Set project release version to 3.0.6.RELEASE

Remove session timeout check in tutorial sample.
SEC-1795: Fix possible NPEs in AclImpl.equals()
2026-09-07 09:49:52 +00:00 · 2011-08-19 12:47:55 -07:00 · 2011-08-19 12:47:06 -07:00 · 2011-08-19 12:03:04 -07:00 · 2011-08-19 10:15:48 -07:00 · 2011-08-12 14:36:42 +01:00
187 changed files with 4859 additions and 2054 deletions
@@ -3,9 +3,14 @@ target/
 .project
 .settings/
 build/
+out/
+intellij/
+*.ipr
+*.iws
 *.log
 *.log.1
 .DS_Store
 *.iml
 .gradle/
 gradle.properties
+atlassian-ide-plugin.xml
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>spring-security-parent</artifactId>
        <groupId>org.springframework.security</groupId>
-        <version>3.0.3.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
    </parent>
    <modelVersion>4.0.0</modelVersion>
    <groupId>org.springframework.security</groupId>
@@ -108,7 +108,7 @@ public class AclEntryAfterInvocationProvider extends AbstractAclProvider impleme

            logger.debug("Denying access");

-            throw new AccessDeniedException(messages.getMessage("BasicAclEntryAfterInvocationProvider.noPermission",
+            throw new AccessDeniedException(messages.getMessage("AclEntryAfterInvocationProvider.noPermission",
                    new Object[] {authentication.getName(), returnedObject},
                    "Authentication {0} has NO permissions to the domain object {1}"));
        }
@@ -379,15 +379,15 @@ public class AclImpl implements Acl, MutableAcl, AuditableAcl, OwnershipAcl {
        if (obj instanceof AclImpl) {
            AclImpl rhs = (AclImpl) obj;
            if (this.aces.equals(rhs.aces)) {
-                if ((this.parentAcl == null && rhs.parentAcl == null) || (this.parentAcl.equals(rhs.parentAcl))) {
-                    if ((this.objectIdentity == null && rhs.objectIdentity == null) || (this.objectIdentity.equals(rhs.objectIdentity))) {
-                        if ((this.id == null && rhs.id == null) || (this.id.equals(rhs.id))) {
-                            if ((this.owner == null && rhs.owner == null) || this.owner.equals(rhs.owner)) {
+                if ((this.parentAcl == null && rhs.parentAcl == null) || (this.parentAcl !=null && this.parentAcl.equals(rhs.parentAcl))) {
+                    if ((this.objectIdentity == null && rhs.objectIdentity == null) || (this.objectIdentity != null && this.objectIdentity.equals(rhs.objectIdentity))) {
+                        if ((this.id == null && rhs.id == null) || (this.id != null && this.id.equals(rhs.id))) {
+                            if ((this.owner == null && rhs.owner == null) || (this.owner != null && this.owner.equals(rhs.owner))) {
                                if (this.entriesInheriting == rhs.entriesInheriting) {
                                    if ((this.loadedSids == null && rhs.loadedSids == null)) {
                                        return true;
                                    }
-                                    if (this.loadedSids.size() == rhs.loadedSids.size()) {
+                                    if (this.loadedSids != null && (this.loadedSids.size() == rhs.loadedSids.size())) {
                                        for (int i = 0; i < this.loadedSids.size(); i++) {
                                            if (!this.loadedSids.get(i).equals(rhs.loadedSids.get(i))) {
                                                return false;
@@ -504,6 +504,16 @@ public class AclImplTests {
        acl.deleteAce(1);
    }

+    // SEC-1795
+    @Test
+    public void changingParentIsSuccessful() throws Exception {
+        AclImpl parentAcl = new AclImpl(objectIdentity, 1L, mockAuthzStrategy, mockAuditLogger);
+        AclImpl childAcl = new AclImpl(objectIdentity, 2L, mockAuthzStrategy, mockAuditLogger);
+        AclImpl changeParentAcl = new AclImpl(objectIdentity, 3L, mockAuthzStrategy, mockAuditLogger);
+
+        childAcl.setParent(parentAcl);
+        childAcl.setParent(changeParentAcl);
+    }

    //~ Inner Classes ==================================================================================================

@@ -1,3 +1,5 @@
+Implementation-Title: org.springframework.security.acls
+Implementation-Version: ${version}
 Bundle-SymbolicName: org.springframework.security.acls
 Bundle-Name: Spring Security Acls
 Bundle-Vendor: SpringSource
@@ -17,5 +19,4 @@ Import-Template:
 org.springframework.transaction.support.*;version="[${spring.version}, 3.1.0)";resolution:=optional,
 org.springframework.util.*;version="[${spring.version}, 3.1.0)";resolution:=optional, 
 net.sf.ehcache.*;version="[1.4.1, 2.0.0)";resolution:=optional,
- javax.sql.*;version="0";resolution:=optional 
- 
+ javax.sql.*;version="0";resolution:=optional
@@ -5,7 +5,7 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-parent</artifactId>
-        <version>3.0.3.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
    </parent>
    <packaging>jar</packaging>
    <artifactId>spring-security-aspects</artifactId>
@@ -18,7 +18,7 @@
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-core</artifactId>
-            <version>3.0.3.RELEASE</version>
+            <version>3.0.6.RELEASE</version>
        </dependency>
    </dependencies>
    <build>
@@ -1,7 +1,7 @@
 apply plugin: 'base'

 allprojects {
-    version = '3.0.3.RELEASE'
+    version = '3.0.6.RELEASE'
    releaseBuild = version.endsWith('RELEASE')
    snapshotBuild = version.endsWith('SNAPSHOT')

@@ -23,7 +23,7 @@ dependencies {
            fopDeps

    runtime 'net.sf.xslthl:xslthl:2.0.1',
-            'net.sf.docbook:docbook-xsl:1.75.2:resources@zip'
+            'net.sf.docbook:docbook-xsl:1.75.2:ns-resources@zip'
 }

 task ide(type: Copy)  {
@@ -10,12 +10,23 @@ import org.gradle.api.tasks.bundling.Compression;
 class TarUpload extends Tar {
    @Input
    String remoteDir
-
-    @Input
    Login login
+    @Input
+    String host
    
    TarUpload() {
        compression = Compression.BZIP2
+        if (project.configurations.findByName('antjsch') == null) {
+            project.configurations.add('antjsch')
+            project.dependencies {
+                antjsch 'org.apache.ant:ant-jsch:1.8.1'
+            }
+            def classpath = project.configurations.antjsch.asPath
+            project.ant {
+                taskdef(name: 'scp', classname: 'org.apache.tools.ant.taskdefs.optional.ssh.Scp', classpath: classpath)
+                taskdef(name: 'sshexec', classname: 'org.apache.tools.ant.taskdefs.optional.ssh.SSHExec', classpath: classpath)
+            }
+        }
    }
    
    @TaskAction
@@ -38,6 +49,7 @@ class TarUpload extends Tar {
    void setLogin(Login login) {
        dependsOn(login)
        this.login = login
+        this.host = login.host
    }
 }

@@ -52,11 +64,12 @@ class Login extends DefaultTask {

    @TaskAction
    login() {
-        project.ant {
-            input("Please enter the ssh username for host '$host'", addproperty: "user.$host")
-            input("Please enter the ssh password '$host'", addproperty: "pass.$host")
+        def console = System.console()
+        if (console) {
+            username = console.readLine("\nPlease enter the ssh username for host '$host': ")
+            password = new String(console.readPassword("Please enter the ssh password for '$host': "))
+        } else {
+            logger.error "Unable to access System.console()."
        }
-        username = ant.properties["user.$host"]
-        password = ant.properties["pass.$host"]
    }
 }
@@ -3,7 +3,7 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-parent</artifactId>
-        <version>3.0.3.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
    </parent>
    <artifactId>spring-security-cas-client</artifactId>
    <name>Spring Security - CAS support</name>
@@ -54,6 +54,7 @@ import org.springframework.security.web.authentication.AbstractAuthenticationPro
 * By default this filter processes the URL <tt>/j_spring_cas_security_check</tt>.
 *
 * @author Ben Alex
+ * @author Rob Winch
 */
 public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
    //~ Static fields/initializers =====================================================================================
@@ -89,7 +90,13 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
    //~ Methods ========================================================================================================

    public Authentication attemptAuthentication(final HttpServletRequest request, final HttpServletResponse response)
-            throws AuthenticationException {
+            throws AuthenticationException, IOException {
+        // if the request is a proxy request process it and return null to indicate the request has been processed
+        if(isProxyRequest(request)) {
+            CommonUtils.readAndRespondToProxyReceptorRequest(request, response, this.proxyGrantingTicketStorage);
+            return null;
+        }
+
        final String username = CAS_STATEFUL_IDENTIFIER;
        String password = request.getParameter(this.artifactParameter);

@@ -108,18 +115,7 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
     * Overridden to provide proxying capabilities.
     */
    protected boolean requiresAuthentication(final HttpServletRequest request, final HttpServletResponse response) {
-        final String requestUri = request.getRequestURI();
-
-        if (CommonUtils.isEmpty(this.proxyReceptorUrl) || !requestUri.endsWith(this.proxyReceptorUrl) || this.proxyGrantingTicketStorage == null) {
-            return super.requiresAuthentication(request, response);
-        }
-
-        try {
-            CommonUtils.readAndRespondToProxyReceptorRequest(request, response, this.proxyGrantingTicketStorage);
-            return false;
-        } catch (final IOException e) {
-            return super.requiresAuthentication(request, response);
-        }
+        return isProxyRequest(request) || super.requiresAuthentication(request, response);
    }

    public final void setProxyReceptorUrl(final String proxyReceptorUrl) {
@@ -134,4 +130,14 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
    public final void setServiceProperties(final ServiceProperties serviceProperties) {
        this.artifactParameter = serviceProperties.getArtifactParameter();
    }
+
+    /**
+     * Indicates if the request is eligible to be processed as a proxy request.
+     * @param request
+     * @return
+     */
+    private boolean isProxyRequest(final HttpServletRequest request) {
+        final String requestUri = request.getRequestURI();
+        return this.proxyGrantingTicketStorage != null && !CommonUtils.isEmpty(this.proxyReceptorUrl) && requestUri.endsWith(this.proxyReceptorUrl);
+    }
 }
@@ -16,7 +16,11 @@
 package org.springframework.security.cas.web;

 import static org.junit.Assert.*;
+import static org.mockito.Mockito.*;

+import javax.servlet.FilterChain;
+
+import org.jasig.cas.client.proxy.ProxyGrantingTicketStorage;
 import org.junit.Test;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
@@ -30,6 +34,7 @@ import org.springframework.security.core.AuthenticationException;
 * Tests {@link CasAuthenticationFilter}.
 *
 * @author Ben Alex
+ * @author Rob Winch
 */
 public class CasAuthenticationFilterTests {
    //~ Methods ========================================================================================================
@@ -67,4 +72,58 @@ public class CasAuthenticationFilterTests {

        filter.attemptAuthentication(new MockHttpServletRequest(), new MockHttpServletResponse());
    }
+
+    @Test
+    public void testRequiresAuthenticationFilterProcessUrl() {
+        CasAuthenticationFilter filter = new CasAuthenticationFilter();
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        request.setRequestURI(filter.getFilterProcessesUrl());
+        assertTrue(filter.requiresAuthentication(request, response));
+    }
+
+    @Test
+    public void testRequiresAuthenticationProxyRequest() {
+        CasAuthenticationFilter filter = new CasAuthenticationFilter();
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        request.setRequestURI("/pgtCallback");
+        assertFalse(filter.requiresAuthentication(request, response));
+        filter.setProxyReceptorUrl(request.getRequestURI());
+        assertFalse(filter.requiresAuthentication(request, response));
+        filter.setProxyGrantingTicketStorage(mock(ProxyGrantingTicketStorage.class));
+        assertTrue(filter.requiresAuthentication(request, response));
+        request.setRequestURI("/other");
+        assertFalse(filter.requiresAuthentication(request, response));
+    }
+
+    @Test
+    public void testAuthenticateProxyUrl() throws Exception {
+        CasAuthenticationFilter filter = new CasAuthenticationFilter();
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        request.setRequestURI("/pgtCallback");
+        filter.setProxyGrantingTicketStorage(mock(ProxyGrantingTicketStorage.class));
+        filter.setProxyReceptorUrl(request.getRequestURI());
+        assertNull(filter.attemptAuthentication(request, response));
+    }
+
+    // SEC-1592
+    @Test
+    public void testChainNotInvokedForProxy() throws Exception {
+        CasAuthenticationFilter filter = new CasAuthenticationFilter();
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        MockHttpServletResponse response = new MockHttpServletResponse();
+        FilterChain chain = mock(FilterChain.class);
+
+        request.setRequestURI("/pgtCallback");
+        filter.setProxyGrantingTicketStorage(mock(ProxyGrantingTicketStorage.class));
+        filter.setProxyReceptorUrl(request.getRequestURI());
+
+        filter.doFilter(request,response,chain);
+        verifyZeroInteractions(chain);
+    }
 }
@@ -1,3 +1,5 @@
+Implementation-Title: org.springframework.security.cas
+Implementation-Version: ${version}
 Bundle-SymbolicName: org.springframework.security.cas
 Bundle-Name: Spring Security CAS
 Bundle-Vendor: SpringSource
@@ -18,4 +20,3 @@ Import-Template:
 org.springframework.util;version="[${spring.version}, 3.1.0)", 
 net.sf.ehcache.*;version="[1.4.1, 2.0.0)";resolution:=optional, 
 javax.servlet.*;version="0"
-  
@@ -3,9 +3,9 @@
 pushd src/main/resources/org/springframework/security/config/

 echo "Converting rnc file to xsd ..."
-java -jar ~/bin/trang.jar spring-security-3.0.3.rnc spring-security-3.0.3.xsd
+java -jar ~/bin/trang.jar spring-security-3.0.4.rnc spring-security-3.0.4.xsd

 echo "Applying XSL transformation to xsd ..."
-xsltproc --output spring-security-3.0.3.xsd spring-security.xsl spring-security-3.0.3.xsd
+xsltproc --output spring-security-3.0.4.xsd spring-security.xsl spring-security-3.0.4.xsd

 popd
@@ -3,7 +3,7 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-parent</artifactId>
-        <version>3.0.3.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
    </parent>
    <packaging>jar</packaging>
    <artifactId>spring-security-config</artifactId>
@@ -50,4 +50,5 @@ public abstract class Elements {
    @Deprecated
    public static final String FILTER_INVOCATION_DEFINITION_SOURCE = "filter-invocation-definition-source";
    public static final String LDAP_PASSWORD_COMPARE = "password-compare";
+    public static final String HTTP_FIREWALL = "http-firewall";
 }
@@ -3,6 +3,8 @@ package org.springframework.security.config;
 import java.util.HashMap;
 import java.util.Map;

+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.beans.factory.config.BeanDefinitionHolder;
 import org.springframework.beans.factory.xml.BeanDefinitionDecorator;
@@ -15,12 +17,14 @@ import org.springframework.security.config.authentication.JdbcUserServiceBeanDef
 import org.springframework.security.config.authentication.UserServiceBeanDefinitionParser;
 import org.springframework.security.config.http.FilterChainMapBeanDefinitionDecorator;
 import org.springframework.security.config.http.FilterInvocationSecurityMetadataSourceParser;
+import org.springframework.security.config.http.HttpFirewallBeanDefinitionParser;
 import org.springframework.security.config.http.HttpSecurityBeanDefinitionParser;
 import org.springframework.security.config.ldap.LdapProviderBeanDefinitionParser;
 import org.springframework.security.config.ldap.LdapServerBeanDefinitionParser;
 import org.springframework.security.config.ldap.LdapUserServiceBeanDefinitionParser;
 import org.springframework.security.config.method.GlobalMethodSecurityBeanDefinitionParser;
 import org.springframework.security.config.method.InterceptMethodsBeanDefinitionDecorator;
+import org.springframework.security.core.SpringSecurityCoreVersion;
 import org.springframework.util.ClassUtils;
 import org.w3c.dom.Element;
 import org.w3c.dom.Node;
@@ -33,14 +37,35 @@ import org.w3c.dom.Node;
 * @since 2.0
 */
 public final class SecurityNamespaceHandler implements NamespaceHandler {
+    private final Log logger = LogFactory.getLog(getClass());
+
    private final Map<String, BeanDefinitionParser> parsers = new HashMap<String, BeanDefinitionParser>();
    private final BeanDefinitionDecorator interceptMethodsBDD = new InterceptMethodsBeanDefinitionDecorator();
    private BeanDefinitionDecorator filterChainMapBDD;

+    public SecurityNamespaceHandler() {
+        String coreVersion = SpringSecurityCoreVersion.getVersion();
+
+        Package pkg = SpringSecurityCoreVersion.class.getPackage();
+
+        if (pkg == null || coreVersion == null) {
+            logger.info("Couldn't determine package version information.");
+            return;
+        }
+
+        String version = pkg.getImplementationVersion();
+        logger.info("Spring Security 'config' module version is " + version);
+
+        if (version.compareTo(coreVersion) != 0) {
+            logger.error("You are running with different versions of the Spring Security 'core' and 'config' modules");
+        }
+    }
+
    public BeanDefinition parse(Element element, ParserContext pc) {
        if (!namespaceMatchesVersion(element)) {
-            pc.getReaderContext().fatal("You cannot use a spring-security-2.0.xsd schema with Spring Security 3.0." +
-                    " Please update your schema declarations to the 3.0 schema.", element);
+            pc.getReaderContext().fatal("You must use a 3.0 schema with Spring Security 3.0." +
+                    "(2.0 or 3.1 versions are not valid)" +
+                    " Please update your schema declarations to the 3.0.3 schema (spring-security-3.0.3.xsd).", element);
        }
        String name = pc.getDelegate().getLocalName(element);
        BeanDefinitionParser parser = parsers.get(name);
@@ -118,6 +143,7 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
        // Only load the web-namespace parsers if the web classes are available
        if (ClassUtils.isPresent("org.springframework.security.web.FilterChainProxy", getClass().getClassLoader())) {
            parsers.put(Elements.HTTP, new HttpSecurityBeanDefinitionParser());
+            parsers.put(Elements.HTTP_FIREWALL, new HttpFirewallBeanDefinitionParser());
            parsers.put(Elements.FILTER_INVOCATION_DEFINITION_SOURCE, new FilterInvocationSecurityMetadataSourceParser());
            parsers.put(Elements.FILTER_SECURITY_METADATA_SOURCE, new FilterInvocationSecurityMetadataSourceParser());
            filterChainMapBDD = new FilterChainMapBeanDefinitionDecorator();
@@ -2,11 +2,6 @@ package org.springframework.security.config.http;

 import static org.springframework.security.config.http.SecurityFilters.*;

-import java.security.NoSuchAlgorithmException;
-import java.security.SecureRandom;
-import java.util.ArrayList;
-import java.util.List;
-
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.beans.BeanMetadataElement;
@@ -33,13 +28,16 @@ import org.springframework.security.web.authentication.preauth.PreAuthenticatedA
 import org.springframework.security.web.authentication.preauth.x509.SubjectDnX509PrincipalExtractor;
 import org.springframework.security.web.authentication.preauth.x509.X509AuthenticationFilter;
 import org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter;
-import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
 import org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint;
+import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
 import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
 import org.springframework.util.StringUtils;
 import org.springframework.util.xml.DomUtils;
 import org.w3c.dom.Element;

+import java.security.SecureRandom;
+import java.util.*;
+
 /**
 * Handles creation of authentication mechanism filters and related beans for &lt;http&gt; parsing.
 *
@@ -68,6 +66,8 @@ final class AuthenticationConfigBuilder {

    private static final String ATT_REF = "ref";

+    private static final String ATT_KEY = "key";
+
    private Element httpElt;
    private ParserContext pc;

@@ -81,10 +81,8 @@ final class AuthenticationConfigBuilder {
    private String rememberMeServicesId;
    private BeanReference rememberMeProviderRef;
    private BeanDefinition basicFilter;
-    private BeanReference basicEntryPoint;
-    private RootBeanDefinition formFilter;
+    private RuntimeBeanReference basicEntryPoint;
    private BeanDefinition formEntryPoint;
-    private RootBeanDefinition openIDFilter;
    private BeanDefinition openIDEntryPoint;
    private BeanReference openIDProviderRef;
    private String openIDProviderId;
@@ -99,8 +97,6 @@ final class AuthenticationConfigBuilder {
    private BeanDefinition etf;
    private BeanReference requestCache;

-    final SecureRandom random;
-
    public AuthenticationConfigBuilder(Element element, ParserContext pc, boolean allowSessionCreation,
            String portMapperName) {
        this.httpElt = element;
@@ -108,18 +104,9 @@ final class AuthenticationConfigBuilder {
        this.portMapperName = portMapperName;
        autoConfig = "true".equals(element.getAttribute(ATT_AUTO_CONFIG));
        this.allowSessionCreation = allowSessionCreation;
-        try {
-            random = SecureRandom.getInstance("SHA1PRNG");
-        } catch (NoSuchAlgorithmException e) {
-            // Shouldn't happen...
-            throw new RuntimeException("Failed find SHA1PRNG algorithm!");
-        }
    }

    void createRememberMeFilter(BeanReference authenticationManager) {
-        final String ATT_KEY = "key";
-        final String DEF_KEY = "SpringSecured";
-
        // Parse remember me before logout as RememberMeServices is also a LogoutHandler implementation.
        Element rememberMeElt = DomUtils.getChildElementByTagName(httpElt, Elements.REMEMBER_ME);

@@ -127,10 +114,10 @@ final class AuthenticationConfigBuilder {
            String key = rememberMeElt.getAttribute(ATT_KEY);

            if (!StringUtils.hasText(key)) {
-                key = DEF_KEY;
+                key = createKey();
            }

-            rememberMeFilter = (RootBeanDefinition) new RememberMeBeanDefinitionParser(key).parse(rememberMeElt, pc);
+            rememberMeFilter = new RememberMeBeanDefinitionParser(key).parse(rememberMeElt, pc);
            rememberMeFilter.getPropertyValues().addPropertyValue("authenticationManager", authenticationManager);
            rememberMeServicesId = ((RuntimeBeanReference) rememberMeFilter.getPropertyValues().getPropertyValue("rememberMeServices").getValue()).getBeanName();
            createRememberMeProvider(key);
@@ -152,6 +139,7 @@ final class AuthenticationConfigBuilder {
    void createFormLoginFilter(BeanReference sessionStrategy, BeanReference authManager) {

        Element formLoginElt = DomUtils.getChildElementByTagName(httpElt, Elements.FORM_LOGIN);
+        RootBeanDefinition formFilter = null;

        if (formLoginElt != null || autoConfig) {
            FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser("/j_spring_security_check",
@@ -176,6 +164,7 @@ final class AuthenticationConfigBuilder {

    void createOpenIDLoginFilter(BeanReference sessionStrategy, BeanReference authManager) {
        Element openIDLoginElt = DomUtils.getChildElementByTagName(httpElt, Elements.OPENID_LOGIN);
+        RootBeanDefinition openIDFilter = null;

        if (openIDLoginElt != null) {
            FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser("/j_spring_openid_security_check",
@@ -329,7 +318,7 @@ final class AuthenticationConfigBuilder {


    void createLoginPageFilterIfNeeded() {
-        boolean needLoginPage = formFilter != null || openIDFilter != null;
+        boolean needLoginPage = formFilterId != null || openIDFilterId != null;
        String formLoginPage = getLoginFormUrl(formEntryPoint);
        String openIDLoginPage = getLoginFormUrl(openIDEntryPoint);

@@ -340,11 +329,11 @@ final class AuthenticationConfigBuilder {
            BeanDefinitionBuilder loginPageFilter =
                BeanDefinitionBuilder.rootBeanDefinition(DefaultLoginPageGeneratingFilter.class);

-            if (formFilter != null) {
+            if (formFilterId != null) {
                loginPageFilter.addConstructorArgReference(formFilterId);
            }

-            if (openIDFilter != null) {
+            if (openIDFilterId != null) {
                loginPageFilter.addConstructorArgReference(openIDFilterId);
            }

@@ -374,7 +363,7 @@ final class AuthenticationConfigBuilder {
        if (anonymousElt != null) {
            grantedAuthority = anonymousElt.getAttribute("granted-authority");
            username = anonymousElt.getAttribute("username");
-            key = anonymousElt.getAttribute("key");
+            key = anonymousElt.getAttribute(ATT_KEY);
            source = pc.extractSource(anonymousElt);
        }

@@ -388,7 +377,7 @@ final class AuthenticationConfigBuilder {

        if (!StringUtils.hasText(key)) {
            // Generate a random key for the Anonymous provider
-            key = Long.toString(random.nextLong());
+            key = createKey();
        }

        anonymousFilter = new RootBeanDefinition(AnonymousAuthenticationFilter.class);
@@ -408,6 +397,11 @@ final class AuthenticationConfigBuilder {

    }

+    private String createKey() {
+        SecureRandom random = new SecureRandom();
+        return Long.toString(random.nextLong());
+    }
+
    void createExceptionTranslationFilter() {
        BeanDefinitionBuilder etfBuilder = BeanDefinitionBuilder.rootBeanDefinition(ExceptionTranslationFilter.class);
        etfBuilder.addPropertyValue("accessDeniedHandler", createAccessDeniedHandler(httpElt, pc));
@@ -503,12 +497,12 @@ final class AuthenticationConfigBuilder {
                    "but not both.", pc.extractSource(openIDLoginElt));
        }

-        if (formFilter != null && openIDLoginPage == null) {
+        if (formFilterId != null && openIDLoginPage == null) {
            return formEntryPoint;
        }

        // Otherwise use OpenID if enabled
-        if (openIDFilter != null) {
+        if (openIDFilterId != null) {
            return openIDEntryPoint;
        }

@@ -572,12 +566,12 @@ final class AuthenticationConfigBuilder {
            filters.add(new OrderDecorator(x509Filter, X509_FILTER));
        }

-        if (formFilter != null) {
-            filters.add(new OrderDecorator(formFilter, FORM_LOGIN_FILTER));
+        if (formFilterId != null) {
+            filters.add(new OrderDecorator(new RuntimeBeanReference(formFilterId), FORM_LOGIN_FILTER));
        }

-        if (openIDFilter != null) {
-            filters.add(new OrderDecorator(openIDFilter, OPENID_FILTER));
+        if (openIDFilterId != null) {
+            filters.add(new OrderDecorator(new RuntimeBeanReference(openIDFilterId), OPENID_FILTER));
        }

        if (loginPageGenerationFilter != null) {
@@ -1,5 +1,8 @@
 package org.springframework.security.config.http;

+import static org.springframework.security.config.http.HttpSecurityBeanDefinitionParser.*;
+import static org.springframework.security.config.Elements.*;
+
 import java.util.List;

 import org.apache.commons.logging.Log;
@@ -112,6 +115,13 @@ public class FilterInvocationSecurityMetadataSourceParser implements BeanDefinit
            if (!StringUtils.hasText(access)) {
                continue;
            }
+            String filters = urlElt.getAttribute(ATT_FILTERS);
+            if(OPT_FILTERS_NONE.equals(filters)) {
+                parserContext.getReaderContext().error(
+                        "Ambiguous configuration. Cannot contain " + INTERCEPT_URL+"@" + ATT_FILTERS +
+                        "=\"" + OPT_FILTERS_NONE + "\" and " + INTERCEPT_URL + "@" + ATT_ACCESS,
+                        parserContext.extractSource(urlElt));
+            }

            String path = urlElt.getAttribute(ATT_PATTERN);

@@ -2,6 +2,7 @@ package org.springframework.security.config.http;

 import static org.springframework.security.config.http.SecurityFilters.*;
 import static org.springframework.security.config.http.HttpSecurityBeanDefinitionParser.*;
+import static org.springframework.security.config.Elements.*;

 import java.util.ArrayList;
 import java.util.Collections;
@@ -393,9 +394,21 @@ class HttpConfigurationBuilder {
            String requiredChannel = urlElt.getAttribute(ATT_REQUIRES_CHANNEL);

            if (StringUtils.hasText(requiredChannel)) {
+                String filters = urlElt.getAttribute(ATT_FILTERS);
+                if(OPT_FILTERS_NONE.equals(filters)) {
+                    pc.getReaderContext().error(
+                            "Ambiguous configuration. Cannot contain " + INTERCEPT_URL+"@" + ATT_FILTERS +
+                            "=\"" + OPT_FILTERS_NONE + "\" and " + INTERCEPT_URL + "@" + ATT_REQUIRES_CHANNEL,
+                            pc.extractSource(urlElt));
+                }
                BeanDefinition requestKey = new RootBeanDefinition(RequestKey.class);
                requestKey.getConstructorArgumentValues().addGenericArgumentValue(path);

+                String method = urlElt.getAttribute(ATT_HTTP_METHOD);
+                if(StringUtils.hasText(method)) {
+                    requestKey.getConstructorArgumentValues().addGenericArgumentValue(method);
+                }
+
                RootBeanDefinition channelAttributes = new RootBeanDefinition(ChannelAttributeFactory.class);
                channelAttributes.getConstructorArgumentValues().addGenericArgumentValue(requiredChannel);
                channelAttributes.setFactoryMethodName("createChannelAttributes");
@@ -0,0 +1,38 @@
+package org.springframework.security.config.http;
+
+import org.springframework.beans.BeanMetadataElement;
+import org.springframework.beans.factory.config.BeanDefinition;
+import org.springframework.beans.factory.config.RuntimeBeanReference;
+import org.springframework.beans.factory.support.BeanDefinitionBuilder;
+import org.springframework.beans.factory.support.ManagedMap;
+import org.springframework.beans.factory.support.RootBeanDefinition;
+import org.springframework.beans.factory.xml.BeanDefinitionParser;
+import org.springframework.beans.factory.xml.ParserContext;
+import org.springframework.security.config.BeanIds;
+import org.springframework.util.StringUtils;
+import org.w3c.dom.Element;
+
+import java.util.*;
+
+/**
+ * Injects the supplied {@code HttpFirewall} bean reference into the {@code FilterChainProxy}.
+ *
+ * @author Luke Taylor
+ */
+public class HttpFirewallBeanDefinitionParser implements BeanDefinitionParser {
+
+    public BeanDefinition parse(Element element, ParserContext pc) {
+        String ref = element.getAttribute("ref");
+
+        if (!StringUtils.hasText(ref)) {
+            pc.getReaderContext().error("ref attribute is required", pc.extractSource(element));
+        }
+
+        BeanDefinitionBuilder injector = BeanDefinitionBuilder.rootBeanDefinition(HttpFirewallInjectionBeanPostProcessor.class);
+        injector.addConstructorArgValue(ref);
+
+        pc.getReaderContext().registerWithGeneratedName(injector.getBeanDefinition());
+
+        return null;
+    }
+}
@@ -0,0 +1,40 @@
+package org.springframework.security.config.http;
+
+import org.springframework.beans.BeansException;
+import org.springframework.beans.factory.BeanFactory;
+import org.springframework.beans.factory.BeanFactoryAware;
+import org.springframework.beans.factory.config.BeanPostProcessor;
+import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
+import org.springframework.security.config.BeanIds;
+import org.springframework.security.web.FilterChainProxy;
+import org.springframework.security.web.firewall.HttpFirewall;
+
+/**
+ * @author Luke Taylor
+ */
+public class HttpFirewallInjectionBeanPostProcessor implements BeanPostProcessor, BeanFactoryAware {
+    private ConfigurableListableBeanFactory beanFactory;
+    private String ref;
+
+    public HttpFirewallInjectionBeanPostProcessor(String ref) {
+        this.ref = ref;
+    }
+
+    public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException {
+        if (BeanIds.FILTER_CHAIN_PROXY.equals(beanName)) {
+            HttpFirewall fw = (HttpFirewall) beanFactory.getBean(ref);
+            ((FilterChainProxy)bean).setFirewall(fw);
+        }
+
+        return bean;
+    }
+
+    public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
+        return bean;
+    }
+
+
+    public void setBeanFactory(BeanFactory beanFactory) throws BeansException {
+        this.beanFactory = (ConfigurableListableBeanFactory) beanFactory;
+    }
+}
@@ -56,6 +56,7 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
    static final String OPT_FILTERS_NONE = "none";

    static final String ATT_REQUIRES_CHANNEL = "requires-channel";
+    static final String ATT_HTTP_METHOD = "method";

    private static final String ATT_LOWERCASE_COMPARISONS = "lowercase-comparisons";

@@ -36,12 +36,12 @@ class ContextSourceSettingPostProcessor implements BeanFactoryPostProcessor, Ord
                    "jar file in your application", e);
        }

-        String[] sources = bf.getBeanNamesForType(contextSourceClass);
-
+        String[] sources = bf.getBeanNamesForType(contextSourceClass, false, false);

        if (sources.length == 0) {
            throw new ApplicationContextException("No BaseLdapPathContextSource instances found. Have you " +
-                    "added an <" + Elements.LDAP_SERVER + " /> element to your application context?");
+                    "added an <" + Elements.LDAP_SERVER + " /> element to your application context? If you have " +
+                    "declared an explicit bean, do not use lazy-init");
        }

        if (!bf.containsBean(BeanIds.CONTEXT_SOURCE) && defaultNameRequired) {
@@ -9,6 +9,7 @@ import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.beans.factory.config.BeanDefinitionHolder;
 import org.springframework.beans.factory.config.RuntimeBeanReference;
 import org.springframework.beans.factory.support.BeanDefinitionBuilder;
+import org.springframework.beans.factory.support.ManagedMap;
 import org.springframework.beans.factory.support.RootBeanDefinition;
 import org.springframework.beans.factory.xml.BeanDefinitionDecorator;
 import org.springframework.beans.factory.xml.ParserContext;
@@ -64,16 +65,16 @@ class InternalInterceptMethodsBeanDefinitionDecorator extends AbstractIntercepto
        interceptor.addPropertyValue("authenticationManager", new RuntimeBeanReference(BeanIds.AUTHENTICATION_MANAGER));

        // Lookup parent bean information
-        Element parent = (Element) node.getParentNode();
-        String parentBeanClass = parent.getAttribute("class");
-        parent = null;
+        String parentBeanClass = ((Element) node.getParentNode()).getAttribute("class");

        // Parse the included methods
        List<Element> methods = DomUtils.getChildElementsByTagName(interceptMethodsElt, Elements.PROTECT);
-        Map<String, List<ConfigAttribute>> mappings = new LinkedHashMap<String, List<ConfigAttribute>>();
+        Map<String, BeanDefinition> mappings = new ManagedMap<String, BeanDefinition>();

        for (Element protectmethodElt : methods) {
-            String[] tokens = StringUtils.commaDelimitedListToStringArray(protectmethodElt.getAttribute(ATT_ACCESS));
+            BeanDefinitionBuilder attributeBuilder = BeanDefinitionBuilder.rootBeanDefinition(SecurityConfig.class);
+            attributeBuilder.setFactoryMethod("createListFromCommaDelimitedString");
+            attributeBuilder.addConstructorArgValue(protectmethodElt.getAttribute(ATT_ACCESS));

            // Support inference of class names
            String methodName = protectmethodElt.getAttribute(ATT_METHOD);
@@ -84,7 +85,7 @@ class InternalInterceptMethodsBeanDefinitionDecorator extends AbstractIntercepto
                }
            }

-            mappings.put(methodName, SecurityConfig.createList(tokens));
+            mappings.put(methodName, attributeBuilder.getBeanDefinition());
        }

        BeanDefinition metadataSource = new RootBeanDefinition(MapBasedMethodSecurityMetadataSource.class);
@@ -1,12 +1,7 @@
 package org.springframework.security.config.method;

 import java.lang.reflect.Method;
-import java.util.HashSet;
-import java.util.LinkedHashMap;
-import java.util.LinkedHashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
+import java.util.*;

 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
@@ -50,10 +45,11 @@ final class ProtectPointcutPostProcessor implements BeanPostProcessor {

    private static final Log logger = LogFactory.getLog(ProtectPointcutPostProcessor.class);

-    private Map<String,List<ConfigAttribute>> pointcutMap = new LinkedHashMap<String,List<ConfigAttribute>>();
-    private MapBasedMethodSecurityMetadataSource mapBasedMethodSecurityMetadataSource;
-    private Set<PointcutExpression> pointCutExpressions = new LinkedHashSet<PointcutExpression>();
-    private PointcutParser parser;
+    private final Map<String,List<ConfigAttribute>> pointcutMap = new LinkedHashMap<String,List<ConfigAttribute>>();
+    private final MapBasedMethodSecurityMetadataSource mapBasedMethodSecurityMetadataSource;
+    private final Set<PointcutExpression> pointCutExpressions = new LinkedHashSet<PointcutExpression>();
+    private final PointcutParser parser;
+    private final Set<String> processedBeans = new HashSet<String>();

    public ProtectPointcutPostProcessor(MapBasedMethodSecurityMetadataSource mapBasedMethodSecurityMetadataSource) {
        Assert.notNull(mapBasedMethodSecurityMetadataSource, "MapBasedMethodSecurityMetadataSource to populate is required");
@@ -79,6 +75,11 @@ final class ProtectPointcutPostProcessor implements BeanPostProcessor {
    }

    public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException {
+        if (processedBeans.contains(beanName)) {
+            // We already have the metadata for this bean
+            return bean;
+        }
+
        // Obtain methods for the present bean
        Method[] methods;
        try {
@@ -98,6 +99,8 @@ final class ProtectPointcutPostProcessor implements BeanPostProcessor {
            }
        }

+        processedBeans.add(beanName);
+
        return bean;
    }

@@ -1,5 +1,6 @@
-http\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-3.0.3.xsd
+http\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-3.0.4.xsd
 http\://www.springframework.org/schema/security/spring-security-3.0.xsd=org/springframework/security/config/spring-security-3.0.xsd
+http\://www.springframework.org/schema/security/spring-security-3.0.4.xsd=org/springframework/security/config/spring-security-3.0.4.xsd
 http\://www.springframework.org/schema/security/spring-security-3.0.3.xsd=org/springframework/security/config/spring-security-3.0.3.xsd
 http\://www.springframework.org/schema/security/spring-security-2.0.xsd=org/springframework/security/config/spring-security-2.0.xsd
 http\://www.springframework.org/schema/security/spring-security-2.0.1.xsd=org/springframework/security/config/spring-security-2.0.1.xsd
@@ -187,7 +187,7 @@ protect.attlist &=

 global-method-security =
    ## Provides method security for all beans registered in the Spring application context. Specifically, beans will be scanned for matches with the ordered list of "protect-pointcut" sub-elements, Spring Security annotations and/or. Where there is a match, the beans will automatically be proxied and security authorization applied to the methods accordingly. If you use and enable all four sources of method security metadata (ie "protect-pointcut" declarations, expression annotations, @Secured and also JSR250 security annotations), the metadata sources will be queried in that order. In practical terms, this enables you to use XML to override method security metadata expressed in annotations. If using annotations, the order of precedence is EL-based (@PreAuthorize etc.), @Secured and finally JSR-250.
-	element global-method-security {global-method-security.attlist, (pre-post-annotation-handling | expression-handler)?, protect-pointcut*, after-invocation-provider*}
+    element global-method-security {global-method-security.attlist, (pre-post-annotation-handling | expression-handler)?, protect-pointcut*, after-invocation-provider*}
 global-method-security.attlist &=
    ## Specifies whether the use of Spring Security's pre and post invocation annotations (@PreFilter, @PreAuthorize, @PostFilter, @PostAuthorize) should be enabled for this application context. Defaults to "disabled".
    attribute pre-post-annotations {"disabled" | "enabled" }?
@@ -245,6 +245,9 @@ protect-pointcut.attlist &=
    ## Access configuration attributes list that applies to all methods matching the pointcut, e.g. "ROLE_A,ROLE_B"
    attribute access {xsd:token}

+http-firewall =
+    ## Allows a custom instance of HttpFirewall to be injected into the FilterChainProxy created by the namespace.
+    element http-firewall {ref}

 http =
    ## Container element for HTTP security configuration
@@ -319,16 +322,16 @@ intercept-url.attlist &=
    attribute requires-channel {xsd:token}?

 logout =
-	## Incorporates a logout processing filter. Most web applications require a logout filter, although you may not require one if you write a controller to provider similar logic.
+    ## Incorporates a logout processing filter. Most web applications require a logout filter, although you may not require one if you write a controller to provider similar logic.
    element logout {logout.attlist, empty}
 logout.attlist &=
-	## Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.
+    ## Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.
    attribute logout-url {xsd:token}?
 logout.attlist &=
-	## Specifies the URL to display once the user has logged out. If not specified, defaults to /.
+    ## Specifies the URL to display once the user has logged out. If not specified, defaults to /.
    attribute logout-success-url {xsd:token}?
 logout.attlist &=
-	## Specifies whether a logout also causes HttpSession invalidation, which is generally desirable. If unspecified, defaults to true.
+    ## Specifies whether a logout also causes HttpSession invalidation, which is generally desirable. If unspecified, defaults to true.
    attribute invalidate-session {boolean}?
 logout.attlist &=
    ## A reference to a LogoutSuccessHandler implementation which will be used to determine the destination to which the user is taken after logging out.
@@ -565,29 +568,29 @@ properties-file =
    attribute properties {xsd:token}?

 user =
-	  ## Represents a user in the application.
+      ## Represents a user in the application.
    element user {user.attlist, empty}
 user.attlist &=
-	  ## The username assigned to the user.
+      ## The username assigned to the user.
    attribute name {xsd:token}
 user.attlist &=
-	  ## The password assigned to the user. This may be hashed if the corresponding authentication provider supports hashing (remember to set the "hash" attribute of the "user-service" element). This attribute be omitted in the case where the data will not be used for authentication, but only for accessing authorities. If omitted, the namespace will generate a random value, preventing its accidental use for authentication. Cannot be empty.
+      ## The password assigned to the user. This may be hashed if the corresponding authentication provider supports hashing (remember to set the "hash" attribute of the "user-service" element). This attribute be omitted in the case where the data will not be used for authentication, but only for accessing authorities. If omitted, the namespace will generate a random value, preventing its accidental use for authentication. Cannot be empty.
    attribute password {xsd:string}?
 user.attlist &=
-	  ## One of more authorities granted to the user. Separate authorities with a comma (but no space). For example, "ROLE_USER,ROLE_ADMINISTRATOR"
+      ## One of more authorities granted to the user. Separate authorities with a comma (but no space). For example, "ROLE_USER,ROLE_ADMINISTRATOR"
    attribute authorities {xsd:token}
 user.attlist &=
-	  ## Can be set to "true" to mark an account as locked and unusable.
+      ## Can be set to "true" to mark an account as locked and unusable.
    attribute locked {boolean}?
 user.attlist &=
-	  ## Can be set to "true" to mark an account as disabled and unusable.
+      ## Can be set to "true" to mark an account as disabled and unusable.
    attribute disabled {boolean}?

 jdbc-user-service =
-	  ## Causes creation of a JDBC-based UserDetailsService.
+      ## Causes creation of a JDBC-based UserDetailsService.
    element jdbc-user-service {id? & jdbc-user-service.attlist}
 jdbc-user-service.attlist &=
-	  ## The bean ID of the DataSource which provides the required tables.
+      ## The bean ID of the DataSource which provides the required tables.
    attribute data-source-ref {xsd:token}
 jdbc-user-service.attlist &=
    cache-ref?
@@ -628,5 +631,3 @@ position =


 named-security-filter = "FIRST" | "CHANNEL_FILTER" | "CONCURRENT_SESSION_FILTER" | "SECURITY_CONTEXT_FILTER" | "LOGOUT_FILTER" | "X509_FILTER" | "PRE_AUTH_FILTER" | "CAS_FILTER" | "FORM_LOGIN_FILTER" | "OPENID_FILTER" |"BASIC_AUTH_FILTER" | "SERVLET_API_SUPPORT_FILTER" | "REMEMBER_ME_FILTER" | "ANONYMOUS_FILTER" | "EXCEPTION_TRANSLATION_FILTER" | "SESSION_MANAGEMENT_FILTER" | "FILTER_SECURITY_INTERCEPTOR" | "SWITCH_USER_FILTER" | "LAST"
-
-
@@ -70,40 +70,40 @@ public class FilterChainProxyConfigTests {

    @Test
    public void normalOperation() throws Exception {
-        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("filterChain", FilterChainProxy.class);
+        FilterChainProxy filterChainProxy = appCtx.getBean("filterChain", FilterChainProxy.class);
        doNormalOperation(filterChainProxy);
    }

    @Test
    public void normalOperationWithNewConfig() throws Exception {
-        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("newFilterChainProxy", FilterChainProxy.class);
+        FilterChainProxy filterChainProxy = appCtx.getBean("newFilterChainProxy", FilterChainProxy.class);
        checkPathAndFilterOrder(filterChainProxy);
        doNormalOperation(filterChainProxy);
    }

    @Test
    public void normalOperationWithNewConfigRegex() throws Exception {
-        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("newFilterChainProxyRegex", FilterChainProxy.class);
+        FilterChainProxy filterChainProxy = appCtx.getBean("newFilterChainProxyRegex", FilterChainProxy.class);
        checkPathAndFilterOrder(filterChainProxy);
        doNormalOperation(filterChainProxy);
    }

    @Test
    public void normalOperationWithNewConfigNonNamespace() throws Exception {
-        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("newFilterChainProxyNonNamespace", FilterChainProxy.class);
+        FilterChainProxy filterChainProxy = appCtx.getBean("newFilterChainProxyNonNamespace", FilterChainProxy.class);
        checkPathAndFilterOrder(filterChainProxy);
        doNormalOperation(filterChainProxy);
    }

    @Test
    public void pathWithNoMatchHasNoFilters() throws Exception {
-        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("newFilterChainProxyNoDefaultPath", FilterChainProxy.class);
+        FilterChainProxy filterChainProxy = appCtx.getBean("newFilterChainProxyNoDefaultPath", FilterChainProxy.class);
        assertEquals(null, filterChainProxy.getFilters("/nomatch"));
    }

    @Test
    public void urlStrippingPropertyIsRespected() throws Exception {
-        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("newFilterChainProxyNoDefaultPath", FilterChainProxy.class);
+        FilterChainProxy filterChainProxy = appCtx.getBean("newFilterChainProxyNoDefaultPath", FilterChainProxy.class);

        // Should only match if we are stripping the query string
        String url = "/blah.bar?x=something";
@@ -116,7 +116,7 @@ public class FilterChainProxyConfigTests {
    // SEC-1235
    @Test
    public void mixingPatternsAndPlaceholdersDoesntCauseOrderingIssues() throws Exception {
-        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("sec1235FilterChainProxy", FilterChainProxy.class);
+        FilterChainProxy filterChainProxy = appCtx.getBean("sec1235FilterChainProxy", FilterChainProxy.class);

        String[] paths = filterChainProxy.getFilterChainMap().keySet().toArray(new String[0]);
        assertEquals("/login*", paths[0]);
@@ -23,7 +23,7 @@ public class SecurityNamespacehandlerTests {
            );
            fail("Expected BeanDefinitionParsingException");
        } catch (BeanDefinitionParsingException expected) {
-            assertTrue(expected.getMessage().contains("You cannot use a spring-security-2.0.xsd schema"));
+            assertTrue(expected.getMessage().contains("You must use a 3.0 schema with Spring Security 3.0."));
        }
    }
 }
@@ -80,11 +80,13 @@ import org.springframework.security.web.authentication.www.BasicAuthenticationFi
 import org.springframework.security.web.context.HttpSessionSecurityContextRepository;
 import org.springframework.security.web.context.SaveContextOnUpdateOrErrorResponseWrapper;
 import org.springframework.security.web.context.SecurityContextPersistenceFilter;
+import org.springframework.security.web.firewall.DefaultHttpFirewall;
 import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
 import org.springframework.security.web.savedrequest.RequestCacheAwareFilter;
 import org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter;
 import org.springframework.security.web.session.ConcurrentSessionFilter;
 import org.springframework.security.web.session.SessionManagementFilter;
+import org.springframework.test.util.ReflectionTestUtils;
 import org.springframework.util.ReflectionUtils;

 /**
@@ -183,6 +185,29 @@ public class HttpSecurityBeanDefinitionParserTests {
        assertTrue(filters.size() == 0);
    }

+    @Test(expected=BeanDefinitionParsingException.class)
+    public void filtersEqualsNoneErrorsWithRequiresChannel() throws Exception {
+        setContext(
+                "    <http auto-config='true'>" +
+                "        <intercept-url pattern='/ambiguousConfig' requires-channel='https' filters='none' />" +
+                "    </http>" + AUTH_PROVIDER_XML);
+    }
+
+    @Test(expected=BeanDefinitionParsingException.class)
+    public void filtersEqualsNoneErrorsWithAccess() throws Exception {
+        setContext(
+                "    <http auto-config='true'>" +
+                "        <intercept-url pattern='/ambiguousConfig' access='ROLE_USER' filters='none' />" +
+                "    </http>" + AUTH_PROVIDER_XML);
+    }
+
+    @Test(expected=BeanDefinitionParsingException.class)
+    public void filtersEqualsNoneErrorsWithRequiresChannelAndAccess() throws Exception {
+        setContext(
+                "    <http auto-config='true'>" +
+                "        <intercept-url pattern='/ambiguousConfig' requires-channel='https' filters='none' />" +
+                "    </http>" + AUTH_PROVIDER_XML);
+    }

    @Test
    public void regexPathsWorkCorrectly() throws Exception {
@@ -407,6 +432,23 @@ public class HttpSecurityBeanDefinitionParserTests {
        assertTrue(attrs.contains(new SecurityConfig("ROLE_B")));
    }

+
+    @Test
+    public void httpMethodMatchIsSupportedForRequiresChannel() throws Exception {
+        setContext(
+                 "    <http auto-config='true'>" +
+                 "        <intercept-url pattern='/anyurl'/>" +
+                 "        <intercept-url pattern='/anyurl' method='GET' access='ROLE_ADMIN' requires-channel='https' />" +
+                 "    </http>" + AUTH_PROVIDER_XML);
+
+        ChannelProcessingFilter filter = getFilter(ChannelProcessingFilter.class);
+        FilterInvocationSecurityMetadataSource fids = (FilterInvocationSecurityMetadataSource)FieldUtils.getFieldValue(filter,"securityMetadataSource");
+        Collection<ConfigAttribute> attrs = fids.getAttributes(createFilterinvocation("/anyurl", "GET"));
+         assertEquals(1, attrs.size());
+        attrs = fids.getAttributes(createFilterinvocation("/anyurl", "POST"));
+         assertEquals(null, attrs);
+    }
+
    @Test
    public void oncePerRequestAttributeIsSupported() throws Exception {
        setContext("<http once-per-request='false'><http-basic /></http>" + AUTH_PROVIDER_XML);
@@ -1233,6 +1275,18 @@ public class HttpSecurityBeanDefinitionParserTests {
        fcp.doFilter(request, new MockHttpServletResponse(), new MockFilterChain());
    }

+    @Test
+    public void httpFirewallInjectionIsSupported() throws Exception {
+        setContext(
+                "<http-firewall ref='fw'/>" +
+                "<http>" +
+                "   <form-login />" +
+                "</http>" +
+                "<b:bean id='fw' class='" + DefaultHttpFirewall.class.getName() +"'/>" +
+                AUTH_PROVIDER_XML);
+        FilterChainProxy fcp = (FilterChainProxy) appContext.getBean(BeanIds.FILTER_CHAIN_PROXY);
+        assertSame(appContext.getBean("fw"), FieldUtils.getFieldValue(fcp, "firewall"));
+    }

    private void setContext(String context) {
        appContext = new InMemoryXmlApplicationContext(context);
@@ -25,6 +25,8 @@ public class InterceptMethodsBeanDefinitionDecoratorTests {

    @Before
    public void loadContext() {
+        // Set value for placeholder
+        System.setProperty("admin.role", "ROLE_ADMIN");
        appContext = new ClassPathXmlApplicationContext("org/springframework/security/config/method-security.xml");
        target = (TestBusinessBean) appContext.getBean("target");
    }
@@ -22,11 +22,11 @@ public class InMemoryXmlApplicationContext extends AbstractXmlApplicationContext
    Resource inMemoryXml;

    public InMemoryXmlApplicationContext(String xml) {
-        this(xml, "3.0.3", null);
+        this(xml, "3.0.4", null);
    }

    public InMemoryXmlApplicationContext(String xml, ApplicationContext parent) {
-        this(xml, "3.0.3", parent);
+        this(xml, "3.0.4", parent);
    }

    public InMemoryXmlApplicationContext(String xml, String secVersion, ApplicationContext parent) {
@@ -6,11 +6,13 @@
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
 http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">

+    <b:bean class='org.springframework.beans.factory.config.PropertyPlaceholderConfigurer'/>
+
    <b:bean id="target" class="org.springframework.security.config.TestBusinessBeanImpl">
        <!-- This will add a security interceptor to the bean -->
        <intercept-methods>
-            <protect method="org.springframework.security.config.TestBusinessBean.set*" access="ROLE_ADMIN" />
-            <protect method="get*" access="ROLE_ADMIN,ROLE_USER" />
+            <protect method="org.springframework.security.config.TestBusinessBean.set*" access="${admin.role}" />
+            <protect method="get*" access="${admin.role},ROLE_USER" />
            <protect method="doSomething" access="ROLE_USER" />
        </intercept-methods>
    </b:bean>
@@ -1,3 +1,5 @@
+Implementation-Title: org.springframework.security.config
+Implementation-Version: ${version}
 Bundle-SymbolicName: org.springframework.security.config
 Bundle-Name: Spring Security Namespace Configuration
 Bundle-Vendor: SpringSource
@@ -3,7 +3,7 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-parent</artifactId>
-        <version>3.0.3.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
    </parent>
    <packaging>jar</packaging>
    <artifactId>spring-security-core</artifactId>
@@ -35,7 +35,7 @@ import org.springframework.security.access.method.AbstractFallbackMethodSecurity
 public class SecuredAnnotationSecurityMetadataSource extends AbstractFallbackMethodSecurityMetadataSource {

    protected Collection<ConfigAttribute> findAttributes(Class<?> clazz) {
-        return processAnnotation(clazz.getAnnotation(Secured.class));
+        return processAnnotation(AnnotationUtils.findAnnotation(clazz, Secured.class));
    }

    protected Collection<ConfigAttribute> findAttributes(Method method, Class<?> targetClass) {
@@ -36,6 +36,14 @@ public abstract class SecurityExpressionRoot {
        this.authentication = a;
    }

+    public final boolean hasAuthority(String authority) {
+        return hasRole(authority);
+    }
+
+    public final boolean hasAnyAuthority(String... authorities) {
+        return hasAnyRole(authorities);
+    }
+
    public final boolean hasRole(String role) {
        return getAuthoritySet().contains(role);
    }
@@ -29,6 +29,7 @@ import java.util.regex.Pattern;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.AuthorityUtils;
 import org.springframework.security.core.authority.GrantedAuthorityImpl;

 /**
@@ -106,7 +107,7 @@ public class RoleHierarchyImpl implements RoleHierarchy {

    public Collection<GrantedAuthority> getReachableGrantedAuthorities(Collection<GrantedAuthority> authorities) {
        if (authorities == null || authorities.isEmpty()) {
-            return null;
+            return AuthorityUtils.NO_AUTHORITIES;
        }

        Set<GrantedAuthority> reachableRoles = new HashSet<GrantedAuthority>();
@@ -40,6 +40,7 @@ import org.springframework.security.authentication.AuthenticationCredentialsNotF
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.SpringSecurityMessageSource;
+import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.util.Assert;

@@ -224,16 +225,18 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean, A
            }

            // no further work post-invocation
-            return new InterceptorStatusToken(authenticated, false, attributes, object);
+            return new InterceptorStatusToken(SecurityContextHolder.getContext(), false, attributes, object);
        } else {
            if (debug) {
                logger.debug("Switching to RunAs Authentication: " + runAs);
            }

+            SecurityContext origCtx = SecurityContextHolder.getContext();
+            SecurityContextHolder.setContext(SecurityContextHolder.createEmptyContext());
            SecurityContextHolder.getContext().setAuthentication(runAs);

            // need to revert to token.Authenticated post-invocation
-            return new InterceptorStatusToken(authenticated, true, attributes, object);
+            return new InterceptorStatusToken(origCtx, true, attributes, object);
        }
    }

@@ -253,21 +256,22 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean, A

        if (token.isContextHolderRefreshRequired()) {
            if (logger.isDebugEnabled()) {
-                logger.debug("Reverting to original Authentication: " + token.getAuthentication().toString());
+                logger.debug("Reverting to original Authentication: " + token.getSecurityContext().getAuthentication());
            }

-            SecurityContextHolder.getContext().setAuthentication(token.getAuthentication());
+            SecurityContextHolder.setContext(token.getSecurityContext());
        }

        if (afterInvocationManager != null) {
            // Attempt after invocation handling
            try {
-                returnedObject = afterInvocationManager.decide(token.getAuthentication(), token.getSecureObject(),
+                returnedObject = afterInvocationManager.decide(token.getSecurityContext().getAuthentication(),
+                        token.getSecureObject(),
                        token.getAttributes(), returnedObject);
            }
            catch (AccessDeniedException accessDeniedException) {
                AuthorizationFailureEvent event = new AuthorizationFailureEvent(token.getSecureObject(), token
-                        .getAttributes(), token.getAuthentication(), accessDeniedException);
+                        .getAttributes(), token.getSecurityContext().getAuthentication(), accessDeniedException);
                publishEvent(event);

                throw accessDeniedException;
@@ -19,6 +19,7 @@ import java.util.Collection;

 import org.springframework.security.access.ConfigAttribute;
 import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContext;


 /**
@@ -33,16 +34,16 @@ import org.springframework.security.core.Authentication;
 public class InterceptorStatusToken {
    //~ Instance fields ================================================================================================

-    private Authentication authentication;
+    private SecurityContext securityContext;
    private Collection<ConfigAttribute> attr;
    private Object secureObject;
    private boolean contextHolderRefreshRequired;

    //~ Constructors ===================================================================================================

-    public InterceptorStatusToken(Authentication authentication, boolean contextHolderRefreshRequired,
+    public InterceptorStatusToken(SecurityContext securityContext, boolean contextHolderRefreshRequired,
            Collection<ConfigAttribute> attributes, Object secureObject) {
-        this.authentication = authentication;
+        this.securityContext = securityContext;
        this.contextHolderRefreshRequired = contextHolderRefreshRequired;
        this.attr = attributes;
        this.secureObject = secureObject;
@@ -54,8 +55,8 @@ public class InterceptorStatusToken {
        return attr;
    }

-    public Authentication getAuthentication() {
-        return authentication;
+    public SecurityContext getSecurityContext() {
+        return securityContext;
    }

    public Object getSecureObject() {
@@ -73,7 +73,8 @@ public class RunAsUserToken extends AbstractAuthenticationToken {

    public String toString() {
        StringBuilder sb = new StringBuilder(super.toString());
-        sb.append("; Original Class: ").append(this.originalAuthentication.getName());
+        String className = this.originalAuthentication == null ? null : this.originalAuthentication.getName();
+        sb.append("; Original Class: ").append(className);

        return sb.toString();
    }
@@ -15,6 +15,7 @@

 package org.springframework.security.access.method;

+import org.springframework.aop.framework.AopProxyUtils;
 import org.springframework.security.access.ConfigAttribute;

 import org.aopalliance.intercept.MethodInvocation;
@@ -52,7 +53,12 @@ public abstract class AbstractMethodSecurityMetadataSource implements MethodSecu
            Class<?> targetClass = null;

            if (target != null) {
-                targetClass = target instanceof Class<?> ? (Class<?>)target : target.getClass();
+                targetClass = target instanceof Class<?> ? (Class<?>)target : AopProxyUtils.ultimateTargetClass(target);
+
+                if (targetClass == null) {
+                    // See SPR-7447. TODO: Only required for Spring < 3.0.4
+                    targetClass = target.getClass();
+                }
            }

            return getAttributes(mi.getMethod(), targetClass);
@@ -88,6 +88,10 @@ public final class DelegatingMethodSecurityMetadataSource extends AbstractMethod
        this.methodSecurityMetadataSources = methodSecurityMetadataSources;
    }

+    public List<MethodSecurityMetadataSource> getMethodSecurityMetadataSources() {
+        return methodSecurityMetadataSources;
+    }
+
    //~ Inner Classes ==================================================================================================

    private static class DefaultCacheKey {
@@ -25,6 +25,7 @@ import java.util.Map;
 import java.util.Set;

 import org.springframework.beans.factory.BeanClassLoaderAware;
+import org.springframework.beans.factory.InitializingBean;
 import org.springframework.security.access.ConfigAttribute;
 import org.springframework.util.Assert;
 import org.springframework.util.ClassUtils;
@@ -42,7 +43,8 @@ import org.springframework.util.ClassUtils;
 * @author Ben Alex
 * @since 2.0
 */
-public class MapBasedMethodSecurityMetadataSource extends AbstractFallbackMethodSecurityMetadataSource implements BeanClassLoaderAware {
+public class MapBasedMethodSecurityMetadataSource extends AbstractFallbackMethodSecurityMetadataSource
+        implements BeanClassLoaderAware {

    //~ Instance fields ================================================================================================
    private ClassLoader beanClassLoader = ClassUtils.getDefaultClassLoader();
@@ -103,7 +105,7 @@ public class MapBasedMethodSecurityMetadataSource extends AbstractFallbackMethod
     * for matching multiple methods.
     *
     * @param name type and method name, separated by a dot
-     * @param attr required authorities associated with the method
+     * @param attr the security attributes associated with the method
     */
    private void addSecureMethod(String name, List<ConfigAttribute> attr) {
        int lastDotIndex = name.lastIndexOf(".");
@@ -175,7 +177,9 @@ public class MapBasedMethodSecurityMetadataSource extends AbstractFallbackMethod
     * Adds configuration attributes for a specific method, for example where the method has been
     * matched using a pointcut expression. If a match already exists in the map for the method, then
     * the existing match will be retained, so that if this method is called for a more general pointcut
-     * it will not override a more specific one which has already been added. This
+     * it will not override a more specific one which has already been added.
+     * <p>
+     * This method should only be called during initialization of the {@code BeanFactory}.
     */
    public void addSecureMethod(Class<?> javaType, Method method, List<ConfigAttribute> attr) {
        RegisteredMethod key = new RegisteredMethod(method, javaType);
@@ -105,23 +105,13 @@ public class PrePostAnnotationSecurityMetadataSource extends AbstractMethodSecur
        }

        // Check the class-level (note declaringClass, not targetClass, which may not actually implement the method)
-        annotation = specificMethod.getDeclaringClass().getAnnotation(annotationClass);
+        annotation = AnnotationUtils.findAnnotation(specificMethod.getDeclaringClass(), annotationClass);

        if (annotation != null) {
            logger.debug(annotation + " found on: " + specificMethod.getDeclaringClass().getName());
            return annotation;
        }

-        // Check for a possible interface annotation which would not be inherited by the declaring class
-        if (specificMethod != method) {
-            annotation = method.getDeclaringClass().getAnnotation(annotationClass);
-
-            if (annotation != null) {
-                logger.debug(annotation + " found on: " + method.getDeclaringClass().getName());
-                return annotation;
-            }
-        }
-
        return null;
    }

@@ -77,7 +77,9 @@ public abstract class AbstractAuthenticationManager implements AuthenticationMan
     * be serialized to the client. Defaults to 'false'.
     *
     * @see org.springframework.security.core.AuthenticationException#getExtraInformation()
+     * @deprecated the {@code extraInformation} property is deprecated
     */
+    @Deprecated
    public void setClearExtraInformation(boolean clearExtraInformation) {
        this.clearExtraInformation = clearExtraInformation;
    }
@@ -17,6 +17,7 @@ public abstract class AccountStatusException extends AuthenticationException {
        super(msg, t);
    }

+    @Deprecated
    protected AccountStatusException(String msg, Object extraInformation) {
        super(msg, extraInformation);
    }
@@ -14,20 +14,20 @@ public class AccountStatusUserDetailsChecker implements UserDetailsChecker {

    public void check(UserDetails user) {
        if (!user.isAccountNonLocked()) {
-            throw new LockedException(messages.getMessage("UserDetailsService.locked", "User account is locked"), user);
+            throw new LockedException(messages.getMessage("AccountStatusUserDetailsChecker.locked", "User account is locked"), user);
        }

        if (!user.isEnabled()) {
-            throw new DisabledException(messages.getMessage("UserDetailsService.disabled", "User is disabled"), user);
+            throw new DisabledException(messages.getMessage("AccountStatusUserDetailsChecker.disabled", "User is disabled"), user);
        }

        if (!user.isAccountNonExpired()) {
-            throw new AccountExpiredException(messages.getMessage("UserDetailsService.expired",
+            throw new AccountExpiredException(messages.getMessage("AccountStatusUserDetailsChecker.expired",
                    "User account has expired"), user);
        }

        if (!user.isCredentialsNonExpired()) {
-            throw new CredentialsExpiredException(messages.getMessage("UserDetailsService.credentialsExpired",
+            throw new CredentialsExpiredException(messages.getMessage("AccountStatusUserDetailsChecker.credentialsExpired",
                    "User credentials have expired"), user);
        }
    }
@@ -36,6 +36,7 @@ public class BadCredentialsException extends AuthenticationException {
        super(msg);
    }

+    @Deprecated
    public BadCredentialsException(String msg, Object extraInformation) {
        super(msg, extraInformation);
    }
@@ -16,6 +16,8 @@
 package org.springframework.security.authentication.dao;


+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
 import org.springframework.security.authentication.AccountExpiredException;
 import org.springframework.security.authentication.AuthenticationProvider;
 import org.springframework.security.authentication.BadCredentialsException;
@@ -71,6 +73,9 @@ import org.springframework.util.Assert;
 */
 public abstract class AbstractUserDetailsAuthenticationProvider implements AuthenticationProvider, InitializingBean,
        MessageSourceAware {
+
+    protected final Log logger = LogFactory.getLog(getClass());
+
    //~ Instance fields ================================================================================================

    protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
@@ -123,6 +128,8 @@ public abstract class AbstractUserDetailsAuthenticationProvider implements Authe
            try {
                user = retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication);
            } catch (UsernameNotFoundException notFound) {
+                logger.debug("User '" + username + "' not found");
+
                if (hideUserNotFoundExceptions) {
                    throw new BadCredentialsException(messages.getMessage(
                            "AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
@@ -178,7 +185,7 @@ public abstract class AbstractUserDetailsAuthenticationProvider implements Authe
     * @return the successful authentication token
     */
    protected Authentication createSuccessAuthentication(Object principal, Authentication authentication,
-        UserDetails user) {
+            UserDetails user) {
        // Ensure we return the original credentials the user supplied,
        // so subsequent attempts are successful even with encoded passwords.
        // Also ensure we return the original getDetails(), so that future
@@ -291,16 +298,22 @@ public abstract class AbstractUserDetailsAuthenticationProvider implements Authe
    private class DefaultPreAuthenticationChecks implements UserDetailsChecker {
        public void check(UserDetails user) {
            if (!user.isAccountNonLocked()) {
+                logger.debug("User account is locked");
+
                throw new LockedException(messages.getMessage("AbstractUserDetailsAuthenticationProvider.locked",
                        "User account is locked"), user);
            }

            if (!user.isEnabled()) {
+                logger.debug("User account is disabled");
+
                throw new DisabledException(messages.getMessage("AbstractUserDetailsAuthenticationProvider.disabled",
                        "User is disabled"), user);
            }

            if (!user.isAccountNonExpired()) {
+                logger.debug("User account is expired");
+
                throw new AccountExpiredException(messages.getMessage("AbstractUserDetailsAuthenticationProvider.expired",
                        "User account has expired"), user);
            }
@@ -310,6 +323,8 @@ public abstract class AbstractUserDetailsAuthenticationProvider implements Authe
    private class DefaultPostAuthenticationChecks implements UserDetailsChecker {
        public void check(UserDetails user) {
            if (!user.isCredentialsNonExpired()) {
+                logger.debug("User account credentials have expired");
+
                throw new CredentialsExpiredException(messages.getMessage(
                        "AbstractUserDetailsAuthenticationProvider.credentialsExpired",
                        "User credentials have expired"), user);
@@ -56,6 +56,8 @@ public class DaoAuthenticationProvider extends AbstractUserDetailsAuthentication
        }

        if (authentication.getCredentials() == null) {
+            logger.debug("Authentication failed: no credentials provided");
+
            throw new BadCredentialsException(messages.getMessage(
                    "AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"),
                    includeDetailsObject ? userDetails : null);
@@ -64,6 +66,8 @@ public class DaoAuthenticationProvider extends AbstractUserDetailsAuthentication
        String presentedPassword = authentication.getCredentials().toString();

        if (!passwordEncoder.isPasswordValid(userDetails.getPassword(), presentedPassword, salt)) {
+            logger.debug("Authentication failed: password does not match stored value");
+
            throw new BadCredentialsException(messages.getMessage(
                    "AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"),
                    includeDetailsObject ? userDetails : null);
@@ -16,12 +16,12 @@
 package org.springframework.security.authentication.encoding;


-import java.io.UnsupportedEncodingException;
-import java.security.MessageDigest;
-
 import org.springframework.security.core.codec.Base64;
+import org.springframework.security.core.codec.Utf8;
 import org.springframework.util.Assert;

+import java.io.UnsupportedEncodingException;
+import java.security.MessageDigest;

 /**
 * A version of {@link ShaPasswordEncoder} which supports Ldap SHA and SSHA (salted-SHA) encodings. The values are
@@ -101,7 +101,7 @@ public class LdapShaPasswordEncoder implements PasswordEncoder {
            prefix = forceLowerCasePrefix ? SSHA_PREFIX_LC : SSHA_PREFIX;
        }

-        return prefix + new String(Base64.encode(hash));
+        return prefix + Utf8.decode(Base64.encode(hash));
    }

    private byte[] extractSalt(String encPass) {
@@ -145,7 +145,7 @@ public class LdapShaPasswordEncoder implements PasswordEncoder {

        String encodedRawPass = encodePassword(rawPass, salt).substring(startOfHash);

-        return encodedRawPass.equals(encPass.substring(startOfHash));
+        return PasswordEncoderUtils.equals(encodedRawPass,encPass.substring(startOfHash));
    }

    /**
@@ -14,10 +14,11 @@
 */
 package org.springframework.security.authentication.encoding;

-import java.io.UnsupportedEncodingException;
-
 import org.springframework.security.core.codec.Base64;
 import org.springframework.security.core.codec.Hex;
+import org.springframework.security.core.codec.Utf8;
+
+import java.io.UnsupportedEncodingException;

 /**
 * MD4 implementation of PasswordEncoder.
@@ -60,7 +61,7 @@ public class Md4PasswordEncoder extends BaseDigestPasswordEncoder {
        byte[] resBuf = md4.digest();

        if (getEncodeHashAsBase64()) {
-            return new String(Base64.encode(resBuf));
+            return Utf8.decode(Base64.encode(resBuf));
        } else {
            return new String(Hex.encode(resBuf));
        }
@@ -78,7 +79,7 @@ public class Md4PasswordEncoder extends BaseDigestPasswordEncoder {
    public boolean isPasswordValid(String encPass, String rawPass, Object salt) {
        String pass1 = "" + encPass;
        String pass2 = encodePassword(rawPass, salt);
-        return pass1.equals(pass2);
+        return PasswordEncoderUtils.equals(pass1,pass2);
    }

    public String getAlgorithm() {
@@ -1,13 +1,14 @@
 package org.springframework.security.authentication.encoding;

+import org.springframework.security.core.codec.Base64;
+import org.springframework.security.core.codec.Hex;
+import org.springframework.security.core.codec.Utf8;
+import org.springframework.util.Assert;
+
 import java.io.UnsupportedEncodingException;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;

-import org.springframework.security.core.codec.Base64;
-import org.springframework.security.core.codec.Hex;
-import org.springframework.util.Assert;
-
 /**
 * Base for digest password encoders.
 * <p>
@@ -92,7 +93,7 @@ public class MessageDigestPasswordEncoder extends BaseDigestPasswordEncoder {
        }

        if (getEncodeHashAsBase64()) {
-            return new String(Base64.encode(digest));
+            return Utf8.decode(Base64.encode(digest));
        } else {
            return new String(Hex.encode(digest));
        }
@@ -126,7 +127,7 @@ public class MessageDigestPasswordEncoder extends BaseDigestPasswordEncoder {
        String pass1 = "" + encPass;
        String pass2 = encodePassword(rawPass, salt);

-        return pass1.equals(pass2);
+        return PasswordEncoderUtils.equals(pass1,pass2);
    }

    public String getAlgorithm() {
@@ -0,0 +1,45 @@
+package org.springframework.security.authentication.encoding;
+
+import java.io.UnsupportedEncodingException;
+
+/**
+ * Utility for constant time comparison to prevent against timing attacks.
+ *
+ * @author Rob Winch
+ */
+class PasswordEncoderUtils {
+
+    /**
+     * Constant time comparison to prevent against timing attacks.
+     * @param expected
+     * @param actual
+     * @return
+     */
+    static boolean equals(String expected, String actual) {
+        byte[] expectedBytes = bytesUtf8(expected);
+        byte[] actualBytes = bytesUtf8(actual);
+        int expectedLength = expectedBytes == null ? -1 : expectedBytes.length;
+        int actualLength = actualBytes == null ? -1 : actualBytes.length;
+        if (expectedLength != actualLength) {
+            return false;
+        }
+
+        int result = 0;
+        for (int i = 0; i < expectedLength; i++) {
+            result |= expectedBytes[i] ^ actualBytes[i];
+        }
+        return result == 0;
+    }
+
+    private static byte[] bytesUtf8(String s) {
+        if(s == null) {
+            return null;
+        }
+        try {
+            return s.getBytes("UTF-8");
+        } catch (UnsupportedEncodingException e) {
+            throw new IllegalStateException("Could not get bytes in UTF-8 format",e);
+        }
+    }
+    private PasswordEncoderUtils() {}
+}
@@ -15,6 +15,8 @@

 package org.springframework.security.authentication.encoding;

+import java.util.Locale;
+
 /**
 * <p>Plaintext implementation of PasswordEncoder.</p>
 *  <P>As callers may wish to extract the password and salts separately from the encoded password, the salt must
@@ -46,11 +48,12 @@ public class PlaintextPasswordEncoder extends BasePasswordEncoder {
        // authentication will fail as the encodePassword never allows them)
        String pass2 = mergePasswordAndSalt(rawPass, salt, false);

-        if (!ignorePasswordCase) {
-            return pass1.equals(pass2);
-        } else {
-            return pass1.equalsIgnoreCase(pass2);
+        if (ignorePasswordCase) {
+            // Note: per String javadoc to get correct results for Locale insensitive, use English
+            pass1 = pass1.toLowerCase(Locale.ENGLISH);
+            pass2 = pass2.toLowerCase(Locale.ENGLISH);
        }
+        return PasswordEncoderUtils.equals(pass1,pass2);
    }

    /**
@@ -15,22 +15,6 @@

 package org.springframework.security.authentication.jaas;

-import java.io.File;
-import java.io.IOException;
-import java.net.URL;
-import java.security.Principal;
-import java.security.Security;
-import java.util.ArrayList;
-import java.util.HashSet;
-import java.util.Set;
-
-import javax.security.auth.callback.Callback;
-import javax.security.auth.callback.CallbackHandler;
-import javax.security.auth.callback.UnsupportedCallbackException;
-import javax.security.auth.login.Configuration;
-import javax.security.auth.login.LoginContext;
-import javax.security.auth.login.LoginException;
-
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.beans.factory.InitializingBean;
@@ -49,6 +33,19 @@ import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.session.SessionDestroyedEvent;
 import org.springframework.util.Assert;

+import javax.security.auth.callback.Callback;
+import javax.security.auth.callback.CallbackHandler;
+import javax.security.auth.callback.UnsupportedCallbackException;
+import javax.security.auth.login.Configuration;
+import javax.security.auth.login.LoginContext;
+import javax.security.auth.login.LoginException;
+import java.io.File;
+import java.io.IOException;
+import java.net.URL;
+import java.security.Principal;
+import java.security.Security;
+import java.util.*;
+

 /**
 * An {@link AuthenticationProvider} implementation that retrieves user details from a JAAS login configuration.
@@ -185,7 +182,6 @@ public class JaasAuthenticationProvider implements AuthenticationProvider, Appli

            // Create a set to hold the authorities, and add any that have already been applied.
            authorities = new HashSet<GrantedAuthority>();
-            authorities.addAll(request.getAuthorities());

            // Get the subject principals and pass them to each of the AuthorityGranters
            Set<Principal> principals = loginContext.getSubject().getPrincipals();
@@ -269,14 +265,20 @@ public class JaasAuthenticationProvider implements AuthenticationProvider, Appli
    }

    private String convertLoginConfigToUrl() throws IOException {
-        String loginConfigPath = loginConfig.getFile().getAbsolutePath();
-        loginConfigPath.replace(File.separatorChar, '/');
+        String loginConfigPath;

-        if (!loginConfigPath.startsWith("/")) {
-            loginConfigPath = "/" + loginConfigPath;
+        try {
+            loginConfigPath = loginConfig.getFile().getAbsolutePath().replace(File.separatorChar, '/');
+
+            if (!loginConfigPath.startsWith("/")) {
+                loginConfigPath = "/" + loginConfigPath;
+            }
+
+            return new URL("file", "", loginConfigPath).toString();
+        } catch (IOException e) {
+            // SEC-1700:  May be inside a jar
+            return loginConfig.getURL().toString();
        }
-
-        return new URL("file", "", loginConfigPath).toString();
    }

    /**
@@ -427,7 +429,7 @@ public class JaasAuthenticationProvider implements AuthenticationProvider, Appli
     * If set, a call to {@code Configuration#refresh()} will be made by {@code #configureJaas(Resource) }
     * method. Defaults to {@code true}.
     *
-     * @see <a href="https://jira.springsource.org/browse/SEC-1320">SEC-1230</a>
+     * @see <a href="https://jira.springsource.org/browse/SEC-1320">SEC-1320</a>
     *
     * @param refresh set to {@code false} to disable reloading of the configuration.
     * May be useful in some environments.
@@ -25,12 +25,12 @@ public abstract class AuthenticationException extends RuntimeException {
    //~ Instance fields ================================================================================================

    private Authentication authentication;
-    private Object extraInformation;
+    private transient Object extraInformation;

    //~ Constructors ===================================================================================================

    /**
-     * Constructs an <code>AuthenticationException</code> with the specified message and root cause.
+     * Constructs an {@code AuthenticationException} with the specified message and root cause.
     *
     * @param msg the detail message
     * @param t the root cause
@@ -40,7 +40,7 @@ public abstract class AuthenticationException extends RuntimeException {
    }

    /**
-     * Constructs an <code>AuthenticationException</code> with the specified message and no root cause.
+     * Constructs an {@code AuthenticationException} with the specified message and no root cause.
     *
     * @param msg the detail message
     */
@@ -48,15 +48,22 @@ public abstract class AuthenticationException extends RuntimeException {
        super(msg);
    }

+    /**
+     * @deprecated Use the exception message or use a custom exception if you really need additional information.
+     */
+    @Deprecated
    public AuthenticationException(String msg, Object extraInformation) {
        super(msg);
+        if (extraInformation instanceof CredentialsContainer) {
+            ((CredentialsContainer) extraInformation).eraseCredentials();
+        }
        this.extraInformation = extraInformation;
    }

    //~ Methods ========================================================================================================

    /**
-     * The authentication request which this exception corresponds to (may be <code>null</code>)
+     * The authentication request which this exception corresponds to (may be {@code null})
     */
    public Authentication getAuthentication() {
        return authentication;
@@ -67,14 +74,17 @@ public abstract class AuthenticationException extends RuntimeException {
    }

    /**
-     * Any additional information about the exception. Generally a <code>UserDetails</code> object.
+     * Any additional information about the exception. Generally a {@code UserDetails} object.
     *
-     * @return extra information or <code>null</code>
+     * @return extra information or {@code null}
+     * @deprecated Use the exception message or use a custom exception if you really need additional information.
     */
+    @Deprecated
    public Object getExtraInformation() {
        return extraInformation;
    }

+    @Deprecated
    public void clearExtraInformation() {
        this.extraInformation = null;
    }
@@ -0,0 +1,39 @@
+package org.springframework.security.core;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.springframework.core.SpringVersion;
+
+/**
+ * Internal class used for checking version compatibility in a deployed application.
+ *
+ * @author Luke Taylor
+ */
+public class SpringSecurityCoreVersion {
+    private static final Log logger = LogFactory.getLog(SpringSecurityCoreVersion.class);
+
+    static {
+        // Check Spring Compatibility
+        String springVersion = SpringVersion.getVersion();
+        String version = getVersion();
+
+        if (springVersion != null) {
+            // TODO: Generate version class and information dynamically from a template in the build file
+            logger.info("You are running with Spring Security Core " + version);
+            if (!springVersion.startsWith("3")) {
+                logger.error("Spring Major version '3' expected, but you are running with version: "
+                        + springVersion + ". Please check your classpath for unwanted jar files.");
+            }
+
+            if (springVersion.compareTo("3.0.6") < 0) {
+                logger.warn("You are advised to use Spring 3.0.6 or later with this version. You are running: " +
+                    springVersion);
+            }
+        }
+    }
+
+    public static String getVersion() {
+        Package pkg = SpringSecurityCoreVersion.class.getPackage();
+        return (pkg != null ? pkg.getImplementationVersion() : null);
+    }
+}
@@ -2,7 +2,7 @@ package org.springframework.security.core.codec;


 /**
- * Base64 encoder which is a reduced version of Robert Harder's public domain implementation.
+ * Base64 encoder which is a reduced version of Robert Harder's public domain implementation (version 2.3.7).
 * See <a href="http://iharder.net/base64">http://iharder.net/base64</a> for more information.
 * <p>
 * For internal use only.
@@ -101,8 +101,8 @@ public final class Base64 {
        -9,-9,-9,-9,-9,-9,                          // Decimal 91 - 96
        26,27,28,29,30,31,32,33,34,35,36,37,38,     // Letters 'a' through 'm'
        39,40,41,42,43,44,45,46,47,48,49,50,51,     // Letters 'n' through 'z'
-        -9,-9,-9,-9                                 // Decimal 123 - 126
-        /*,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 127 - 139
+        -9,-9,-9,-9,-9                              // Decimal 123 - 127
+        ,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,       // Decimal 128 - 139
        -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 140 - 152
        -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 153 - 165
        -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 166 - 178
@@ -111,7 +111,7 @@ public final class Base64 {
        -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 205 - 217
        -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 218 - 230
        -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 231 - 243
-        -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9         // Decimal 244 - 255 */
+        -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9         // Decimal 244 - 255
    };


@@ -163,8 +163,8 @@ public final class Base64 {
      -9,                                         // Decimal 96
      26,27,28,29,30,31,32,33,34,35,36,37,38,     // Letters 'a' through 'm'
      39,40,41,42,43,44,45,46,47,48,49,50,51,     // Letters 'n' through 'z'
-      -9,-9,-9,-9                                 // Decimal 123 - 126
-      /*,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 127 - 139
+      -9,-9,-9,-9,-9                              // Decimal 123 - 127
+      ,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 128 - 139
      -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 140 - 152
      -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 153 - 165
      -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 166 - 178
@@ -173,7 +173,7 @@ public final class Base64 {
      -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 205 - 217
      -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 218 - 230
      -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 231 - 243
-      -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9         // Decimal 244 - 255 */
+      -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9         // Decimal 244 - 255
    };


@@ -228,8 +228,8 @@ public final class Base64 {
      -9,                                         // Decimal 96
      38,39,40,41,42,43,44,45,46,47,48,49,50,     // Letters 'a' through 'm'
      51,52,53,54,55,56,57,58,59,60,61,62,63,     // Letters 'n' through 'z'
-      -9,-9,-9,-9                                 // Decimal 123 - 126
-      /*,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 127 - 139
+      -9,-9,-9,-9,-9                                 // Decimal 123 - 127
+       ,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 128 - 139
        -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 140 - 152
        -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 153 - 165
        -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 166 - 178
@@ -238,7 +238,7 @@ public final class Base64 {
        -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 205 - 217
        -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 218 - 230
        -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 231 - 243
-        -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9         // Decimal 244 - 255 */
+        -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9         // Decimal 244 - 255
    };


@@ -370,10 +370,6 @@ public final class Base64 {


    /**
-     * Similar to {@link #encodeBytes(byte[], int, int, int)} but returns
-     * a byte array instead of instantiating a String. This is more efficient
-     * if you're working with I/O streams and have large data sets to encode.
-     *
     *
     * @param source The data to convert
     * @param off Offset in array where conversion should begin
@@ -444,7 +440,7 @@ public final class Base64 {


        // Only resize array if we didn't guess it right.
-        if( e < outBuff.length - 1 ){
+        if( e <= outBuff.length - 1 ){
            byte[] finalOut = new byte[e];
            System.arraycopy(outBuff,0, finalOut,0,e);
            //System.err.println("Having to resize array from " + outBuff.length + " to " + e );
@@ -601,26 +597,24 @@ public final class Base64 {
        byte[] b4        = new byte[4];     // Four byte buffer from source, eliminating white space
        int    b4Posn    = 0;               // Keep track of four byte input buffer
        int    i         = 0;               // Source array counter
-        byte   sbiCrop   = 0;               // Low seven bits (ASCII) of input
        byte   sbiDecode = 0;               // Special value from DECODABET

        for( i = off; i < off+len; i++ ) {  // Loop through source

-            sbiCrop = (byte)(source[i] & 0x7f); // Only the low seven bits
-            sbiDecode = DECODABET[ sbiCrop ];   // Special value
+            sbiDecode = DECODABET[ source[i]&0xFF ];

            // White space, Equals sign, or legit Base64 character
            // Note the values such as -5 and -9 in the
            // DECODABETs at the top of the file.
            if( sbiDecode >= WHITE_SPACE_ENC )  {
                if( sbiDecode >= EQUALS_SIGN_ENC ) {
-                    b4[ b4Posn++ ] = sbiCrop;           // Save non-whitespace
+                    b4[ b4Posn++ ] = source[i];         // Save non-whitespace
                    if( b4Posn > 3 ) {                  // Time to decode?
                        outBuffPosn += decode4to3( b4, 0, outBuff, outBuffPosn, options );
                        b4Posn = 0;

                        // If that was the equals sign, break out of 'for' loop
-                        if( sbiCrop == EQUALS_SIGN ) {
+                        if( source[i] == EQUALS_SIGN ) {
                            break;
                        }
                    }
@@ -629,7 +623,7 @@ public final class Base64 {
            else {
                // There's a bad input character in the Base64 stream.
                throw new InvalidBase64CharacterException( String.format(
-                "Bad Base64 input character '%c' in array position %d", source[i], i ) );
+                "Bad Base64 input character decimal %d in array position %d", ((int)source[i])&0xFF, i ) );
            }
        }

@@ -0,0 +1,44 @@
+package org.springframework.security.core.codec;
+
+import java.nio.ByteBuffer;
+import java.nio.CharBuffer;
+import java.nio.charset.CharacterCodingException;
+import java.nio.charset.Charset;
+import java.util.*;
+
+/**
+ * UTF-8 Charset encoder/decoder.
+ * <p>
+ * For internal use only.
+ *
+ * @author Luke Taylor
+ */
+public final class Utf8 {
+    private static final Charset CHARSET = Charset.forName("UTF-8");
+
+    /**
+     * Get the bytes of the String in UTF-8 encoded form.
+     */
+    public static byte[] encode(CharSequence string) {
+        try {
+            ByteBuffer bytes = CHARSET.newEncoder().encode(CharBuffer.wrap(string));
+
+            byte[] copy = new byte[bytes.limit()];
+            System.arraycopy(bytes.array(), 0, copy, 0, bytes.limit());
+            return copy;
+        } catch (CharacterCodingException e) {
+            throw new IllegalArgumentException("Encoding failed", e);
+        }
+    }
+
+    /**
+     * Decode the bytes in UTF-8 form into a String.
+     */
+    public static String decode(byte[] bytes) {
+        try {
+            return CHARSET.newDecoder().decode(ByteBuffer.wrap(bytes)).toString();
+        } catch (CharacterCodingException e) {
+            throw new IllegalArgumentException("Decoding failed", e);
+        }
+    }
+}
@@ -35,7 +35,7 @@ final class InheritableThreadLocalSecurityContextHolderStrategy implements Secur
    //~ Methods ========================================================================================================

    public void clearContext() {
-        contextHolder.set(null);
+        contextHolder.remove();
    }

    public SecurityContext getContext() {
@@ -34,7 +34,7 @@ final class ThreadLocalSecurityContextHolderStrategy implements SecurityContextH
    //~ Methods ========================================================================================================

    public void clearContext() {
-        contextHolder.set(null);
+        contextHolder.remove();
    }

    public SecurityContext getContext() {
@@ -37,19 +37,19 @@ public class UsernameNotFoundException extends AuthenticationException {
    }

    /**
-     * Constructs a <code>UsernameNotFoundException</code>, making use of the <tt>extraInformation</tt>
+     * Constructs a {@code UsernameNotFoundException}, making use of the {@code extraInformation}
     * property of the superclass.
     *
     * @param msg the detail message
     * @param extraInformation additional information such as the username.
     */
+    @Deprecated
    public UsernameNotFoundException(String msg, Object extraInformation) {
        super(msg, extraInformation);
    }

    /**
-     * Constructs a <code>UsernameNotFoundException</code> with the specified
-     * message and root cause.
+     * Constructs a {@code UsernameNotFoundException} with the specified message and root cause.
     *
     * @param msg the detail message.
     * @param t root cause
@@ -152,6 +152,8 @@ public class JdbcDaoImpl extends JdbcDaoSupport implements UserDetailsService {
        List<UserDetails> users = loadUsersByUsername(username);

        if (users.size() == 0) {
+            logger.debug("Query returned no results for user '" + username + "'");
+
            throw new UsernameNotFoundException(
                    messages.getMessage("JdbcDaoImpl.notFound", new Object[]{username}, "Username {0} not found"), username);
        }
@@ -173,6 +175,8 @@ public class JdbcDaoImpl extends JdbcDaoSupport implements UserDetailsService {
        addCustomAuthorities(user.getUsername(), dbAuths);

        if (dbAuths.size() == 0) {
+            logger.debug("User '" + username + "' has no authorities and will be treated as 'not found'");
+
            throw new UsernameNotFoundException(
                    messages.getMessage("JdbcDaoImpl.noAuthority",
                            new Object[] {username}, "User {0} has no GrantedAuthority"), username);
@@ -15,32 +15,30 @@

 package org.springframework.security.remoting.rmi;

-import org.springframework.security.core.context.SecurityContext;
-import org.springframework.security.core.context.SecurityContextHolder;
-
 import org.aopalliance.intercept.MethodInvocation;
-
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
-
 import org.springframework.remoting.support.RemoteInvocation;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;

 import java.lang.reflect.InvocationTargetException;


 /**
- * The actual <code>RemoteInvocation</code> that is passed from the client to the server, which contains the
- * contents of {@link SecurityContextHolder}, being a {@link SecurityContext} object.
+ * The actual {@code RemoteInvocation} that is passed from the client to the server.
 * <p>
- * When constructed on the client via {@link ContextPropagatingRemoteInvocationFactory}, the contents of the
- * <code>SecurityContext</code> are stored inside the object. The object is then passed to the server that is
- * processing the remote invocation. Upon the server invoking the remote invocation, it will retrieve the passed
- * contents of the <code>SecurityContextHolder</code> and set them on the server-side
- * <code>SecurityContextHolder</code> while the target object is invoked. When the target invocation has been
- * completed, the security context will be cleared using a call to {@link SecurityContextHolder#clearContext()}.
+ * The principal and credentials information will be extracted from the current
+ * security context and passed to the server as part of the invocation object.
+ * <p>
+ * To avoid potential serialization-based attacks, this implementation interprets the values as {@code String}s
+ * and creates a {@code UsernamePasswordAuthenticationToken} on the server side to hold them. If a different
+ * token type is required you can override the {@code createAuthenticationRequest} method.
 *
 * @author James Monaghan
 * @author Ben Alex
+ * @author Luke Taylor
 */
 public class ContextPropagatingRemoteInvocation extends RemoteInvocation {
    //~ Static fields/initializers =====================================================================================
@@ -49,34 +47,40 @@ public class ContextPropagatingRemoteInvocation extends RemoteInvocation {

    //~ Instance fields ================================================================================================

-    private SecurityContext securityContext;
+    private final String principal;
+    private final String credentials;

    //~ Constructors ===================================================================================================

    /**
-     * Constructs the object, storing the value of the client-side
-     * <code>SecurityContextHolder</code> inside the object.
+     * Constructs the object, storing the principal and credentials extracted from the client-side
+     * security context.
     *
     * @param methodInvocation the method to invoke
     */
    public ContextPropagatingRemoteInvocation(MethodInvocation methodInvocation) {
        super(methodInvocation);
-        securityContext = SecurityContextHolder.getContext();
+        Authentication currentUser = SecurityContextHolder.getContext().getAuthentication();
+
+        if (currentUser != null) {
+            principal = currentUser.getPrincipal().toString();
+            credentials = currentUser.getCredentials().toString();
+        } else {
+            principal = credentials = null;
+        }

        if (logger.isDebugEnabled()) {
-            logger.debug("RemoteInvocation now has SecurityContext: " + securityContext);
+            logger.debug("RemoteInvocation now has principal: " + principal);
        }
    }

    //~ Methods ========================================================================================================

    /**
-     * Invoked on the server-side as described in the class JavaDocs.
+     * Invoked on the server-side.
     * <p>
-     * Invocations will always have their {@link org.springframework.security.core.Authentication#setAuthenticated(boolean)}
-     * set to <code>false</code>, which is guaranteed to always be accepted by <code>Authentication</code>
-     * implementations. This ensures that even remotely authenticated <code>Authentication</code>s will be untrusted by
-     * the server-side, which is an appropriate security measure.
+     * The transmitted principal and credentials will be used to create an unauthenticated {@code Authentication}
+     * instance for processing by the {@code AuthenticationManager}.
     *
     * @param targetObject the target object to apply the invocation to
     *
@@ -88,15 +92,15 @@ public class ContextPropagatingRemoteInvocation extends RemoteInvocation {
     */
    public Object invoke(Object targetObject)
            throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
-        SecurityContextHolder.setContext(securityContext);

-        if ((SecurityContextHolder.getContext() != null)
-            && (SecurityContextHolder.getContext().getAuthentication() != null)) {
-            SecurityContextHolder.getContext().getAuthentication().setAuthenticated(false);
-        }
+        if (principal != null) {
+            Authentication request = createAuthenticationRequest(principal, credentials);
+            request.setAuthenticated(false);
+            SecurityContextHolder.getContext().setAuthentication(request);

-        if (logger.isDebugEnabled()) {
-            logger.debug("Set SecurityContextHolder to contain: " + securityContext);
+            if (logger.isDebugEnabled()) {
+                logger.debug("Set SecurityContextHolder to contain: " + request);
+            }
        }

        try {
@@ -109,4 +113,11 @@ public class ContextPropagatingRemoteInvocation extends RemoteInvocation {
            }
        }
    }
+
+    /**
+     * Creates the server-side authentication request object.
+     */
+    protected Authentication createAuthenticationRequest(String principal, String credentials) {
+        return new UsernamePasswordAuthenticationToken(principal, credentials);
+    }
 }
@@ -1,54 +1,42 @@
-AuthByAdapterProvider.incorrectKey=The presented AuthByAdapter implementation does not contain the expected key
-BasicAclEntryAfterInvocationProvider.noPermission=Authentication {0} has NO permissions at all to the domain object {1}
-BasicAclEntryAfterInvocationProvider.insufficientPermission=Authentication {0} has ACL permissions to the domain object, but not the required ACL permission to the domain object {1}
-ConcurrentSessionControllerImpl.exceededAllowed=Maximum sessions of {0} for this principal exceeded
-ProviderManager.providerNotFound=No AuthenticationProvider found for {0}
-AnonymousAuthenticationProvider.incorrectKey=The presented AnonymousAuthenticationToken does not contain the expected key
-CasAuthenticationProvider.incorrectKey=The presented CasAuthenticationToken does not contain the expected key
-CasAuthenticationProvider.noServiceTicket=Failed to provide a CAS service ticket to validate
-NamedCasProxyDecider.untrusted=Nearest proxy {0} is untrusted
-RejectProxyTickets.reject=Proxy tickets are rejected
+AbstractAccessDecisionManager.accessDenied=Access is denied
 AbstractSecurityInterceptor.authenticationNotFound=An Authentication object was not found in the SecurityContext
-AbstractUserDetailsAuthenticationProvider.onlySupports=Only UsernamePasswordAuthenticationToken is supported
-AbstractUserDetailsAuthenticationProvider.locked=User account is locked
+AbstractUserDetailsAuthenticationProvider.badCredentials=Bad credentials
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=User credentials have expired
 AbstractUserDetailsAuthenticationProvider.disabled=User is disabled
 AbstractUserDetailsAuthenticationProvider.expired=User account has expired
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=User credentials have expired
-AbstractUserDetailsAuthenticationProvider.badCredentials=Bad credentials
-X509AuthenticationProvider.certificateNull=Certificate is null
-DaoX509AuthoritiesPopulator.noMatching=No matching pattern was found in subjectDN: {0}
+AbstractUserDetailsAuthenticationProvider.locked=User account is locked
+AbstractUserDetailsAuthenticationProvider.onlySupports=Only UsernamePasswordAuthenticationToken is supported
+AccountStatusUserDetailsChecker.credentialsExpired=User credentials have expired
+AccountStatusUserDetailsChecker.disabled=User is disabled
+AccountStatusUserDetailsChecker.expired=User account has expired
+AccountStatusUserDetailsChecker.locked=User account is locked
+AclEntryAfterInvocationProvider.noPermission=Authentication {0} has NO permissions to the domain object {1}
+AnonymousAuthenticationProvider.incorrectKey=The presented AnonymousAuthenticationToken does not contain the expected key
+BindAuthenticator.badCredentials=Bad credentials
+BindAuthenticator.emptyPassword=Emtpy Password
+CasAuthenticationProvider.incorrectKey=The presented CasAuthenticationToken does not contain the expected key
+CasAuthenticationProvider.noServiceTicket=Failed to provide a CAS service ticket to validate
+ConcurrentSessionControlStrategy.exceededAllowed=Maximum sessions of {0} for this principal exceeded
+DigestAuthenticationFilter.incorrectRealm=Response realm name {0} does not match system realm name of {1}
+DigestAuthenticationFilter.incorrectResponse=Incorrect response
+DigestAuthenticationFilter.missingAuth=Missing mandatory digest value for 'auth' QOP; received header {0}
+DigestAuthenticationFilter.missingMandatory=Missing mandatory digest value; received header {0}
+DigestAuthenticationFilter.nonceCompromised=Nonce token compromised {0}
+DigestAuthenticationFilter.nonceEncoding=Nonce is not encoded in Base64; received nonce {0}
+DigestAuthenticationFilter.nonceExpired=Nonce has expired/timed out
+DigestAuthenticationFilter.nonceNotNumeric=Nonce token should have yielded a numeric first token, but was {0}
+DigestAuthenticationFilter.nonceNotTwoTokens=Nonce should have yielded two tokens but was {0}
+DigestAuthenticationFilter.usernameNotFound=Username {0} not found
+JdbcDaoImpl.noAuthority=User {0} has no GrantedAuthority
+JdbcDaoImpl.notFound=User {0} not found
+LdapAuthenticationProvider.badCredentials=Bad credentials
+LdapAuthenticationProvider.emptyUsername=Empty username not allowed
+LdapAuthenticationProvider.onlySupports=Only UsernamePasswordAuthenticationToken is supported
+PasswordComparisonAuthenticator.badCredentials=Bad credentials
+PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound=No AuthenticationProvider found for {0}
 RememberMeAuthenticationProvider.incorrectKey=The presented RememberMeAuthenticationToken does not contain the expected key
 RunAsImplAuthenticationProvider.incorrectKey=The presented RunAsUserToken does not contain the expected key
-DigestProcessingFilter.missingMandatory=Missing mandatory digest value; received header {0}
-DigestProcessingFilter.missingAuth=Missing mandatory digest value for 'auth' QOP; received header {0}
-DigestProcessingFilter.incorrectRealm=Response realm name {0} does not match system realm name of {1}
-DigestProcessingFilter.nonceExpired=Nonce has expired/timed out
-DigestProcessingFilter.nonceEncoding=Nonce is not encoded in Base64; received nonce {0}
-DigestProcessingFilter.nonceNotTwoTokens=Nonce should have yielded two tokens but was {0}
-DigestProcessingFilter.nonceNotNumeric=Nonce token should have yielded a numeric first token, but was {0}
-DigestProcessingFilter.nonceCompromised=Nonce token compromised {0}
-DigestProcessingFilter.usernameNotFound=Username {0} not found
-DigestProcessingFilter.incorrectResponse=Incorrect response
-JdbcDaoImpl.notFound=User {0} not found
-JdbcDaoImpl.noAuthority=User {0} has no GrantedAuthority
-SwitchUserProcessingFilter.noCurrentUser=No current user associated with this request
-SwitchUserProcessingFilter.noOriginalAuthentication=Could not find original Authentication object
-SwitchUserProcessingFilter.usernameNotFound=Username {0} not found
-SwitchUserProcessingFilter.locked=User account is locked
-SwitchUserProcessingFilter.disabled=User is disabled
-SwitchUserProcessingFilter.expired=User account has expired
-SwitchUserProcessingFilter.credentialsExpired=User credentials have expired
-AbstractAccessDecisionManager.accessDenied=Access is denied
-LdapAuthenticationProvider.emptyUsername=Empty username not allowed
-LdapAuthenticationProvider.emptyPassword=Bad credentials
-DefaultIntitalDirContextFactory.communicationFailure=Unable to connect to LDAP server
-DefaultIntitalDirContextFactory.badCredentials=Bad credentials
-DefaultIntitalDirContextFactory.unexpectedException=Failed to obtain InitialDirContext due to unexpected exception
-PasswordComparisonAuthenticator.badCredentials=Bad credentials
-BindAuthenticator.badCredentials=Bad credentials
-BindAuthenticator.failedToLoadAttributes=Bad credentials
-UserDetailsService.locked=User account is locked
-UserDetailsService.disabled=User is disabled
-UserDetailsService.expired=User account has expired
-UserDetailsService.credentialsExpired=User credentials have expired
-
+SubjectDnX509PrincipalExtractor.noMatching=No matching pattern was found in subjectDN: {0}
+SwitchUserFilter.noCurrentUser=No current user associated with this request
+SwitchUserFilter.noOriginalAuthentication=Could not find original Authentication object
@@ -1,47 +1,42 @@
-AuthByAdapterProvider.incorrectKey=Pou\u017eit\u00e1 implementace AuthByAdapter neobsahuje o\u010dek\u00e1van\u00fd kl\u00ed\u010d
-BasicAclEntryAfterInvocationProvider.noPermission=Autentizovan\u00fd u\u017eivatel {0} nem\u00e1 \u017d\u00c1DN\u00c1 pr\u00e1va k objektu {1}
-BasicAclEntryAfterInvocationProvider.insufficientPermission=Autentizovan\u00fd u\u017eivatel {0} nem\u00e1 po\u017eadovan\u00e1 opr\u00e1vn\u011bn\u00ed k objektu {1}
-ConcurrentSessionControllerImpl.exceededAllowed=Maxim\u00e1ln\u00ed po\u010det sou\u010dasn\u00fdch p\u0159ihl\u00e1\u0161en\u00ed {0} tohoto u\u017eivatele je p\u0159ekro\u010den.
-ProviderManager.providerNotFound=Nebyl nalezen \u017e\u00e1dn\u00fd AuthenticationProvider pro {0}
-AnonymousAuthenticationProvider.incorrectKey=Pou\u017eit\u00fd AnonymousAuthenticationToken neobsahuje o\u010dek\u00e1van\u00fd kl\u00ed\u010d
-CasAuthenticationProvider.incorrectKey=Pou\u017eit\u00fd CasAuthenticationToken neobsahuje o\u010dek\u00e1van\u00fd kl\u00ed\u010d
-CasAuthenticationProvider.noServiceTicket=Nepoda\u0159ilo se z\u00edskat otisk CAS (centr\u00e1ln\u00ed autentiza\u010dn\u00ed autority) k ov\u011b\u0159en\u00ed autenticity u\u017eivatele.
-NamedCasProxyDecider.untrusted=Nelze v\u011b\u0159it nejbli\u017e\u0161\u00ed proxy {0}
-RejectProxyTickets.reject=Otisky proxy jsou odm\u00edtnuty
-AbstractSecurityInterceptor.authenticationNotFound=Nebyl nalezen \u017e\u00e1dn\u00fd Authentication objekt v SecurityContext
-AbstractUserDetailsAuthenticationProvider.onlySupports=Je podporov\u00e1n pouze UsernamePasswordAuthenticationToken
-AbstractUserDetailsAuthenticationProvider.locked=U\u017eivatelsk\u00fd \u00fa\u010det je uzam\u010den
-AbstractUserDetailsAuthenticationProvider.disabled=U\u017eivatelsk\u00fd \u00fa\u010det nen\u00ed aktivn\u00ed
-AbstractUserDetailsAuthenticationProvider.expired=Platnost u\u017eivatelsk\u00e9ho \u00fa\u010dtu vypr\u0161ela
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=Platnost u\u017eivatelsk\u00e9ho hesla vypr\u0161ela
-AbstractUserDetailsAuthenticationProvider.badCredentials=\u0160patn\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje
-X509AuthenticationProvider.certificateNull=Certifik\u00e1t je pr\u00e1zdn\u00fd
-DaoX509AuthoritiesPopulator.noMatching=V subjectDN nebyl nalezen \u017e\u00e1dn\u00fd \u0159et\u011bzec odpov\u00eddaj\u00edc\u00ed vy\u017eadovan\u00e9 masce: {0}
-RememberMeAuthenticationProvider.incorrectKey=Pou\u017eit\u00fd RememberMeAuthenticationToken neobsahuje o\u010dek\u00e1van\u00fd kl\u00ed\u010d
-RunAsImplAuthenticationProvider.incorrectKey=Pou\u017eit\u00fd RunAsUserToken neobsahuje o\u010dek\u00e1van\u00fd kl\u00ed\u010d
-DigestProcessingFilter.missingMandatory=Chyb\u00ed povinn\u00e1 kl\u00ed\u010dov\u00e1 polo\u017eka; p\u0159ijat\u00e1 hlavi\u010dka {0}
-DigestProcessingFilter.missingAuth=Chyb\u00ed povinn\u00e1 kl\u00ed\u010dov\u00e1 polo\u017eka 'auth' QOP (\u00farove\u0148 bezpe\u010dnosti RFC 2617); p\u0159ijat\u00e1 hlavi\u010dka {0}
-DigestProcessingFilter.incorrectRealm=Oblast odpov\u011bdi {0} neodpov\u00edd\u00e1 syst\u00e9mov\u00e9 oblasti {1}
-DigestProcessingFilter.nonceExpired=Kryptovan\u00fd kl\u00ed\u010d (nonce) vypr\u0161el
-DigestProcessingFilter.nonceEncoding=Kryptovan\u00fd kl\u00ed\u010d (nonce) nen\u00ed p\u0159ek\u00e9dov\u00e1n do Base60; p\u0159ijat\u00fd kl\u00ed\u010d {0}
-DigestProcessingFilter.nonceNotTwoTokens=Kryptovan\u00fd kl\u00ed\u010d (nonce) by m\u011bl b\u00fdt slo\u017een ze dvou \u010d\u00e1st\u00ed {0}
-DigestProcessingFilter.nonceNotNumeric=Kryptovan\u00fd kl\u00ed\u010d (nonce) by m\u011bl m\u00edt prvn\u00ed \u010d\u00e1st \u010d\u00edselnou, ale je {0}
-DigestProcessingFilter.nonceCompromised=Kryptovan\u00fd kl\u00ed\u010d (nonce) je znehodnocen\u00fd {0}
-DigestProcessingFilter.usernameNotFound=U\u017eivatelsk\u00e9 jm\u00e9no {0} nebylo nalezeno
-DigestProcessingFilter.incorrectResponse=Vadn\u00e1 odpov\u011b\u010f
-SwitchUserProcessingFilter.noCurrentUser=\u017d\u00e1dn\u00fd u\u017eivatel nen\u00ed asociov\u00e1n s t\u00edmto po\u017eadavkem
-SwitchUserProcessingFilter.noOriginalAuthentication=Nepoda\u0159ilo se nal\u00e9zt p\u016fvodn\u00ed Authentication objekt
-SwitchUserProcessingFilter.usernameNotFound=U\u017eivatelsk\u00e9 jm\u00e9no {0} nebylo nalezeno
-SwitchUserProcessingFilter.locked=U\u017eivatelsk\u00fd \u00fa\u010det je uzam\u010den
-SwitchUserProcessingFilter.disabled=U\u017eivatelsk\u00fd \u00fa\u010det nen\u00ed aktivn\u00ed
-SwitchUserProcessingFilter.expired=Platnost u\u017eivatelsk\u00e9ho \u00fa\u010dtu vypr\u0161ela
-SwitchUserProcessingFilter.credentialsExpired=Platnost u\u017eivatelsk\u00e9ho hesla vypr\u0161ela
-AbstractAccessDecisionManager.accessDenied=P\u0159\u00edstup odep\u0159en
-LdapAuthenticationProvider.emptyUsername=Nen\u00ed povoleno pr\u00e1zdn\u00e9 u\u017eivatelsk\u00e9 jm\u00e9no
-LdapAuthenticationProvider.emptyPassword=\u0160patn\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje
-DefaultIntitalDirContextFactory.communicationFailure=Nen\u00ed mo\u017en\u00e9 se p\u0159ipojit k LDAP serveru
-DefaultIntitalDirContextFactory.badCredentials=\u0160patn\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje
-DefaultIntitalDirContextFactory.unexpectedException=Nepoda\u0159ilo se z\u00edskat InitialDirContext d\u00edky neo\u010dek\u00e1van\u00e9 vyj\u00edmce
-PasswordComparisonAuthenticator.badCredentials=\u0160patn\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje
-BindAuthenticator.badCredentials=\u0160patn\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje
-BindAuthenticator.failedToLoadAttributes=\u0160patn\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje
+AbstractAccessDecisionManager.accessDenied=P\u0159\u00EDstup odep\u0159en
+AbstractSecurityInterceptor.authenticationNotFound=Nebyl nalezen \u017E\u00E1dn\u00FD Authentication objekt v SecurityContext
+AbstractUserDetailsAuthenticationProvider.badCredentials=\u0160patn\u00E9 p\u0159ihla\u0161ovac\u00ED \u00FAdaje
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=Platnost u\u017Eivatelsk\u00E9ho hesla vypr\u0161ela
+AbstractUserDetailsAuthenticationProvider.disabled=U\u017Eivatelsk\u00FD \u00FA\u010Det nen\u00ED aktivn\u00ED
+AbstractUserDetailsAuthenticationProvider.expired=Platnost u\u017Eivatelsk\u00E9ho \u00FA\u010Dtu vypr\u0161ela
+AbstractUserDetailsAuthenticationProvider.locked=U\u017Eivatelsk\u00FD \u00FA\u010Det je uzam\u010Den
+AbstractUserDetailsAuthenticationProvider.onlySupports=Je podporov\u00E1n pouze UsernamePasswordAuthenticationToken
+AccountStatusUserDetailsChecker.credentialsExpired=Platnost u\u017Eivatelsk\u00E9ho hesla vypr\u0161ela
+AccountStatusUserDetailsChecker.disabled=U\u017Eivatelsk\u00FD \u00FA\u010Det nen\u00ED aktivn\u00ED
+AccountStatusUserDetailsChecker.expired=Platnost u\u017Eivatelsk\u00E9ho \u00FA\u010Dtu vypr\u0161ela
+AccountStatusUserDetailsChecker.locked=U\u017Eivatelsk\u00FD \u00FA\u010Det je uzam\u010Den
+AclEntryAfterInvocationProvider.noPermission=Autentizovan\u00FD u\u017Eivatel {0} nem\u00E1 \u017D\u00C1DN\u00C1 pr\u00E1va k objektu {1}
+AnonymousAuthenticationProvider.incorrectKey=Pou\u017Eit\u00FD AnonymousAuthenticationToken neobsahuje o\u010Dek\u00E1van\u00FD kl\u00ED\u010D
+BindAuthenticator.badCredentials=\u0160patn\u00E9 p\u0159ihla\u0161ovac\u00ED \u00FAdaje
+BindAuthenticator.emptyPassword=\u0160patn\u00E9 p\u0159ihla\u0161ovac\u00ED \u00FAdaje
+CasAuthenticationProvider.incorrectKey=Pou\u017Eit\u00FD CasAuthenticationToken neobsahuje o\u010Dek\u00E1van\u00FD kl\u00ED\u010D
+CasAuthenticationProvider.noServiceTicket=Nepoda\u0159ilo se z\u00EDskat otisk CAS (centr\u00E1ln\u00ED autentiza\u010Dn\u00ED autority) k ov\u011B\u0159en\u00ED autenticity u\u017Eivatele.
+ConcurrentSessionControlStrategy.exceededAllowed=Maxim\u00E1ln\u00ED po\u010Det sou\u010Dasn\u00FDch p\u0159ihl\u00E1\u0161en\u00ED {0} tohoto u\u017Eivatele je p\u0159ekro\u010Den.
+DigestAuthenticationFilter.incorrectRealm=Oblast odpov\u011Bdi {0} neodpov\u00EDd\u00E1 syst\u00E9mov\u00E9 oblasti {1}
+DigestAuthenticationFilter.incorrectResponse=Vadn\u00E1 odpov\u011B\u010F
+DigestAuthenticationFilter.missingAuth=Chyb\u00ED povinn\u00E1 kl\u00ED\u010Dov\u00E1 polo\u017Eka 'auth' QOP (\u00FArove\u0148 bezpe\u010Dnosti RFC 2617); p\u0159ijat\u00E1 hlavi\u010Dka {0}
+DigestAuthenticationFilter.missingMandatory=Chyb\u00ED povinn\u00E1 kl\u00ED\u010Dov\u00E1 polo\u017Eka; p\u0159ijat\u00E1 hlavi\u010Dka {0}
+DigestAuthenticationFilter.nonceCompromised=Kryptovan\u00FD kl\u00ED\u010D (nonce) je znehodnocen\u00FD {0}
+DigestAuthenticationFilter.nonceEncoding=Kryptovan\u00FD kl\u00ED\u010D (nonce) nen\u00ED p\u0159ek\u00E9dov\u00E1n do Base60; p\u0159ijat\u00FD kl\u00ED\u010D {0}
+DigestAuthenticationFilter.nonceExpired=Kryptovan\u00FD kl\u00ED\u010D (nonce) vypr\u0161el
+DigestAuthenticationFilter.nonceNotNumeric=Kryptovan\u00FD kl\u00ED\u010D (nonce) by m\u011Bl m\u00EDt prvn\u00ED \u010D\u00E1st \u010D\u00EDselnou, ale je {0}
+DigestAuthenticationFilter.nonceNotTwoTokens=Kryptovan\u00FD kl\u00ED\u010D (nonce) by m\u011Bl b\u00FDt slo\u017Een ze dvou \u010D\u00E1st\u00ED {0}
+DigestAuthenticationFilter.usernameNotFound=U\u017Eivatelsk\u00E9 jm\u00E9no {0} nebylo nalezeno
+#JdbcDaoImpl.noAuthority=User {0} has no GrantedAuthority
+#JdbcDaoImpl.notFound=User {0} not found
+LdapAuthenticationProvider.badCredentials=\u0160patn\u00E9 p\u0159ihla\u0161ovac\u00ED \u00FAdaje
+LdapAuthenticationProvider.emptyUsername=Nen\u00ED povoleno pr\u00E1zdn\u00E9 u\u017Eivatelsk\u00E9 jm\u00E9no
+LdapAuthenticationProvider.onlySupports=Je podporov\u00E1n pouze UsernamePasswordAuthenticationToken
+PasswordComparisonAuthenticator.badCredentials=\u0160patn\u00E9 p\u0159ihla\u0161ovac\u00ED \u00FAdaje
+#PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound=Nebyl nalezen \u017E\u00E1dn\u00FD AuthenticationProvider pro {0}
+RememberMeAuthenticationProvider.incorrectKey=Pou\u017Eit\u00FD RememberMeAuthenticationToken neobsahuje o\u010Dek\u00E1van\u00FD kl\u00ED\u010D
+RunAsImplAuthenticationProvider.incorrectKey=Pou\u017Eit\u00FD RunAsUserToken neobsahuje o\u010Dek\u00E1van\u00FD kl\u00ED\u010D
+SubjectDnX509PrincipalExtractor.noMatching=V subjectDN nebyl nalezen \u017E\u00E1dn\u00FD \u0159et\u011Bzec odpov\u00EDdaj\u00EDc\u00ED vy\u017Eadovan\u00E9 masce\: {0}
+SwitchUserFilter.noCurrentUser=\u017D\u00E1dn\u00FD u\u017Eivatel nen\u00ED asociov\u00E1n s t\u00EDmto po\u017Eadavkem
+SwitchUserFilter.noOriginalAuthentication=Nepoda\u0159ilo se nal\u00E9zt p\u016Fvodn\u00ED Authentication objekt
@@ -1,48 +1,42 @@
-AuthByAdapterProvider.incorrectKey=Die angegebene AuthByAdapter-Implementierung enthält nicht den erwarteten Schlüssel
-BasicAclEntryAfterInvocationProvider.noPermission=Authentifikation {0} hat KEINE Berechtigungen bezüglich des Domänen-Objekts {1}
-BasicAclEntryAfterInvocationProvider.insufficientPermission=Authentifikation {0} hat keine ausreichenden ACL-Berechtigungen bezüglich des Domänen-Objekts {1}
-ConcurrentSessionControllerImpl.exceededAllowed=Die maximale Sitzungs-Anzahl von {0} für diesen Nutzer wurde überschritten
-ProviderManager.providerNotFound=Für {0} wurde kein AuthenticationProvider gefunden
-AnonymousAuthenticationProvider.incorrectKey=Das angegebene AnonymousAuthenticationToken enthält nicht den erwarteten Schlüssel
-CasAuthenticationProvider.incorrectKey=Das angegebene CasAuthenticationToken enthält nicht den erwarteten Schlüssel
-CasAuthenticationProvider.noServiceTicket=Es konnte kein CAS Service-Ticket zur Prüfung geliefert werden
-NamedCasProxyDecider.untrusted=Der nächste Proxy {0} ist nicht vertrauenswürdig
-RejectProxyTickets.reject=Proxy-Tickets sind abgelehnt
-AbstractSecurityInterceptor.authenticationNotFound=Im SecurityContext wurde keine Authentifikation gefunden
-AbstractUserDetailsAuthenticationProvider.onlySupports=Nur UsernamePasswordAuthenticationToken wird unterstützt
-AbstractUserDetailsAuthenticationProvider.locked=Das Benutzerkonto ist gesperrt
-AbstractUserDetailsAuthenticationProvider.disabled=Der Benutzer ist deaktiviert
-AbstractUserDetailsAuthenticationProvider.expired=Die Gültigkeit des Benutzerkontos ist abgelaufen
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=Die Gültigkeit der Benutzerberechtigungen ist abgelaufen
-AbstractUserDetailsAuthenticationProvider.badCredentials=Ungültige Benutzerberechtigungen
-X509AuthenticationProvider.certificateNull=Zertifikat ist nicht gesetzt
-DaoX509AuthoritiesPopulator.noMatching=Kein passendes Muster gefunden in subjectDN: {0}
-RememberMeAuthenticationProvider.incorrectKey=Das angegebene RememberMeAuthenticationToken enthält nicht den erwarteten Schlüssel
-RunAsImplAuthenticationProvider.incorrectKey=Das angegebene RunAsUserToken enthält nicht den erwarteten Schlüssel
-DigestProcessingFilter.missingMandatory=Erforderlicher Digest-Wert fehlt; Empfangener Header {0}
-DigestProcessingFilter.missingAuth=Erforderlicher Digest-Wert fehlt für 'auth' QOP; Empfangener Header {0}
-DigestProcessingFilter.incorrectRealm=Realm-Name in Antwort {0} entspricht nicht dem Namen des System-Realms {1}
-DigestProcessingFilter.nonceExpired=Die Nonce ist nicht mehr gültig
-DigestProcessingFilter.nonceEncoding=Die Nonce ist nicht in Base64 kodiert; Empfangene Nonce {0}
-DigestProcessingFilter.nonceNotTwoTokens=Nonce sollte zwei Elemente beinhalten. Gefundener Inhalt: {0}
-DigestProcessingFilter.nonceNotNumeric=Das erste Element der Nonce sollte numerisch sein. Gefundener Inhalt: {0}
-DigestProcessingFilter.nonceCompromised=Das Nonce-Element ist kompromittiert {0}
-DigestProcessingFilter.usernameNotFound=Benutzername {0} wurde nicht gefunden
-DigestProcessingFilter.incorrectResponse=Fehlerhafte Antwort
-SwitchUserProcessingFilter.noCurrentUser=Mit dieser Anfrage ist kein aktueller Benutzer assoziiert
-SwitchUserProcessingFilter.noOriginalAuthentication=Kann das ursprüngliche Authentifikationsobjekt nicht finden
-SwitchUserProcessingFilter.usernameNotFound=Benutzername {0} wurde nicht gefunden
-SwitchUserProcessingFilter.locked=Das Benutzerkonto ist gesperrt
-SwitchUserProcessingFilter.disabled=Der Benutzer ist deaktiviert
-SwitchUserProcessingFilter.expired=Die Gültigkeit des Benutzerkontos ist abgelaufen
-SwitchUserProcessingFilter.credentialsExpired=Die Gültigkeit der Benutzerberechtigungen ist abgelaufen
 AbstractAccessDecisionManager.accessDenied=Zugriff verweigert
+AbstractSecurityInterceptor.authenticationNotFound=Im SecurityContext wurde keine Authentifikation gefunden
+AbstractUserDetailsAuthenticationProvider.badCredentials=Ung\u00FCltige Benutzerberechtigungen
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=Die G\u00FCltigkeit der Benutzerberechtigungen ist abgelaufen
+AbstractUserDetailsAuthenticationProvider.disabled=Der Benutzer ist deaktiviert
+AbstractUserDetailsAuthenticationProvider.expired=Die G\u00FCltigkeit des Benutzerkontos ist abgelaufen
+AbstractUserDetailsAuthenticationProvider.locked=Das Benutzerkonto ist gesperrt
+AbstractUserDetailsAuthenticationProvider.onlySupports=Nur UsernamePasswordAuthenticationToken wird unterst\u00FCtzt
+AccountStatusUserDetailsChecker.credentialsExpired=Die G\u00FCltigkeit der Benutzerberechtigungen ist abgelaufen
+AccountStatusUserDetailsChecker.disabled=Der Benutzer ist deaktiviert
+AccountStatusUserDetailsChecker.expired=Die G\u00FCltigkeit des Benutzerkontos ist abgelaufen
+AccountStatusUserDetailsChecker.locked=Das Benutzerkonto ist gesperrt
+AclEntryAfterInvocationProvider.noPermission=Authentifikation {0} hat KEINE Berechtigungen bez\u00FCglich des Dom\u00E4nen-Objekts {1}
+AnonymousAuthenticationProvider.incorrectKey=Das angegebene AnonymousAuthenticationToken enth\u00E4lt nicht den erwarteten Schl\u00FCssel
+BindAuthenticator.badCredentials=Ung\u00FCltige Benutzerberechtigungen
+BindAuthenticator.emptyPassword=Ung\u00FCltige Benutzerberechtigungen
+CasAuthenticationProvider.incorrectKey=Das angegebene CasAuthenticationToken enth\u00E4lt nicht den erwarteten Schl\u00FCssel
+CasAuthenticationProvider.noServiceTicket=Es konnte kein CAS Service-Ticket zur Pr\u00FCfung geliefert werden
+ConcurrentSessionControlStrategy.exceededAllowed=Die maximale Sitzungs-Anzahl von {0} f\u00FCr diesen Nutzer wurde \u00FCberschritten
+DigestAuthenticationFilter.incorrectRealm=Realm-Name in Antwort {0} entspricht nicht dem Namen des System-Realms {1}
+DigestAuthenticationFilter.incorrectResponse=Fehlerhafte Antwort
+DigestAuthenticationFilter.missingAuth=Erforderlicher Digest-Wert fehlt f\u00FCr 'auth' QOP; Empfangener Header {0}
+DigestAuthenticationFilter.missingMandatory=Erforderlicher Digest-Wert fehlt; Empfangener Header {0}
+DigestAuthenticationFilter.nonceCompromised=Das Nonce-Element ist kompromittiert {0}
+DigestAuthenticationFilter.nonceEncoding=Die Nonce ist nicht in Base64 kodiert; Empfangene Nonce {0}
+DigestAuthenticationFilter.nonceExpired=Die Nonce ist nicht mehr g\u00FCltig
+DigestAuthenticationFilter.nonceNotNumeric=Das erste Element der Nonce sollte numerisch sein. Gefundener Inhalt\: {0}
+DigestAuthenticationFilter.nonceNotTwoTokens=Nonce sollte zwei Elemente beinhalten. Gefundener Inhalt\: {0}
+DigestAuthenticationFilter.usernameNotFound=Benutzername {0} wurde nicht gefunden
+#JdbcDaoImpl.noAuthority=User {0} has no GrantedAuthority
+#JdbcDaoImpl.notFound=User {0} not found
+LdapAuthenticationProvider.badCredentials=Ung\u00FCltige Benutzerberechtigungen
 LdapAuthenticationProvider.emptyUsername=Ein leerer Benutzername ist nicht erlaubt
-LdapAuthenticationProvider.emptyPassword=Ungültige Benutzerberechtigungen
-DefaultIntitalDirContextFactory.communicationFailure=Kann keine Verbindung zum LDAP-Server herstellen
-DefaultIntitalDirContextFactory.badCredentials=Ungültige Benutzerberechtigungen
-DefaultIntitalDirContextFactory.unexpectedException=Auf den InitialDirContext kann aufgrund eines unerwarteten Fehlers nicht zugegriffen werden
-PasswordComparisonAuthenticator.badCredentials=Ungültige Benutzerberechtigungen
-BindAuthenticator.badCredentials=Ungültige Benutzerberechtigungen
-BindAuthenticator.failedToLoadAttributes=Ungültige Benutzerberechtigungen
-
+LdapAuthenticationProvider.onlySupports=Nur UsernamePasswordAuthenticationToken wird unterst\u00FCtzt
+PasswordComparisonAuthenticator.badCredentials=Ung\u00FCltige Benutzerberechtigungen
+#PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound=F\u00FCr {0} wurde kein AuthenticationProvider gefunden
+RememberMeAuthenticationProvider.incorrectKey=Das angegebene RememberMeAuthenticationToken enth\u00E4lt nicht den erwarteten Schl\u00FCssel
+RunAsImplAuthenticationProvider.incorrectKey=Das angegebene RunAsUserToken enth\u00E4lt nicht den erwarteten Schl\u00FCssel
+SubjectDnX509PrincipalExtractor.noMatching=Kein passendes Muster gefunden in subjectDN\: {0}
+SwitchUserFilter.noCurrentUser=Mit dieser Anfrage ist kein aktueller Benutzer assoziiert
+SwitchUserFilter.noOriginalAuthentication=Kann das urspr\u00FCngliche Authentifikationsobjekt nicht finden
@@ -1,53 +1,42 @@
-AuthByAdapterProvider.incorrectKey=La actual implementación de AuthByAdapter no contiene la clave esperada
-BasicAclEntryAfterInvocationProvider.noPermission=Authentication {0} NO tiene permisos para el objeto de dominio {1}
-BasicAclEntryAfterInvocationProvider.insufficientPermission=Authentication {0} tiene permisos ACL para objeto de dominio, pero no los permisos ACL requeridos para el objeto de dominio {1}
-ConcurrentSessionControllerImpl.exceededAllowed=Sesiones máximas de {0} para esta Identificación excedidas
-ProviderManager.providerNotFound=AuthenticationProvider no encontrado para {0}
+AbstractAccessDecisionManager.accessDenied=Acceso denegado
+AbstractSecurityInterceptor.authenticationNotFound=El objeto Authentication no ha sido encontrado en el SecurityContext
+AbstractUserDetailsAuthenticationProvider.badCredentials=Credenciales err\u00F3neas
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=Las credenciales del usuario han expirado
+AbstractUserDetailsAuthenticationProvider.disabled=El usuario est\u00E1 deshabilitado
+AbstractUserDetailsAuthenticationProvider.expired=La cuenta del usuario ha expirado
+AbstractUserDetailsAuthenticationProvider.locked=La cuenta del usuario est\u00E1 bloqueada
+AbstractUserDetailsAuthenticationProvider.onlySupports=S\u00F3lo UsernamePasswordAuthenticationToken es soportada
+AccountStatusUserDetailsChecker.credentialsExpired=Las credenciales del usuario han expirado
+AccountStatusUserDetailsChecker.disabled=El usuario est\u00E1 deshabilitado
+AccountStatusUserDetailsChecker.expired=La cuenta del usuario ha expirado
+AccountStatusUserDetailsChecker.locked=La cuenta del usuario est\u00E1 bloqueada
+AclEntryAfterInvocationProvider.noPermission=Authentication {0} NO tiene permisos para el objeto de dominio {1}
 AnonymousAuthenticationProvider.incorrectKey=El actual AnonymousAuthenticationToken no contiene la clave esperada
+BindAuthenticator.badCredentials=Credenciales err\u00F3neas
+BindAuthenticator.emptyPassword=Credenciales err\u00F3neas
 CasAuthenticationProvider.incorrectKey=El actual CasAuthenticationToken no contiene la clave esperada
 CasAuthenticationProvider.noServiceTicket=No se ha podido proporcionar un billete de servicio CAS para validar
-NamedCasProxyDecider.untrusted=El proxy más cercano {0} no es confiable
-RejectProxyTickets.reject=Las entradas del proxy han sido rechazadas
-AbstractSecurityInterceptor.authenticationNotFound=El objeto Authentication no ha sido encontrado en el SecurityContext
-AbstractUserDetailsAuthenticationProvider.onlySupports=Sólo UsernamePasswordAuthenticationToken es soportada
-AbstractUserDetailsAuthenticationProvider.locked=La cuenta del usuario está bloqueada
-AbstractUserDetailsAuthenticationProvider.disabled=El usuario está deshabilitado
-AbstractUserDetailsAuthenticationProvider.expired=La cuenta del usuario ha expirado
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=Las credenciales del usuario han expirado
-AbstractUserDetailsAuthenticationProvider.badCredentials=Credenciales erróneas
-X509AuthenticationProvider.certificateNull=Cerfificado nulo
-DaoX509AuthoritiesPopulator.noMatching=No se ha encontrado un patrón coincidente en subjectDN: {0}
+ConcurrentSessionControlStrategy.exceededAllowed=Sesiones m\u00E1ximas de {0} para esta Identificaci\u00F3n excedidas
+DigestAuthenticationFilter.incorrectRealm=Respuesta realm de nombre {0} no coincide con realm del sistema de nombre {1}
+DigestAuthenticationFilter.incorrectResponse=Respuesta incorrecta
+DigestAuthenticationFilter.missingAuth=Valor digest obligatorio perdido para 'auth' QOP; header recibido {0}
+DigestAuthenticationFilter.missingMandatory=Valor digest obligatorio perdido; header recibido {0}
+DigestAuthenticationFilter.nonceCompromised=Nonce token comprometido {0}
+DigestAuthenticationFilter.nonceEncoding=Nonce no est\u00E1 codificado en Base64; nonce recibido {0}
+DigestAuthenticationFilter.nonceExpired=Nonce ha expirado/fuera de tiempo
+DigestAuthenticationFilter.nonceNotNumeric=Nonce token deber\u00EDa tener primero un token num\u00E9rico, pero ten\u00EDa {0}
+DigestAuthenticationFilter.nonceNotTwoTokens=Nonce token deber\u00EDa tener dos fichas pero ten\u00EDa {0}
+DigestAuthenticationFilter.usernameNotFound=Usuario y nombre {0} no encontrado
+JdbcDaoImpl.noAuthority=Usuario {0} no tiene GrantedAuthority
+JdbcDaoImpl.notFound=Usuario {0} no encontrado
+LdapAuthenticationProvider.badCredentials=Credenciales err\u00F3neas
+LdapAuthenticationProvider.emptyUsername=Usuario y nombre no permitido
+LdapAuthenticationProvider.onlySupports=S\u00F3lo UsernamePasswordAuthenticationToken es soportada
+PasswordComparisonAuthenticator.badCredentials=Credenciales err\u00F3neas
+PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound=AuthenticationProvider no encontrado para {0}
 RememberMeAuthenticationProvider.incorrectKey=El actual RememberMeAuthenticationToken no contiene la clave esperada
 RunAsImplAuthenticationProvider.incorrectKey=El actual RunAsUserToken no contiene la clave esperada
-DigestProcessingFilter.missingMandatory=Valor digest obligatorio perdido; header recibido {0}
-DigestProcessingFilter.missingAuth=Valor digest obligatorio perdido para 'auth' QOP; header recibido {0}
-DigestProcessingFilter.incorrectRealm=Respuesta realm de nombre {0} no coincide con realm del sistema de nombre {1}
-DigestProcessingFilter.nonceExpired=Nonce ha expirado/fuera de tiempo
-DigestProcessingFilter.nonceEncoding=Nonce no está codificado en Base64; nonce recibido {0}
-DigestProcessingFilter.nonceNotTwoTokens=Nonce token debería tener dos fichas pero tenía {0}
-DigestProcessingFilter.nonceNotNumeric=Nonce token debería tener primero un token numérico, pero tenía {0}
-DigestProcessingFilter.nonceCompromised=Nonce token comprometido {0}
-DigestProcessingFilter.usernameNotFound=Usuario y nombre {0} no encontrado
-DigestProcessingFilter.incorrectResponse=Respuesta incorrecta
-JdbcDaoImpl.notFound=Usuario {0} no encontrado
-JdbcDaoImpl.noAuthority=Usuario {0} no tiene GrantedAuthority
-SwitchUserProcessingFilter.noCurrentUser=No hay usuario actual asociado con esta petición
-SwitchUserProcessingFilter.noOriginalAuthentication=No se puede encontrar el objeto Authentication original
-SwitchUserProcessingFilter.usernameNotFound=Usuario y nombre {0} no encontrado
-SwitchUserProcessingFilter.locked=La cuenta del usuario está bloqueada
-SwitchUserProcessingFilter.disabled=El usuario está deshabilitado
-SwitchUserProcessingFilter.expired=La cuenta del usuario ha expirado
-SwitchUserProcessingFilter.credentialsExpired=Las credenciales del usuario han expirado
-AbstractAccessDecisionManager.accessDenied=Acceso denegado
-LdapAuthenticationProvider.emptyUsername=Usuario y nombre no permitido
-LdapAuthenticationProvider.emptyPassword=Credenciales erróneas
-DefaultIntitalDirContextFactory.communicationFailure=No se puede conectar con el servidor LDAP
-DefaultIntitalDirContextFactory.badCredentials=Credenciales erróneas
-DefaultIntitalDirContextFactory.unexpectedException=Error al obtener el InitialDirContext debido a una excepción inesperada
-PasswordComparisonAuthenticator.badCredentials=Credenciales erróneas
-BindAuthenticator.badCredentials=Credenciales erróneas
-BindAuthenticator.failedToLoadAttributes=Credenciales erróneas
-UserDetailsService.locked=La cuenta del usuario está bloqueada
-UserDetailsService.disabled=El usuario está deshabilitado
-UserDetailsService.expired=La cuenta del usuario ha expirado
-UserDetailsService.credentialsExpired=Las credenciales del usuario han expirado
+SubjectDnX509PrincipalExtractor.noMatching=No se ha encontrado un patr\u00F3n coincidente en subjectDN\: {0}
+SwitchUserFilter.noCurrentUser=No hay usuario actual asociado con esta petici\u00F3n
+SwitchUserFilter.noOriginalAuthentication=No se puede encontrar el objeto Authentication original
@@ -2,57 +2,45 @@
 # Messages in French
 # Translation by Laurent Pireyn (laurent.pireyn@pisolutions.eu)
 # Translation by Valentin Crettaz (valentin.crettaz@consulthys.com)
-
-AuthByAdapterProvider.incorrectKey=L'implémentation de AuthByAdapter présentée ne contient pas la clé attendue
-BasicAclEntryAfterInvocationProvider.noPermission=L'authentification {0} n'a AUCUNE permission pour l'objet de domaine {1}
-BasicAclEntryAfterInvocationProvider.insufficientPermission=L'authentification {0} a des permissions ACL pour l'objet de domaine, mais pas la permission ACL requise pour l'objet de domaine {1}
-ConcurrentSessionControllerImpl.exceededAllowed=Le maximum de {0} sessions a été dépassé pour cet utilisateur
-ProviderManager.providerNotFound=Aucun AuthenticationProvider n'a été trouvé pour {0}
-AnonymousAuthenticationProvider.incorrectKey=L'AnonymousAuthenticationToken présenté ne contient pas la clé attendue
-CasAuthenticationProvider.incorrectKey=Le CasAuthenticationToken présenté ne contient pas la clé attendue
-CasAuthenticationProvider.noServiceTicket=Echec d'obtention d'un ticket CAS à valider
-NamedCasProxyDecider.untrusted=Le proxy {0} le plus proche n'est pas fiable
-RejectProxyTickets.reject=Des tickets proxy ont été rejetés
-AbstractSecurityInterceptor.authenticationNotFound=Aucun objet Authentication n'a été trouvé dans le SecurityContext
+AbstractAccessDecisionManager.accessDenied=Acc\u00E8s refus\u00E9
+AbstractSecurityInterceptor.authenticationNotFound=Aucun objet Authentication n'a \u00E9t\u00E9 trouv\u00E9 dans le SecurityContext
+AbstractUserDetailsAuthenticationProvider.badCredentials=Les cr\u00E9ances sont erron\u00E9es
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=Les cr\u00E9ances de l'utilisateur ont expir\u00E9
+AbstractUserDetailsAuthenticationProvider.disabled=Le compte utilisateur est d\u00E9sactiv\u00E9
+AbstractUserDetailsAuthenticationProvider.expired=Le compte utilisateur a expir\u00E9
+AbstractUserDetailsAuthenticationProvider.locked=Le compte utilisateur est bloqu\u00E9
 AbstractUserDetailsAuthenticationProvider.onlySupports=Seul UsernamePasswordAuthenticationToken est pris en charge
-AbstractUserDetailsAuthenticationProvider.locked=Le compte utilisateur est bloqué
-AbstractUserDetailsAuthenticationProvider.disabled=Le compte utilisateur est désactivé
-AbstractUserDetailsAuthenticationProvider.expired=Le compte utilisateur a expiré
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=Les créances de l'utilisateur ont expiré
-AbstractUserDetailsAuthenticationProvider.badCredentials=Les créances sont erronées
-X509AuthenticationProvider.certificateNull=Le certificat est null
-DaoX509AuthoritiesPopulator.noMatching=Aucun motif concordant n'a été trouvé dans le subjectDN: {0}
-RememberMeAuthenticationProvider.incorrectKey=Le RememberMeAuthenticationToken présenté ne contient pas la clé attendue
-RunAsImplAuthenticationProvider.incorrectKey=Le RunAsUserToken présenté ne contient pas la clé attendue
-DigestProcessingFilter.missingMandatory=Une valeur obligatoire manque au condensé; reçu l'entête {0}
-DigestProcessingFilter.missingAuth=Une valeur obligatoire manque au condensé pour 'auth' QOP; reçu l'entête {0}
-DigestProcessingFilter.incorrectRealm=Le nom de domaine de la réponse {0} ne correspond pas au nom de domaine du système {1}
-DigestProcessingFilter.nonceExpired=Le nonce a expiré
-DigestProcessingFilter.nonceEncoding=Le nonce n'est pas encodé en Base64; reçu le nonce {0}
-DigestProcessingFilter.nonceNotTwoTokens=Le nonce aurait dû générer deux jetons, mais était {0}
-DigestProcessingFilter.nonceNotNumeric=Le jeton nonce aurait dû générer d'abord un jeton numérique, mais était {0}
-DigestProcessingFilter.nonceCompromised=Le jeton nonce est compromis {0}
-DigestProcessingFilter.usernameNotFound=Le nom d'utilisateur {0} n'a pas été trouvé
-DigestProcessingFilter.incorrectResponse=Réponse incorrecte
-JdbcDaoImpl.notFound=Le nom d'utilisateur {0} n'a pas été trouvé
+AccountStatusUserDetailsChecker.credentialsExpired=Les cr\u00E9ances de l'utilisateur ont expir\u00E9
+AccountStatusUserDetailsChecker.disabled=Le compte utilisateur est d\u00E9sactiv\u00E9
+AccountStatusUserDetailsChecker.expired=Le compte utilisateur a expir\u00E9
+AccountStatusUserDetailsChecker.locked=Le compte utilisateur est bloqu\u00E9
+AclEntryAfterInvocationProvider.noPermission=L'authentification {0} n'a AUCUNE permission pour l'objet de domaine {1}
+AnonymousAuthenticationProvider.incorrectKey=L'AnonymousAuthenticationToken pr\u00E9sent\u00E9 ne contient pas la cl\u00E9 attendue
+BindAuthenticator.badCredentials=Les cr\u00E9ances sont erron\u00E9es
+BindAuthenticator.emptyPassword=Le mot de passe est obligatoire
+CasAuthenticationProvider.incorrectKey=Le CasAuthenticationToken pr\u00E9sent\u00E9 ne contient pas la cl\u00E9 attendue
+CasAuthenticationProvider.noServiceTicket=Echec d'obtention d'un ticket CAS \u00E0 valider
+ConcurrentSessionControlStrategy.exceededAllowed=Le maximum de {0} sessions a \u00E9t\u00E9 d\u00E9pass\u00E9 pour cet utilisateur
+DigestAuthenticationFilter.incorrectRealm=Le nom de domaine de la r\u00E9ponse {0} ne correspond pas au nom de domaine du syst\u00E8me {1}
+DigestAuthenticationFilter.incorrectResponse=R\u00E9ponse incorrecte
+DigestAuthenticationFilter.missingAuth=Une valeur obligatoire manque au condens\u00E9 pour 'auth' QOP; re\u00E7u l'ent\u00EAte {0}
+DigestAuthenticationFilter.missingMandatory=Une valeur obligatoire manque au condens\u00E9; re\u00E7u l'ent\u00EAte {0}
+DigestAuthenticationFilter.nonceCompromised=Le jeton nonce est compromis {0}
+DigestAuthenticationFilter.nonceEncoding=Le nonce n'est pas encod\u00E9 en Base64; re\u00E7u le nonce {0}
+DigestAuthenticationFilter.nonceExpired=Le nonce a expir\u00E9
+DigestAuthenticationFilter.nonceNotNumeric=Le jeton nonce aurait d\u00FB g\u00E9n\u00E9rer d'abord un jeton num\u00E9rique, mais \u00E9tait {0}
+DigestAuthenticationFilter.nonceNotTwoTokens=Le nonce aurait d\u00FB g\u00E9n\u00E9rer deux jetons, mais \u00E9tait {0}
+DigestAuthenticationFilter.usernameNotFound=Le nom d'utilisateur {0} n'a pas \u00E9t\u00E9 trouv\u00E9
 JdbcDaoImpl.noAuthority=Le compte utilisateur {0} n'a pas de permission
-SwitchUserProcessingFilter.noCurrentUser=Aucun utilisateur n'est associé à la requête en cours
-SwitchUserProcessingFilter.noOriginalAuthentication=L'objet Authentication original n'a pas été trouvé
-SwitchUserProcessingFilter.usernameNotFound=Le nom d'utilisateur {0} n'a pas été trouvé
-SwitchUserProcessingFilter.locked=Le compte utilisateur est bloqué
-SwitchUserProcessingFilter.disabled=Le compte utilisateur est désactivé
-SwitchUserProcessingFilter.expired=Le compte utilisateur a expiré
-SwitchUserProcessingFilter.credentialsExpired=Les créances de l'utilisateur ont expiré
-AbstractAccessDecisionManager.accessDenied=Accès refusé
+JdbcDaoImpl.notFound=Le nom d'utilisateur {0} n'a pas \u00E9t\u00E9 trouv\u00E9
+LdapAuthenticationProvider.badCredentials=Les cr\u00E9ances sont erron\u00E9es
 LdapAuthenticationProvider.emptyUsername=Le nom d'utilisateur est obligatoire
-LdapAuthenticationProvider.emptyPassword=Le mot de passe est obligatoire
-DefaultIntitalDirContextFactory.communicationFailure=Impossible de se connecter au serveur LDAP
-DefaultIntitalDirContextFactory.badCredentials=Les créances sont erronées
-DefaultIntitalDirContextFactory.unexpectedException=Impossible d'obtenir un InitialDirContext à cause d'une erreur inattendue
-PasswordComparisonAuthenticator.badCredentials=Les créances sont erronées
-BindAuthenticator.badCredentials=Les créances sont erronées
-BindAuthenticator.failedToLoadAttributes=Les créances sont erronées
-UserDetailsService.locked=Le compte utilisateur est bloqué
-UserDetailsService.disabled=Le compte utilisateur est désactivé
-UserDetailsService.expired=Le compte utilisateur a expiré
-UserDetailsService.credentialsExpired=Les créances de l'utilisateur ont expiré
+LdapAuthenticationProvider.onlySupports=Seul UsernamePasswordAuthenticationToken est pris en charge
+PasswordComparisonAuthenticator.badCredentials=Les cr\u00E9ances sont erron\u00E9es
+PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound=Aucun AuthenticationProvider n'a \u00E9t\u00E9 trouv\u00E9 pour {0}
+RememberMeAuthenticationProvider.incorrectKey=Le RememberMeAuthenticationToken pr\u00E9sent\u00E9 ne contient pas la cl\u00E9 attendue
+RunAsImplAuthenticationProvider.incorrectKey=Le RunAsUserToken pr\u00E9sent\u00E9 ne contient pas la cl\u00E9 attendue
+SubjectDnX509PrincipalExtractor.noMatching=Aucun motif concordant n'a \u00E9t\u00E9 trouv\u00E9 dans le subjectDN\: {0}
+SwitchUserFilter.noCurrentUser=Aucun utilisateur n'est associ\u00E9 \u00E0 la requ\u00EAte en cours
+SwitchUserFilter.noOriginalAuthentication=L'objet Authentication original n'a pas \u00E9t\u00E9 trouv\u00E9
@@ -5,43 +5,38 @@ AbstractUserDetailsAuthenticationProvider.credentialsExpired=Credenziali dell'ut
 AbstractUserDetailsAuthenticationProvider.disabled=Utente disabilitato
 AbstractUserDetailsAuthenticationProvider.expired=Account dell'utente scadute
 AbstractUserDetailsAuthenticationProvider.locked=Account dell'utente bloccato
-AbstractUserDetailsAuthenticationProvider.onlySupports=Solo UsernamePasswordAuthenticationToken è supportata
+AbstractUserDetailsAuthenticationProvider.onlySupports=Solo UsernamePasswordAuthenticationToken \u00E8 supportata
+AccountStatusUserDetailsChecker.credentialsExpired=Credenziali dell'utente scadute
+AccountStatusUserDetailsChecker.disabled=Utente disabilitato
+AccountStatusUserDetailsChecker.expired=Account dell'utente scaduto
+AccountStatusUserDetailsChecker.locked=Account dell'utente bloccato
+AclEntryAfterInvocationProvider.noPermission=L'autenticazione {0} non ha nessun permesso sull'oggetto di dominio {1}
 AnonymousAuthenticationProvider.incorrectKey=AnonymousAuthenticationToken non contiene la chiave prevista
-AuthByAdapterProvider.incorrectKey=AuthByAdapter non contiene la chiave prevista
-BasicAclEntryAfterInvocationProvider.noPermission=L'autenticazione {0} non ha nessun permesso sull'oggetto di dominio {1}
-BasicAclEntryAfterInvocationProvider.insufficientPermission=L'autenticazione {0} ha permessi ACL sull'oggetto di dominio, ma non il permesso ACL richiesto dall'oggetto {1}
 BindAuthenticator.badCredentials=Credenziali non valide
-BindAuthenticator.failedToLoadAttributes=Credenziali non valide
+BindAuthenticator.emptyPassword=Credenziali non valide
 CasAuthenticationProvider.incorrectKey=CasAuthenticationToken non contiene la chiave prevista
 CasAuthenticationProvider.noServiceTicket=Non e' stato fornito un CAS service ticket valido
-ConcurrentSessionControllerImpl.exceededAllowed=Il numero massimo delle sessioni ({0}) per questo utente sono state superate
-DaoX509AuthoritiesPopulator.noMatching=Non e' stato validato correttamente il subjectDN: {0}
-DefaultIntitalDirContextFactory.communicationFailure=Impossibile connettersi al server LDAP
-DefaultIntitalDirContextFactory.badCredentials=Credenziali non valide
-DefaultIntitalDirContextFactory.unexpectedException=Impossibile creare l'InitialDirContext a causa di un errore imprevisto
-DigestProcessingFilter.missingMandatory=Valore digest obbligatorio mancante; ricevuto header {0}
-DigestProcessingFilter.missingAuth=Valore digest obbligatorio mancante per 'auth' QOP; ricevuto header {0}
-DigestProcessingFilter.incorrectRealm=Il response realm name {0} non corrisponde al realm name di sistema {1}
-DigestProcessingFilter.nonceExpired=Nonce scaduto/in timeout
-DigestProcessingFilter.nonceEncoding=Nonce non codificato in Base64; ricevuto nonce {0}
-DigestProcessingFilter.nonceNotTwoTokens=Nonce avrebbe dovuto dare due token invece di {0}
-DigestProcessingFilter.nonceNotNumeric=Nonce token avrebbe dovuto dare un primo token numerico invece di {0}
-DigestProcessingFilter.nonceCompromised=Nonce token corrotto {0}
-DigestProcessingFilter.usernameNotFound=Username {0} non trovato
-DigestProcessingFilter.incorrectResponse=Replica non corretta
+ConcurrentSessionControlStrategy.exceededAllowed=Il numero massimo delle sessioni ({0}) per questo utente sono state superate
+DigestAuthenticationFilter.incorrectRealm=Il response realm name {0} non corrisponde al realm name di sistema {1}
+DigestAuthenticationFilter.incorrectResponse=Replica non corretta
+DigestAuthenticationFilter.missingAuth=Valore digest obbligatorio mancante per 'auth' QOP; ricevuto header {0}
+DigestAuthenticationFilter.missingMandatory=Valore digest obbligatorio mancante; ricevuto header {0}
+DigestAuthenticationFilter.nonceCompromised=Nonce token corrotto {0}
+DigestAuthenticationFilter.nonceEncoding=Nonce non codificato in Base64; ricevuto nonce {0}
+DigestAuthenticationFilter.nonceExpired=Nonce scaduto/in timeout
+DigestAuthenticationFilter.nonceNotNumeric=Nonce token avrebbe dovuto dare un primo token numerico invece di {0}
+DigestAuthenticationFilter.nonceNotTwoTokens=Nonce avrebbe dovuto dare due token invece di {0}
+DigestAuthenticationFilter.usernameNotFound=Username {0} non trovato
+#JdbcDaoImpl.noAuthority=User {0} has no GrantedAuthority
+#JdbcDaoImpl.notFound=User {0} not found
+LdapAuthenticationProvider.badCredentials=Credenziali non valide
 LdapAuthenticationProvider.emptyUsername=Username vuoto non consentito
-LdapAuthenticationProvider.emptyPassword=Credenziali non valide
-NamedCasProxyDecider.untrusted=Il Proxy piu' vicino {0} non e' trusted
+LdapAuthenticationProvider.onlySupports=Solo UsernamePasswordAuthenticationToken \u00E8 supportata
 PasswordComparisonAuthenticator.badCredentials=Credenziali non valide
+#PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
 ProviderManager.providerNotFound=Nessun Provider di autenticazione trovato per {0}
-RejectProxyTickets.reject=Proxy tickets rifiutati
 RememberMeAuthenticationProvider.incorrectKey=RememberMeAuthenticationToken non contiene la chiave prevista
 RunAsImplAuthenticationProvider.incorrectKey=RunAsUserToken non contiene la chiave prevista
-SwitchUserProcessingFilter.noCurrentUser=Nessun utente corrente associato con questa richiesta
-SwitchUserProcessingFilter.noOriginalAuthentication=Impossibile trovare l'Authentication object originale
-SwitchUserProcessingFilter.usernameNotFound=Username {0} non trovato
-SwitchUserProcessingFilter.locked=Account dell'utente bloccato
-SwitchUserProcessingFilter.disabled=Account dell'utente disabilitato
-SwitchUserProcessingFilter.expired=Account dell'utente scaduto
-SwitchUserProcessingFilter.credentialsExpired=Credenziali dell'utente scadute
-X509AuthenticationProvider.certificateNull=Il certificato e' nullo
+SubjectDnX509PrincipalExtractor.noMatching=Non e' stato validato correttamente il subjectDN\: {0}
+SwitchUserFilter.noCurrentUser=Nessun utente corrente associato con questa richiesta
+SwitchUserFilter.noOriginalAuthentication=Impossibile trovare l'Authentication object originale
@@ -1,54 +1,42 @@
-AuthByAdapterProvider.incorrectKey=\uc81c\uacf5\ub41c AuthByAdapter \uad6c\ud604\uc5d0\ub294 \ucc3e\ub294 key\uac00 \uc5c6\uc2b5\ub2c8\ub2e4.
-BasicAclEntryAfterInvocationProvider.noPermission=Authentication {0}\uc740/\ub294 domain object {1}\uc5d0 \ub300\ud55c \uad8c\ud55c\uc774 \uc5c6\uc2b5\ub2c8\ub2e4.
-BasicAclEntryAfterInvocationProvider.insufficientPermission=domain object {1}\uc5d0 \ub300\ud55c Authentication {0}\uc758 ACL \uad8c\ud55c\uc774 \ubd88\ucda9\ubd84\ud569\ub2c8\ub2e4.
-ConcurrentSessionControllerImpl.exceededAllowed={0}\uc758 \ucd5c\ub300 \uc138\uc158 \ud5c8\uc6a9 \uc218\ub97c \ucd08\uacfc\ud558\uc600\uc2b5\ub2c8\ub2e4.
-ProviderManager.providerNotFound={0}\uc744 \uc704\ud55c AuthenticationProvider\ub97c \ucc3e\uc744 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-AnonymousAuthenticationProvider.incorrectKey=\uc81c\uacf5\ub41c AnonymousAuthenticationToken\uc5d0\ub294 \ucc3e\ub294 key\uac00 \uc5c6\uc2b5\ub2c8\ub2e4.
-CasAuthenticationProvider.incorrectKey=\uc81c\uacf5\ub41c CasAuthenticationToken\uc5d0\ub294 \ucc3e\ub294 key\uac00 \uc5c6\uc2b5\ub2c8\ub2e4.
-CasAuthenticationProvider.noServiceTicket=\uac80\uc99d\uc744 \uc704\ud55c CAS \uc11c\ube44\uc2a4 \ud2f0\ucf13\uc744 \uc81c\uacf5\ud560 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-NamedCasProxyDecider.untrusted=\uac00\uc7a5 \uac00\uae4c\uc6b4 \ud504\ub77d\uc2dc {0}\ub294 \uc2e0\ub8b0\ud560 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-RejectProxyTickets.reject=\ud504\ub77d\uc2dc \ud2f0\ucf13\uc774 \uac70\ubd80\ub418\uc5c8\uc2b5\ub2c8\ub2e4.
-AbstractSecurityInterceptor.authenticationNotFound=SecurityContext\uc5d0\uc11c Authentication \uac1d\uccb4\ub97c \ucc3e\uc744 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-AbstractUserDetailsAuthenticationProvider.onlySupports=UsernamePasswordAuthenticationToken\ub9cc \uc9c0\uc6d0\ud569\ub2c8\ub2e4.
-AbstractUserDetailsAuthenticationProvider.locked=\uc0ac\uc6a9\uc790 \uacc4\uc815\uc774 \uc7a0\uaca8 \uc788\uc2b5\ub2c8\ub2e4.
-AbstractUserDetailsAuthenticationProvider.disabled=\uc874\uc7ac\ud558\uc9c0 \uc54a\ub294 \uc0ac\uc6a9\uc790 \uc785\ub2c8\ub2e4.
-AbstractUserDetailsAuthenticationProvider.expired=\uc0ac\uc6a9\uc790 \uacc4\uc815\uc758 \uc720\ud6a8 \uae30\uac04\uc774 \ub9cc\ub8cc \ub418\uc5c8\uc2b5\ub2c8\ub2e4.
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=\ube44\ubc00\ubc88\ud638(credential)\uc758 \uc720\ud6a8 \uae30\uac04\uc774 \ub9cc\ub8cc\ub418\uc5c8\uc2b5\ub2c8\ub2e4.
-AbstractUserDetailsAuthenticationProvider.badCredentials=\ube44\ubc00\ubc88\ud638(credential)\uac00 \ub9de\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.
-X509AuthenticationProvider.certificateNull=\ube44\ubc00\ubc88\ud638(credential)\uac00 null \uc785\ub2c8\ub2e4.
-DaoX509AuthoritiesPopulator.noMatching=subjectDN: {0}\uc5d0\uc11c \ub9e4\uce6d\ub418\ub294 \ud328\ud134\uc774 \uc5c6\uc2b5\ub2c8\ub2e4.
-RememberMeAuthenticationProvider.incorrectKey=\uc81c\uacf5\ub41c RememberMeAuthenticationToken\uc5d0\ub294 \ucc3e\ub294 key\uac00 \uc5c6\uc2b5\ub2c8\ub2e4.
-RunAsImplAuthenticationProvider.incorrectKey=\uc81c\uacf5\ub41c RunAsUserToken\uc5d0\ub294 \ucc3e\ub294 key\uac00 \uc5c6\uc2b5\ub2c8\ub2e4.
-DigestProcessingFilter.missingMandatory=\ud544\uc218 digest \ud30c\ub77c\ubbf8\ud130 \uac12\uc774 \ub204\ub77d\ub418\uc5c8\uc2b5\ub2c8\ub2e4. \ud604\uc7ac header\ub294 {0}\uc785\ub2c8\ub2e4.
-DigestProcessingFilter.missingAuth='auth' QOP\ub97c \uc704\ud55c \ud544\uc218 digest \ud30c\ub77c\ubbf8\ud130 \uac12\uc774 \ub204\ub77d\ub418\uc5c8\uc2b5\ub2c8\ub2e4. \ud604\uc7ac header\ub294 {0}\uc785\ub2c8\ub2e4.
-DigestProcessingFilter.incorrectRealm=\uc751\ub2f5 realm \uc774\ub984 {0}\uc774 \uc2dc\uc2a4\ud15c realm \uc774\ub984 {1}\uacfc \uc77c\uce58 \ud558\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.
-DigestProcessingFilter.nonceExpired=Nonce\uc758 \uc720\ud6a8 \uae30\uac04\uc774 \ub9cc\ub8cc\ub418\uc5c8\uc2b5\ub2c8\ub2e4.
-DigestProcessingFilter.nonceEncoding=Nonce\uac00 Base64\ub85c \uc778\ucf54\ub529 \ub418\uc5b4\uc788\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4. \ud604\uc7ac nonce\ub294 {0}\uc785\ub2c8\ub2e4.
-DigestProcessingFilter.nonceNotTwoTokens=Nonce\ub294 2\uac1c\uc758 \ud1a0\ud070\uc744 \ub9cc\ub4e4\uc5b4\uc57c \ud569\ub2c8\ub2e4. \ud604\uc7ac nonce\ub294 {0}\uc785\ub2c8\ub2e4.
-DigestProcessingFilter.nonceNotNumeric=Nonce \ud1a0\ud070\uc758 \uccab \uae00\uc790\ub294  \uc22b\uc790\ub85c \uc2dc\uc791\ud574\uc57c \ud569\ub2c8\ub2e4. \ud604\uc7ac nonce\ub294 {0}\uc785\ub2c8\ub2e4.
-DigestProcessingFilter.nonceCompromised=Nonce \ud1a0\ud070\uc774 \ud6fc\uc190\ub418\uc5c8\uc2b5\ub2c8\ub2e4. \ud604\uc7ac nonce\ub294 {0}\uc785\ub2c8\ub2e4.
-DigestProcessingFilter.usernameNotFound=\uc0ac\uc6a9\uc790 {0}\uc744/\ub97c \ucc3e\uc744 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-DigestProcessingFilter.incorrectResponse=\uc751\ub2f5\uc774 \uc815\ud655\ud558\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.
-JdbcDaoImpl.notFound=\uc0ac\uc6a9\uc790 {0}\uc744/\ub97c \ucc3e\uc744 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-JdbcDaoImpl.noAuthority=\uc0ac\uc6a9\uc790 {0}\uc740/\ub294 \uad8c\ud55c\uc774 \uc5c6\uc2b5\ub2c8\ub2e4.
-SwitchUserProcessingFilter.noCurrentUser=\uc0ac\uc6a9\uc790\uac00  \uc874\uc7ac\ud558\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.
-SwitchUserProcessingFilter.noOriginalAuthentication=Authentication\uc758 \uc6d0\ubcf8\uc744 \ucc3e\uc744 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-SwitchUserProcessingFilter.usernameNotFound=\uc0ac\uc6a9\uc790\uba85(username) {0}\uc744/\ub97c \ucc3e\uc744 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-SwitchUserProcessingFilter.locked=\uc0ac\uc6a9\uc790 \uacc4\uc815\uc774 \uc7a0\uaca8 \uc788\uc2b5\ub2c8\ub2e4.
-SwitchUserProcessingFilter.disabled=\uc0ac\uc6a9\uc790 \uacc4\uc815\uc744 \uc0ac\uc6a9\ud560 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-SwitchUserProcessingFilter.expired=\uc0ac\uc6a9\uc790 \uacc4\uc815\uc758 \uc720\ud6a8 \uae30\uac04\uc774 \ub9cc\ub8cc \ub418\uc5c8\uc2b5\ub2c8\ub2e4.
-SwitchUserProcessingFilter.credentialsExpired=\ube44\ubc00\ubc88\ud638(credential)\uc758 \uc720\ud6a8 \uae30\uac04\uc774 \ub9cc\ub8cc\ub418\uc5c8\uc2b5\ub2c8\ub2e4.
-AbstractAccessDecisionManager.accessDenied=\uc811\uadfc\uc774 \uac70\ubd80\ub418\uc5c8\uc2b5\ub2c8\ub2e4.
-LdapAuthenticationProvider.emptyUsername=\uc0ac\uc6a9\uc790\uba85(username)\uc5d0 \uacf5\ubc31\uc740 \ud5c8\uc6a9\ub418\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.
-LdapAuthenticationProvider.emptyPassword=\ube44\ubc00\ubc88\ud638(credential)\uac00 \ub9de\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.
-DefaultIntitalDirContextFactory.communicationFailure=LDAP \uc11c\ubc84\ub85c \uc811\uc18d\ud560 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-DefaultIntitalDirContextFactory.badCredentials=\ube44\ubc00\ubc88\ud638\uac00 \ub9de\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.
-DefaultIntitalDirContextFactory.unexpectedException=\uc54c \uc218 \uc5c6\ub294 \uc608\uc678\uac00 \ubc1c\uc0dd\ud558\uc5ec InitialDirContext\ub97c \uc5bb\uc5b4\uc62c \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-PasswordComparisonAuthenticator.badCredentials=\ube44\ubc00\ubc88\ud638\uac00 \ub9de\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.
-BindAuthenticator.badCredentials=\ube44\ubc00\ubc88\ud638\uac00 \ub9de\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.
-BindAuthenticator.failedToLoadAttributes=\ube44\ubc00\ubc88\ud638\uac00 \ub9de\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.
-UserDetailsService.locked=\uc0ac\uc6a9\uc790 \uacc4\uc815\uc774 \uc7a0\uaca8 \uc788\uc2b5\ub2c8\ub2e4.
-UserDetailsService.disabled=\uc0ac\uc6a9\uc790 \uacc4\uc815\uc744 \uc0ac\uc6a9\ud560 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-UserDetailsService.expired=\uc0ac\uc6a9\uc790 \uacc4\uc815\uc758 \uc720\ud6a8 \uae30\uac04\uc774 \ub9cc\ub8cc \ub418\uc5c8\uc2b5\ub2c8\ub2e4.
-UserDetailsService.credentialsExpired=\ube44\ubc00\ubc88\ud638\uc758 \uc720\ud6a8 \uae30\uac04\uc774 \ub9cc\ub8cc\ub418\uc5c8\uc2b5\ub2c8\ub2e4.
-
+AbstractAccessDecisionManager.accessDenied=\uC811\uADFC\uC774 \uAC70\uBD80\uB418\uC5C8\uC2B5\uB2C8\uB2E4.
+AbstractSecurityInterceptor.authenticationNotFound=SecurityContext\uC5D0\uC11C Authentication \uAC1D\uCCB4\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.
+AbstractUserDetailsAuthenticationProvider.badCredentials=\uBE44\uBC00\uBC88\uD638(credential)\uAC00 \uB9DE\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=\uBE44\uBC00\uBC88\uD638(credential)\uC758 \uC720\uD6A8 \uAE30\uAC04\uC774 \uB9CC\uB8CC\uB418\uC5C8\uC2B5\uB2C8\uB2E4.
+AbstractUserDetailsAuthenticationProvider.disabled=\uC874\uC7AC\uD558\uC9C0 \uC54A\uB294 \uC0AC\uC6A9\uC790 \uC785\uB2C8\uB2E4.
+AbstractUserDetailsAuthenticationProvider.expired=\uC0AC\uC6A9\uC790 \uACC4\uC815\uC758 \uC720\uD6A8 \uAE30\uAC04\uC774 \uB9CC\uB8CC \uB418\uC5C8\uC2B5\uB2C8\uB2E4.
+AbstractUserDetailsAuthenticationProvider.locked=\uC0AC\uC6A9\uC790 \uACC4\uC815\uC774 \uC7A0\uACA8 \uC788\uC2B5\uB2C8\uB2E4.
+AbstractUserDetailsAuthenticationProvider.onlySupports=UsernamePasswordAuthenticationToken\uB9CC \uC9C0\uC6D0\uD569\uB2C8\uB2E4.
+AccountStatusUserDetailsChecker.credentialsExpired=\uBE44\uBC00\uBC88\uD638\uC758 \uC720\uD6A8 \uAE30\uAC04\uC774 \uB9CC\uB8CC\uB418\uC5C8\uC2B5\uB2C8\uB2E4.
+AccountStatusUserDetailsChecker.disabled=\uC0AC\uC6A9\uC790 \uACC4\uC815\uC744 \uC0AC\uC6A9\uD560 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.
+AccountStatusUserDetailsChecker.expired=\uC0AC\uC6A9\uC790 \uACC4\uC815\uC758 \uC720\uD6A8 \uAE30\uAC04\uC774 \uB9CC\uB8CC \uB418\uC5C8\uC2B5\uB2C8\uB2E4.
+AccountStatusUserDetailsChecker.locked=\uC0AC\uC6A9\uC790 \uACC4\uC815\uC774 \uC7A0\uACA8 \uC788\uC2B5\uB2C8\uB2E4.
+AclEntryAfterInvocationProvider.noPermission=Authentication {0}\uC740/\uB294 domain object {1}\uC5D0 \uB300\uD55C \uAD8C\uD55C\uC774 \uC5C6\uC2B5\uB2C8\uB2E4.
+AnonymousAuthenticationProvider.incorrectKey=\uC81C\uACF5\uB41C AnonymousAuthenticationToken\uC5D0\uB294 \uCC3E\uB294 key\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4.
+BindAuthenticator.badCredentials=\uBE44\uBC00\uBC88\uD638\uAC00 \uB9DE\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.
+BindAuthenticator.emptyPassword=\uBE44\uBC00\uBC88\uD638(credential)\uAC00 \uB9DE\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.
+CasAuthenticationProvider.incorrectKey=\uC81C\uACF5\uB41C CasAuthenticationToken\uC5D0\uB294 \uCC3E\uB294 key\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4.
+CasAuthenticationProvider.noServiceTicket=\uAC80\uC99D\uC744 \uC704\uD55C CAS \uC11C\uBE44\uC2A4 \uD2F0\uCF13\uC744 \uC81C\uACF5\uD560 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.
+ConcurrentSessionControlStrategy.exceededAllowed={0}\uC758 \uCD5C\uB300 \uC138\uC158 \uD5C8\uC6A9 \uC218\uB97C \uCD08\uACFC\uD558\uC600\uC2B5\uB2C8\uB2E4.
+DigestAuthenticationFilter.incorrectRealm=\uC751\uB2F5 realm \uC774\uB984 {0}\uC774 \uC2DC\uC2A4\uD15C realm \uC774\uB984 {1}\uACFC \uC77C\uCE58 \uD558\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.
+DigestAuthenticationFilter.incorrectResponse=\uC751\uB2F5\uC774 \uC815\uD655\uD558\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.
+DigestAuthenticationFilter.missingAuth='auth' QOP\uB97C \uC704\uD55C \uD544\uC218 digest \uD30C\uB77C\uBBF8\uD130 \uAC12\uC774 \uB204\uB77D\uB418\uC5C8\uC2B5\uB2C8\uB2E4. \uD604\uC7AC header\uB294 {0}\uC785\uB2C8\uB2E4.
+DigestAuthenticationFilter.missingMandatory=\uD544\uC218 digest \uD30C\uB77C\uBBF8\uD130 \uAC12\uC774 \uB204\uB77D\uB418\uC5C8\uC2B5\uB2C8\uB2E4. \uD604\uC7AC header\uB294 {0}\uC785\uB2C8\uB2E4.
+DigestAuthenticationFilter.nonceCompromised=Nonce \uD1A0\uD070\uC774 \uD6FC\uC190\uB418\uC5C8\uC2B5\uB2C8\uB2E4. \uD604\uC7AC nonce\uB294 {0}\uC785\uB2C8\uB2E4.
+DigestAuthenticationFilter.nonceEncoding=Nonce\uAC00 Base64\uB85C \uC778\uCF54\uB529 \uB418\uC5B4\uC788\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4. \uD604\uC7AC nonce\uB294 {0}\uC785\uB2C8\uB2E4.
+DigestAuthenticationFilter.nonceExpired=Nonce\uC758 \uC720\uD6A8 \uAE30\uAC04\uC774 \uB9CC\uB8CC\uB418\uC5C8\uC2B5\uB2C8\uB2E4.
+DigestAuthenticationFilter.nonceNotNumeric=Nonce \uD1A0\uD070\uC758 \uCCAB \uAE00\uC790\uB294  \uC22B\uC790\uB85C \uC2DC\uC791\uD574\uC57C \uD569\uB2C8\uB2E4. \uD604\uC7AC nonce\uB294 {0}\uC785\uB2C8\uB2E4.
+DigestAuthenticationFilter.nonceNotTwoTokens=Nonce\uB294 2\uAC1C\uC758 \uD1A0\uD070\uC744 \uB9CC\uB4E4\uC5B4\uC57C \uD569\uB2C8\uB2E4. \uD604\uC7AC nonce\uB294 {0}\uC785\uB2C8\uB2E4.
+DigestAuthenticationFilter.usernameNotFound=\uC0AC\uC6A9\uC790 {0}\uC744/\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.
+JdbcDaoImpl.noAuthority=\uC0AC\uC6A9\uC790 {0}\uC740/\uB294 \uAD8C\uD55C\uC774 \uC5C6\uC2B5\uB2C8\uB2E4.
+JdbcDaoImpl.notFound=\uC0AC\uC6A9\uC790 {0}\uC744/\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.
+LdapAuthenticationProvider.badCredentials=\uBE44\uBC00\uBC88\uD638\uAC00 \uB9DE\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.
+LdapAuthenticationProvider.emptyUsername=\uC0AC\uC6A9\uC790\uBA85(username)\uC5D0 \uACF5\uBC31\uC740 \uD5C8\uC6A9\uB418\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.
+LdapAuthenticationProvider.onlySupports=UsernamePasswordAuthenticationToken\uB9CC \uC9C0\uC6D0\uD569\uB2C8\uB2E4.
+PasswordComparisonAuthenticator.badCredentials=\uBE44\uBC00\uBC88\uD638\uAC00 \uB9DE\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.
+#PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound={0}\uC744 \uC704\uD55C AuthenticationProvider\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.
+RememberMeAuthenticationProvider.incorrectKey=\uC81C\uACF5\uB41C RememberMeAuthenticationToken\uC5D0\uB294 \uCC3E\uB294 key\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4.
+RunAsImplAuthenticationProvider.incorrectKey=\uC81C\uACF5\uB41C RunAsUserToken\uC5D0\uB294 \uCC3E\uB294 key\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4.
+SubjectDnX509PrincipalExtractor.noMatching=subjectDN\: {0}\uC5D0\uC11C \uB9E4\uCE6D\uB418\uB294 \uD328\uD134\uC774 \uC5C6\uC2B5\uB2C8\uB2E4.
+SwitchUserFilter.noCurrentUser=\uC0AC\uC6A9\uC790\uAC00  \uC874\uC7AC\uD558\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.
+SwitchUserFilter.noOriginalAuthentication=Authentication\uC758 \uC6D0\uBCF8\uC744 \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.
@@ -1,53 +1,42 @@
-AuthByAdapterProvider.incorrectKey=Podana implementacja AuthByAdapter nie zawiera oczekiwanego klucza
-BasicAclEntryAfterInvocationProvider.noPermission=U\u017cytkownik {0} nie posiada \u017bADNYCH uprawnie\u0144 do obiektu {1}
-BasicAclEntryAfterInvocationProvider.insufficientPermission=U\u017cytkownik {0} nie posiada wymaganych uprawnie\u0144 do obiektu {1}
-ConcurrentSessionControllerImpl.exceededAllowed=Maksymalna liczba sesji ({0}) dla tego u\u017cytkownika zosta\u0142a przekroczona
-ProviderManager.providerNotFound=AuthenticationProvider dla {0} nie zosta\u0142 znaleziony
+AbstractAccessDecisionManager.accessDenied=Dost\u0119p zabroniony
+AbstractSecurityInterceptor.authenticationNotFound=Obiekt Authentication nie zosta\u0142 odnaleziony w SecurityContext
+AbstractUserDetailsAuthenticationProvider.badCredentials=Niepoprawne dane uwierzytelniaj\u0105ce
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=Wa\u017Cno\u015B\u0107 danych uwierzytelniaj\u0105cych wygas\u0142a
+AbstractUserDetailsAuthenticationProvider.disabled=Konto u\u017Cytkownika jest wy\u0142\u0105czone
+AbstractUserDetailsAuthenticationProvider.expired=Wa\u017Cno\u015B\u0107 konta u\u017Cytkownika wygas\u0142a
+AbstractUserDetailsAuthenticationProvider.locked=Konto u\u017Cytkownika jest zablokowane
+AbstractUserDetailsAuthenticationProvider.onlySupports=Tylko UsernamePasswordAuthenticationToken jest obs\u0142ugiwany
+AccountStatusUserDetailsChecker.credentialsExpired=Wa\u017Cno\u015B\u0107 danych uwierzytelniaj\u0105cych wygas\u0142a
+AccountStatusUserDetailsChecker.disabled=Konto u\u017Cytkownika jest wy\u0142\u0105czone
+AccountStatusUserDetailsChecker.expired=Wa\u017Cno\u015B\u0107 konta u\u017Cytkownika wygas\u0142a
+AccountStatusUserDetailsChecker.locked=Konto u\u017Cytkownika jest zablokowane
+AclEntryAfterInvocationProvider.noPermission=U\u017Cytkownik {0} nie posiada \u017BADNYCH uprawnie\u0144 do obiektu {1}
 AnonymousAuthenticationProvider.incorrectKey=Podany AnonymousAuthenticationToken nie zawiera oczekiwanego klucza
+BindAuthenticator.badCredentials=Niepoprawne dane uwierzytelniaj\u0105ce
+BindAuthenticator.emptyPassword=Niepoprawne dane uwierzytelniaj\u0105ce
 CasAuthenticationProvider.incorrectKey=Podany CasAuthenticationToken nie zawiera oczekiwanego klucza
 CasAuthenticationProvider.noServiceTicket=Dostarczenie biletu serwisu CAS do walidacji nie powiod\u0142o si\u0119
-NamedCasProxyDecider.untrusted=Najbli\u017cszy serwer po\u015brednicz\u0105cy {0} jest niezaufany
-RejectProxyTickets.reject=Bilety serwera po\u015brednicz\u0105cego zosta\u0142y odrzucone
-AbstractSecurityInterceptor.authenticationNotFound=Obiekt Authentication nie zosta\u0142 odnaleziony w SecurityContext
-AbstractUserDetailsAuthenticationProvider.onlySupports=Tylko UsernamePasswordAuthenticationToken jest obs\u0142ugiwany
-AbstractUserDetailsAuthenticationProvider.locked=Konto u\u017cytkownika jest zablokowane
-AbstractUserDetailsAuthenticationProvider.disabled=Konto u\u017cytkownika jest wy\u0142\u0105czone
-AbstractUserDetailsAuthenticationProvider.expired=Wa\u017cno\u015b\u0107 konta u\u017cytkownika wygas\u0142a
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=Wa\u017cno\u015b\u0107 danych uwierzytelniaj\u0105cych wygas\u0142a
-AbstractUserDetailsAuthenticationProvider.badCredentials=Niepoprawne dane uwierzytelniaj\u0105ce
-X509AuthenticationProvider.certificateNull=Certyfikat jest pusty
-DaoX509AuthoritiesPopulator.noMatching=Nie odnaleziono pasuj\u0105cego wzorca w subjectDN: {0}
+ConcurrentSessionControlStrategy.exceededAllowed=Maksymalna liczba sesji ({0}) dla tego u\u017Cytkownika zosta\u0142a przekroczona
+DigestAuthenticationFilter.incorrectRealm=Nazwa domeny {0} w odpowiedzi nie jest zgodna z nazw\u0105 domeny {1} w systemie
+DigestAuthenticationFilter.incorrectResponse=Niepoprawna odpowied\u017A
+DigestAuthenticationFilter.missingAuth=Brakuje wymaganej warto\u015Bci skr\u00F3tu dla 'auth' QOP; otrzymany nag\u0142\u00F3wek {0}
+DigestAuthenticationFilter.missingMandatory=Brakuje wymaganej warto\u015Bci skr\u00F3tu; otrzymany nag\u0142\u00F3wek {0}
+DigestAuthenticationFilter.nonceCompromised=Niepoprawny kod jednorazowy (nonce) {0}
+DigestAuthenticationFilter.nonceEncoding=Kod jednorazowy (nonce) nie jest zakodowany w Base64; otrzymany kod {0}
+DigestAuthenticationFilter.nonceExpired=Wa\u017Cno\u015B\u0107 kodu jednorazowego (nonce) wygas\u0142a
+DigestAuthenticationFilter.nonceNotNumeric=Pierwsza warto\u015B\u0107 kodu jednorazowego (nonce) nie jest warto\u015Bci\u0105 numeryczn\u0105\: {0}
+DigestAuthenticationFilter.nonceNotTwoTokens=Kod jednorazowy (nonce) powinien zawiera\u0107 dwie warto\u015Bci {0}
+DigestAuthenticationFilter.usernameNotFound=Nazwa u\u017Cytkownika {0} nie zosta\u0142a odnaleziona
+JdbcDaoImpl.noAuthority=U\u017Cytkownik {0} nie posiada \u017Cadnych uprawnie\u0144 (GrantedAuthority)
+JdbcDaoImpl.notFound=Nazwa u\u017Cytkownika {0} nie zosta\u0142a odnaleziona
+LdapAuthenticationProvider.badCredentials=Niepoprawne dane uwierzytelniaj\u0105ce
+LdapAuthenticationProvider.emptyUsername=Pusta nazwa u\u017Cytkownika jest niedozwolona
+LdapAuthenticationProvider.onlySupports=Tylko UsernamePasswordAuthenticationToken jest obs\u0142ugiwany
+PasswordComparisonAuthenticator.badCredentials=Niepoprawne dane uwierzytelniaj\u0105ce
+#PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound=AuthenticationProvider dla {0} nie zosta\u0142 znaleziony
 RememberMeAuthenticationProvider.incorrectKey=Podany RememberMeAuthenticationToken nie zawiera oczekiwanego klucza
 RunAsImplAuthenticationProvider.incorrectKey=Podany RunAsUserToken nie zawiera oczekiwanego klucza
-DigestProcessingFilter.missingMandatory=Brakuje wymaganej warto\u015bci skr\u00f3tu; otrzymany nag\u0142\u00f3wek {0}
-DigestProcessingFilter.missingAuth=Brakuje wymaganej warto\u015bci skr\u00f3tu dla 'auth' QOP; otrzymany nag\u0142\u00f3wek {0}
-DigestProcessingFilter.incorrectRealm=Nazwa domeny {0} w odpowiedzi nie jest zgodna z nazw\u0105 domeny {1} w systemie
-DigestProcessingFilter.nonceExpired=Wa\u017cno\u015b\u0107 kodu jednorazowego (nonce) wygas\u0142a
-DigestProcessingFilter.nonceEncoding=Kod jednorazowy (nonce) nie jest zakodowany w Base64; otrzymany kod {0}
-DigestProcessingFilter.nonceNotTwoTokens=Kod jednorazowy (nonce) powinien zawiera\u0107 dwie warto\u015bci {0}
-DigestProcessingFilter.nonceNotNumeric=Pierwsza warto\u015b\u0107 kodu jednorazowego (nonce) nie jest warto\u015bci\u0105 numeryczn\u0105: {0}
-DigestProcessingFilter.nonceCompromised=Niepoprawny kod jednorazowy (nonce) {0}
-DigestProcessingFilter.usernameNotFound=Nazwa u\u017cytkownika {0} nie zosta\u0142a odnaleziona
-DigestProcessingFilter.incorrectResponse=Niepoprawna odpowied\u017a
-JdbcDaoImpl.notFound=Nazwa u\u017cytkownika {0} nie zosta\u0142a odnaleziona
-JdbcDaoImpl.noAuthority=U\u017cytkownik {0} nie posiada \u017cadnych uprawnie\u0144 (GrantedAuthority)
-SwitchUserProcessingFilter.noCurrentUser=\u017baden aktualny u\u017cytkownik nie jest powi\u0105zany z tym zapytaniem
-SwitchUserProcessingFilter.noOriginalAuthentication=Nie mo\u017cna by\u0142o odnale\u017a\u0107 oryginalnego obiektu Authentication
-SwitchUserProcessingFilter.usernameNotFound=Nazwa u\u017cytkownika {0} nie zosta\u0142a odnaleziona
-SwitchUserProcessingFilter.locked=Konto u\u017cytkownika jest zablokowane
-SwitchUserProcessingFilter.disabled=Konto u\u017cytkownika jest wy\u0142\u0105czone
-SwitchUserProcessingFilter.expired=Wa\u017cno\u015b\u0107 konta u\u017cytkownika wygas\u0142a
-SwitchUserProcessingFilter.credentialsExpired=Wa\u017cno\u015b\u0107 danych uwierzytelniaj\u0105cych wygas\u0142a
-AbstractAccessDecisionManager.accessDenied=Dost\u0119p zabroniony
-LdapAuthenticationProvider.emptyUsername=Pusta nazwa u\u017cytkownika jest niedozwolona
-LdapAuthenticationProvider.emptyPassword=Niepoprawne dane uwierzytelniaj\u0105ce
-DefaultIntitalDirContextFactory.communicationFailure=Po\u0142\u0105czenie z serwerem LDAP nie powiod\u0142o si\u0119
-DefaultIntitalDirContextFactory.badCredentials=Niepoprawne dane uwierzytelniaj\u0105ce
-DefaultIntitalDirContextFactory.unexpectedException=Nie mo\u017cna by\u0142o uzyska\u0107 InitialDirContext z powodu nieoczekiwanego wyj\u0105tku
-PasswordComparisonAuthenticator.badCredentials=Niepoprawne dane uwierzytelniaj\u0105ce
-BindAuthenticator.badCredentials=Niepoprawne dane uwierzytelniaj\u0105ce
-BindAuthenticator.failedToLoadAttributes=Niepoprawne dane uwierzytelniaj\u0105ce
-UserDetailsService.locked=Konto u\u017cytkownika jest zablokowane
-UserDetailsService.disabled=Konto u\u017cytkownika jest wy\u0142\u0105czone
-UserDetailsService.expired=Wa\u017cno\u015b\u0107 konta u\u017cytkownika wygas\u0142a
-UserDetailsService.credentialsExpired=Wa\u017cno\u015b\u0107 danych uwierzytelniaj\u0105cych wygas\u0142a
+SubjectDnX509PrincipalExtractor.noMatching=Nie odnaleziono pasuj\u0105cego wzorca w subjectDN\: {0}
+SwitchUserFilter.noCurrentUser=\u017Baden aktualny u\u017Cytkownik nie jest powi\u0105zany z tym zapytaniem
+SwitchUserFilter.noOriginalAuthentication=Nie mo\u017Cna by\u0142o odnale\u017A\u0107 oryginalnego obiektu Authentication
@@ -1,58 +1,45 @@
 # Spring security
 # Messages in Brazilian Portuguese
 # Translation by Leonardo Pinto (leoviveiros@gmail.com)
-
-AuthByAdapterProvider.incorrectKey=A implementa\u00E7\u00E3o de AuthByAdapter apresentada n\u00E3o cont\u00E9m a chave esperada
-BasicAclEntryAfterInvocationProvider.noPermission=Autentica\u00E7\u00E3o {0} n\u00E3o possui permiss\u00F5es no objeto de dom\u00EDnio {1}
-BasicAclEntryAfterInvocationProvider.insufficientPermission=Autentica\u00E7\u00E3o {0} possui permiss\u00F5es ACL para o objeto de dom\u00EDnio, mas n\u00E3o a permiss\u00E3o ACL requerida para o objeto de dom\u00EDnio {1}
-ConcurrentSessionControllerImpl.exceededAllowed=Excedidas as sess\u00F5es m\u00E1ximas de {0} para este usu\u00E1rio
-ProviderManager.providerNotFound=Nenhum AuthenticationProvider encontrado para {0}
-AnonymousAuthenticationProvider.incorrectKey=O AnonymousAuthenticationToken apresentado n\u00E3o cont\u00E9m a chave esperada
-CasAuthenticationProvider.incorrectKey=O CasAuthenticationToken apresentado n\u00E3o cont\u00E9m a chave esperada
-CasAuthenticationProvider.noServiceTicket=N\u00E3o foi poss\u00EDvel prover um ticket de servi\u00E7o CAS para validar
-NamedCasProxyDecider.untrusted=O proxy mais pr\u00F3ximo {0} n\u00E3o \u00E9 confi\u00E1vel
-RejectProxyTickets.reject=Os tickets do proxy foram rejeitados
+AbstractAccessDecisionManager.accessDenied=Acesso negado
 AbstractSecurityInterceptor.authenticationNotFound=Um objeto de autentica\u00E7\u00E3o n\u00E3o foi encontrado no SecurityContext
-AbstractUserDetailsAuthenticationProvider.onlySupports=Somente UsernamePasswordAuthenticationToken \u00E9 suportado
-AbstractUserDetailsAuthenticationProvider.locked=Conta bloqueada
+AbstractUserDetailsAuthenticationProvider.badCredentials=Usu\u00E1rio inexistente ou senha inv\u00E1lida
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=Credenciais expiradas
 AbstractUserDetailsAuthenticationProvider.disabled=Usu\u00E1rio desabilitado
 AbstractUserDetailsAuthenticationProvider.expired=Conta expirada
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=Credenciais expiradas
-AbstractUserDetailsAuthenticationProvider.badCredentials=Usu\u00E1rio inexistente ou senha inv\u00E1lida
-X509AuthenticationProvider.certificateNull=Certificado nulo
-DaoX509AuthoritiesPopulator.noMatching=Nenhum padr\u00E3o compat\u00EDvel foi encontrado em subjectDN: {0}
+AbstractUserDetailsAuthenticationProvider.locked=Conta bloqueada
+AbstractUserDetailsAuthenticationProvider.onlySupports=Somente UsernamePasswordAuthenticationToken \u00E9 suportado
+AccountStatusUserDetailsChecker.credentialsExpired=Credenciais expiradas
+AccountStatusUserDetailsChecker.disabled=Usu\u00E1rio desabilitado
+AccountStatusUserDetailsChecker.expired=Conta expirada
+AccountStatusUserDetailsChecker.locked=Conta bloqueada
+AclEntryAfterInvocationProvider.noPermission=Autentica\u00E7\u00E3o {0} n\u00E3o possui permiss\u00F5es no objeto de dom\u00EDnio {1}
+AnonymousAuthenticationProvider.incorrectKey=O AnonymousAuthenticationToken apresentado n\u00E3o cont\u00E9m a chave esperada
+BindAuthenticator.badCredentials=Usu\u00E1rio inexistente ou senha inv\u00E1lida
+BindAuthenticator.emptyPassword=Usu\u00E1rio inexistente ou senha inv\u00E1lida
+CasAuthenticationProvider.incorrectKey=O CasAuthenticationToken apresentado n\u00E3o cont\u00E9m a chave esperada
+CasAuthenticationProvider.noServiceTicket=N\u00E3o foi poss\u00EDvel prover um ticket de servi\u00E7o CAS para validar
+ConcurrentSessionControlStrategy.exceededAllowed=Excedidas as sess\u00F5es m\u00E1ximas de {0} para este usu\u00E1rio
+DigestAuthenticationFilter.incorrectRealm=Resposta realm de nome {0} n\u00E3o coincide com realm de sistema de nome {1}
+DigestAuthenticationFilter.incorrectResponse=Resposta incorreta
+DigestAuthenticationFilter.missingAuth=Valor digest obrigat\u00F3rio perdido para 'auth' QOP; header recibido {0}
+DigestAuthenticationFilter.missingMandatory=Valor digest obrigat\u00F3rio perdido; header recibido {0}
+DigestAuthenticationFilter.nonceCompromised=Nonce token comprometido {0}
+DigestAuthenticationFilter.nonceEncoding=Nonce n\u00E3o est\u00E1 codificado em Base64; nonce recibido {0}
+DigestAuthenticationFilter.nonceExpired=Nonce expirou/tempo esgotado
+DigestAuthenticationFilter.nonceNotNumeric=Nonce token deveria ter um primero token num\u00E9rico, mas tem {0}
+DigestAuthenticationFilter.nonceNotTwoTokens=Nonce token deveria ter dois tokens mas tem {0}
+DigestAuthenticationFilter.usernameNotFound=Usu\u00E1rio {0} n\u00E3o encontrado
+JdbcDaoImpl.noAuthority=Usu\u00E1rio {0} n\u00E3o tem permiss\u00E3o
+JdbcDaoImpl.notFound=Usu\u00E1rio {0} n\u00E3o encontrado
+LdapAuthenticationProvider.badCredentials=Usu\u00E1rio inexistente ou senha inv\u00E1lida
+LdapAuthenticationProvider.emptyUsername=Nome vazio n\u00E3o permitido
+LdapAuthenticationProvider.onlySupports=Somente UsernamePasswordAuthenticationToken \u00E9 suportado
+PasswordComparisonAuthenticator.badCredentials=Usu\u00E1rio inexistente ou senha inv\u00E1lida
+#PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound=Nenhum AuthenticationProvider encontrado para {0}
 RememberMeAuthenticationProvider.incorrectKey=O RememberMeAuthenticationToken apresentado n\u00E3o cont\u00E9m a chave esperada
 RunAsImplAuthenticationProvider.incorrectKey=O RunAsUserToken apresentado n\u00E3o cont\u00E9m a chave esperada
-DigestProcessingFilter.missingMandatory=Valor digest obrigat\u00F3rio perdido; header recibido {0}
-DigestProcessingFilter.missingAuth=Valor digest obrigat\u00F3rio perdido para 'auth' QOP; header recibido {0}
-DigestProcessingFilter.incorrectRealm=Resposta realm de nome {0} n\u00E3o coincide com realm de sistema de nome {1}
-DigestProcessingFilter.nonceExpired=Nonce expirou/tempo esgotado
-DigestProcessingFilter.nonceEncoding=Nonce n\u00E3o est\u00E1 codificado em Base64; nonce recibido {0}
-DigestProcessingFilter.nonceNotTwoTokens=Nonce token deveria ter dois tokens mas tem {0}
-DigestProcessingFilter.nonceNotNumeric=Nonce token deveria ter um primero token num\u00E9rico, mas tem {0}
-DigestProcessingFilter.nonceCompromised=Nonce token comprometido {0}
-DigestProcessingFilter.usernameNotFound=Usu\u00E1rio {0} n\u00E3o encontrado
-DigestProcessingFilter.incorrectResponse=Resposta incorreta
-JdbcDaoImpl.notFound=Usu\u00E1rio {0} n\u00E3o encontrado
-JdbcDaoImpl.noAuthority=Usu\u00E1rio {0} n\u00E3o tem permiss\u00E3o
-SwitchUserProcessingFilter.noCurrentUser=Nenhum usu\u00E1rio associado a esta requisi\u00E7\u00E3o
-SwitchUserProcessingFilter.noOriginalAuthentication=N\u00E3o foi poss\u00EDvel encontrar o objeto Authentication original
-SwitchUserProcessingFilter.usernameNotFound=Usu\u00E1rio {0} n\u00E3o encontrado
-SwitchUserProcessingFilter.locked=Conta bloqueada
-SwitchUserProcessingFilter.disabled=Usu\u00E1rio desabilitado
-SwitchUserProcessingFilter.expired=Conta expirada
-SwitchUserProcessingFilter.credentialsExpired=Credenciais expiradas
-AbstractAccessDecisionManager.accessDenied=Acesso negado
-LdapAuthenticationProvider.emptyUsername=Nome vazio n\u00E3o permitido
-LdapAuthenticationProvider.emptyPassword=Usu\u00E1rio inexistente ou senha inv\u00E1lida
-DefaultIntitalDirContextFactory.communicationFailure=N\u00E3o foi poss\u00EDvel conectar ao servidor LDAP
-DefaultIntitalDirContextFactory.badCredentials=Usu\u00E1rio inexistente ou senha inv\u00E1lida
-DefaultIntitalDirContextFactory.unexpectedException=Falha ao obter InitialDirContext devido a uma exce\u00E7\u00E3o n\u00E3o esperada
-PasswordComparisonAuthenticator.badCredentials=Usu\u00E1rio inexistente ou senha inv\u00E1lida
-BindAuthenticator.badCredentials=Usu\u00E1rio inexistente ou senha inv\u00E1lida
-BindAuthenticator.failedToLoadAttributes=Usu\u00E1rio inexistente ou senha inv\u00E1lida
-UserDetailsService.locked=Conta bloqueada
-UserDetailsService.disabled=Usu\u00E1rio desabilitado
-UserDetailsService.expired=Conta expirada
-UserDetailsService.credentialsExpired=Credenciais expiradas
-
+SubjectDnX509PrincipalExtractor.noMatching=Nenhum padr\u00E3o compat\u00EDvel foi encontrado em subjectDN\: {0}
+SwitchUserFilter.noCurrentUser=Nenhum usu\u00E1rio associado a esta requisi\u00E7\u00E3o
+SwitchUserFilter.noOriginalAuthentication=N\u00E3o foi poss\u00EDvel encontrar o objeto Authentication original
@@ -1,56 +1,44 @@
 # Spring Security Portuguese Resource Bundle
 # Author: José Santos
-
-AuthByAdapterProvider.incorrectKey=A implementação do AuthByAdapter especificado não contém a chave esperada
-BasicAclEntryAfterInvocationProvider.noPermission=A autenticação {0} não tem QUALQUER permissão para o objecto de domínio {1}
-BasicAclEntryAfterInvocationProvider.insufficientPermission=A autenticação {0} tem permissões ACL para o objecto de domínio {1}, mas não a permissão ACL requerida
-ConcurrentSessionControllerImpl.exceededAllowed=Número máximo de sessões ({0}) excedido para este utilizador
-ProviderManager.providerNotFound=Nenhum AuthenticationProvider encontrado para {0}
-AnonymousAuthenticationProvider.incorrectKey=O AnonymousAuthenticationToken especificado não contém a chave esperada
-CasAuthenticationProvider.incorrectKey=O CasAuthenticationToken especificado não contém a chave esperada
-CasAuthenticationProvider.noServiceTicket=Falha na obtenção de um ticket de serviço CAS de validação
-NamedCasProxyDecider.untrusted=O proxy mais próximo {0} não é fiável
-RejectProxyTickets.reject=Tickets proxy rejeitados
-AbstractSecurityInterceptor.authenticationNotFound=Objecto Authentication não encontrado em SecurityContext
-AbstractUserDetailsAuthenticationProvider.onlySupports=Apenas UsernamePasswordAuthenticationToken é suportado
-AbstractUserDetailsAuthenticationProvider.locked=A conta de utilizador está bloqueada
-AbstractUserDetailsAuthenticationProvider.disabled=O utilizador está desactivado
-AbstractUserDetailsAuthenticationProvider.expired=A conta de utilizador expirou
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=As credenciais do utilizador expiraram
-AbstractUserDetailsAuthenticationProvider.badCredentials=Credenciais inválidas
-X509AuthenticationProvider.certificateNull=Certificado nulo
-DaoX509AuthoritiesPopulator.noMatching=Formato do subjectDN {0} incorrecto
-RememberMeAuthenticationProvider.incorrectKey=O RememberMeAuthenticationToken especificado não contém a chave esperada
-RunAsImplAuthenticationProvider.incorrectKey=O RunAsUserToken especificado não contém a chave esperada
-DigestProcessingFilter.missingMandatory=Valor digest obrigatório em falta; cabeçalho recebido {0}
-DigestProcessingFilter.missingAuth=Valor digest obrigatório em falta para 'auth' QOP; cabeçalho recebido {0}
-DigestProcessingFilter.incorrectRealm=Nome de domínio na resposta {0} não corresponde ao nome de domínio do sistema {1}
-DigestProcessingFilter.nonceExpired=O nonce expirou
-DigestProcessingFilter.nonceEncoding=O nonce não está codificado em Base64; nonce recebido {0}
-DigestProcessingFilter.nonceNotTwoTokens=O nonce deve ser constituído por 2 tokens, não por {0}
-DigestProcessingFilter.nonceNotNumeric=O primeiro elemento do token nonce ({0}) deve ser numérico
-DigestProcessingFilter.nonceCompromised=Token nonce comprometido {0}
-DigestProcessingFilter.usernameNotFound=Nome de utilizador {0} não encontrado
-DigestProcessingFilter.incorrectResponse=Resposta incorrecta
-JdbcDaoImpl.notFound=Utilizador {0} não encontrado
-JdbcDaoImpl.noAuthority=Utilizador {0} não tem GrantedAuthority
-SwitchUserProcessingFilter.noCurrentUser=Nenhum utilizador associado a este pedido
-SwitchUserProcessingFilter.noOriginalAuthentication=Objecto Authentication original não encontrado
-SwitchUserProcessingFilter.usernameNotFound=Nome de utilizador {0} não encontrado
-SwitchUserProcessingFilter.locked=A conta de utilizador está bloqueada
-SwitchUserProcessingFilter.disabled=O utilizador está desactivado
-SwitchUserProcessingFilter.expired=A conta de utilizador expirou
-SwitchUserProcessingFilter.credentialsExpired=As credenciais do utilizador expiraram
 AbstractAccessDecisionManager.accessDenied=Acesso negado
-LdapAuthenticationProvider.emptyUsername=Nome de utilizador vazio não permitido
-LdapAuthenticationProvider.emptyPassword=Credenciais inválidas
-DefaultIntitalDirContextFactory.communicationFailure=Falha na ligação ao servidor LDAP
-DefaultIntitalDirContextFactory.badCredentials=Credenciais inválidas
-DefaultIntitalDirContextFactory.unexpectedException=Falha na obtenção do InitialDirContext devido a erro desconhecido
-PasswordComparisonAuthenticator.badCredentials=Credenciais inválidas
-BindAuthenticator.badCredentials=Credenciais inválidas
-BindAuthenticator.failedToLoadAttributes=Credenciais inválidas
-UserDetailsService.locked=A conta de utilizador está bloqueada
-UserDetailsService.disabled=O utilizador está desactivado
-UserDetailsService.expired=A conta de utilizador expirou
-UserDetailsService.credentialsExpired=As credenciais do utilizador expiraram
+AbstractSecurityInterceptor.authenticationNotFound=Objecto Authentication n\u00E3o encontrado em SecurityContext
+AbstractUserDetailsAuthenticationProvider.badCredentials=Credenciais inv\u00E1lidas
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=As credenciais do utilizador expiraram
+AbstractUserDetailsAuthenticationProvider.disabled=O utilizador est\u00E1 desactivado
+AbstractUserDetailsAuthenticationProvider.expired=A conta de utilizador expirou
+AbstractUserDetailsAuthenticationProvider.locked=A conta de utilizador est\u00E1 bloqueada
+AbstractUserDetailsAuthenticationProvider.onlySupports=Apenas UsernamePasswordAuthenticationToken \u00E9 suportado
+AccountStatusUserDetailsChecker.credentialsExpired=As credenciais do utilizador expiraram
+AccountStatusUserDetailsChecker.disabled=O utilizador est\u00E1 desactivado
+AccountStatusUserDetailsChecker.expired=A conta de utilizador expirou
+AccountStatusUserDetailsChecker.locked=A conta de utilizador est\u00E1 bloqueada
+AclEntryAfterInvocationProvider.noPermission=A autentica\u00E7\u00E3o {0} n\u00E3o tem QUALQUER permiss\u00E3o para o objecto de dom\u00EDnio {1}
+AnonymousAuthenticationProvider.incorrectKey=O AnonymousAuthenticationToken especificado n\u00E3o cont\u00E9m a chave esperada
+BindAuthenticator.badCredentials=Credenciais inv\u00E1lidas
+BindAuthenticator.emptyPassword=Credenciais inv\u00E1lidas
+CasAuthenticationProvider.incorrectKey=O CasAuthenticationToken especificado n\u00E3o cont\u00E9m a chave esperada
+CasAuthenticationProvider.noServiceTicket=Falha na obten\u00E7\u00E3o de um ticket de servi\u00E7o CAS de valida\u00E7\u00E3o
+ConcurrentSessionControlStrategy.exceededAllowed=N\u00FAmero m\u00E1ximo de sess\u00F5es ({0}) excedido para este utilizador
+DigestAuthenticationFilter.incorrectRealm=Nome de dom\u00EDnio na resposta {0} n\u00E3o corresponde ao nome de dom\u00EDnio do sistema {1}
+DigestAuthenticationFilter.incorrectResponse=Resposta incorrecta
+DigestAuthenticationFilter.missingAuth=Valor digest obrigat\u00F3rio em falta para 'auth' QOP; cabe\u00E7alho recebido {0}
+DigestAuthenticationFilter.missingMandatory=Valor digest obrigat\u00F3rio em falta; cabe\u00E7alho recebido {0}
+DigestAuthenticationFilter.nonceCompromised=Token nonce comprometido {0}
+DigestAuthenticationFilter.nonceEncoding=O nonce n\u00E3o est\u00E1 codificado em Base64; nonce recebido {0}
+DigestAuthenticationFilter.nonceExpired=O nonce expirou
+DigestAuthenticationFilter.nonceNotNumeric=O primeiro elemento do token nonce ({0}) deve ser num\u00E9rico
+DigestAuthenticationFilter.nonceNotTwoTokens=O nonce deve ser constitu\u00EDdo por 2 tokens, n\u00E3o por {0}
+DigestAuthenticationFilter.usernameNotFound=Nome de utilizador {0} n\u00E3o encontrado
+JdbcDaoImpl.noAuthority=Utilizador {0} n\u00E3o tem GrantedAuthority
+JdbcDaoImpl.notFound=Utilizador {0} n\u00E3o encontrado
+LdapAuthenticationProvider.badCredentials=Credenciais inv\u00E1lidas
+LdapAuthenticationProvider.emptyUsername=Nome de utilizador vazio n\u00E3o permitido
+LdapAuthenticationProvider.onlySupports=Apenas UsernamePasswordAuthenticationToken \u00E9 suportado
+PasswordComparisonAuthenticator.badCredentials=Credenciais inv\u00E1lidas
+#PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound=Nenhum AuthenticationProvider encontrado para {0}
+RememberMeAuthenticationProvider.incorrectKey=O RememberMeAuthenticationToken especificado n\u00E3o cont\u00E9m a chave esperada
+RunAsImplAuthenticationProvider.incorrectKey=O RunAsUserToken especificado n\u00E3o cont\u00E9m a chave esperada
+SubjectDnX509PrincipalExtractor.noMatching=Formato do subjectDN {0} incorrecto
+SwitchUserFilter.noCurrentUser=Nenhum utilizador associado a este pedido
+SwitchUserFilter.noOriginalAuthentication=Objecto Authentication original n\u00E3o encontrado
@@ -1,53 +1,42 @@
-AuthByAdapterProvider.incorrectKey=\u0414\u0430\u043D\u0430 \u0456\u043C\u043F\u043B\u0435\u043C\u0435\u043D\u0442\u0430\u0446\u0456\u044F AuthByAdapter \u043D\u0435 \u043C\u0456\u0441\u0442\u0438\u0442\u044C \u043E\u0447\u0456\u043A\u0443\u0432\u0430\u043D\u043E\u0433\u043E \u043A\u043B\u044E\u0447\u0430
-BasicAclEntryAfterInvocationProvider.noPermission=\u0410\u0443\u0442\u0435\u043D\u0442\u0438\u0444\u0456\u043A\u0430\u0446\u0456\u044F {0} \u043D\u0435 \u043C\u0430\u0454 \u0436\u043E\u0434\u043D\u043E\u0433\u043E \u0434\u043E\u0437\u0432\u043E\u043B\u0443 \u0434\u043B\u044F \u0434\u043E\u0441\u0442\u0443\u043F\u0443 \u0434\u043E \u043E\u0431'\u0454\u043A\u0442\u0443 \u0434\u043E\u043C\u0435\u043D\u0443 {1}
-BasicAclEntryAfterInvocationProvider.insufficientPermission=\u0410\u0443\u0442\u0435\u043D\u0442\u0438\u0444\u0456\u043A\u0430\u0446\u0456\u044F {0} \u043C\u0430\u0454 ACL \u0434\u043E\u0437\u0432\u043E\u043B\u0438, \u0430\u043B\u0435 \u043D\u0435 \u043C\u0430\u0454 \u043D\u0435\u043E\u0431\u0445\u0456\u0434\u043D\u043E\u0433\u043E \u0434\u043E\u0437\u0432\u043E\u043B\u0443 \u0434\u043B\u044F \u0434\u043E\u0441\u0442\u0443\u043F\u0443 \u0434\u043E \u043E\u0431'\u0454\u043A\u0442\u0443 \u0434\u043E\u043C\u0435\u043D\u0443 {1}
-ConcurrentSessionControllerImpl.exceededAllowed=\u041C\u0430\u043A\u0441\u0438\u043C\u0430\u043B\u044C\u043D\u0430 \u043A\u0456\u043B\u044C\u043A\u0456\u0441\u0442\u044C \u0441\u0435\u0441\u0456\u0439 ({0}) \u0434\u043B\u044F \u0446\u044C\u043E\u0433\u043E \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u043D\u0430
-ProviderManager.providerNotFound=AuthenticationProvider \u0434\u043B\u044F {0} \u043D\u0435 \u0437\u043D\u0430\u0439\u0434\u0435\u043D\u0438\u0439
-AnonymousAuthenticationProvider.incorrectKey=\u0414\u0430\u043D\u0438\u0439 AnonymousAuthenticationToken \u043D\u0435 \u043C\u0456\u0441\u0442\u0438\u0442\u044C \u043E\u0447\u0456\u043A\u0443\u0432\u0430\u043D\u043E\u0433\u043E \u043A\u043B\u044E\u0447\u0430
-CasAuthenticationProvider.incorrectKey=\u0414\u0430\u043D\u0438\u0439 CasAuthenticationToken \u043D\u0435 \u043C\u0456\u0441\u0442\u0438\u0442\u044C \u043E\u0447\u0456\u043A\u0443\u0432\u0430\u043D\u043E\u0433\u043E \u043A\u043B\u044E\u0447\u0430
-CasAuthenticationProvider.noServiceTicket=\u041D\u0435 \u043C\u043E\u0436\u043B\u0438\u0432\u043E \u043D\u0430\u0434\u0430\u0442\u0438 \u0431\u0456\u043B\u0435\u0442 \u0441\u0435\u0440\u0432\u0456\u0441\u0443 CAS \u0434\u043B\u044F \u0432\u0430\u043B\u0456\u0434\u0430\u0446\u0456\u0457
-NamedCasProxyDecider.untrusted=\u041D\u0430\u0439\u0431\u043B\u0438\u0436\u0447\u0438\u0439 \u043F\u0440\u043E\u043A\u0441\u0456-\u0441\u0435\u0440\u0432\u0435\u0440 {0} \u0454 \u043D\u0435\u043D\u0430\u0434\u0456\u0439\u043D\u0438\u043C
-RejectProxyTickets.reject=\u0411\u0456\u043B\u0435\u0442\u0438 \u043F\u0440\u043E\u043A\u0441\u0456-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0432\u0456\u0434\u0445\u0438\u043B\u0435\u043D\u0456
+AbstractAccessDecisionManager.accessDenied=\u0414\u043E\u0441\u0442\u0443\u043F \u0437\u0430\u0431\u043E\u0440\u043E\u043D\u0435\u043D\u0438\u0439
 AbstractSecurityInterceptor.authenticationNotFound=\u041E\u0431'\u0454\u043A\u0442 Authentication \u043D\u0435 \u0437\u043D\u0430\u0439\u0434\u0435\u043D\u0438\u0439 \u0432 SecurityContext
-AbstractUserDetailsAuthenticationProvider.onlySupports=\u0422\u0456\u043B\u044C\u043A\u0438 UsernamePasswordAuthenticationToken \u043F\u0456\u0434\u0442\u0440\u0438\u043C\u0443\u0454\u0442\u044C\u0441\u044F
-AbstractUserDetailsAuthenticationProvider.locked=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0437\u0430\u0431\u043B\u043E\u043A\u043E\u0432\u0430\u043D\u0438\u0439
+AbstractUserDetailsAuthenticationProvider.badCredentials=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=\u041F\u043E\u0432\u043D\u043E\u0432\u0430\u0436\u0435\u043D\u043D\u044F \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u043B\u0438 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
 AbstractUserDetailsAuthenticationProvider.disabled=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0437\u0430\u0431\u043E\u0440\u043E\u043D\u0435\u043D\u0438\u0439
 AbstractUserDetailsAuthenticationProvider.expired=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u0432 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=\u041F\u043E\u0432\u043D\u043E\u0432\u0430\u0436\u0435\u043D\u043D\u044F \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u043B\u0438 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
-AbstractUserDetailsAuthenticationProvider.badCredentials=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
-X509AuthenticationProvider.certificateNull=\u0421\u0435\u0440\u0442\u0438\u0444\u0456\u043A\u0430\u0442 \u043F\u043E\u0440\u043E\u0436\u043D\u0456\u0439
-DaoX509AuthoritiesPopulator.noMatching=\u041D\u0435 \u0437\u043D\u0430\u0439\u0434\u0435\u043D\u043E \u0432\u0456\u0434\u043F\u043E\u0432\u0456\u0434\u043D\u043E\u0433\u043E \u0448\u0430\u0431\u043B\u043E\u043D\u0443 \u0432 subjectDN: {0}
+AbstractUserDetailsAuthenticationProvider.locked=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0437\u0430\u0431\u043B\u043E\u043A\u043E\u0432\u0430\u043D\u0438\u0439
+AbstractUserDetailsAuthenticationProvider.onlySupports=\u0422\u0456\u043B\u044C\u043A\u0438 UsernamePasswordAuthenticationToken \u043F\u0456\u0434\u0442\u0440\u0438\u043C\u0443\u0454\u0442\u044C\u0441\u044F
+AccountStatusUserDetailsChecker.credentialsExpired=\u041F\u043E\u0432\u043D\u043E\u0432\u0430\u0436\u0435\u043D\u043D\u044F \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u043B\u0438 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
+AccountStatusUserDetailsChecker.disabled=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0437\u0430\u0431\u043E\u0440\u043E\u043D\u0435\u043D\u0438\u0439
+AccountStatusUserDetailsChecker.expired=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u0432 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
+AccountStatusUserDetailsChecker.locked=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0437\u0430\u0431\u043B\u043E\u043A\u043E\u0432\u0430\u043D\u0438\u0439
+AclEntryAfterInvocationProvider.noPermission=\u0410\u0443\u0442\u0435\u043D\u0442\u0438\u0444\u0456\u043A\u0430\u0446\u0456\u044F {0} \u043D\u0435 \u043C\u0430\u0454 \u0436\u043E\u0434\u043D\u043E\u0433\u043E \u0434\u043E\u0437\u0432\u043E\u043B\u0443 \u0434\u043B\u044F \u0434\u043E\u0441\u0442\u0443\u043F\u0443 \u0434\u043E \u043E\u0431'\u0454\u043A\u0442\u0443 \u0434\u043E\u043C\u0435\u043D\u0443 {1}
+AnonymousAuthenticationProvider.incorrectKey=\u0414\u0430\u043D\u0438\u0439 AnonymousAuthenticationToken \u043D\u0435 \u043C\u0456\u0441\u0442\u0438\u0442\u044C \u043E\u0447\u0456\u043A\u0443\u0432\u0430\u043D\u043E\u0433\u043E \u043A\u043B\u044E\u0447\u0430
+BindAuthenticator.badCredentials=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
+BindAuthenticator.emptyPassword=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
+CasAuthenticationProvider.incorrectKey=\u0414\u0430\u043D\u0438\u0439 CasAuthenticationToken \u043D\u0435 \u043C\u0456\u0441\u0442\u0438\u0442\u044C \u043E\u0447\u0456\u043A\u0443\u0432\u0430\u043D\u043E\u0433\u043E \u043A\u043B\u044E\u0447\u0430
+CasAuthenticationProvider.noServiceTicket=\u041D\u0435 \u043C\u043E\u0436\u043B\u0438\u0432\u043E \u043D\u0430\u0434\u0430\u0442\u0438 \u0431\u0456\u043B\u0435\u0442 \u0441\u0435\u0440\u0432\u0456\u0441\u0443 CAS \u0434\u043B\u044F \u0432\u0430\u043B\u0456\u0434\u0430\u0446\u0456\u0457
+ConcurrentSessionControlStrategy.exceededAllowed=\u041C\u0430\u043A\u0441\u0438\u043C\u0430\u043B\u044C\u043D\u0430 \u043A\u0456\u043B\u044C\u043A\u0456\u0441\u0442\u044C \u0441\u0435\u0441\u0456\u0439 ({0}) \u0434\u043B\u044F \u0446\u044C\u043E\u0433\u043E \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u043D\u0430
+DigestAuthenticationFilter.incorrectRealm=\u041D\u0430\u0437\u0432\u0430 \u0434\u043E\u043C\u0435\u043D\u0443 {0} \u0443 \u0432\u0456\u0434\u043F\u043E\u0432\u0456\u0434\u0456 \u043D\u0435 \u0432\u0456\u0434\u043F\u043E\u0432\u0456\u0434\u0430\u0454 \u043D\u0430\u0437\u0432\u0456 \u0434\u043E\u043C\u0435\u043D\u0443 {1} \u0432 \u0441\u0438\u0441\u0442\u0435\u043C\u0456
+DigestAuthenticationFilter.incorrectResponse=\u041D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0430 \u0432\u0456\u0434\u043F\u043E\u0432\u0456\u0434\u044C
+DigestAuthenticationFilter.missingAuth=\u0412\u0456\u0434\u0441\u0443\u0442\u043D\u0454 \u043E\u0431\u043E\u0432'\u044F\u0437\u043A\u043E\u0432\u0435 \u0437\u043D\u0430\u0447\u0435\u043D\u043D\u044F \u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442\u0430 \u0434\u043B\u044F 'auth' QOP; \u043E\u0442\u0440\u0438\u043C\u0430\u043D\u0438\u0439 \u0437\u0430\u0433\u043E\u043B\u043E\u0432\u043E\u043A {0}
+DigestAuthenticationFilter.missingMandatory=\u0412\u0456\u0434\u0441\u0443\u0442\u043D\u0454 \u043E\u0431\u043E\u0432'\u044F\u0437\u043A\u043E\u0432\u0435 \u0437\u043D\u0430\u0447\u0435\u043D\u043D\u044F \u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442\u0430; \u043E\u0442\u0440\u0438\u043C\u0430\u043D\u0438\u0439 \u0437\u0430\u0433\u043E\u043B\u043E\u0432\u043E\u043A {0}
+DigestAuthenticationFilter.nonceCompromised=\u041A\u043E\u0434 (nonce) \u0441\u043A\u043E\u043C\u043F\u0440\u043E\u043C\u0435\u0442\u043E\u0432\u0430\u043D\u0438\u0439 {0}
+DigestAuthenticationFilter.nonceEncoding=\u041A\u043E\u0434 (nonce) \u043D\u0435 \u0437\u0430\u0448\u0438\u0444\u0440\u043E\u0432\u0430\u043D\u0438\u0439 \u0432 Base64; \u043E\u0442\u0440\u0438\u043C\u0430\u043D\u0438\u0439 \u043A\u043E\u0434 {0}
+DigestAuthenticationFilter.nonceExpired=\u041A\u043E\u0434 (nonce) \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u0432 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
+DigestAuthenticationFilter.nonceNotNumeric=\u041F\u0435\u0440\u0448\u0438\u0439 \u0441\u0438\u043C\u0432\u043E\u043B (token) \u043A\u043E\u0434 \u043F\u043E\u0432\u0438\u043D\u0435\u043D \u043C\u0456\u0441\u0442\u0438\u0442\u0438 \u0446\u0438\u0444\u0440\u043E\u0432\u0435 \u0437\u043D\u0430\u0447\u0435\u043D\u043D\u044F, \u0430 \u043C\u0456\u0441\u0442\u0438\u0442\u044C\: {0}
+DigestAuthenticationFilter.nonceNotTwoTokens=\u041A\u043E\u0434 (nonce) \u043F\u043E\u0432\u0438\u043D\u0435\u043D \u043C\u0456\u0441\u0442\u0438\u0442\u0438 \u0434\u0432\u0430 \u0441\u0438\u043C\u0432\u043E\u043B\u0438 (tokens), \u0430\u043B\u0435 \u043C\u0456\u0441\u0442\u0438\u0442\u044C {0}
+DigestAuthenticationFilter.usernameNotFound=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 {0} \u043D\u0435 \u0437\u043D\u0430\u0439\u0434\u0435\u043D\u0438\u0439
+JdbcDaoImpl.noAuthority=\u041A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447 {0} \u043D\u0435 \u043C\u0430\u0454 \u043F\u043E\u0432\u043D\u043E\u0432\u0430\u0436\u0435\u043D\u044C (GrantedAuthority)
+JdbcDaoImpl.notFound=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 {0} \u043D\u0435 \u0437\u043D\u0430\u0439\u0434\u0435\u043D\u0438\u0439
+LdapAuthenticationProvider.badCredentials=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
+LdapAuthenticationProvider.emptyUsername=\u041F\u043E\u0440\u043E\u0436\u043D\u0454 \u0456\u043C'\u044F \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0454 \u0437\u0430\u0431\u043E\u0440\u043E\u043D\u0435\u043D\u0438\u043C
+LdapAuthenticationProvider.onlySupports=\u0422\u0456\u043B\u044C\u043A\u0438 UsernamePasswordAuthenticationToken \u043F\u0456\u0434\u0442\u0440\u0438\u043C\u0443\u0454\u0442\u044C\u0441\u044F
+PasswordComparisonAuthenticator.badCredentials=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
+#PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound=AuthenticationProvider \u0434\u043B\u044F {0} \u043D\u0435 \u0437\u043D\u0430\u0439\u0434\u0435\u043D\u0438\u0439
 RememberMeAuthenticationProvider.incorrectKey=\u0414\u0430\u043D\u0438\u0439 RememberMeAuthenticationToken \u043D\u0435 \u043C\u0456\u0441\u0442\u0438\u0442\u044C \u043E\u0447\u0456\u043A\u0443\u0432\u0430\u043D\u043E\u0433\u043E \u043A\u043B\u044E\u0447\u0430
 RunAsImplAuthenticationProvider.incorrectKey=\u0414\u0430\u043D\u0438\u0439 RunAsUserToken \u043D\u0435 \u043C\u0456\u0441\u0442\u0438\u0442\u044C \u043E\u0447\u0456\u043A\u0443\u0432\u0430\u043D\u043E\u0433\u043E \u043A\u043B\u044E\u0447\u0430
-DigestProcessingFilter.missingMandatory=\u0412\u0456\u0434\u0441\u0443\u0442\u043D\u0454 \u043E\u0431\u043E\u0432'\u044F\u0437\u043A\u043E\u0432\u0435 \u0437\u043D\u0430\u0447\u0435\u043D\u043D\u044F \u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442\u0430; \u043E\u0442\u0440\u0438\u043C\u0430\u043D\u0438\u0439 \u0437\u0430\u0433\u043E\u043B\u043E\u0432\u043E\u043A {0}
-DigestProcessingFilter.missingAuth=\u0412\u0456\u0434\u0441\u0443\u0442\u043D\u0454 \u043E\u0431\u043E\u0432'\u044F\u0437\u043A\u043E\u0432\u0435 \u0437\u043D\u0430\u0447\u0435\u043D\u043D\u044F \u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442\u0430 \u0434\u043B\u044F 'auth' QOP; \u043E\u0442\u0440\u0438\u043C\u0430\u043D\u0438\u0439 \u0437\u0430\u0433\u043E\u043B\u043E\u0432\u043E\u043A {0}
-DigestProcessingFilter.incorrectRealm=\u041D\u0430\u0437\u0432\u0430 \u0434\u043E\u043C\u0435\u043D\u0443 {0} \u0443 \u0432\u0456\u0434\u043F\u043E\u0432\u0456\u0434\u0456 \u043D\u0435 \u0432\u0456\u0434\u043F\u043E\u0432\u0456\u0434\u0430\u0454 \u043D\u0430\u0437\u0432\u0456 \u0434\u043E\u043C\u0435\u043D\u0443 {1} \u0432 \u0441\u0438\u0441\u0442\u0435\u043C\u0456
-DigestProcessingFilter.nonceExpired=\u041A\u043E\u0434 (nonce) \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u0432 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
-DigestProcessingFilter.nonceEncoding=\u041A\u043E\u0434 (nonce) \u043D\u0435 \u0437\u0430\u0448\u0438\u0444\u0440\u043E\u0432\u0430\u043D\u0438\u0439 \u0432 Base64; \u043E\u0442\u0440\u0438\u043C\u0430\u043D\u0438\u0439 \u043A\u043E\u0434 {0}
-DigestProcessingFilter.nonceNotTwoTokens=\u041A\u043E\u0434 (nonce) \u043F\u043E\u0432\u0438\u043D\u0435\u043D \u043C\u0456\u0441\u0442\u0438\u0442\u0438 \u0434\u0432\u0430 \u0441\u0438\u043C\u0432\u043E\u043B\u0438 (tokens), \u0430\u043B\u0435 \u043C\u0456\u0441\u0442\u0438\u0442\u044C {0}
-DigestProcessingFilter.nonceNotNumeric=\u041F\u0435\u0440\u0448\u0438\u0439 \u0441\u0438\u043C\u0432\u043E\u043B (token) \u043A\u043E\u0434 \u043F\u043E\u0432\u0438\u043D\u0435\u043D \u043C\u0456\u0441\u0442\u0438\u0442\u0438 \u0446\u0438\u0444\u0440\u043E\u0432\u0435 \u0437\u043D\u0430\u0447\u0435\u043D\u043D\u044F, \u0430 \u043C\u0456\u0441\u0442\u0438\u0442\u044C: {0}
-DigestProcessingFilter.nonceCompromised=\u041A\u043E\u0434 (nonce) \u0441\u043A\u043E\u043C\u043F\u0440\u043E\u043C\u0435\u0442\u043E\u0432\u0430\u043D\u0438\u0439 {0}
-DigestProcessingFilter.usernameNotFound=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 {0} \u043D\u0435 \u0437\u043D\u0430\u0439\u0434\u0435\u043D\u0438\u0439
-DigestProcessingFilter.incorrectResponse=\u041D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0430 \u0432\u0456\u0434\u043F\u043E\u0432\u0456\u0434\u044C
-JdbcDaoImpl.notFound=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 {0} \u043D\u0435 \u0437\u043D\u0430\u0439\u0434\u0435\u043D\u0438\u0439
-JdbcDaoImpl.noAuthority=\u041A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447 {0} \u043D\u0435 \u043C\u0430\u0454 \u043F\u043E\u0432\u043D\u043E\u0432\u0430\u0436\u0435\u043D\u044C (GrantedAuthority)
-SwitchUserProcessingFilter.noCurrentUser=\u041D\u0435\u043C\u0430\u0454 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430, \u043F\u043E\u0432'\u044F\u0437\u0430\u043D\u043E\u0433\u043E \u0456\u0437 \u0434\u0430\u043D\u0438\u043C \u0437\u0430\u043F\u0438\u0442\u043E\u043C
-SwitchUserProcessingFilter.noOriginalAuthentication=\u041D\u0435 \u043C\u043E\u0436\u043B\u0438\u0432\u043E \u0437\u043D\u0430\u0439\u0442\u0438 \u043E\u0440\u0438\u0433\u0456\u043D\u0430\u043B\u044C\u043D\u0438\u0439 \u043E\u0431'\u0454\u043A\u0442 Authentication
-SwitchUserProcessingFilter.usernameNotFound=\u0406\u043C'\u044F \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 {0} \u043D\u0435 \u0437\u043D\u0430\u0439\u0434\u0435\u043D\u0435
-SwitchUserProcessingFilter.locked=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0437\u0430\u0431\u043B\u043E\u043A\u043E\u0432\u0430\u043D\u0438\u0439
-SwitchUserProcessingFilter.disabled=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0437\u0430\u0431\u043E\u0440\u043E\u043D\u0435\u043D\u0438\u0439
-SwitchUserProcessingFilter.expired=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u0432 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
-SwitchUserProcessingFilter.credentialsExpired=\u041F\u043E\u0432\u043D\u043E\u0432\u0430\u0436\u0435\u043D\u043D\u044F \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u043B\u0438 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
-AbstractAccessDecisionManager.accessDenied=\u0414\u043E\u0441\u0442\u0443\u043F \u0437\u0430\u0431\u043E\u0440\u043E\u043D\u0435\u043D\u0438\u0439
-LdapAuthenticationProvider.emptyUsername=\u041F\u043E\u0440\u043E\u0436\u043D\u0454 \u0456\u043C'\u044F \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0454 \u0437\u0430\u0431\u043E\u0440\u043E\u043D\u0435\u043D\u0438\u043C
-LdapAuthenticationProvider.emptyPassword=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
-DefaultIntitalDirContextFactory.communicationFailure=\u041D\u0435\u043C\u043E\u0436\u043B\u0438\u0432\u043E \u0437'\u0454\u0434\u043D\u0430\u0442\u0438\u0441\u044F \u0437  LDAP \u0441\u0435\u0440\u0432\u0435\u0440\u043E\u043C
-DefaultIntitalDirContextFactory.badCredentials=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
-DefaultIntitalDirContextFactory.unexpectedException=\u041D\u0435\u043C\u043E\u0436\u043B\u0438\u0432\u043E \u043E\u0442\u0440\u0438\u043C\u0430\u0442\u0438 InitialDirContext \u0447\u0435\u0440\u0435\u0437 \u0432\u0438\u043D\u0438\u043A\u043D\u0435\u043D\u043D\u044F \u043D\u0435\u043E\u0447\u0456\u043A\u0443\u0432\u0430\u043D\u043E\u0457 \u043F\u043E\u043C\u0438\u043B\u043A\u0438
-PasswordComparisonAuthenticator.badCredentials=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
-BindAuthenticator.badCredentials=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
-BindAuthenticator.failedToLoadAttributes=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
-UserDetailsService.locked=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0437\u0430\u0431\u043B\u043E\u043A\u043E\u0432\u0430\u043D\u0438\u0439
-UserDetailsService.disabled=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0437\u0430\u0431\u043E\u0440\u043E\u043D\u0435\u043D\u0438\u0439
-UserDetailsService.expired=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u0432 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
-UserDetailsService.credentialsExpired=\u041F\u043E\u0432\u043D\u043E\u0432\u0430\u0436\u0435\u043D\u043D\u044F \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u043B\u0438 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
+SubjectDnX509PrincipalExtractor.noMatching=\u041D\u0435 \u0437\u043D\u0430\u0439\u0434\u0435\u043D\u043E \u0432\u0456\u0434\u043F\u043E\u0432\u0456\u0434\u043D\u043E\u0433\u043E \u0448\u0430\u0431\u043B\u043E\u043D\u0443 \u0432 subjectDN\: {0}
+SwitchUserFilter.noCurrentUser=\u041D\u0435\u043C\u0430\u0454 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430, \u043F\u043E\u0432'\u044F\u0437\u0430\u043D\u043E\u0433\u043E \u0456\u0437 \u0434\u0430\u043D\u0438\u043C \u0437\u0430\u043F\u0438\u0442\u043E\u043C
+SwitchUserFilter.noOriginalAuthentication=\u041D\u0435 \u043C\u043E\u0436\u043B\u0438\u0432\u043E \u0437\u043D\u0430\u0439\u0442\u0438 \u043E\u0440\u0438\u0433\u0456\u043D\u0430\u043B\u044C\u043D\u0438\u0439 \u043E\u0431'\u0454\u043A\u0442 Authentication
@@ -1,54 +1,42 @@
-AuthByAdapterProvider.incorrectKey=\u5c55\u793a\u7684AuthByAdapter\u5b9e\u73b0\u4e0d\u542b\u6709\u9884\u671f\u7684key
-BasicAclEntryAfterInvocationProvider.noPermission=\u7ed9\u5b9a\u7684Authentication\u5bf9\u8c61({0})\u6839\u672c\u65e0\u6743\u64cd\u63a7\u9886\u57df\u5bf9\u8c61({1})
-BasicAclEntryAfterInvocationProvider.insufficientPermission=Authentication\u5bf9\u8c61({0})\u786e\u5b9e\u542b\u6709ACL\u6743\u9650\uff0c\u4f46\u5e76\u4e0d\u662f\u76ee\u6807\u9886\u57df\u5bf9\u8c61\u6240\u8981\u6c42\u7684({1})
-ConcurrentSessionControllerImpl.exceededAllowed=\u5df2\u7ecf\u8d85\u8fc7\u4e86\u5f53\u524d\u4e3b\u4f53({0})\u88ab\u5141\u8bb8\u7684\u6700\u5927\u4f1a\u8bdd\u6570\u91cf
-ProviderManager.providerNotFound=\u672a\u67e5\u627e\u5230\u9488\u5bf9{0}\u7684AuthenticationProvider
-AnonymousAuthenticationProvider.incorrectKey=\u5c55\u793a\u7684AnonymousAuthenticationToken\u4e0d\u542b\u6709\u9884\u671f\u7684key
-CasAuthenticationProvider.incorrectKey=\u5c55\u793a\u7684CasAuthenticationToken\u4e0d\u542b\u6709\u9884\u671f\u7684key
-CasAuthenticationProvider.noServiceTicket=\u672a\u80fd\u591f\u6b63\u786e\u63d0\u4f9b\u5f85\u9a8c\u8bc1\u7684CAS\u670d\u52a1\u7968\u6839
-NamedCasProxyDecider.untrusted=\u4ee3\u7406({0})\u4e0d\u53d7\u4fe1\u4efb
-RejectProxyTickets.reject=Proxy\u7968\u6839\u88ab\u62d2\u7edd
-AbstractSecurityInterceptor.authenticationNotFound=\u672a\u5728SecurityContext\u4e2d\u67e5\u627e\u5230\u8ba4\u8bc1\u5bf9\u8c61
-AbstractUserDetailsAuthenticationProvider.onlySupports=\u4ec5\u4ec5\u652f\u6301UsernamePasswordAuthenticationToken
-AbstractUserDetailsAuthenticationProvider.locked=\u7528\u6237\u5e10\u53f7\u5df2\u88ab\u9501\u5b9a
-AbstractUserDetailsAuthenticationProvider.disabled=\u7528\u6237\u5df2\u5931\u6548
-AbstractUserDetailsAuthenticationProvider.expired=\u7528\u6237\u5e10\u53f7\u5df2\u8fc7\u671f
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=\u7528\u6237\u51ed\u8bc1\u5df2\u8fc7\u671f
-AbstractUserDetailsAuthenticationProvider.badCredentials=\u574f\u7684\u51ed\u8bc1
-X509AuthenticationProvider.certificateNull=\u672a\u63d0\u4f9b\u8bc1\u4e66
-DaoX509AuthoritiesPopulator.noMatching=\u672a\u5728subjectDN: {0}\u4e2d\u627e\u5230\u5339\u914d\u7684\u6a21\u5f0f
-RememberMeAuthenticationProvider.incorrectKey=\u5c55\u793aRememberMeAuthenticationToken\u4e0d\u542b\u6709\u9884\u671f\u7684key
-RunAsImplAuthenticationProvider.incorrectKey=\u5c55\u793a\u7684RunAsUserToken\u4e0d\u542b\u6709\u9884\u671f\u7684key
-DigestProcessingFilter.missingMandatory=\u9057\u6f0f\u4e86\u5fc5\u987b\u7ed9\u5b9a\u7684\u6458\u8981\u53d6\u503c; \u63a5\u6536\u5230\u7684\u5934\u4fe1\u606f\u4e3a{0}
-DigestProcessingFilter.missingAuth=\u9057\u6f0f\u4e86\u9488\u5bf9'auth' QOP\u7684\u3001\u5fc5\u987b\u7ed9\u5b9a\u7684\u6458\u8981\u53d6\u503c; \u63a5\u6536\u5230\u7684\u5934\u4fe1\u606f\u4e3a{0}
-DigestProcessingFilter.incorrectRealm=\u54cd\u5e94\u7ed3\u679c\u4e2d\u7684Realm\u540d\u5b57({0})\u540c\u7cfb\u7edf\u6307\u5b9a\u7684Realm\u540d\u5b57({1})\u4e0d\u543b\u5408
-DigestProcessingFilter.nonceExpired=Nonce\u5df2\u7ecf\u8fc7\u671f/\u8d85\u65f6
-DigestProcessingFilter.nonceEncoding=Nonce\u672a\u7ecf\u8fc7Base64\u7f16\u7801; \u76f8\u5e94\u7684nonce\u53d6\u503c\u4e3a {0}
-DigestProcessingFilter.nonceNotTwoTokens=Nonce\u5e94\u8be5\u7531\u4e24\u90e8\u5206\u53d6\u503c\u6784\u6210\uff0c\u4f46\u7ed3\u679c\u5374\u662f{0}
-DigestProcessingFilter.nonceNotNumeric=Nonce\u4ee4\u724c\u7684\u7b2c1\u90e8\u5206\u5e94\u8be5\u662f\u6570\u5b57\uff0c\u4f46\u7ed3\u679c\u5374\u662f{0}
-DigestProcessingFilter.nonceCompromised=Nonce\u4ee4\u724c\u5df2\u7ecf\u5b58\u5728\u95ee\u9898\u4e86\uff0c{0}
-DigestProcessingFilter.usernameNotFound=\u7528\u6237\u540d{0}\u672a\u627e\u5230
-DigestProcessingFilter.incorrectResponse=\u9519\u8bef\u7684\u54cd\u5e94\u7ed3\u679c
-JdbcDaoImpl.notFound=\u672a\u627e\u5230\u7528\u6237{0}
-JdbcDaoImpl.noAuthority=\u6ca1\u6709\u4e3a\u7528\u6237{0}\u6307\u5b9a\u89d2\u8272
-SwitchUserProcessingFilter.noCurrentUser=\u4e0d\u5b58\u5728\u5f53\u524d\u7528\u6237
-SwitchUserProcessingFilter.noOriginalAuthentication=\u4e0d\u80fd\u591f\u67e5\u627e\u5230\u539f\u5148\u7684\u5df2\u8ba4\u8bc1\u5bf9\u8c61
-SwitchUserProcessingFilter.usernameNotFound=\u7528\u6237\u540d{0}\u672a\u627e\u5230
-SwitchUserProcessingFilter.locked=\u7528\u6237\u5e10\u53f7\u5df2\u88ab\u9501\u5b9a
-SwitchUserProcessingFilter.disabled=\u7528\u6237\u5df2\u5931\u6548
-SwitchUserProcessingFilter.expired=\u7528\u6237\u5e10\u53f7\u5df2\u8fc7\u671f
-SwitchUserProcessingFilter.credentialsExpired=\u7528\u6237\u51ed\u8bc1\u5df2\u8fc7\u671f
-AbstractAccessDecisionManager.accessDenied=\u4e0d\u5141\u8bb8\u8bbf\u95ee
-LdapAuthenticationProvider.emptyUsername=\u7528\u6237\u540d\u4e0d\u5141\u8bb8\u4e3a\u7a7a
-LdapAuthenticationProvider.emptyPassword=\u574f\u7684\u51ed\u8bc1
-DefaultIntitalDirContextFactory.communicationFailure=\u4e0d\u80fd\u591f\u8fde\u63a5\u5230LDAP\u670d\u52a1\u5668
-DefaultIntitalDirContextFactory.badCredentials=\u574f\u7684\u51ed\u8bc1
-DefaultIntitalDirContextFactory.unexpectedException=\u7531\u4e8e\u672a\u9884\u671f\u5f02\u5e38\u800c\u4e0d\u80fd\u591f\u83b7\u5f97InitialDirContext
-PasswordComparisonAuthenticator.badCredentials=\u574f\u7684\u51ed\u8bc1
-BindAuthenticator.badCredentials=\u574f\u7684\u51ed\u8bc1
-BindAuthenticator.failedToLoadAttributes=\u574f\u7684\u51ed\u8bc1
-UserDetailsService.locked=\u7528\u6237\u5e10\u53f7\u5df2\u88ab\u9501\u5b9a
-UserDetailsService.disabled=\u7528\u6237\u5df2\u5931\u6548
-UserDetailsService.expired=\u7528\u6237\u5e10\u53f7\u5df2\u8fc7\u671f
-UserDetailsService.credentialsExpired=\u7528\u6237\u51ed\u8bc1\u5df2\u8fc7\u671f
-
+AbstractAccessDecisionManager.accessDenied=\u4E0D\u5141\u8BB8\u8BBF\u95EE
+AbstractSecurityInterceptor.authenticationNotFound=\u672A\u5728SecurityContext\u4E2D\u67E5\u627E\u5230\u8BA4\u8BC1\u5BF9\u8C61
+AbstractUserDetailsAuthenticationProvider.badCredentials=\u574F\u7684\u51ED\u8BC1
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=\u7528\u6237\u51ED\u8BC1\u5DF2\u8FC7\u671F
+AbstractUserDetailsAuthenticationProvider.disabled=\u7528\u6237\u5DF2\u5931\u6548
+AbstractUserDetailsAuthenticationProvider.expired=\u7528\u6237\u5E10\u53F7\u5DF2\u8FC7\u671F
+AbstractUserDetailsAuthenticationProvider.locked=\u7528\u6237\u5E10\u53F7\u5DF2\u88AB\u9501\u5B9A
+AbstractUserDetailsAuthenticationProvider.onlySupports=\u4EC5\u4EC5\u652F\u6301UsernamePasswordAuthenticationToken
+AccountStatusUserDetailsChecker.credentialsExpired=\u7528\u6237\u51ED\u8BC1\u5DF2\u8FC7\u671F
+AccountStatusUserDetailsChecker.disabled=\u7528\u6237\u5DF2\u5931\u6548
+AccountStatusUserDetailsChecker.expired=\u7528\u6237\u5E10\u53F7\u5DF2\u8FC7\u671F
+AccountStatusUserDetailsChecker.locked=\u7528\u6237\u5E10\u53F7\u5DF2\u88AB\u9501\u5B9A
+AclEntryAfterInvocationProvider.noPermission=\u7ED9\u5B9A\u7684Authentication\u5BF9\u8C61({0})\u6839\u672C\u65E0\u6743\u64CD\u63A7\u9886\u57DF\u5BF9\u8C61({1})
+AnonymousAuthenticationProvider.incorrectKey=\u5C55\u793A\u7684AnonymousAuthenticationToken\u4E0D\u542B\u6709\u9884\u671F\u7684key
+BindAuthenticator.badCredentials=\u574F\u7684\u51ED\u8BC1
+BindAuthenticator.emptyPassword=\u574F\u7684\u51ED\u8BC1
+CasAuthenticationProvider.incorrectKey=\u5C55\u793A\u7684CasAuthenticationToken\u4E0D\u542B\u6709\u9884\u671F\u7684key
+CasAuthenticationProvider.noServiceTicket=\u672A\u80FD\u591F\u6B63\u786E\u63D0\u4F9B\u5F85\u9A8C\u8BC1\u7684CAS\u670D\u52A1\u7968\u6839
+ConcurrentSessionControlStrategy.exceededAllowed=\u5DF2\u7ECF\u8D85\u8FC7\u4E86\u5F53\u524D\u4E3B\u4F53({0})\u88AB\u5141\u8BB8\u7684\u6700\u5927\u4F1A\u8BDD\u6570\u91CF
+DigestAuthenticationFilter.incorrectRealm=\u54CD\u5E94\u7ED3\u679C\u4E2D\u7684Realm\u540D\u5B57({0})\u540C\u7CFB\u7EDF\u6307\u5B9A\u7684Realm\u540D\u5B57({1})\u4E0D\u543B\u5408
+DigestAuthenticationFilter.incorrectResponse=\u9519\u8BEF\u7684\u54CD\u5E94\u7ED3\u679C
+DigestAuthenticationFilter.missingAuth=\u9057\u6F0F\u4E86\u9488\u5BF9'auth' QOP\u7684\u3001\u5FC5\u987B\u7ED9\u5B9A\u7684\u6458\u8981\u53D6\u503C; \u63A5\u6536\u5230\u7684\u5934\u4FE1\u606F\u4E3A{0}
+DigestAuthenticationFilter.missingMandatory=\u9057\u6F0F\u4E86\u5FC5\u987B\u7ED9\u5B9A\u7684\u6458\u8981\u53D6\u503C; \u63A5\u6536\u5230\u7684\u5934\u4FE1\u606F\u4E3A{0}
+DigestAuthenticationFilter.nonceCompromised=Nonce\u4EE4\u724C\u5DF2\u7ECF\u5B58\u5728\u95EE\u9898\u4E86\uFF0C{0}
+DigestAuthenticationFilter.nonceEncoding=Nonce\u672A\u7ECF\u8FC7Base64\u7F16\u7801; \u76F8\u5E94\u7684nonce\u53D6\u503C\u4E3A {0}
+DigestAuthenticationFilter.nonceExpired=Nonce\u5DF2\u7ECF\u8FC7\u671F/\u8D85\u65F6
+DigestAuthenticationFilter.nonceNotNumeric=Nonce\u4EE4\u724C\u7684\u7B2C1\u90E8\u5206\u5E94\u8BE5\u662F\u6570\u5B57\uFF0C\u4F46\u7ED3\u679C\u5374\u662F{0}
+DigestAuthenticationFilter.nonceNotTwoTokens=Nonce\u5E94\u8BE5\u7531\u4E24\u90E8\u5206\u53D6\u503C\u6784\u6210\uFF0C\u4F46\u7ED3\u679C\u5374\u662F{0}
+DigestAuthenticationFilter.usernameNotFound=\u7528\u6237\u540D{0}\u672A\u627E\u5230
+JdbcDaoImpl.noAuthority=\u6CA1\u6709\u4E3A\u7528\u6237{0}\u6307\u5B9A\u89D2\u8272
+JdbcDaoImpl.notFound=\u672A\u627E\u5230\u7528\u6237{0}
+LdapAuthenticationProvider.badCredentials=\u574F\u7684\u51ED\u8BC1
+LdapAuthenticationProvider.emptyUsername=\u7528\u6237\u540D\u4E0D\u5141\u8BB8\u4E3A\u7A7A
+LdapAuthenticationProvider.onlySupports=\u4EC5\u4EC5\u652F\u6301UsernamePasswordAuthenticationToken
+PasswordComparisonAuthenticator.badCredentials=\u574F\u7684\u51ED\u8BC1
+#PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound=\u672A\u67E5\u627E\u5230\u9488\u5BF9{0}\u7684AuthenticationProvider
+RememberMeAuthenticationProvider.incorrectKey=\u5C55\u793ARememberMeAuthenticationToken\u4E0D\u542B\u6709\u9884\u671F\u7684key
+RunAsImplAuthenticationProvider.incorrectKey=\u5C55\u793A\u7684RunAsUserToken\u4E0D\u542B\u6709\u9884\u671F\u7684key
+SubjectDnX509PrincipalExtractor.noMatching=\u672A\u5728subjectDN\: {0}\u4E2D\u627E\u5230\u5339\u914D\u7684\u6A21\u5F0F
+SwitchUserFilter.noCurrentUser=\u4E0D\u5B58\u5728\u5F53\u524D\u7528\u6237
+SwitchUserFilter.noOriginalAuthentication=\u4E0D\u80FD\u591F\u67E5\u627E\u5230\u539F\u5148\u7684\u5DF2\u8BA4\u8BC1\u5BF9\u8C61
@@ -1,12 +1,16 @@
 package org.springframework.security.access.expression;

 import static org.junit.Assert.*;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;

 import java.util.Collection;

 import org.junit.Test;
 import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
+import org.springframework.security.authentication.AuthenticationTrustResolver;
 import org.springframework.security.authentication.TestingAuthenticationToken;
+import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.AuthorityUtils;

@@ -16,11 +20,30 @@ import org.springframework.security.core.authority.AuthorityUtils;
 * @since 3.0
 */
 public class SecurityExpressionRootTests {
+    private final Authentication JOE = new TestingAuthenticationToken("joe", "pass", "A", "B");
+
+    @Test
+    public void denyAllIsFalsePermitAllTrue() throws Exception {
+        SecurityExpressionRoot root = new SecurityExpressionRoot(JOE) {};
+        assertFalse(root.denyAll());
+        assertFalse(root.denyAll);
+        assertTrue(root.permitAll());
+        assertTrue(root.permitAll);
+    }
+
+    @Test
+    public void rememberMeIsCorrectlyDetected() throws Exception {
+        SecurityExpressionRoot root = new SecurityExpressionRoot(JOE) {};
+        AuthenticationTrustResolver atr = mock(AuthenticationTrustResolver.class);
+        root.setTrustResolver(atr);
+        when(atr.isRememberMe(JOE)).thenReturn(true);
+        assertTrue(root.isRememberMe());
+        assertFalse(root.isFullyAuthenticated());
+    }

    @Test
    public void roleHierarchySupportIsCorrectlyUsedInEvaluatingRoles() throws Exception {
-        SecurityExpressionRoot root =
-            new SecurityExpressionRoot(new TestingAuthenticationToken("joe", "pass", "A", "B")) {};
+        SecurityExpressionRoot root = new SecurityExpressionRoot(JOE) {};

        root.setRoleHierarchy(new RoleHierarchy() {
            public Collection<GrantedAuthority> getReachableGrantedAuthorities(Collection<GrantedAuthority> authorities) {
@@ -29,9 +52,11 @@ public class SecurityExpressionRootTests {
        });

        assertTrue(root.hasRole("C"));
+        assertTrue(root.hasAuthority("C"));
        assertFalse(root.hasRole("A"));
        assertFalse(root.hasRole("B"));
        assertTrue(root.hasAnyRole("C", "A", "B"));
+        assertTrue(root.hasAnyAuthority("C", "A", "B"));
        assertFalse(root.hasAnyRole("A", "B"));
    }
 }
@@ -14,6 +14,7 @@

 package org.springframework.security.access.hierarchicalroles;

+import java.util.ArrayList;
 import java.util.List;

 import junit.framework.TestCase;
@@ -30,6 +31,19 @@ import org.springframework.security.core.authority.AuthorityUtils;
 */
 public class RoleHierarchyImplTests extends TestCase {

+    public void testRoleHierarchyWithNullOrEmptyAuthorities() {
+        List<GrantedAuthority> authorities0 = null;
+        List<GrantedAuthority> authorities1 = new ArrayList<GrantedAuthority>();
+
+        RoleHierarchyImpl roleHierarchyImpl = new RoleHierarchyImpl();
+        roleHierarchyImpl.setHierarchy("ROLE_A > ROLE_B");
+
+        assertNotNull(roleHierarchyImpl.getReachableGrantedAuthorities(authorities0));
+        assertEquals(0, roleHierarchyImpl.getReachableGrantedAuthorities(authorities0).size());
+        assertNotNull(roleHierarchyImpl.getReachableGrantedAuthorities(authorities1));
+        assertEquals(0, roleHierarchyImpl.getReachableGrantedAuthorities(authorities1).size());
+    }
+
    public void testSimpleRoleHierarchy() {

        List<GrantedAuthority> authorities0 = AuthorityUtils.createAuthorityList("ROLE_0");
@@ -15,8 +15,7 @@

 package org.springframework.security.access.intercept;

-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.*;

 import java.util.List;

@@ -24,8 +23,8 @@ import org.aopalliance.intercept.MethodInvocation;
 import org.junit.Test;
 import org.springframework.security.access.ConfigAttribute;
 import org.springframework.security.access.SecurityConfig;
-import org.springframework.security.access.intercept.InterceptorStatusToken;
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.util.SimpleMethodInvocation;


@@ -40,12 +39,12 @@ public class InterceptorStatusTokenTests {
    public void testOperation() {
        List<ConfigAttribute> attr = SecurityConfig.createList("FOO");
        MethodInvocation mi = new SimpleMethodInvocation();
-        InterceptorStatusToken token = new InterceptorStatusToken(new UsernamePasswordAuthenticationToken("rod",
-                    "koala"), true, attr, mi);
+        SecurityContext ctx = SecurityContextHolder.createEmptyContext();
+        InterceptorStatusToken token = new InterceptorStatusToken(ctx, true, attr, mi);

        assertTrue(token.isContextHolderRefreshRequired());
        assertEquals(attr, token.getAttributes());
        assertEquals(mi, token.getSecureObject());
-        assertEquals("rod", token.getAuthentication().getPrincipal());
+        assertSame(ctx, token.getSecurityContext());
    }
 }
@@ -84,6 +84,14 @@ public class RunAsUserTokenTests extends TestCase {
        RunAsUserToken token = new RunAsUserToken("my_password", "Test", "Password",
                new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_ONE"), new GrantedAuthorityImpl("ROLE_TWO")},
                UsernamePasswordAuthenticationToken.class);
-        assertTrue(token.toString().lastIndexOf("Original Class:") != -1);
+        assertTrue(token.toString().lastIndexOf("Original Class: "+UsernamePasswordAuthenticationToken.class.getName().toString()) != -1);
+    }
+
+    // SEC-1792
+    public void testToStringNullOriginalAuthentication() {
+        RunAsUserToken token = new RunAsUserToken("my_password", "Test", "Password",
+                new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_ONE"), new GrantedAuthorityImpl("ROLE_TWO")},
+                null);
+        assertTrue(token.toString().lastIndexOf("Original Class: null") != -1);
    }
 }
@@ -15,8 +15,7 @@

 package org.springframework.security.access.intercept.aopalliance;

-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.*;

 import java.util.List;

@@ -44,6 +43,7 @@ import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;

 /**
@@ -276,7 +276,8 @@ public class MethodSecurityInterceptorTests {

    @Test
    public void runAsReplacementIsCorrectlySet() throws Exception {
-        SecurityContextHolder.getContext().setAuthentication(token);
+        SecurityContext ctx = SecurityContextHolder.getContext();
+        ctx.setAuthentication(token);
        token.setAuthenticated(true);
        final RunAsManager runAs = jmock.mock(RunAsManager.class);
        final RunAsUserToken runAsToken =
@@ -292,7 +293,8 @@ public class MethodSecurityInterceptorTests {
        String result = advisedTarget.makeUpperCase("hello");
        assertEquals("HELLO org.springframework.security.access.intercept.RunAsUserToken true", result);
        // Check we've changed back
-        assertEquals(token, SecurityContextHolder.getContext().getAuthentication());
+        assertSame(ctx, SecurityContextHolder.getContext());
+        assertSame(token, SecurityContextHolder.getContext().getAuthentication());
    }

    @Test(expected=AuthenticationCredentialsNotFoundException.class)
@@ -0,0 +1,33 @@
+package org.springframework.security.authentication.encoding;
+
+import static org.junit.Assert.*;
+
+import org.junit.Test;
+/**
+ * @author Rob Winch
+ */
+public class PasswordEncoderUtilsTests {
+
+    @Test
+    public void differentLength() {
+        assertFalse(PasswordEncoderUtils.equals("abc", "a"));
+        assertFalse(PasswordEncoderUtils.equals("a", "abc"));
+    }
+
+    @Test
+    public void equalsNull() {
+        assertFalse(PasswordEncoderUtils.equals(null, "a"));
+        assertFalse(PasswordEncoderUtils.equals("a", null));
+        assertTrue(PasswordEncoderUtils.equals(null, null));
+    }
+
+    @Test
+    public void equalsCaseSensitive() {
+        assertFalse(PasswordEncoderUtils.equals("aBc", "abc"));
+    }
+
+    @Test
+    public void equalsSuccess() {
+        assertTrue(PasswordEncoderUtils.equals("abcdef", "abcdef"));
+    }
+}
@@ -179,7 +179,7 @@ public class JaasAuthenticationProviderTests {

    @Test
    public void testFull() throws Exception {
-        List<GrantedAuthority> defaultAuths = AuthorityUtils.createAuthorityList("ROLE_ONE", "ROLE_TWO");
+        List<GrantedAuthority> defaultAuths = AuthorityUtils.createAuthorityList("ROLE_ONE");
        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("user", "password",
                defaultAuths);

@@ -196,8 +196,7 @@ public class JaasAuthenticationProviderTests {

        assertTrue("GrantedAuthorities should contain ROLE_TEST1", list.contains(new GrantedAuthorityImpl("ROLE_TEST1")));
        assertTrue("GrantedAuthorities should contain ROLE_TEST2", list.contains(new GrantedAuthorityImpl("ROLE_TEST2")));
-        assertTrue("GrantedAuthorities should contain ROLE_1", list.contains(defaultAuths.get(0)));
-        assertTrue("GrantedAuthorities should contain ROLE_2", list.contains(defaultAuths.get(1)));
+        assertFalse("GrantedAuthorities should not contain ROLE_ONE", list.contains(defaultAuths.get(0)));

        boolean foundit = false;

@@ -32,7 +32,7 @@ public class SpringSecurityMessageSourceTests extends TestCase {

    public void testOperation() {
        SpringSecurityMessageSource msgs = new SpringSecurityMessageSource();
-        assertEquals("Proxy\u7968\u6839\u88ab\u62d2\u7edd", msgs.getMessage("RejectProxyTickets.reject", null, Locale.SIMPLIFIED_CHINESE));
+        assertEquals("\u4E0D\u5141\u8BB8\u8BBF\u95EE", msgs.getMessage("AbstractAccessDecisionManager.accessDenied", null, Locale.SIMPLIFIED_CHINESE));
    }

    public void testReplacableLookup() {
@@ -43,7 +43,7 @@ public class SpringSecurityMessageSourceTests extends TestCase {
        // Cause a message to be generated
        MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
        assertEquals("Le jeton nonce est compromis FOOBAR",
-            messages.getMessage("DigestProcessingFilter.nonceCompromised", new Object[] {"FOOBAR"},
+            messages.getMessage("DigestAuthenticationFilter.nonceCompromised", new Object[] {"FOOBAR"},
                "ERROR - FAILED TO LOOKUP"));

        // Revert to original Locale
@@ -16,20 +16,13 @@
 package org.springframework.security.remoting.rmi;

 import junit.framework.TestCase;
-
+import org.aopalliance.intercept.MethodInvocation;
 import org.springframework.security.TargetObject;
-
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
-
-import org.springframework.security.remoting.rmi.ContextPropagatingRemoteInvocation;
-import org.springframework.security.remoting.rmi.ContextPropagatingRemoteInvocationFactory;
-
 import org.springframework.security.util.SimpleMethodInvocation;

-import org.aopalliance.intercept.MethodInvocation;
-
 import java.lang.reflect.Method;


@@ -57,8 +50,7 @@ public class ContextPropagatingRemoteInvocationTests extends TestCase {
        return (ContextPropagatingRemoteInvocation) factory.createRemoteInvocation(mi);
    }

-    public void testContextIsResetEvenIfExceptionOccurs()
-        throws Exception {
+    public void testContextIsResetEvenIfExceptionOccurs() throws Exception {
        // Setup client-side context
        Authentication clientSideAuthentication = new UsernamePasswordAuthenticationToken("rod", "koala");
        SecurityContextHolder.getContext().setAuthentication(clientSideAuthentication);
@@ -96,10 +88,10 @@ public class ContextPropagatingRemoteInvocationTests extends TestCase {
    }

    public void testNullContextHolderDoesNotCauseInvocationProblems() throws Exception {
-        SecurityContextHolder.getContext().setAuthentication(null); // just to be explicit
+        SecurityContextHolder.clearContext(); // just to be explicit

        ContextPropagatingRemoteInvocation remoteInvocation = getRemoteInvocation();
-        SecurityContextHolder.getContext().setAuthentication(null); // unnecessary, but for explicitness
+        SecurityContextHolder.clearContext(); // unnecessary, but for explicitness

        assertEquals("some_string Authentication empty", remoteInvocation.invoke(new TargetObject()));
    }
@@ -1,3 +1,5 @@
+Implementation-Title: org.springframework.security.core
+Implementation-Version: ${version}
 Bundle-SymbolicName: org.springframework.security.core
 Bundle-Name: Spring Security Core
 Bundle-Vendor: SpringSource
@@ -25,4 +27,3 @@ Import-Template:
 javax.crypto.*;version="0";resolution:=optional,
 javax.security.auth.*;version="0";resolution:=optional,
 javax.naming.*;version="0";resolution:=optional
- 
@@ -5,8 +5,8 @@
                exclude-result-prefixes="xslthl"
                version='1.0'>

-    <xsl:import href="http://docbook.sourceforge.net/release/xsl/current/html/docbook.xsl"/>
-    <xsl:import href="http://docbook.sourceforge.net/release/xsl/current/html/highlight.xsl"/>
+    <xsl:import href="http://docbook.sourceforge.net/release/xsl-ns/current/html/docbook.xsl"/>
+    <xsl:import href="http://docbook.sourceforge.net/release/xsl-ns/current/html/highlight.xsl"/>

    <!--xsl:param name="use.id.as.filename">'1'</xsl:param-->

@@ -275,7 +275,7 @@
      <programlisting><![CDATA[
 <security:http entry-point-ref="casEntryPoint">
   ...
-   <custom-filter position="FORM_LOGIN_FILTER" ref="myFilter" />
+   <security:custom-filter position="CAS_FILTER" ref="casFilter" />
 </security:http>

 <bean id="casFilter"
@@ -87,7 +87,7 @@
 <bean id="daoAuthenticationProvider"
    class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
  <property name="userDetailsService" ref="inMemoryDaoImpl"/>
-  <property name="saltSource" ref bean="saltSource"/>
+  <property name="saltSource" ref="saltSource"/>
  <property name="passwordEncoder" ref="passwordEncoder"/>
 </bean>]]></programlisting> The <interfacename>PasswordEncoder</interfacename> and
                    <interfacename>SaltSource</interfacename> are optional. A
@@ -154,14 +154,16 @@
                    within the expression, so you can also access properties on the arguments. For
                    example, if you wanted a particular method to only allow access to a user whose
                    username matched that of the contact, you could write</para>
-                <programlisting>  @PreAuthorize("#contact.name == principal.name)")
+                <programlisting>
+  @PreAuthorize("#contact.name == authentication.name")
  public void doSomething(Contact contact);</programlisting>
-                <para>Here we are accessing another built–in expression, which is the
-                        <literal>principal</literal> of the current Spring Security
-                        <interfacename>Authentication</interfacename> object obtained from the
-                    security context. You can also access the
-                        <interfacename>Authentication</interfacename> object itself directly using
-                    the expression name <literal>authentication</literal>.</para>
+                <para>Here we are accessing another built–in expression, <literal>authentication</literal>,
+                    which is the <interfacename>Authentication</interfacename> stored in the
+                    security context. You can also access its <quote>principal</quote> property
+                    directly, using the expression <literal>principal</literal>. The value will
+                    often be a <interfacename>UserDetails</interfacename> instance, so you might use an
+                    expression like <literal>principal.username</literal> or
+                    <literal>principal.enabled</literal>.</para>
                <para>Less commonly, you may wish to perform an access-control check after the
                    method has been invoked. This can be achieved using the
                        <literal>@PostAuthorize</literal> annotation. To access the return value
@@ -364,16 +364,18 @@ public interface UserDetailsContextMapper {

  void mapUserToContext(UserDetails user, DirContextAdapter ctx);
 }]]>
-                </programlisting> Only the first method is relevant for
-                authentication. If you provide an implementation of this interface, you can control
-                exactly how the UserDetails object is created. The first parameter is an instance of
-                Spring LDAP's <interfacename>DirContextOperations</interfacename> which gives you
-                access to the LDAP attributes which were loaded. The <literal>username</literal>
-                parameter is the name used to authenticate and the final parameter is the collection
-                of authorities loaded for the user. </para>
+                </programlisting> Only the first method is relevant for authentication. If you
+                provide an implementation of this interface and inject it into the
+                <classname>LdapAuthenticationProvider</classname>, you have control over exactly how
+                the UserDetails object is created. The first parameter is an instance of Spring
+                LDAP's <interfacename>DirContextOperations</interfacename> which gives you access to
+                the LDAP attributes which were loaded during authentication. The
+                <literal>username</literal> parameter is the name used to authenticate and the final
+                parameter is the collection of authorities loaded for the user by the configured
+                <interfacename>LdapAuthoritiesPopulator</interfacename>. </para>
            <para> The way the context data is loaded varies slightly depending on the type of
-                authentication you are using. With the <classname>BindAuthenticator</classname>,
-                the context returned from the bind operation will be used to read the attributes,
+                authentication you are using. With the <classname>BindAuthenticator</classname>, the
+                context returned from the bind operation will be used to read the attributes,
                otherwise the data will be read using the standard context obtained from the
                configured <interfacename>ContextSource</interfacename> (when a search is configured
                to locate the user, this will be the data returned by the search object). </para>
@@ -9,7 +9,7 @@
    <para> Namespace configuration has been available since version 2.0 of the Spring framework. It
      allows you to supplement the traditional Spring beans application context syntax with elements
      from additional XML schema. You can find more information in the Spring <link
-        xlink:href="http://static.springsource.org/spring/docs/3.0.x/spring-framework-reference/html/apc.html"
+        xlink:href="http://static.springsource.org/spring/docs/3.0.x/spring-framework-reference/htmlsingle/spring-framework-reference.htm"
        > Reference Documentation</link>. A namespace element can be used simply to allow a more
      concise way of configuring an individual bean or, more powerfully, to define an alternative
      configuration syntax which more closely matches the problem domain and hides the underlying
@@ -129,7 +129,11 @@
          <literal>&lt;http></literal> element is the parent for all web-related namespace
        functionality. The <literal>&lt;intercept-url></literal> element defines a
          <literal>pattern</literal> which is matched against the URLs of incoming requests using an
-        ant path style syntax. The <literal>access</literal> attribute defines the access
+        ant path style syntax<footnote>
+          <para>See the section on <link xlink:href="#request-matching">Request
+              Matching</link> in the Web Application Infrastructure chapter for more details
+              on how matches are actually performed.</para>
+          </footnote>. The <literal>access</literal> attribute defines the access
        requirements for requests matching the given pattern. With the default configuration, this
        is typically a comma-separated list of roles, one of which a user must have to be allowed to
        make the request. The prefix <quote>ROLE_</quote> is a marker which indicates that a simple
@@ -255,7 +259,22 @@
          attributes such as <literal>requires-channel</literal>, so you will not be able to access
          information on the current user or call secured methods during the request. Use
            <literal>access='IS_AUTHENTICATED_ANONYMOUSLY'</literal> as an alternative if you still
-          want the security filter chain to be applied.</para>
+          want the security filter chain to be applied.
+          <note>
+              <para>Using <literal>filters="none"</literal> operates by creating an empty filter
+                        chain in Spring Security's <classname>FilterChainProxy</classname>, whereas
+                        the access attributes are used to configure the
+                        <classname>FilterSecurityInterceptor</classname> in the single filter chain
+                        which is created by the namespace configuration. The two are applied
+                        independently, so if you have an access contraint for a sub-pattern of a
+                        pattern which has a <literal>filters="none"</literal> attribute, the access
+                        constraint will be ignored, even if it is listed first. It isn't possible to
+                        apply a <literal>filters="none"</literal> attribute to the pattern
+                        <literal>/**</literal> since this is used by the namespace filter chain. In
+                        version 3.1 things are more flexible. You can define multiple filter chains
+                        and the <literal>filters</literal> attribute is no longer supported.</para>
+          </note>
+        </para>
        <para>If you want to use basic authentication instead of form login, then change the
          configuration to <programlisting language="xml"><![CDATA[
  <http auto-config='true'>
@@ -139,11 +139,11 @@
        <para> A typical configuration using this filter would look like this: <programlisting><![CDATA[
  <security:http>
    <!-- Additional http configuration omitted -->
-    <security:custom-filter ref="siteminderFilter" />
+    <security:custom-filter position="PRE_AUTH_FILTER" ref="siteminderFilter" />
  </security:http>

    <bean id="siteminderFilter" class=
-"org.springframework.security.web.authentication.preauth.header.RequestHeaderAuthenticationFilter">
+"org.springframework.security.web.authentication.preauth.RequestHeaderAuthenticationFilter">
    <property name="principalRequestHeader" value="SM_USER"/>
    <property name="authenticationManager" ref="authenticationManager" />
  </bean>
@@ -143,7 +143,7 @@
 </bean>

 <bean id="rememberMeAuthenticationProvider" class=
- "org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationProvider">
+ "org.springframework.security.authentication.rememberme.RememberMeAuthenticationProvider">
  <property name="key" value="springRocks"/>
 </bean>
 ]]>
--- a/Show More
+++ b/Show More