early instantiation of a security interceptor has caused the AuthenticationManager
- * and thus dependent beans (typically UserDetailsService implementations or DAOs) to be initialized too early. 
- * 
- * @author Luke Taylor
- * @since 2.0.4
- */
-public class NamespaceAuthenticationManager extends ProviderManager implements BeanFactoryAware {
-	BeanFactory beanFactory;
-	List providerBeanNames;
-	
-	public void setBeanFactory(BeanFactory beanFactory) {
-		this.beanFactory = beanFactory;
-	}
-
-	public void afterPropertiesSet() throws Exception {
-		Assert.notNull(providerBeanNames, "provideBeanNames has not been set");
-		Assert.notEmpty(providerBeanNames, "No authentication providers were found in the application context");
-		
-		super.afterPropertiesSet();
-	}
-
-	/**
-	 * Overridden to lazily-initialize the list of providers on first use.
-	 */
-	public List getProviders() {
-		// We use the names array to determine whether the list has been set yet.
-		if (providerBeanNames != null) {
-			List providers = new ArrayList();
-			Iterator beanNames = providerBeanNames.iterator();
-			
-			while (beanNames.hasNext()) {
-				providers.add(beanFactory.getBean((String) beanNames.next()));
-			}
-			providerBeanNames = null;
-			
-			setProviders(providers);
-		}
-		
-		return super.getProviders();
-	}
-
-	public void setProviderBeanNames(List provideBeanNames) {
-		this.providerBeanNames = provideBeanNames;
-	}
-}

core/src/main/java/org/springframework/security/config/OrderedFilterBeanDefinitionDecorator.java

@@ -9,8 +9,8 @@ import javax.servlet.ServletException;
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 
+import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.beans.factory.config.BeanDefinitionHolder;
-import org.springframework.beans.factory.config.RuntimeBeanReference;
 import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.xml.BeanDefinitionDecorator;
 import org.springframework.beans.factory.xml.ParserContext;
@@ -22,8 +22,8 @@ import org.w3c.dom.Element;
 import org.w3c.dom.Node;
 
 /**
- * Adds the decorated "Filter" bean into the standard filter chain maintained by the FilterChainProxy.
- * This allows user to add their own custom filters to the security chain. If the user's filter
+ * Replaces a Spring bean of type "Filter" with a wrapper class which implements the <tt>Ordered</tt>
+ * interface. This allows user to add their own filter to the security chain. If the user's filter
  * already implements Ordered, and no "order" attribute is specified, the filter's default order will be used.
  *
  * @author Luke Taylor
@@ -33,23 +33,22 @@ public class OrderedFilterBeanDefinitionDecorator implements BeanDefinitionDecor
 
     public static final String ATT_AFTER = "after";
     public static final String ATT_BEFORE = "before";
-    public static final String ATT_POSITION = "position";
+    public static final String ATT_POSITION = "position";    
 
     public BeanDefinitionHolder decorate(Node node, BeanDefinitionHolder holder, ParserContext parserContext) {
         Element elt = (Element)node;
         String order = getOrder(elt, parserContext);
 
+        BeanDefinition filter = holder.getBeanDefinition();
         BeanDefinitionBuilder wrapper = BeanDefinitionBuilder.rootBeanDefinition("org.springframework.security.config.OrderedFilterBeanDefinitionDecorator$OrderedFilterDecorator");
         wrapper.addConstructorArg(holder.getBeanName());
-        wrapper.addConstructorArg(new RuntimeBeanReference(holder.getBeanName()));
+        wrapper.addConstructorArg(filter);
 
         if (StringUtils.hasText(order)) {
             wrapper.addPropertyValue("order", order);
         }
 
-        ConfigUtils.addHttpFilter(parserContext, wrapper.getBeanDefinition());
-
-        return holder;
+        return new BeanDefinitionHolder(wrapper.getBeanDefinition(), holder.getBeanName());
     }
 
     /**
@@ -59,26 +58,22 @@ public class OrderedFilterBeanDefinitionDecorator implements BeanDefinitionDecor
         String after = elt.getAttribute(ATT_AFTER);
         String before = elt.getAttribute(ATT_BEFORE);
         String position = elt.getAttribute(ATT_POSITION);
-
+        
         if(ConfigUtils.countNonEmpty(new String[] {after, before, position}) != 1) {
-            pc.getReaderContext().error("A single '" + ATT_AFTER + "', '" + ATT_BEFORE + "', or '" +
-                    ATT_POSITION + "' attribute must be supplied", pc.extractSource(elt));
+        	pc.getReaderContext().error("A single '" + ATT_AFTER + "', '" + ATT_BEFORE + "', or '" +
+        			ATT_POSITION + "' attribute must be supplied", pc.extractSource(elt));
         }
-
+        
         if (StringUtils.hasText(position)) {
-            return Integer.toString(FilterChainOrder.getOrder(position));
+        	return Integer.toString(FilterChainOrder.getOrder(position));
         }
-
+        
         if (StringUtils.hasText(after)) {
-            int order = FilterChainOrder.getOrder(after);
-
-            return Integer.toString(order == Integer.MAX_VALUE ? order : order + 1);
+            return Integer.toString(FilterChainOrder.getOrder(after) + 1);
         }
 
         if (StringUtils.hasText(before)) {
-            int order = FilterChainOrder.getOrder(before);
-
-            return Integer.toString(order == Integer.MIN_VALUE ? order : order - 1);
+            return Integer.toString(FilterChainOrder.getOrder(before) - 1);
         }
 
         return null;
@@ -124,13 +119,5 @@ public class OrderedFilterBeanDefinitionDecorator implements BeanDefinitionDecor
         public String getBeanName() {
             return beanName;
         }
-
-        public String toString() {
-            return "OrderedFilterDecorator[ delegate=" + delegate + "; order=" + getOrder() + "]";
-        }
-
-        Filter getDelegate() {
-            return delegate;
-        }
     }
 }

core/src/main/java/org/springframework/security/config/PasswordEncoderParser.java

@@ -35,7 +35,6 @@ public class PasswordEncoderParser {
     static final String ATT_BASE_64 = "base64";
     static final String OPT_HASH_PLAINTEXT = "plaintext";    
     static final String OPT_HASH_SHA = "sha";
-    static final String OPT_HASH_SHA256 = "sha-256";    
     static final String OPT_HASH_MD4 = "md4";
     static final String OPT_HASH_MD5 = "md5";
     static final String OPT_HASH_LDAP_SHA = "{sha}";
@@ -46,7 +45,6 @@ public class PasswordEncoderParser {
         ENCODER_CLASSES = new HashMap();
         ENCODER_CLASSES.put(OPT_HASH_PLAINTEXT, PlaintextPasswordEncoder.class);
         ENCODER_CLASSES.put(OPT_HASH_SHA, ShaPasswordEncoder.class);
-        ENCODER_CLASSES.put(OPT_HASH_SHA256, ShaPasswordEncoder.class);
         ENCODER_CLASSES.put(OPT_HASH_MD4, Md4PasswordEncoder.class);
         ENCODER_CLASSES.put(OPT_HASH_MD5, Md5PasswordEncoder.class);
         ENCODER_CLASSES.put(OPT_HASH_LDAP_SHA, LdapShaPasswordEncoder.class);
@@ -76,11 +74,6 @@ public class PasswordEncoderParser {
         } else {
             Class beanClass = (Class) ENCODER_CLASSES.get(hash);
             RootBeanDefinition beanDefinition = new RootBeanDefinition(beanClass);
-            
-            if (OPT_HASH_SHA256.equals(hash)) {
-            	beanDefinition.getConstructorArgumentValues().addIndexedArgumentValue(0, new Integer(256));
-            }
-            
             beanDefinition.setSource(parserContext.extractSource(element));
             if (useBase64) {
                 if (BaseDigestPasswordEncoder.class.isAssignableFrom(beanClass)) {

core/src/main/java/org/springframework/security/config/RememberMeBeanDefinitionParser.java

@@ -23,16 +23,13 @@ import org.w3c.dom.Element;
  */
 public class RememberMeBeanDefinitionParser implements BeanDefinitionParser {
     static final String ATT_KEY = "key";
-    static final String DEF_KEY = "SpringSecured";
+    static final String DEF_KEY = "doesNotMatter";
 
-	static final String ATT_DATA_SOURCE = "data-source-ref";
-	static final String ATT_SERVICES_REF = "services-ref";
+	static final String ATT_DATA_SOURCE = "data-source";
 	static final String ATT_TOKEN_REPOSITORY = "token-repository-ref";
 	static final String ATT_USER_SERVICE_REF = "user-service-ref";
-	static final String ATT_TOKEN_VALIDITY = "token-validity-seconds";
-
+	
 	protected final Log logger = LogFactory.getLog(getClass());
-	private String servicesName;
 
     public BeanDefinition parse(Element element, ParserContext parserContext) {
         String tokenRepository = null;
@@ -40,106 +37,73 @@ public class RememberMeBeanDefinitionParser implements BeanDefinitionParser {
         String key = null;
         Object source = null;
         String userServiceRef = null;
-        String rememberMeServicesRef = null;
-        String tokenValiditySeconds = null;
 
         if (element != null) {
             tokenRepository = element.getAttribute(ATT_TOKEN_REPOSITORY);
             dataSource = element.getAttribute(ATT_DATA_SOURCE);
             key = element.getAttribute(ATT_KEY);
-            userServiceRef = element.getAttribute(ATT_USER_SERVICE_REF);
-            rememberMeServicesRef = element.getAttribute(ATT_SERVICES_REF);
-            tokenValiditySeconds = element.getAttribute(ATT_TOKEN_VALIDITY);
+            userServiceRef = element.getAttribute(ATT_USER_SERVICE_REF);            
             source = parserContext.extractSource(element);
         }
-        
-        if (!StringUtils.hasText(key)) {
-        	key = DEF_KEY;
-        }        
-        
-        RootBeanDefinition services = null;
+
+        RootBeanDefinition filter = new RootBeanDefinition(RememberMeProcessingFilter.class);
+        RootBeanDefinition services = new RootBeanDefinition(PersistentTokenBasedRememberMeServices.class);
+
+        filter.getPropertyValues().addPropertyValue("authenticationManager",
+                new RuntimeBeanReference(BeanIds.AUTHENTICATION_MANAGER));
 
         boolean dataSourceSet = StringUtils.hasText(dataSource);
         boolean tokenRepoSet = StringUtils.hasText(tokenRepository);
-        boolean servicesRefSet = StringUtils.hasText(rememberMeServicesRef);
-        boolean userServiceSet = StringUtils.hasText(userServiceRef);
-        boolean tokenValiditySet = StringUtils.hasText(tokenValiditySeconds);
-        
-        if (servicesRefSet && (dataSourceSet || tokenRepoSet || userServiceSet || tokenValiditySet)) {
-    		parserContext.getReaderContext().error(ATT_SERVICES_REF + " can't be used in combination with attributes " 
-    				+ ATT_TOKEN_REPOSITORY + "," + ATT_DATA_SOURCE + ", " + ATT_USER_SERVICE_REF + " or " + ATT_TOKEN_VALIDITY, source);        	
-        }
-        
+
         if (dataSourceSet && tokenRepoSet) {
-            parserContext.getReaderContext().error("Specify " + ATT_TOKEN_REPOSITORY + " or " + 
-            		ATT_DATA_SOURCE +" but not both", source);
+            parserContext.getReaderContext().error("Specify tokenRepository or dataSource but not both", element);
         }
 
         boolean isPersistent = dataSourceSet | tokenRepoSet;
 
         if (isPersistent) {
             Object tokenRepo;
-            services = new RootBeanDefinition(PersistentTokenBasedRememberMeServices.class);
 
             if (tokenRepoSet) {
                 tokenRepo = new RuntimeBeanReference(tokenRepository);
             } else {
                 tokenRepo = new RootBeanDefinition(JdbcTokenRepositoryImpl.class);
-                ((BeanDefinition)tokenRepo).getPropertyValues().addPropertyValue("dataSource",
+                ((BeanDefinition)tokenRepo).getPropertyValues().addPropertyValue(ATT_DATA_SOURCE,
                         new RuntimeBeanReference(dataSource));
             }
             services.getPropertyValues().addPropertyValue("tokenRepository", tokenRepo);
-        } else if (!servicesRefSet) {
+        } else {
+            isPersistent = false;
             services = new RootBeanDefinition(TokenBasedRememberMeServices.class);
         }
 
-        if (services != null) {
-	        if (userServiceSet) {
-	            services.getPropertyValues().addPropertyValue("userDetailsService", new RuntimeBeanReference(userServiceRef));
-	        }
-	        
-	        if (tokenValiditySet) {
-	        	services.getPropertyValues().addPropertyValue("tokenValiditySeconds", new Integer(tokenValiditySeconds));
-	        }
-	        services.setSource(source);
-	        services.getPropertyValues().addPropertyValue(ATT_KEY, key);
-	        parserContext.getRegistry().registerBeanDefinition(BeanIds.REMEMBER_ME_SERVICES, services);
-	        servicesName = BeanIds.REMEMBER_ME_SERVICES;
-        } else {
-        	servicesName = rememberMeServicesRef;
-        	parserContext.getRegistry().registerAlias(rememberMeServicesRef, BeanIds.REMEMBER_ME_SERVICES);
+        if (!StringUtils.hasText(key) && !isPersistent) {
+        	key = DEF_KEY;
         }
-        
-        registerProvider(parserContext, source, key);        
-        
-        registerFilter(parserContext, source);
 
-        return null;
-    }
-    
-    String getServicesName() {
-		return servicesName;
-	}
-
-	private void registerProvider(ParserContext pc, Object source, String key) {
-        //BeanDefinition authManager = ConfigUtils.registerProviderManagerIfNecessary(pc);
+        BeanDefinition authManager = ConfigUtils.registerProviderManagerIfNecessary(parserContext);
         RootBeanDefinition provider = new RootBeanDefinition(RememberMeAuthenticationProvider.class);
-        provider.setSource(source);
-        provider.getPropertyValues().addPropertyValue(ATT_KEY, key);
-        pc.getRegistry().registerBeanDefinition(BeanIds.REMEMBER_ME_AUTHENTICATION_PROVIDER, provider);
-        ConfigUtils.addAuthenticationProvider(pc, BeanIds.REMEMBER_ME_AUTHENTICATION_PROVIDER);
-    }
-    
-    private void registerFilter(ParserContext pc, Object source) {
-        RootBeanDefinition filter = new RootBeanDefinition(RememberMeProcessingFilter.class);
+
         filter.setSource(source);
-        filter.getPropertyValues().addPropertyValue("authenticationManager",
-                new RuntimeBeanReference(BeanIds.AUTHENTICATION_MANAGER));        
-        
+        services.setSource(source);
+        provider.setSource(source);
+
+        if (StringUtils.hasText(userServiceRef)) {
+            services.getPropertyValues().addPropertyValue("userDetailsService", new RuntimeBeanReference(userServiceRef));
+        }
+
+        provider.getPropertyValues().addPropertyValue(ATT_KEY, key);
+        services.getPropertyValues().addPropertyValue(ATT_KEY, key);
+
+        ManagedList providers = (ManagedList) authManager.getPropertyValues().getPropertyValue("providers").getValue();
+        providers.add(provider);
+
         filter.getPropertyValues().addPropertyValue("rememberMeServices",
                 new RuntimeBeanReference(BeanIds.REMEMBER_ME_SERVICES));
 
-        pc.getRegistry().registerBeanDefinition(BeanIds.REMEMBER_ME_FILTER, filter);
-        ConfigUtils.addHttpFilter(pc, new RuntimeBeanReference(BeanIds.REMEMBER_ME_FILTER));    	
+        parserContext.getRegistry().registerBeanDefinition(BeanIds.REMEMBER_ME_SERVICES, services);
+        parserContext.getRegistry().registerBeanDefinition(BeanIds.REMEMBER_ME_FILTER, filter);
+
+        return null;
     }
 }

core/src/main/java/org/springframework/security/config/RememberMeServicesInjectionBeanPostProcessor.java

@@ -33,7 +33,7 @@ public class RememberMeServicesInjectionBeanPostProcessor implements BeanPostPro
                 logger.info("Setting RememberMeServices on bean " + beanName);
                 pf.setRememberMeServices(getRememberMeServices());
             }
-        } else if (BeanIds.BASIC_AUTHENTICATION_FILTER.equals(beanName)) {
+        } else if (beanName.equals(BeanIds.BASIC_AUTHENTICATION_FILTER)) {
             // NB: For remember-me to be sent back, a user must submit a "_spring_security_remember_me" with their login request.
             // Most of the time a user won't present such a parameter with their BASIC authentication request.
             // In the future we might support setting the AbstractRememberMeServices.alwaysRemember = true, but I am reluctant to
@@ -51,8 +51,7 @@ public class RememberMeServicesInjectionBeanPostProcessor implements BeanPostPro
         Map beans = beanFactory.getBeansOfType(RememberMeServices.class);
         
         Assert.isTrue(beans.size() > 0, "No RememberMeServices configured"); 
-        Assert.isTrue(beans.size() == 1, "Use of '<remember-me />' requires a single instance of RememberMeServices " +
-        		"in the application context, but more than one was found.");
+        Assert.isTrue(beans.size() == 1, "More than one RememberMeServices bean found.");
 
         return (RememberMeServices) beans.values().toArray()[0];
     }

core/src/main/java/org/springframework/security/config/SecurityNamespaceHandler.java

@@ -30,6 +30,5 @@ public class SecurityNamespaceHandler extends NamespaceHandlerSupport {
         registerBeanDefinitionDecorator(Elements.FILTER_CHAIN_MAP, new FilterChainMapBeanDefinitionDecorator());
         registerBeanDefinitionDecorator(Elements.CUSTOM_FILTER, new OrderedFilterBeanDefinitionDecorator());
         registerBeanDefinitionDecorator(Elements.CUSTOM_AUTH_PROVIDER, new CustomAuthenticationProviderBeanDefinitionDecorator());
-        registerBeanDefinitionDecorator(Elements.CUSTOM_AFTER_INVOCATION_PROVIDER, new CustomAfterInvocationProviderBeanDefinitionDecorator());        
     }
 }

core/src/main/java/org/springframework/security/config/SessionRegistryInjectionBeanPostProcessor.java

@@ -1,94 +0,0 @@
-package org.springframework.security.config;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import org.springframework.beans.BeansException;
-import org.springframework.beans.factory.BeanFactory;
-import org.springframework.beans.factory.BeanFactoryAware;
-import org.springframework.beans.factory.ListableBeanFactory;
-import org.springframework.beans.factory.config.BeanPostProcessor;
-import org.springframework.security.concurrent.ConcurrentSessionController;
-import org.springframework.security.concurrent.ConcurrentSessionControllerImpl;
-import org.springframework.security.concurrent.SessionRegistry;
-import org.springframework.security.ui.AbstractProcessingFilter;
-import org.springframework.security.ui.SessionFixationProtectionFilter;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
-/**
- * Registered by the <tt>AuthenticationManagerBeanDefinitionParser</tt> if an external 
- * ConcurrentSessionController is set (and hence an external SessionRegistry). 
- * Its responsibility is to set the SessionRegistry on namespace-registered beans which require access
- * to it.
- * <p>
- * It will attempt to read the registry directly from the registered controller. If that fails, it will look in
- * the application context for a registered SessionRegistry bean.
- * 
- * See SEC-879. 
- * 
- * @author Luke Taylor
- * @since 2.0.3
- */
-class SessionRegistryInjectionBeanPostProcessor implements BeanPostProcessor, BeanFactoryAware {
-    private final Log logger = LogFactory.getLog(getClass());
-    private ListableBeanFactory beanFactory;
-    private SessionRegistry sessionRegistry;
-    private final String controllerBeanName;
-
-    SessionRegistryInjectionBeanPostProcessor(String controllerBeanName) {
-    	this.controllerBeanName = controllerBeanName;
-    }
-    
-	public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException {
-		if (BeanIds.FORM_LOGIN_FILTER.equals(beanName) || 
-				BeanIds.OPEN_ID_FILTER.equals(beanName)) {
-			((AbstractProcessingFilter) bean).setSessionRegistry(getSessionRegistry());
-		} else if (BeanIds.SESSION_FIXATION_PROTECTION_FILTER.equals(beanName)) {
-			((SessionFixationProtectionFilter)bean).setSessionRegistry(getSessionRegistry());
-		}
-
-		return bean;
-	}	
-	
-	public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
-		return bean;
-	}
-	
-	private SessionRegistry getSessionRegistry() {
-		if (sessionRegistry != null) {
-			return sessionRegistry;
-		}
-		
-		logger.info("Attempting to read SessionRegistry from registered ConcurrentSessionController bean");
-		
-		ConcurrentSessionController controller = (ConcurrentSessionController) beanFactory.getBean(controllerBeanName);
-		
-		if (controller instanceof ConcurrentSessionControllerImpl) {
-			sessionRegistry = ((ConcurrentSessionControllerImpl)controller).getSessionRegistry();
-			
-			return sessionRegistry;
-		}
-
-		logger.info("ConcurrentSessionController is not a standard implementation. SessionRegistry could not be read from it. Looking for it in the context.");
-		
-		List sessionRegs = new ArrayList(beanFactory.getBeansOfType(SessionRegistry.class).values());
-		
-		if (sessionRegs.size() == 0) {			
-			throw new SecurityConfigurationException("concurrent-session-controller-ref was set but no SessionRegistry could be obtained from the application context.");
-		}
-		
-		if (sessionRegs.size() > 1) {
-			logger.warn("More than one SessionRegistry instance in application context. Possible configuration errors may result.");
-		}
-		
-		sessionRegistry = (SessionRegistry) sessionRegs.get(0);
-		
-		return sessionRegistry;
-	}
-
-	public void setBeanFactory(BeanFactory beanFactory) throws BeansException {
-		this.beanFactory = (ListableBeanFactory) beanFactory;
-	}
-}

core/src/main/java/org/springframework/security/config/UserDetailsServiceInjectionBeanPostProcessor.java

@@ -1,137 +0,0 @@
-package org.springframework.security.config;
-
-import java.util.Map;
-
-import org.springframework.beans.BeanWrapperImpl;
-import org.springframework.beans.BeansException;
-import org.springframework.beans.PropertyValue;
-import org.springframework.beans.factory.BeanFactory;
-import org.springframework.beans.factory.BeanFactoryAware;
-import org.springframework.beans.factory.config.BeanDefinition;
-import org.springframework.beans.factory.config.BeanPostProcessor;
-import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
-import org.springframework.beans.factory.config.RuntimeBeanReference;
-import org.springframework.beans.factory.support.RootBeanDefinition;
-import org.springframework.security.providers.preauth.PreAuthenticatedAuthenticationProvider;
-import org.springframework.security.ui.rememberme.AbstractRememberMeServices;
-import org.springframework.security.userdetails.UserDetailsByNameServiceWrapper;
-import org.springframework.security.userdetails.UserDetailsService;
-import org.springframework.util.Assert;
-
-/**
- * Registered by {@link HttpSecurityBeanDefinitionParser} to inject a UserDetailsService into
- * the X509Provider, RememberMeServices and OpenIDAuthenticationProvider instances created by
- * the namespace.
- *
- * @author Luke Taylor
- * @since 2.0.2
- */
-public class UserDetailsServiceInjectionBeanPostProcessor implements BeanPostProcessor, BeanFactoryAware {
-    private ConfigurableListableBeanFactory beanFactory;
-
-    public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException {
-        if (BeanIds.X509_AUTH_PROVIDER.equals(beanName)) {
-            injectUserDetailsServiceIntoX509Provider((PreAuthenticatedAuthenticationProvider) bean);
-        } else if (BeanIds.REMEMBER_ME_SERVICES.equals(beanName)) {
-            injectUserDetailsServiceIntoRememberMeServices((AbstractRememberMeServices)bean);
-        } else if (BeanIds.OPEN_ID_PROVIDER.equals(beanName)) {
-            injectUserDetailsServiceIntoOpenIDProvider(bean);
-        }
-
-        return bean;
-    }
-
-    public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
-        return bean;
-    }
-
-    private void injectUserDetailsServiceIntoRememberMeServices(AbstractRememberMeServices services) {
-        BeanDefinition beanDefinition = beanFactory.getBeanDefinition(BeanIds.REMEMBER_ME_SERVICES);
-        PropertyValue pv = beanDefinition.getPropertyValues().getPropertyValue("userDetailsService");
-
-        if (pv == null) {
-            services.setUserDetailsService(getUserDetailsService());
-        } else {
-            UserDetailsService cachingUserService = getCachingUserService(pv.getValue());
-
-            if (cachingUserService != null) {
-                services.setUserDetailsService(cachingUserService);
-            }
-        }
-    }
-
-    private void injectUserDetailsServiceIntoX509Provider(PreAuthenticatedAuthenticationProvider provider) {
-        BeanDefinition beanDefinition = beanFactory.getBeanDefinition(BeanIds.X509_AUTH_PROVIDER);
-        PropertyValue pv = beanDefinition.getPropertyValues().getPropertyValue("preAuthenticatedUserDetailsService");
-        UserDetailsByNameServiceWrapper wrapper = new UserDetailsByNameServiceWrapper();
-
-        if (pv == null) {
-            wrapper.setUserDetailsService(getUserDetailsService());
-            provider.setPreAuthenticatedUserDetailsService(wrapper);
-        } else {
-            RootBeanDefinition preAuthUserService = (RootBeanDefinition) pv.getValue();
-            Object userService =
-                preAuthUserService.getPropertyValues().getPropertyValue("userDetailsService").getValue();
-
-            UserDetailsService cachingUserService = getCachingUserService(userService);
-
-            if (cachingUserService != null) {
-                wrapper.setUserDetailsService(cachingUserService);
-                provider.setPreAuthenticatedUserDetailsService(wrapper);
-            }
-        }
-    }
-
-    private void injectUserDetailsServiceIntoOpenIDProvider(Object bean) {
-        BeanDefinition beanDefinition = beanFactory.getBeanDefinition(BeanIds.OPEN_ID_PROVIDER);
-        PropertyValue pv = beanDefinition.getPropertyValues().getPropertyValue("userDetailsService");
-
-        if (pv == null) {
-            BeanWrapperImpl beanWrapper = new BeanWrapperImpl(bean);
-            beanWrapper.setPropertyValue("userDetailsService", getUserDetailsService());
-        }
-    }
-
-
-    /**
-     * Obtains a user details service for use in RememberMeServices etc. Will return a caching version
-     * if available so should not be used for beans which need to separate the two.
-     */
-    UserDetailsService getUserDetailsService() {
-        Map beans = beanFactory.getBeansOfType(CachingUserDetailsService.class);
-
-        if (beans.size() == 0) {
-            beans = beanFactory.getBeansOfType(UserDetailsService.class);
-        }
-
-        if (beans.size() == 0) {
-            throw new SecurityConfigurationException("No UserDetailsService registered.");
-
-        } else if (beans.size() > 1) {
-            throw new SecurityConfigurationException("More than one UserDetailsService registered. Please " +
-                    "use a specific Id in your configuration");
-        }
-
-        return (UserDetailsService) beans.values().toArray()[0];
-    }
-
-    private UserDetailsService getCachingUserService(Object userServiceRef) {
-        Assert.isInstanceOf(RuntimeBeanReference.class, userServiceRef,
-                "userDetailsService property value must be a RuntimeBeanReference");
-
-        String id = ((RuntimeBeanReference)userServiceRef).getBeanName();
-        // Overwrite with the caching version if available
-        String cachingId = id + AbstractUserDetailsServiceBeanDefinitionParser.CACHING_SUFFIX;
-
-        if (beanFactory.containsBeanDefinition(cachingId)) {
-            return (UserDetailsService) beanFactory.getBean(cachingId);
-        }
-
-        return null;
-    }
-
-
-    public void setBeanFactory(BeanFactory beanFactory) throws BeansException {
-        this.beanFactory = (ConfigurableListableBeanFactory) beanFactory;
-    }
-}

core/src/main/java/org/springframework/security/config/UserServiceBeanDefinitionParser.java

@@ -6,6 +6,7 @@ import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.support.RootBeanDefinition;
 import org.springframework.beans.factory.xml.ParserContext;
 import org.springframework.beans.factory.BeanDefinitionStoreException;
+import org.springframework.security.userdetails.memory.InMemoryDaoImpl;
 import org.springframework.security.userdetails.memory.UserMap;
 import org.springframework.security.userdetails.User;
 import org.springframework.security.util.AuthorityUtils;
@@ -32,8 +33,8 @@ public class UserServiceBeanDefinitionParser extends AbstractUserDetailsServiceB
 	static final String ATT_DISABLED = "disabled";
     static final String ATT_LOCKED = "locked";
 
-    protected String getBeanClassName(Element element) {
-        return "org.springframework.security.userdetails.memory.InMemoryDaoImpl";
+    protected Class getBeanClass(Element element) {
+        return InMemoryDaoImpl.class;
     }
 
     protected void doParse(Element element, ParserContext parserContext, BeanDefinitionBuilder builder) {

core/src/main/java/org/springframework/security/config/X509BeanDefinitionParser.java

@@ -45,8 +45,8 @@ public class X509BeanDefinitionParser implements BeanDefinitionParser {
         }
 
         BeanDefinition provider = new RootBeanDefinition(PreAuthenticatedAuthenticationProvider.class);
+        ConfigUtils.getRegisteredProviders(parserContext).add(provider);
         parserContext.getRegistry().registerBeanDefinition(BeanIds.X509_AUTH_PROVIDER, provider);
-        ConfigUtils.addAuthenticationProvider(parserContext, BeanIds.X509_AUTH_PROVIDER);
 
         String userServiceRef = element.getAttribute(ATT_USER_SERVICE_REF);
 
@@ -62,7 +62,6 @@ public class X509BeanDefinitionParser implements BeanDefinitionParser {
 	    filterBuilder.addPropertyValue("authenticationManager", new RuntimeBeanReference(BeanIds.AUTHENTICATION_MANAGER));
 
 	    parserContext.getRegistry().registerBeanDefinition(BeanIds.X509_FILTER, filterBuilder.getBeanDefinition());
-	    ConfigUtils.addHttpFilter(parserContext, new RuntimeBeanReference(BeanIds.X509_FILTER));
 
 	    return null;
     }

core/src/main/java/org/springframework/security/context/HttpSessionContextIntegrationFilter.java

@@ -28,8 +28,6 @@ import javax.servlet.http.HttpSession;
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.util.Assert;
 import org.springframework.util.ReflectionUtils;
-import org.springframework.security.AuthenticationTrustResolver;
-import org.springframework.security.AuthenticationTrustResolverImpl;
 import org.springframework.security.ui.SpringSecurityFilter;
 import org.springframework.security.ui.FilterChainOrder;
 
@@ -152,8 +150,6 @@ public class HttpSessionContextIntegrationFilter extends SpringSecurityFilter im
      * method.
      */
     private boolean cloneFromHttpSession = false;
-    
-    private AuthenticationTrustResolver authenticationTrustResolver = new AuthenticationTrustResolverImpl(); 
 
     public boolean isCloneFromHttpSession() {
         return cloneFromHttpSession;
@@ -180,8 +176,6 @@ public class HttpSessionContextIntegrationFilter extends SpringSecurityFilter im
             throw new IllegalArgumentException(
                     "If using forceEagerSessionCreation, you must set allowSessionCreation to also be true");
         }
-        
-        contextObject = generateNewContext();
     }
 
     public void doFilterHttp(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
@@ -326,8 +320,7 @@ public class HttpSessionContextIntegrationFilter extends SpringSecurityFilter im
 
     /**
      * Stores the supplied security context in the session (if available) and if it has changed since it was
-     * set at the start of the request. If the AuthenticationTrustResolver identifies the current user as
-     * anonymous, then the context will not be stored. 
+     * set at the start of the request.
      *
      * @param securityContext the context object obtained from the SecurityContextHolder after the request has
      *        been processed by the filter chain. SecurityContextHolder.getContext() cannot be used to obtain
@@ -363,7 +356,7 @@ public class HttpSessionContextIntegrationFilter extends SpringSecurityFilter im
                                         + "(because the allowSessionCreation property is false) - SecurityContext thus not "
                                         + "stored for next request");
                     }
-                } else if (!contextObject.equals(securityContext)) {                	
+                } else if (!contextObject.equals(securityContext)) {
                     if (logger.isDebugEnabled()) {
                         logger.debug("HttpSession being created as SecurityContextHolder contents are non-default");
                     }
@@ -383,18 +376,11 @@ public class HttpSessionContextIntegrationFilter extends SpringSecurityFilter im
         // If HttpSession exists, store current SecurityContextHolder contents but only if
         // the SecurityContext has actually changed (see JIRA SEC-37)
         if (httpSession != null && securityContext.hashCode() != contextHashBeforeChainExecution) {
-        	// See SEC-766
-        	if (authenticationTrustResolver.isAnonymous(securityContext.getAuthentication())) {
-                if (logger.isDebugEnabled()) {
-                    logger.debug("SecurityContext contents are anonymous - context will not be stored in HttpSession. ");
-                }
-        	} else {
-	            httpSession.setAttribute(SPRING_SECURITY_CONTEXT_KEY, securityContext);
-	
-	            if (logger.isDebugEnabled()) {
-	                logger.debug("SecurityContext stored to HttpSession: '" + securityContext + "'");
-	            }
-        	}
+            httpSession.setAttribute(SPRING_SECURITY_CONTEXT_KEY, securityContext);
+
+            if (logger.isDebugEnabled()) {
+                logger.debug("SecurityContext stored to HttpSession: '" + securityContext + "'");
+            }
         }
     }
     

core/src/main/java/org/springframework/security/intercept/AbstractSecurityInterceptor.java

@@ -61,7 +61,7 @@ import java.util.Collection;
  * interceptor. It will also implement the proper handling of secure object invocations, namely:
  * <ol>
  * <li>Obtain the {@link Authentication} object from the {@link SecurityContextHolder}.</li>
- * <li>Determine if the request relates to a secured or public invocation by looking up the secure object request
+ * <li>Determine if the request relates to a secured or public invocation by ooking up the secure object request
  * against the {@link ObjectDefinitionSource}.</li>
  * <li>For an invocation that is secured (there is a
  * <code>ConfigAttributeDefinition</code> for the secure object invocation):

core/src/main/java/org/springframework/security/intercept/method/AbstractFallbackMethodDefinitionSource.java

@@ -18,11 +18,11 @@ import org.springframework.util.ObjectUtils;
  * Abstract implementation of {@link MethodDefinitionSource} that supports both Spring AOP and AspectJ and
  * caches configuration attribute resolution from: 1. specific target method; 2. target class;  3. declaring method;
  * 4. declaring class/interface.
- *
+ * 
  * <p>
  * This class mimics the behaviour of Spring's AbstractFallbackTransactionAttributeSource class.
  * </p>
- *
+ * 
  * <p>
  * Note that this class cannot extract security metadata where that metadata is expressed by way of
  * a target method/class (ie #1 and #2 above) AND the target method/class is encapsulated in another
@@ -31,7 +31,7 @@ import org.springframework.util.ObjectUtils;
  * another proxy), move the metadata to declared methods or interfaces the proxy implements, or provide
  * your own replacement <tt>MethodDefinitionSource</tt>.
  * </p>
- *
+ * 
  * @author Ben Alex
  * @version $Id$
  * @since 2.0
@@ -39,16 +39,15 @@ import org.springframework.util.ObjectUtils;
 public abstract class AbstractFallbackMethodDefinitionSource implements MethodDefinitionSource {
 
     private static final Log logger = LogFactory.getLog(AbstractFallbackMethodDefinitionSource.class);
-    private final static Object NULL_CONFIG_ATTRIBUTE = new Object();
+	private final static Object NULL_CONFIG_ATTRIBUTE = new Object();
     private final Map attributeCache = new HashMap();
 
     public ConfigAttributeDefinition getAttributes(Object object) throws IllegalArgumentException {
         Assert.notNull(object, "Object cannot be null");
 
         if (object instanceof MethodInvocation) {
-            MethodInvocation mi = (MethodInvocation) object;
-            Object target = mi.getThis();
-            return getAttributes(mi.getMethod(), target == null ? null : target.getClass());
+        	MethodInvocation mi = (MethodInvocation) object;
+            return getAttributes(mi.getMethod(), mi.getThis().getClass());
         }
 
         if (object instanceof JoinPoint) {
@@ -60,143 +59,143 @@ public abstract class AbstractFallbackMethodDefinitionSource implements MethodDe
 
             Method method = ClassUtils.getMethodIfAvailable(declaringType, targetMethodName, types);
             Assert.notNull(method, "Could not obtain target method from JoinPoint: '"+ jp + "'");
-
+            
             return getAttributes(method, targetClass);
         }
 
         throw new IllegalArgumentException("Object must be a MethodInvocation or JoinPoint");
     }
-
+    
     public final boolean supports(Class clazz) {
         return (MethodInvocation.class.isAssignableFrom(clazz) || JoinPoint.class.isAssignableFrom(clazz));
     }
-
+    
     public ConfigAttributeDefinition getAttributes(Method method, Class targetClass) {
-        // First, see if we have a cached value.
-        Object cacheKey = new DefaultCacheKey(method, targetClass);
-        synchronized (this.attributeCache) {
-            Object cached = this.attributeCache.get(cacheKey);
-            if (cached != null) {
-                // Value will either be canonical value indicating there is no config attribute,
-                // or an actual config attribute.
-                if (cached == NULL_CONFIG_ATTRIBUTE) {
-                    return null;
-                }
-                else {
-                    return (ConfigAttributeDefinition) cached;
-                }
-            }
-            else {
-                // We need to work it out.
-                ConfigAttributeDefinition cfgAtt = computeAttributes(method, targetClass);
-                // Put it in the cache.
-                if (cfgAtt == null) {
-                    this.attributeCache.put(cacheKey, NULL_CONFIG_ATTRIBUTE);
-                }
-                else {
-                    if (logger.isDebugEnabled()) {
-                        logger.debug("Adding security method [" + cacheKey + "] with attribute [" + cfgAtt + "]");
-                    }
-                    this.attributeCache.put(cacheKey, cfgAtt);
-                }
-                return cfgAtt;
-            }
-        }
+		// First, see if we have a cached value.
+		Object cacheKey = new DefaultCacheKey(method, targetClass);
+		synchronized (this.attributeCache) {
+			Object cached = this.attributeCache.get(cacheKey);
+			if (cached != null) {
+				// Value will either be canonical value indicating there is no config attribute,
+				// or an actual config attribute.
+				if (cached == NULL_CONFIG_ATTRIBUTE) {
+					return null;
+				}
+				else {
+					return (ConfigAttributeDefinition) cached;
+				}
+			}
+			else {
+				// We need to work it out.
+				ConfigAttributeDefinition cfgAtt = computeAttributes(method, targetClass);
+				// Put it in the cache.
+				if (cfgAtt == null) {
+					this.attributeCache.put(cacheKey, NULL_CONFIG_ATTRIBUTE);
+				}
+				else {
+					if (logger.isDebugEnabled()) {
+						logger.debug("Adding security method [" + cacheKey + "] with attribute [" + cfgAtt + "]");
+					}
+					this.attributeCache.put(cacheKey, cfgAtt);
+				}
+				return cfgAtt;
+			}
+		}
     }
-
+    
     /**
-     *
-     * @param method the method for the current invocation (never <code>null</code>)
-     * @param targetClass the target class for this invocation (may be <code>null</code>)
+     * 
+	 * @param method the method for the current invocation (never <code>null</code>)
+	 * @param targetClass the target class for this invocation (may be <code>null</code>)
      * @return
      */
     private ConfigAttributeDefinition computeAttributes(Method method, Class targetClass) {
-        // The method may be on an interface, but we need attributes from the target class.
-        // If the target class is null, the method will be unchanged.
-        Method specificMethod = ClassUtils.getMostSpecificMethod(method, targetClass);
-        // First try is the method in the target class.
-        ConfigAttributeDefinition attr = findAttributes(specificMethod, targetClass);
-        if (attr != null) {
-            return attr;
-        }
+    	// The method may be on an interface, but we need attributes from the target class.
+		// If the target class is null, the method will be unchanged.
+		Method specificMethod = ClassUtils.getMostSpecificMethod(method, targetClass);
+		// First try is the method in the target class.
+		ConfigAttributeDefinition attr = findAttributes(specificMethod, targetClass);
+		if (attr != null) {
+			return attr;
+		}
 
-        // Second try is the config attribute on the target class.
-        attr = findAttributes(specificMethod.getDeclaringClass());
-        if (attr != null) {
-            return attr;
-        }
+		// Second try is the config attribute on the target class.
+		attr = findAttributes(specificMethod.getDeclaringClass());
+		if (attr != null) {
+			return attr;
+		}
 
-        if (specificMethod != method || targetClass == null) {
-            // Fallback is to look at the original method.
-            attr = findAttributes(method, method.getDeclaringClass());
-            if (attr != null) {
-                return attr;
-            }
-            // Last fallback is the class of the original method.
-            return findAttributes(method.getDeclaringClass());
-        }
-        return null;
+		if (specificMethod != method) {
+			// Fallback is to look at the original method.
+			attr = findAttributes(method, method.getDeclaringClass());
+			if (attr != null) {
+				return attr;
+			}
+			// Last fallback is the class of the original method.
+			return findAttributes(method.getDeclaringClass());
+		}
+		return null;
 
     }
-
+    
     /**
      * Obtains the security metadata applicable to the specified method invocation.
-     *
+     * 
      * <p>
      * Note that the {@link Method#getDeclaringClass()} may not equal the <code>targetClass</code>.
      * Both parameters are provided to assist subclasses which may wish to provide advanced
      * capabilities related to method metadata being "registered" against a method even if the
      * target class does not declare the method (i.e. the subclass may only inherit the method).
-     *
+     * 
      * @param method the method for the current invocation (never <code>null</code>)
      * @param targetClass the target class for the invocation (may be <code>null</code>)
      * @return the security metadata (or null if no metadata applies)
      */
     protected abstract ConfigAttributeDefinition findAttributes(Method method, Class targetClass);
-
+    
     /**
      * Obtains the security metadata registered against the specified class.
-     *
+     * 
      * <p>
      * Subclasses should only return metadata expressed at a class level. Subclasses should NOT
      * aggregate metadata for each method registered against a class, as the abstract superclass
      * will separate invoke {@link #findAttributes(Method, Class)} for individual methods as
-     * appropriate.
-     *
+     * appropriate. 
+     * 
      * @param clazz the target class for the invocation (never <code>null</code>)
      * @return the security metadata (or null if no metadata applies)
      */
     protected abstract ConfigAttributeDefinition findAttributes(Class clazz);
+    
+	private static class DefaultCacheKey {
 
-    private static class DefaultCacheKey {
+		private final Method method;
+		private final Class targetClass;
 
-        private final Method method;
-        private final Class targetClass;
+		public DefaultCacheKey(Method method, Class targetClass) {
+			this.method = method;
+			this.targetClass = targetClass;
+		}
 
-        public DefaultCacheKey(Method method, Class targetClass) {
-            this.method = method;
-            this.targetClass = targetClass;
-        }
+		public boolean equals(Object other) {
+			if (this == other) {
+				return true;
+			}
+			if (!(other instanceof DefaultCacheKey)) {
+				return false;
+			}
+			DefaultCacheKey otherKey = (DefaultCacheKey) other;
+			return (this.method.equals(otherKey.method) &&
+					ObjectUtils.nullSafeEquals(this.targetClass, otherKey.targetClass));
+		}
 
-        public boolean equals(Object other) {
-            if (this == other) {
-                return true;
-            }
-            if (!(other instanceof DefaultCacheKey)) {
-                return false;
-            }
-            DefaultCacheKey otherKey = (DefaultCacheKey) other;
-            return (this.method.equals(otherKey.method) &&
-                    ObjectUtils.nullSafeEquals(this.targetClass, otherKey.targetClass));
-        }
-
-        public int hashCode() {
-            return this.method.hashCode() * 21 + (this.targetClass != null ? this.targetClass.hashCode() : 0);
-        }
-
-        public String toString() {
-            return "CacheKey[" + (targetClass == null ? "-" : targetClass.getName()) + "; " + method + "]";
-        }
-    }
+		public int hashCode() {
+			return this.method.hashCode() * 21 + (this.targetClass != null ? this.targetClass.hashCode() : 0);
+		}
 
+		public String toString() {
+			return "CacheKey[" + (targetClass == null ? "-" : targetClass.getName()) + "; " + method + "]";
+		}
+	}
+    
 }

core/src/main/java/org/springframework/security/intercept/method/MapBasedMethodDefinitionSource.java

@@ -34,13 +34,13 @@ import org.springframework.util.ClassUtils;
 
 /**
  * Stores a {@link ConfigAttributeDefinition} for a method or class signature.
- *
+ * 
  * <p>
  * This class is the preferred implementation of {@link MethodDefinitionSource} for XML-based
  * definition of method security metadata. To assist in XML-based definition, wildcard support
  * is provided.
  * </p>
- *
+ * 
  * @author Ben Alex
  * @version $Id$
  * @since 2.0
@@ -51,9 +51,9 @@ public class MapBasedMethodDefinitionSource extends AbstractFallbackMethodDefini
     private static final Log logger = LogFactory.getLog(MapBasedMethodDefinitionSource.class);
 
     //~ Instance fields ================================================================================================
-    private ClassLoader beanClassLoader = ClassUtils.getDefaultClassLoader();
+	private ClassLoader beanClassLoader = ClassUtils.getDefaultClassLoader();
 
-    /** Map from RegisteredMethod to ConfigAttributeDefinition */
+	/** Map from RegisteredMethod to ConfigAttributeDefinition */
     protected Map methodMap = new HashMap();
 
     /** Map from RegisteredMethod to name pattern used for registration */
@@ -74,37 +74,48 @@ public class MapBasedMethodDefinitionSource extends AbstractFallbackMethodDefini
         while (iterator.hasNext()) {
             Map.Entry entry = (Map.Entry) iterator.next();
             addSecureMethod((String)entry.getKey(), (ConfigAttributeDefinition)entry.getValue());
-        }
+        }        
     }
 
+	/**
+	 * Implementation does not support class-level attributes.
+	 */
+	protected ConfigAttributeDefinition findAttributes(Class clazz) {
+		return null;
+	}
+
+	/**
+	 * Will walk the method inheritance tree to find the most specific declaration applicable.
+	 */
+	protected ConfigAttributeDefinition findAttributes(Method method, Class targetClass) {
+		return findAttributesSpecifiedAgainst(method, targetClass);
+	}
+	
+	private ConfigAttributeDefinition findAttributesSpecifiedAgainst(Method method, Class clazz) {
+		RegisteredMethod registeredMethod = new RegisteredMethod(method, clazz);
+		if (methodMap.containsKey(registeredMethod)) {
+			return (ConfigAttributeDefinition) methodMap.get(registeredMethod);
+		}
+		// Search superclass
+		if (clazz.getSuperclass() != null) {
+			return findAttributesSpecifiedAgainst(method, clazz.getSuperclass());
+		}
+		return null;
+	}
+
     /**
-     * Implementation does not support class-level attributes.
+     * Add configuration attributes for a secure method.
+     *
+     * @param method the method to be secured
+     * @param attr required authorities associated with the method
      */
-    protected ConfigAttributeDefinition findAttributes(Class clazz) {
-        return null;
-    }
-
-    /**
-     * Will walk the method inheritance tree to find the most specific declaration applicable.
-     */
-    protected ConfigAttributeDefinition findAttributes(Method method, Class targetClass) {
-        if (targetClass == null) {
-            return null;
-        }
-
-        return findAttributesSpecifiedAgainst(method, targetClass);
-    }
-
-    private ConfigAttributeDefinition findAttributesSpecifiedAgainst(Method method, Class clazz) {
-        RegisteredMethod registeredMethod = new RegisteredMethod(method, clazz);
-        if (methodMap.containsKey(registeredMethod)) {
-            return (ConfigAttributeDefinition) methodMap.get(registeredMethod);
-        }
-        // Search superclass
-        if (clazz.getSuperclass() != null) {
-            return findAttributesSpecifiedAgainst(method, clazz.getSuperclass());
-        }
-        return null;
+    private void addSecureMethod(RegisteredMethod method, ConfigAttributeDefinition attr) {
+    	Assert.notNull(method, "RegisteredMethod required");
+    	Assert.notNull(attr, "Configuration attribute required");
+    	if (logger.isInfoEnabled()) {
+            logger.info("Adding secure method [" + method + "] with attributes [" + attr + "]");
+    	}
+        this.methodMap.put(method, attr);
     }
 
     /**
@@ -115,7 +126,7 @@ public class MapBasedMethodDefinitionSource extends AbstractFallbackMethodDefini
      * @param attr required authorities associated with the method
      */
     public void addSecureMethod(String name, ConfigAttributeDefinition attr) {
-        int lastDotIndex = name.lastIndexOf(".");
+    	int lastDotIndex = name.lastIndexOf(".");
 
         if (lastDotIndex == -1) {
             throw new IllegalArgumentException("'" + name + "' is not a valid method name: format is FQN.methodName");
@@ -123,17 +134,17 @@ public class MapBasedMethodDefinitionSource extends AbstractFallbackMethodDefini
 
         String methodName = name.substring(lastDotIndex + 1);
         Assert.hasText(methodName, "Method not found for '" + name + "'");
-
+        
         String typeName = name.substring(0, lastDotIndex);
         Class type = ClassUtils.resolveClassName(typeName, this.beanClassLoader);
-
+        
         addSecureMethod(type, methodName, attr);
     }
 
     /**
      * Add configuration attributes for a secure method. Mapped method names can end or start with <code>&#42</code>
      * for matching multiple methods.
-     *
+     * 
      * @param javaType target interface or class the security configuration attribute applies to
      * @param mappedName mapped method name, which the javaType has declared or inherited
      * @param attr required authorities associated with the method
@@ -181,38 +192,6 @@ public class MapBasedMethodDefinitionSource extends AbstractFallbackMethodDefini
         }
     }
 
-    /**
-     * Adds configuration attributes for a specific method, for example where the method has been
-     * matched using a pointcut expression. If a match already exists in the map for the method, then
-     * the existing match will be retained, so that if this method is called for a more general pointcut
-     * it will not override a more specific one which has already been added. This
-     */
-    public void addSecureMethod(Class javaType, Method method, ConfigAttributeDefinition attr) {
-        RegisteredMethod key = new RegisteredMethod(method, javaType);
-
-        if (methodMap.containsKey(key)) {
-            logger.debug("Method [" + method + "] is already registered with attributes [" + methodMap.get(key) + "]");
-            return;
-        }
-
-        methodMap.put(key, attr);
-    }
-
-    /**
-     * Add configuration attributes for a secure method.
-     *
-     * @param method the method to be secured
-     * @param attr required authorities associated with the method
-     */
-    private void addSecureMethod(RegisteredMethod method, ConfigAttributeDefinition attr) {
-        Assert.notNull(method, "RegisteredMethod required");
-        Assert.notNull(attr, "Configuration attribute required");
-        if (logger.isInfoEnabled()) {
-            logger.info("Adding secure method [" + method + "] with attributes [" + attr + "]");
-        }
-        this.methodMap.put(method, attr);
-    }
-
     /**
      * Obtains the configuration attributes explicitly defined against this bean.
      *
@@ -236,54 +215,93 @@ public class MapBasedMethodDefinitionSource extends AbstractFallbackMethodDefini
         || (mappedName.startsWith("*") && methodName.endsWith(mappedName.substring(1, mappedName.length())));
     }
 
-    public void setBeanClassLoader(ClassLoader beanClassLoader) {
-        Assert.notNull(beanClassLoader, "Bean class loader required");
-        this.beanClassLoader = beanClassLoader;
-    }
+    protected ConfigAttributeDefinition lookupAttributes(Method method) {
+        List attributesToReturn = new ArrayList();
 
-    /**
-     * @return map size (for unit tests and diagnostics)
-     */
-    public int getMethodMapSize() {
-        return methodMap.size();
-    }
+        // Add attributes explicitly defined for this method invocation
+        merge(attributesToReturn, (ConfigAttributeDefinition) this.methodMap.get(method));
 
-    /**
-     * Stores both the Java Method as well as the Class we obtained the Method from. This is necessary because Method only
-     * provides us access to the declaring class. It doesn't provide a way for us to introspect which Class the Method
-     * was registered against. If a given Class inherits and redeclares a method (i.e. calls super();) the registered Class
-     * and declaring Class are the same. If a given class merely inherits but does not redeclare a method, the registered
-     * Class will be the Class we're invoking against and the Method will provide details of the declared class.
-     */
-    private class RegisteredMethod {
-        private Method method;
-        private Class registeredJavaType;
+        // Add attributes explicitly defined for this method invocation's interfaces
+        Class[] interfaces = method.getDeclaringClass().getInterfaces();
 
-        public RegisteredMethod(Method method, Class registeredJavaType) {
-            Assert.notNull(method, "Method required");
-            Assert.notNull(registeredJavaType, "Registered Java Type required");
-            this.method = method;
-            this.registeredJavaType = registeredJavaType;
-        }
+        for (int i = 0; i < interfaces.length; i++) {
+            Class clazz = interfaces[i];
 
-        public boolean equals(Object obj) {
-            if (this == obj) {
-                return true;
+            try {
+                // Look for the method on the current interface
+                Method interfaceMethod = clazz.getDeclaredMethod(method.getName(), (Class[]) method.getParameterTypes());
+                ConfigAttributeDefinition interfaceAssigned =
+                        (ConfigAttributeDefinition) this.methodMap.get(interfaceMethod);
+                merge(attributesToReturn, interfaceAssigned);
+            } catch (Exception e) {
+                // skip this interface
             }
-            if (obj != null && obj instanceof RegisteredMethod) {
-                RegisteredMethod rhs = (RegisteredMethod) obj;
-                return method.equals(rhs.method) && registeredJavaType.equals(rhs.registeredJavaType);
-            }
-            return false;
         }
 
-        public int hashCode() {
-            return method.hashCode() * registeredJavaType.hashCode();
+        // Return null if empty, as per abstract superclass contract
+        if (attributesToReturn.size() == 0) {
+            return null;
         }
 
-        public String toString() {
-            return "RegisteredMethod[" + registeredJavaType.getName() + "; " + method + "]";
-        }
+        return new ConfigAttributeDefinition(attributesToReturn);
     }
 
+    private void merge(List attributes, ConfigAttributeDefinition toMerge) {
+        if (toMerge == null) {
+            return;
+        }
+
+        attributes.addAll(toMerge.getConfigAttributes());
+    }
+
+	public void setBeanClassLoader(ClassLoader beanClassLoader) {
+		Assert.notNull(beanClassLoader, "Bean class loader required");
+		this.beanClassLoader = beanClassLoader;
+	}
+
+	/**
+	 * @return map size (for unit tests and diagnostics)
+	 */
+	public int getMethodMapSize() {
+		return methodMap.size();
+	}
+	
+	/**
+	 * Stores both the Java Method as well as the Class we obtained the Method from. This is necessary because Method only
+	 * provides us access to the declaring class. It doesn't provide a way for us to introspect which Class the Method
+	 * was registered against. If a given Class inherits and redeclares a method (i.e. calls super();) the registered Class
+	 * and declaring Class are the same. If a given class merely inherits but does not redeclare a method, the registered
+	 * Class will be the Class we're invoking against and the Method will provide details of the declared class.
+	 */
+	private class RegisteredMethod {
+		private Method method;
+		private Class registeredJavaType;
+
+		public RegisteredMethod(Method method, Class registeredJavaType) {
+			Assert.notNull(method, "Method required");
+			Assert.notNull(registeredJavaType, "Registered Java Type required");
+			this.method = method;
+			this.registeredJavaType = registeredJavaType;
+		}
+
+		public boolean equals(Object obj) {
+			if (this == obj) {
+				return true;
+			}
+			if (obj != null && obj instanceof RegisteredMethod) {
+				RegisteredMethod rhs = (RegisteredMethod) obj;
+				return method.equals(rhs.method) && registeredJavaType.equals(rhs.registeredJavaType);
+			}
+			return false;
+		}
+
+		public int hashCode() {
+			return method.hashCode() * registeredJavaType.hashCode();
+		}
+
+		public String toString() {
+			return "RegisteredMethod[" + registeredJavaType.getName() + "; " + method + "]";
+		}
+	}
+    
 }

core/src/main/java/org/springframework/security/intercept/method/ProtectPointcutPostProcessor.java

@@ -17,30 +17,29 @@ import org.springframework.beans.factory.config.BeanPostProcessor;
 import org.springframework.security.ConfigAttributeDefinition;
 import org.springframework.security.intercept.method.aopalliance.MethodDefinitionSourceAdvisor;
 import org.springframework.util.Assert;
-import org.springframework.util.StringUtils;
 
 /**
  * Parses AspectJ pointcut expressions, registering methods that match the pointcut with a
  * traditional {@link MapBasedMethodDefinitionSource}.
- *
+ * 
  * <p>
  * This class provides a convenient way of declaring a list of pointcuts, and then
  * having every method of every bean defined in the Spring application context compared with
  * those pointcuts. Where a match is found, the matching method will be registered with the
  * {@link MapBasedMethodDefinitionSource}.
  * </p>
- *
+ * 
  * <p>
  * It is very important to understand that only the <b>first</b> pointcut that matches a given
  * method will be taken as authoritative for that method. This is why pointcuts should be provided
  * as a <tt>LinkedHashMap</tt>, because their order is very important.
  * </p>
- *
+ * 
  * <p>
  * Note also that only beans defined in the Spring application context will be examined by this
- * class.
+ * class. 
  * </p>
- *
+ * 
  * <p>
  * Because this class registers method security metadata with {@link MapBasedMethodDefinitionSource},
  * normal Spring Security capabilities such as {@link MethodDefinitionSourceAdvisor} can be used.
@@ -58,18 +57,18 @@ public final class ProtectPointcutPostProcessor implements BeanPostProcessor {
     private static final Log logger = LogFactory.getLog(ProtectPointcutPostProcessor.class);
 
     private Map pointcutMap = new LinkedHashMap(); /** Key: string-based pointcut, value: ConfigAttributeDefinition */
-    private MapBasedMethodDefinitionSource mapBasedMethodDefinitionSource;
-    private PointcutParser parser;
-
-    public ProtectPointcutPostProcessor(MapBasedMethodDefinitionSource mapBasedMethodDefinitionSource) {
-        Assert.notNull(mapBasedMethodDefinitionSource, "MapBasedMethodDefinitionSource to populate is required");
-        this.mapBasedMethodDefinitionSource = mapBasedMethodDefinitionSource;
-
-        // Setup AspectJ pointcut expression parser
-        Set supportedPrimitives = new HashSet();
-        supportedPrimitives.add(PointcutPrimitive.EXECUTION);
-        supportedPrimitives.add(PointcutPrimitive.ARGS);
-        supportedPrimitives.add(PointcutPrimitive.REFERENCE);
+	private MapBasedMethodDefinitionSource mapBasedMethodDefinitionSource;
+	private PointcutParser parser;
+	
+	public ProtectPointcutPostProcessor(MapBasedMethodDefinitionSource mapBasedMethodDefinitionSource) {
+		Assert.notNull(mapBasedMethodDefinitionSource, "MapBasedMethodDefinitionSource to populate is required");
+		this.mapBasedMethodDefinitionSource = mapBasedMethodDefinitionSource;
+		
+		// Setup AspectJ pointcut expression parser
+		Set supportedPrimitives = new HashSet();
+		supportedPrimitives.add(PointcutPrimitive.EXECUTION);
+		supportedPrimitives.add(PointcutPrimitive.ARGS);
+		supportedPrimitives.add(PointcutPrimitive.REFERENCE);
 //		supportedPrimitives.add(PointcutPrimitive.THIS);
 //		supportedPrimitives.add(PointcutPrimitive.TARGET);
 //		supportedPrimitives.add(PointcutPrimitive.WITHIN);
@@ -77,90 +76,79 @@ public final class ProtectPointcutPostProcessor implements BeanPostProcessor {
 //		supportedPrimitives.add(PointcutPrimitive.AT_WITHIN);
 //		supportedPrimitives.add(PointcutPrimitive.AT_ARGS);
 //		supportedPrimitives.add(PointcutPrimitive.AT_TARGET);
-        parser = PointcutParser.getPointcutParserSupportingSpecifiedPrimitivesAndUsingContextClassloaderForResolution(supportedPrimitives);
-    }
+		parser = PointcutParser.getPointcutParserSupportingSpecifiedPrimitivesAndUsingContextClassloaderForResolution(supportedPrimitives);
+	}
 
-    public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
-        return bean;
-    }
+	public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
+		return bean;
+	}
 
-    public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException {
-        // Obtain methods for the present bean
-        Method[] methods;
-        try {
-            methods = bean.getClass().getMethods();
-        } catch (Exception e) {
-            throw new IllegalStateException(e.getMessage());
-        }
+	public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException {
+		// Obtain methods for the present bean
+		Method[] methods;
+		try {
+			methods = bean.getClass().getMethods();
+		} catch (Exception e) {
+			throw new IllegalStateException(e.getMessage());
+		}
+		
+		// Check to see if any of those methods are compatible with our pointcut expressions
+		for (int i = 0; i < methods.length; i++) {
+			Iterator iter = pointcutMap.keySet().iterator();
+			while (iter.hasNext()) {
+				String ex = iter.next().toString();
+				
+				// Parse the presented AspectJ pointcut expression
+				PointcutExpression expression = parser.parsePointcutExpression(ex);
 
-        // Check to see if any of those methods are compatible with our pointcut expressions
-        for (int i = 0; i < methods.length; i++) {
-            Iterator iter = pointcutMap.keySet().iterator();
-            while (iter.hasNext()) {
-                String ex = iter.next().toString();
-
-                // Parse the presented AspectJ pointcut expression
-                PointcutExpression expression = parser.parsePointcutExpression(ex);
-
-                // Try for the bean class directly
-                if (attemptMatch(bean.getClass(), methods[i], expression, beanName)) {
-                    // We've found the first expression that matches this method, so move onto the next method now
-                    break; // the "while" loop, not the "for" loop
-                }
-            }
-        }
-
-        return bean;
-    }
-
-    private boolean attemptMatch(Class targetClass, Method method, PointcutExpression expression, String beanName) {
-        // Determine if the presented AspectJ pointcut expression matches this method
-        boolean matches = expression.matchesMethodExecution(method).alwaysMatches();
-
-        // Handle accordingly
-        if (matches) {
-            ConfigAttributeDefinition attr = (ConfigAttributeDefinition) pointcutMap.get(expression.getPointcutExpression());
-
-            if (logger.isDebugEnabled()) {
-                logger.debug("AspectJ pointcut expression '" + expression.getPointcutExpression() + "' matches target class '" + targetClass.getName() + "' (bean ID '" + beanName + "') for method '" + method + "'; registering security configuration attribute '" + attr + "'");
-            }
-
-            mapBasedMethodDefinitionSource.addSecureMethod(targetClass, method, attr);
-        }
-
-        return matches;
-    }
-
-    public void setPointcutMap(Map map) {
-        Assert.notEmpty(map);
-        Iterator i = map.keySet().iterator();
-        while (i.hasNext()) {
-            String expression = i.next().toString();
-            Object value = map.get(expression);
-            Assert.isInstanceOf(ConfigAttributeDefinition.class, value, "Map keys must be instances of ConfigAttributeDefinition");
-            addPointcut(expression, (ConfigAttributeDefinition) value);
-        }
-    }
-
-    private void addPointcut(String pointcutExpression, ConfigAttributeDefinition definition) {
-        Assert.hasText(pointcutExpression, "An AspectJ pointcut expression is required");
-        Assert.notNull(definition, "ConfigAttributeDefinition required");
-        pointcutExpression = replaceBooleanOperators(pointcutExpression);
-        pointcutMap.put(pointcutExpression, definition);
-
-        if (logger.isDebugEnabled()) {
-            logger.debug("AspectJ pointcut expression '" + pointcutExpression + "' registered for security configuration attribute '" + definition + "'");
-        }
-    }
-
-    /**
-     * @see org.springframework.aop.aspectj.AspectJExpressionPointcut#replaceBooleanOperators
-     */
-    private String replaceBooleanOperators(String pcExpr) {
-        pcExpr = StringUtils.replace(pcExpr," and "," && ");
-        pcExpr = StringUtils.replace(pcExpr, " or ", " || ");
-        pcExpr = StringUtils.replace(pcExpr, " not ", " ! ");
-        return pcExpr;
-    }
+				// Try for the bean class directly
+				if (attemptMatch(bean.getClass(), methods[i], expression, beanName)) {
+					// We've found the first expression that matches this method, so move onto the next method now
+					break; // the "while" loop, not the "for" loop
+				}
+			}
+		}
+		
+		return bean;
+	}
+	
+	private boolean attemptMatch(Class targetClass, Method method, PointcutExpression expression, String beanName) {
+		// Determine if the presented AspectJ pointcut expression matches this method
+		boolean matches = expression.matchesMethodExecution(method).alwaysMatches();
+		
+		// Handle accordingly
+		if (matches) {
+			ConfigAttributeDefinition attr = (ConfigAttributeDefinition) pointcutMap.get(expression.getPointcutExpression());
+			
+			if (logger.isDebugEnabled()) {
+				logger.debug("AspectJ pointcut expression '" + expression.getPointcutExpression() + "' matches target class '" + targetClass.getName() + "' (bean ID '" + beanName + "') for method '" + method + "'; registering security configuration attribute '" + attr + "'");
+			}
+			
+			mapBasedMethodDefinitionSource.addSecureMethod(targetClass, method.getName(), attr);
+		}
+		
+		return matches;
+	}
+	
+	public void setPointcutMap(Map map) {
+		Assert.notEmpty(map);
+		Iterator i = map.keySet().iterator();
+		while (i.hasNext()) {
+			String expression = i.next().toString();
+			Object value = map.get(expression);
+			Assert.isInstanceOf(ConfigAttributeDefinition.class, value, "Map keys must be instances of ConfigAttributeDefinition");
+			addPointcut(expression, (ConfigAttributeDefinition) value);
+		}
+	}
 
+	public void addPointcut(String pointcutExpression, ConfigAttributeDefinition definition) {
+		Assert.hasText(pointcutExpression, "An AspecTJ pointcut expression is required");
+		Assert.notNull(definition, "ConfigAttributeDefinition required");
+		pointcutMap.put(pointcutExpression, definition);
+		
+		if (logger.isDebugEnabled()) {
+			logger.debug("AspectJ pointcut expression '" + pointcutExpression + "' registered for security configuration attribute '" + definition + "'");
+		}
+	}
+	
 }

core/src/main/java/org/springframework/security/intercept/method/aopalliance/MethodDefinitionSourceAdvisor.java

@@ -23,18 +23,13 @@ import org.aopalliance.intercept.MethodInvocation;
 import org.springframework.aop.Pointcut;
 import org.springframework.aop.support.AbstractPointcutAdvisor;
 import org.springframework.aop.support.StaticMethodMatcherPointcut;
-import org.springframework.beans.BeansException;
-import org.springframework.beans.factory.BeanFactory;
-import org.springframework.beans.factory.BeanFactoryAware;
 import org.springframework.security.intercept.method.MethodDefinitionSource;
 import org.springframework.util.Assert;
 
 /**
  * Advisor driven by a {@link MethodDefinitionSource}, used to exclude a {@link MethodSecurityInterceptor} from
- * public (ie non-secure) methods.
- * <p>
- * Because the AOP framework caches advice calculations, this is normally faster than just letting the
- * <code>MethodSecurityInterceptor</code> run and find out itself that it has no work to do.
+ * public (ie non-secure) methods.<p>Because the AOP framework caches advice calculations, this is normally faster
+ * than just letting the <code>MethodSecurityInterceptor</code> run and find out itself that it has no work to do.
  * <p>
  * This class also allows the use of Spring's
  * {@link org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator}, which makes
@@ -47,79 +42,42 @@ import org.springframework.util.Assert;
  * @author Ben Alex
  * @version $Id$
  */
-public class MethodDefinitionSourceAdvisor extends AbstractPointcutAdvisor implements BeanFactoryAware {
+public class MethodDefinitionSourceAdvisor extends AbstractPointcutAdvisor {
     //~ Instance fields ================================================================================================
 
     private MethodDefinitionSource attributeSource;
     private MethodSecurityInterceptor interceptor;
-    private Pointcut pointcut = new MethodDefinitionSourcePointcut();
-    private BeanFactory beanFactory;
-    private String adviceBeanName;
-    private final Object adviceMonitor = new Object();
+    private Pointcut pointcut;
 
     //~ Constructors ===================================================================================================
 
-    /**
-     * @deprecated use the decoupled approach instead
-     */
     public MethodDefinitionSourceAdvisor(MethodSecurityInterceptor advice) {
-        Assert.notNull(advice.getObjectDefinitionSource(), "Cannot construct a MethodDefinitionSourceAdvisor using a " +
-                "MethodSecurityInterceptor that has no ObjectDefinitionSource configured");
+    	this.interceptor = advice;
+
+    	Assert.notNull(advice.getObjectDefinitionSource(), "Cannot construct a MethodDefinitionSourceAdvisor using a MethodSecurityInterceptor that has no ObjectDefinitionSource configured");
 
-        this.interceptor = advice;
         this.attributeSource = advice.getObjectDefinitionSource();
-    }
-
-    /**
-     * Alternative constructor for situations where we want the advisor decoupled from the advice. Instead the advice
-     * bean name should be set. This prevents eager instantiation of the interceptor
-     * (and hence the AuthenticationManager). See SEC-773, for example.
-     * <p>
-     * This is essentially the approach taken by subclasses of {@link AbstractBeanFactoryPointcutAdvisor}, which this
-     * class should extend in future. The original hierarchy and constructor have been retained for backwards
-     * compatibility.
-     *
-     * @param adviceBeanName name of the MethodSecurityInterceptor bean
-     * @param attributeSource the attribute source (should be the same as the one used on the interceptor)
-     */
-    public MethodDefinitionSourceAdvisor(String adviceBeanName, MethodDefinitionSource attributeSource) {
-        Assert.notNull(adviceBeanName, "The adviceBeanName cannot be null");
-        Assert.notNull(attributeSource, "The attributeSource cannot be null");
-
-        this.adviceBeanName = adviceBeanName;
-        this.attributeSource = attributeSource;
+        this.pointcut = new MethodDefinitionSourcePointcut();
     }
 
     //~ Methods ========================================================================================================
 
-    public Pointcut getPointcut() {
-        return pointcut;
-    }
+	public Pointcut getPointcut() {
+		return pointcut;
+	}
 
-    public Advice getAdvice() {
-        synchronized (this.adviceMonitor) {
-            if (interceptor == null) {
-                Assert.notNull(adviceBeanName, "'adviceBeanName' must be set for use with bean factory lookup.");
-                Assert.state(beanFactory != null, "BeanFactory must be set to resolve 'adviceBeanName'");
-                interceptor = (MethodSecurityInterceptor)
-                        beanFactory.getBean(this.adviceBeanName, MethodSecurityInterceptor.class);
-            }
-            return interceptor;
-        }
-    }
-
-    public void setBeanFactory(BeanFactory beanFactory) throws BeansException {
-        this.beanFactory = beanFactory;
-    }
+	public Advice getAdvice() {
+		return interceptor;
+	}
 
     //~ Inner Classes ==================================================================================================
-
+    
     class MethodDefinitionSourcePointcut extends StaticMethodMatcherPointcut {
         public boolean matches(Method m, Class targetClass) {
             return attributeSource.getAttributes(m, targetClass) != null;
         }
     }
-
+    
     /**
      * Represents a <code>MethodInvocation</code>.
      * <p>
@@ -152,7 +110,7 @@ public class MethodDefinitionSourceAdvisor extends AbstractPointcutAdvisor imple
         }
 
         public Object getThis() {
-            return this.targetClass;
+        	return this.targetClass;
         }
 
         public Object proceed() throws Throwable {

core/src/main/java/org/springframework/security/intercept/method/aspectj/AspectJAnnotationCallback.java

@@ -12,5 +12,5 @@ package org.springframework.security.intercept.method.aspectj;
 public interface AspectJAnnotationCallback {
     //~ Methods ========================================================================================================
 
-    Object proceedWithObject() throws Throwable;
+    Object proceedWithObject();
 }

core/src/main/java/org/springframework/security/intercept/web/DefaultFilterInvocationDefinitionSource.java

@@ -78,7 +78,7 @@ public class DefaultFilterInvocationDefinitionSource implements FilterInvocation
     DefaultFilterInvocationDefinitionSource(UrlMatcher urlMatcher) {
         this.urlMatcher = urlMatcher;
     }
-    
+
     /**
      * Builds the internal request map from the supplied map. The key elements should be of type {@link RequestKey},
      * which contains a URL path and an optional HTTP method (may be null). The path stored in the key will depend on 
@@ -179,7 +179,7 @@ public class DefaultFilterInvocationDefinitionSource implements FilterInvocation
      * @return the <code>ConfigAttributeDefinition</code> that applies to the specified <code>FilterInvocation</code>
      * or null if no match is foud
      */
-    public ConfigAttributeDefinition lookupAttributes(String url, String method) {
+    protected ConfigAttributeDefinition lookupAttributes(String url, String method) {
         if (stripQueryStringFromUrls) {
             // Strip anything after a question mark symbol, as per SEC-161. See also SEC-321
             int firstQuestionMarkIndex = url.indexOf("?");
@@ -252,7 +252,7 @@ public class DefaultFilterInvocationDefinitionSource implements FilterInvocation
         return urlMatcher.requiresLowerCaseUrl();
     }
 
-    public void setStripQueryStringFromUrls(boolean stripQueryStringFromUrls) {
+    protected void setStripQueryStringFromUrls(boolean stripQueryStringFromUrls) {
         this.stripQueryStringFromUrls = stripQueryStringFromUrls;
     }
 }

core/src/main/java/org/springframework/security/intercept/web/RequestKey.java

@@ -3,7 +3,6 @@ package org.springframework.security.intercept.web;
 /**
  * @author Luke Taylor
  * @version $Id$
- * @since 2.0
  */
 public class RequestKey {
     private String url;
@@ -48,22 +47,10 @@ public class RequestKey {
             return false;
         }
         
-        if (method == null) {
-        	return key.method == null;
+        if (method == null && key.method != null) {
+            return false;
         }
-
+        
         return method.equals(key.method);        
     }
-
-	public String toString() {
-		StringBuffer sb = new StringBuffer(url.length() + 7);
-		sb.append("[");
-		if (method != null) {
-			sb.append(method).append(",");
-		}
-		sb.append(url);
-		sb.append("]");
-		
-		return sb.toString();
-	}
 }

core/src/main/java/org/springframework/security/ldap/LdapAuthoritiesPopulator.java

@@ -17,6 +17,8 @@ package org.springframework.security.ldap;
 
 import org.springframework.security.GrantedAuthority;
 
+import org.springframework.security.ldap.LdapDataAccessException;
+
 import org.springframework.ldap.core.DirContextOperations;
 
 
@@ -40,6 +42,7 @@ public interface LdapAuthoritiesPopulator {
      *
      * @return the granted authorities for the given user.
      *
+     * @throws LdapDataAccessException if there is a problem accessing the directory.
      */
     GrantedAuthority[] getGrantedAuthorities(DirContextOperations userData, String username);
 }

core/src/main/java/org/springframework/security/ldap/LdapUtils.java

@@ -158,7 +158,7 @@ public final class LdapUtils {
 
         if (url.startsWith("ldap:") || url.startsWith("ldaps:")) {
             URI uri = parseLdapUrl(url);
-            urlRootDn = uri.getRawPath();
+            urlRootDn = uri.getPath();
         } else {
             // Assume it's an embedded server
             urlRootDn = url;

core/src/main/java/org/springframework/security/ldap/SpringSecurityLdapTemplate.java

@@ -15,21 +15,6 @@
 
 package org.springframework.security.ldap;
 
-import java.text.MessageFormat;
-import java.util.Arrays;
-import java.util.HashSet;
-import java.util.Set;
-
-import javax.naming.NamingEnumeration;
-import javax.naming.NamingException;
-import javax.naming.PartialResultException;
-import javax.naming.directory.Attributes;
-import javax.naming.directory.DirContext;
-import javax.naming.directory.SearchControls;
-import javax.naming.directory.SearchResult;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
 import org.springframework.dao.IncorrectResultSizeDataAccessException;
 import org.springframework.ldap.core.ContextExecutor;
 import org.springframework.ldap.core.ContextMapper;
@@ -37,19 +22,33 @@ import org.springframework.ldap.core.ContextSource;
 import org.springframework.ldap.core.DirContextAdapter;
 import org.springframework.ldap.core.DirContextOperations;
 import org.springframework.ldap.core.DistinguishedName;
-import org.springframework.ldap.core.LdapEncoder;
-import org.springframework.ldap.core.LdapTemplate;
 import org.springframework.util.Assert;
 
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import javax.naming.NamingEnumeration;
+import javax.naming.NamingException;
+import javax.naming.directory.Attributes;
+import javax.naming.directory.DirContext;
+import javax.naming.directory.SearchControls;
+import javax.naming.directory.SearchResult;
+import java.text.MessageFormat;
+import java.util.HashSet;
+import java.util.Set;
+import java.util.Arrays;
+
 
 /**
- * Extension of Spring LDAP's LdapTemplate class which adds extra functionality required by Spring Security.
+ * LDAP equivalent of the Spring JdbcTemplate class.
+ * <p>
+ * This is mainly intended to simplify Ldap access within Spring Security's LDAP-related services.
+ * </p>
  *
  * @author Ben Alex
  * @author Luke Taylor
- * @since 2.0
  */
-public class SpringSecurityLdapTemplate extends LdapTemplate {
+public class SpringSecurityLdapTemplate extends org.springframework.ldap.core.LdapTemplate {
     //~ Static fields/initializers =====================================================================================
     private static final Log logger = LogFactory.getLog(SpringSecurityLdapTemplate.class);
 
@@ -136,16 +135,9 @@ public class SpringSecurityLdapTemplate extends LdapTemplate {
      * @return the set of String values for the attribute as a union of the values found in all the matching entries.
      */
     public Set searchForSingleAttributeValues(final String base, final String filter, final Object[] params,
-            final String attributeName) {
-        // Escape the params acording to RFC2254
-        Object[] encodedParams = new String[params.length];
+        final String attributeName) {
 
-        for (int i=0; i < params.length; i++) {
-            encodedParams[i] = LdapEncoder.filterEncode(params[i].toString());
-        }
-
-        String formattedFilter = MessageFormat.format(filter, encodedParams);
-        logger.debug("Using filter: " + formattedFilter);
+        String formattedFilter = MessageFormat.format(filter, params);
 
         final HashSet set = new HashSet();
 
@@ -175,15 +167,12 @@ public class SpringSecurityLdapTemplate extends LdapTemplate {
     /**
      * Performs a search, with the requirement that the search shall return a single directory entry, and uses
      * the supplied mapper to create the object from that entry.
-     * <p>
-     * Ignores <tt>PartialResultException</tt> if thrown, for compatibility with Active Directory
-     * (see {@link LdapTemplate#setIgnorePartialResultException(boolean)}).
      *
-     * @param base the search base, relative to the base context supplied by the context source.
-     * @param filter the LDAP search filter
-     * @param params parameters to be substituted in the search.
+     * @param base
+     * @param filter
+     * @param params
      *
-     * @return a DirContextOperations instance created from the matching entry.
+     * @return the object created by the mapper from the matching entry
      *
      * @throws IncorrectResultSizeDataAccessException if no results are found or the search returns more than one
      *         result.
@@ -191,38 +180,32 @@ public class SpringSecurityLdapTemplate extends LdapTemplate {
     public DirContextOperations searchForSingleEntry(final String base, final String filter, final Object[] params) {
 
         return (DirContextOperations) executeReadOnly(new ContextExecutor() {
-                public Object executeWithContext(DirContext ctx) throws NamingException {
-                    DistinguishedName ctxBaseDn = new DistinguishedName(ctx.getNameInNamespace());
-                    NamingEnumeration resultsEnum = ctx.search(base, filter, params, searchControls);
-                    Set results = new HashSet();
-                    try {
-                        while (resultsEnum.hasMore()) {
+                public Object executeWithContext(DirContext ctx)
+                    throws NamingException {
 
-                            SearchResult searchResult = (SearchResult) resultsEnum.next();
-                            // Work out the DN of the matched entry
-                            StringBuffer dn = new StringBuffer(searchResult.getName());
+                    NamingEnumeration results = ctx.search(base, filter, params, searchControls);
 
-                            if (base.length() > 0) {
-                                dn.append(",");
-                                dn.append(base);
-                            }
-
-                            results.add(new DirContextAdapter(searchResult.getAttributes(),
-                                    new DistinguishedName(dn.toString()), ctxBaseDn));
-                        }
-                    } catch (PartialResultException e) {
-                        logger.info("Ignoring PartialResultException");
-                    }
-
-                    if (results.size() == 0) {
+                    if (!results.hasMore()) {
                         throw new IncorrectResultSizeDataAccessException(1, 0);
                     }
 
-                    if (results.size() > 1) {
-                        throw new IncorrectResultSizeDataAccessException(1, results.size());
+                    SearchResult searchResult = (SearchResult) results.next();
+
+                    if (results.hasMore()) {
+                        // We don't know how many results but set to 2 which is good enough
+                        throw new IncorrectResultSizeDataAccessException(1, 2);
                     }
 
-                    return results.toArray()[0];
+                    // Work out the DN of the matched entry
+                    StringBuffer dn = new StringBuffer(searchResult.getName());
+
+                    if (base.length() > 0) {
+                        dn.append(",");
+                        dn.append(base);
+                    }
+
+                    return new DirContextAdapter(searchResult.getAttributes(),
+                            new DistinguishedName(dn.toString()), new DistinguishedName(ctx.getNameInNamespace()));
                 }
             });
     }

core/src/main/java/org/springframework/security/ldap/populator/DefaultLdapAuthoritiesPopulator.java

@@ -69,13 +69,13 @@ import java.util.Set;
  * <pre>
  * &lt;bean id="ldapAuthoritiesPopulator"
  *       class="org.springframework.security.providers.ldap.populator.DefaultLdapAuthoritiesPopulator">
- *   &lt;constructor-arg ref="contextSource"/>
- *   &lt;constructor-arg value="ou=groups"/>
- *   &lt;property name="groupRoleAttribute" value="ou"/>
+ *   &lt;constructor-arg>&lt;ref local="contextSource"/>&lt;/constructor-arg>
+ *   &lt;constructor-arg>&lt;value>ou=groups&lt;/value>&lt;/constructor-arg>
+ *   &lt;property name="groupRoleAttribute">&lt;value>ou&lt;/value>&lt;/property>
  * &lt;!-- the following properties are shown with their default values -->
- *   &lt;property name="searchSubTree" value="false"/>
- *   &lt;property name="rolePrefix" value="ROLE_"/>
- *   &lt;property name="convertToUpperCase" value="true"/>
+ *   &lt;property name="searchSubTree">&lt;value>false&lt;/value>&lt;/property>
+ *   &lt;property name="rolePrefix">&lt;value>ROLE_&lt;/value>&lt;/property>
+ *   &lt;property name="convertToUpperCase">&lt;value>true&lt;/value>&lt;/property>
  * &lt;/bean>
  * </pre>
  * A search for roles for user "uid=ben,ou=people,dc=springframework,dc=org" would return the single granted authority
@@ -99,6 +99,8 @@ public class DefaultLdapAuthoritiesPopulator implements LdapAuthoritiesPopulator
      */
     private GrantedAuthority defaultRole;
 
+    private ContextSource contextSource;
+
     private SpringSecurityLdapTemplate ldapTemplate;
 
     /**
@@ -141,10 +143,8 @@ public class DefaultLdapAuthoritiesPopulator implements LdapAuthoritiesPopulator
      *                                 context factory.
      */
     public DefaultLdapAuthoritiesPopulator(ContextSource contextSource, String groupSearchBase) {
-        Assert.notNull(contextSource, "contextSource must not be null");
-        ldapTemplate = new SpringSecurityLdapTemplate(contextSource);
-        ldapTemplate.setSearchControls(searchControls);
-        setGroupSearchBase(groupSearchBase);
+        this.setContextSource(contextSource);
+        this.setGroupSearchBase(groupSearchBase);
     }
 
     //~ Methods ========================================================================================================
@@ -226,7 +226,20 @@ public class DefaultLdapAuthoritiesPopulator implements LdapAuthoritiesPopulator
     }
 
     protected ContextSource getContextSource() {
-        return ldapTemplate.getContextSource();
+        return contextSource;
+    }
+
+    /**
+     * Set the {@link ContextSource}
+     *
+     * @param contextSource supplies the contexts used to search for user roles.
+     */
+    private void setContextSource(ContextSource contextSource) {
+        Assert.notNull(contextSource, "contextSource must not be null");
+        this.contextSource = contextSource;
+
+        ldapTemplate = new SpringSecurityLdapTemplate(contextSource);
+        ldapTemplate.setSearchControls(searchControls);
     }
 
     /**
@@ -271,10 +284,6 @@ public class DefaultLdapAuthoritiesPopulator implements LdapAuthoritiesPopulator
         this.groupSearchFilter = groupSearchFilter;
     }
 
-    /**
-     * Sets the prefix which will be prepended to the values loaded from the directory.
-     * Defaults to "ROLE_" for compatibility with <tt>RoleVoter/tt>.
-     */
     public void setRolePrefix(String rolePrefix) {
         Assert.notNull(rolePrefix, "rolePrefix must not be null");
         this.rolePrefix = rolePrefix;

core/src/main/java/org/springframework/security/providers/ProviderManager.java

@@ -144,10 +144,17 @@ public class ProviderManager extends AbstractAuthenticationManager implements In
     //~ Methods ========================================================================================================
 
     public void afterPropertiesSet() throws Exception {
+        checkIfValidList(this.providers);
         Assert.notNull(this.messages, "A message source must be set");
         exceptionMappings.putAll(additionalExceptionMappings);
     }
 
+    private void checkIfValidList(List listToCheck) {
+        if ((listToCheck == null) || (listToCheck.size() == 0)) {
+            throw new IllegalArgumentException("A list of AuthenticationProviders is required");
+        }
+    }
+
     /**
      * Attempts to authenticate the passed {@link Authentication} object.
      * <p>
@@ -167,7 +174,7 @@ public class ProviderManager extends AbstractAuthenticationManager implements In
      * @throws AuthenticationException if authentication fails.
      */
     public Authentication doAuthentication(Authentication authentication) throws AuthenticationException {
-        Iterator iter = getProviders().iterator();
+        Iterator iter = providers.iterator();
 
         Class toTest = authentication.getClass();
 
@@ -266,11 +273,7 @@ public class ProviderManager extends AbstractAuthenticationManager implements In
     }
 
     public List getProviders() {
-        if (providers == null || providers.size() == 0) {
-            throw new IllegalArgumentException("A list of AuthenticationProviders is required");
-        }
-
-        return providers;
+        return this.providers;
     }
 
     /**
@@ -300,7 +303,8 @@ public class ProviderManager extends AbstractAuthenticationManager implements In
      * AuthenticationProvider instance.
      */
     public void setProviders(List providers) {
-    	Assert.notEmpty(providers, "A list of AuthenticationProviders is required");
+        checkIfValidList(providers);
+
         Iterator iter = providers.iterator();
 
         while (iter.hasNext()) {

core/src/main/java/org/springframework/security/providers/TestingAuthenticationToken.java

@@ -16,7 +16,6 @@
 package org.springframework.security.providers;
 
 import org.springframework.security.GrantedAuthority;
-import org.springframework.security.util.AuthorityUtils;
 
 
 /**
@@ -35,17 +34,6 @@ public class TestingAuthenticationToken extends AbstractAuthenticationToken {
 
     //~ Constructors ===================================================================================================
 
-    public TestingAuthenticationToken(Object principal, Object credentials) {
-    	super(null);
-        this.principal = principal;
-        this.credentials = credentials;    	
-    }    
-
-    
-    public TestingAuthenticationToken(Object principal, Object credentials, String... authorities) {
-    	this(principal, credentials, AuthorityUtils.stringArrayToAuthorityArray(authorities));
-    }    
-
     public TestingAuthenticationToken(Object principal, Object credentials, GrantedAuthority[] authorities) {
         super(authorities);
         this.principal = principal;

core/src/main/java/org/springframework/security/providers/anonymous/AnonymousAuthenticationProvider.java

@@ -15,28 +15,30 @@
 
 package org.springframework.security.providers.anonymous;
 
+import org.springframework.security.SpringSecurityMessageSource;
+import org.springframework.security.Authentication;
+import org.springframework.security.AuthenticationException;
+import org.springframework.security.BadCredentialsException;
+import org.springframework.security.providers.AuthenticationProvider;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.context.MessageSource;
 import org.springframework.context.MessageSourceAware;
 import org.springframework.context.support.MessageSourceAccessor;
-import org.springframework.security.Authentication;
-import org.springframework.security.AuthenticationException;
-import org.springframework.security.BadCredentialsException;
-import org.springframework.security.SpringSecurityMessageSource;
-import org.springframework.security.providers.AuthenticationProvider;
 import org.springframework.util.Assert;
 
 
 /**
- * An {@link AuthenticationProvider} implementation that validates {@link AnonymousAuthenticationToken}s.
- * <p>
- * To be successfully validated, the {@link AnonymousAuthenticationToken#getKeyHash()} must match this class'
- * {@link #getKey()}.
- *
- * @author Ben Alex
- * @version $Id$
+ * An {@link AuthenticationProvider} implementation that validates {@link
+ * org.springframework.security.providers.anonymous.AnonymousAuthenticationToken}s.<p>To be successfully validated, the
+ * {@link org.springframework.security.providers.anonymous.AnonymousAuthenticationToken#getKeyHash()} must match this class'
+ * {@link #getKey()}.</p>
  */
 public class AnonymousAuthenticationProvider implements AuthenticationProvider, InitializingBean, MessageSourceAware {
+    //~ Static fields/initializers =====================================================================================
+
+    private static final Log logger = LogFactory.getLog(AnonymousAuthenticationProvider.class);
 
     //~ Instance fields ================================================================================================
 
@@ -45,7 +47,7 @@ public class AnonymousAuthenticationProvider implements AuthenticationProvider,
 
     //~ Methods ========================================================================================================
 
-    public void afterPropertiesSet() throws Exception {
+	public void afterPropertiesSet() throws Exception {
         Assert.hasLength(key, "A Key is required");
         Assert.notNull(this.messages, "A message source must be set");
     }

core/src/main/java/org/springframework/security/providers/jaas/JaasAuthenticationProvider.java

@@ -158,7 +158,7 @@ public class JaasAuthenticationProvider implements AuthenticationProvider, Appli
         Assert.hasLength(loginContextName, "loginContextName must be set on " + getClass());
 
         configureJaas(loginConfig);
-        
+
         Assert.notNull(Configuration.getConfiguration(),
               "As per http://java.sun.com/j2se/1.5.0/docs/api/javax/security/auth/login/Configuration.html "
             + "\"If a Configuration object was set via the Configuration.setConfiguration method, then that object is "
@@ -246,9 +246,6 @@ public class JaasAuthenticationProvider implements AuthenticationProvider, Appli
      */
     protected void configureJaas(Resource loginConfig) throws IOException {
         configureJaasUsingLoop();
-
-        // Overcome issue in SEC-760
-        Configuration.getConfiguration().refresh();
     }
 
     /**
@@ -378,9 +375,7 @@ public class JaasAuthenticationProvider implements AuthenticationProvider, Appli
      * @param token The {@link UsernamePasswordAuthenticationToken} being processed
      */
     protected void publishSuccessEvent(UsernamePasswordAuthenticationToken token) {
-        if (applicationEventPublisher != null) {
-        	applicationEventPublisher.publishEvent(new JaasAuthenticationSuccessEvent(token));
-        }
+        applicationEventPublisher.publishEvent(new JaasAuthenticationSuccessEvent(token));
     }
 
     /**

core/src/main/java/org/springframework/security/providers/preauth/PreAuthenticatedAuthenticationProvider.java

@@ -88,6 +88,7 @@ public class PreAuthenticatedAuthenticationProvider implements AuthenticationPro
         result.setDetails(authentication.getDetails());
 
         return result;
+
     }
 
     /**
@@ -122,14 +123,4 @@ public class PreAuthenticatedAuthenticationProvider implements AuthenticationPro
     public void setThrowExceptionWhenTokenRejected(boolean throwExceptionWhenTokenRejected) {
         this.throwExceptionWhenTokenRejected = throwExceptionWhenTokenRejected;
     }
-
-    /**
-     * Sets the strategy which will be used to validate the loaded <tt>UserDetails</tt> object
-     * for the user. Defaults to an {@link AccountStatusUserDetailsChecker}. 
-     * @param userDetailsChecker
-     */
-	public void setUserDetailsChecker(UserDetailsChecker userDetailsChecker) {
-		Assert.notNull(userDetailsChecker, "userDetailsChacker cannot be null");
-		this.userDetailsChecker = userDetailsChecker;
-	}
 }

core/src/main/java/org/springframework/security/providers/x509/X509AuthenticationProvider.java

@@ -45,7 +45,7 @@ import java.security.cert.X509Certificate;
  *
  * @author Luke Taylor
  * @deprecated superceded by the preauth provider. Use the X.509 authentication support in org.springframework.security.ui.preauth.x509 instead
- *             or namespace support via the <x509 /> element.
+ *             or namespace support via the <x509 /> element. 
  * @version $Id$
  */
 public class X509AuthenticationProvider implements AuthenticationProvider, InitializingBean, MessageSourceAware {
@@ -61,7 +61,7 @@ public class X509AuthenticationProvider implements AuthenticationProvider, Initi
 
     //~ Methods ========================================================================================================
 
-    public void afterPropertiesSet() throws Exception {
+	public void afterPropertiesSet() throws Exception {
         Assert.notNull(userCache, "An x509UserCache must be set");
         Assert.notNull(x509AuthoritiesPopulator, "An X509AuthoritiesPopulator must be set");
         Assert.notNull(this.messages, "A message source must be set");
@@ -101,9 +101,7 @@ public class X509AuthenticationProvider implements AuthenticationProvider, Initi
         UserDetails user = userCache.getUserFromCache(clientCertificate);
 
         if (user == null) {
-            if (logger.isDebugEnabled()) {
-                logger.debug("Authenticating with certificate " + clientCertificate);
-            }
+            logger.debug("Authenticating with certificate " + clientCertificate);
             user = x509AuthoritiesPopulator.getUserDetails(clientCertificate);
             userCache.putUserInCache(clientCertificate, user);
         }