Set project release version to 3.0.6.RELEASE

Constant time comparison helps to mitigate timing attacks. See the following link for more information

 * http://rdist.root.org/2010/07/19/exploiting-remote-timing-attacks/
 * http://en.wikipedia.org/wiki/Timing_attack for more information.

acl/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <artifactId>spring-security-parent</artifactId>
         <groupId>org.springframework.security</groupId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <modelVersion>4.0.0</modelVersion>
     <groupId>org.springframework.security</groupId>

acl/src/main/java/org/springframework/security/acls/afterinvocation/AclEntryAfterInvocationProvider.java

@@ -108,7 +108,7 @@ public class AclEntryAfterInvocationProvider extends AbstractAclProvider impleme
 
             logger.debug("Denying access");
 
-            throw new AccessDeniedException(messages.getMessage("BasicAclEntryAfterInvocationProvider.noPermission",
+            throw new AccessDeniedException(messages.getMessage("AclEntryAfterInvocationProvider.noPermission",
                     new Object[] {authentication.getName(), returnedObject},
                     "Authentication {0} has NO permissions to the domain object {1}"));
         }

acl/src/main/java/org/springframework/security/acls/domain/AclImpl.java

@@ -379,15 +379,15 @@ public class AclImpl implements Acl, MutableAcl, AuditableAcl, OwnershipAcl {
         if (obj instanceof AclImpl) {
             AclImpl rhs = (AclImpl) obj;
             if (this.aces.equals(rhs.aces)) {
-                if ((this.parentAcl == null && rhs.parentAcl == null) || (this.parentAcl.equals(rhs.parentAcl))) {
-                    if ((this.objectIdentity == null && rhs.objectIdentity == null) || (this.objectIdentity.equals(rhs.objectIdentity))) {
-                        if ((this.id == null && rhs.id == null) || (this.id.equals(rhs.id))) {
-                            if ((this.owner == null && rhs.owner == null) || this.owner.equals(rhs.owner)) {
+                if ((this.parentAcl == null && rhs.parentAcl == null) || (this.parentAcl !=null && this.parentAcl.equals(rhs.parentAcl))) {
+                    if ((this.objectIdentity == null && rhs.objectIdentity == null) || (this.objectIdentity != null && this.objectIdentity.equals(rhs.objectIdentity))) {
+                        if ((this.id == null && rhs.id == null) || (this.id != null && this.id.equals(rhs.id))) {
+                            if ((this.owner == null && rhs.owner == null) || (this.owner != null && this.owner.equals(rhs.owner))) {
                                 if (this.entriesInheriting == rhs.entriesInheriting) {
                                     if ((this.loadedSids == null && rhs.loadedSids == null)) {
                                         return true;
                                     }
-                                    if (this.loadedSids.size() == rhs.loadedSids.size()) {
+                                    if (this.loadedSids != null && (this.loadedSids.size() == rhs.loadedSids.size())) {
                                         for (int i = 0; i < this.loadedSids.size(); i++) {
                                             if (!this.loadedSids.get(i).equals(rhs.loadedSids.get(i))) {
                                                 return false;

acl/src/test/java/org/springframework/security/acls/domain/AclImplTests.java

@@ -504,6 +504,16 @@ public class AclImplTests {
         acl.deleteAce(1);
     }
 
+    // SEC-1795
+    @Test
+    public void changingParentIsSuccessful() throws Exception {
+        AclImpl parentAcl = new AclImpl(objectIdentity, 1L, mockAuthzStrategy, mockAuditLogger);
+        AclImpl childAcl = new AclImpl(objectIdentity, 2L, mockAuthzStrategy, mockAuditLogger);
+        AclImpl changeParentAcl = new AclImpl(objectIdentity, 3L, mockAuthzStrategy, mockAuditLogger);
+
+        childAcl.setParent(parentAcl);
+        childAcl.setParent(changeParentAcl);
+    }
 
     //~ Inner Classes ==================================================================================================
 

aspects/pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-parent</artifactId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <packaging>jar</packaging>
     <artifactId>spring-security-aspects</artifactId>
@@ -18,7 +18,7 @@
         <dependency>
             <groupId>org.springframework.security</groupId>
             <artifactId>spring-security-core</artifactId>
-            <version>3.0.5.RELEASE</version>
+            <version>3.0.6.RELEASE</version>
         </dependency>
     </dependencies>
     <build>

build.gradle

@@ -1,7 +1,7 @@
 apply plugin: 'base'
 
 allprojects {
-    version = '3.0.5.RELEASE'
+    version = '3.0.6.RELEASE'
     releaseBuild = version.endsWith('RELEASE')
     snapshotBuild = version.endsWith('SNAPSHOT')
 

cas/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-parent</artifactId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <artifactId>spring-security-cas-client</artifactId>
     <name>Spring Security - CAS support</name>

cas/src/main/java/org/springframework/security/cas/web/CasAuthenticationFilter.java

@@ -54,6 +54,7 @@ import org.springframework.security.web.authentication.AbstractAuthenticationPro
  * By default this filter processes the URL <tt>/j_spring_cas_security_check</tt>.
  *
  * @author Ben Alex
+ * @author Rob Winch
  */
 public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
     //~ Static fields/initializers =====================================================================================
@@ -89,7 +90,13 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
     //~ Methods ========================================================================================================
 
     public Authentication attemptAuthentication(final HttpServletRequest request, final HttpServletResponse response)
-            throws AuthenticationException {
+            throws AuthenticationException, IOException {
+        // if the request is a proxy request process it and return null to indicate the request has been processed
+        if(isProxyRequest(request)) {
+            CommonUtils.readAndRespondToProxyReceptorRequest(request, response, this.proxyGrantingTicketStorage);
+            return null;
+        }
+
         final String username = CAS_STATEFUL_IDENTIFIER;
         String password = request.getParameter(this.artifactParameter);
 
@@ -108,18 +115,7 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
      * Overridden to provide proxying capabilities.
      */
     protected boolean requiresAuthentication(final HttpServletRequest request, final HttpServletResponse response) {
-        final String requestUri = request.getRequestURI();
-
-        if (CommonUtils.isEmpty(this.proxyReceptorUrl) || !requestUri.endsWith(this.proxyReceptorUrl) || this.proxyGrantingTicketStorage == null) {
-            return super.requiresAuthentication(request, response);
-        }
-
-        try {
-            CommonUtils.readAndRespondToProxyReceptorRequest(request, response, this.proxyGrantingTicketStorage);
-            return false;
-        } catch (final IOException e) {
-            return super.requiresAuthentication(request, response);
-        }
+        return isProxyRequest(request) || super.requiresAuthentication(request, response);
     }
 
     public final void setProxyReceptorUrl(final String proxyReceptorUrl) {
@@ -134,4 +130,14 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
     public final void setServiceProperties(final ServiceProperties serviceProperties) {
         this.artifactParameter = serviceProperties.getArtifactParameter();
     }
+
+    /**
+     * Indicates if the request is eligible to be processed as a proxy request.
+     * @param request
+     * @return
+     */
+    private boolean isProxyRequest(final HttpServletRequest request) {
+        final String requestUri = request.getRequestURI();
+        return this.proxyGrantingTicketStorage != null && !CommonUtils.isEmpty(this.proxyReceptorUrl) && requestUri.endsWith(this.proxyReceptorUrl);
+    }
 }

cas/src/test/java/org/springframework/security/cas/web/CasAuthenticationFilterTests.java

@@ -16,7 +16,11 @@
 package org.springframework.security.cas.web;
 
 import static org.junit.Assert.*;
+import static org.mockito.Mockito.*;
 
+import javax.servlet.FilterChain;
+
+import org.jasig.cas.client.proxy.ProxyGrantingTicketStorage;
 import org.junit.Test;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
@@ -30,6 +34,7 @@ import org.springframework.security.core.AuthenticationException;
  * Tests {@link CasAuthenticationFilter}.
  *
  * @author Ben Alex
+ * @author Rob Winch
  */
 public class CasAuthenticationFilterTests {
     //~ Methods ========================================================================================================
@@ -67,4 +72,58 @@ public class CasAuthenticationFilterTests {
 
         filter.attemptAuthentication(new MockHttpServletRequest(), new MockHttpServletResponse());
     }
+
+    @Test
+    public void testRequiresAuthenticationFilterProcessUrl() {
+        CasAuthenticationFilter filter = new CasAuthenticationFilter();
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        request.setRequestURI(filter.getFilterProcessesUrl());
+        assertTrue(filter.requiresAuthentication(request, response));
+    }
+
+    @Test
+    public void testRequiresAuthenticationProxyRequest() {
+        CasAuthenticationFilter filter = new CasAuthenticationFilter();
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        request.setRequestURI("/pgtCallback");
+        assertFalse(filter.requiresAuthentication(request, response));
+        filter.setProxyReceptorUrl(request.getRequestURI());
+        assertFalse(filter.requiresAuthentication(request, response));
+        filter.setProxyGrantingTicketStorage(mock(ProxyGrantingTicketStorage.class));
+        assertTrue(filter.requiresAuthentication(request, response));
+        request.setRequestURI("/other");
+        assertFalse(filter.requiresAuthentication(request, response));
+    }
+
+    @Test
+    public void testAuthenticateProxyUrl() throws Exception {
+        CasAuthenticationFilter filter = new CasAuthenticationFilter();
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        request.setRequestURI("/pgtCallback");
+        filter.setProxyGrantingTicketStorage(mock(ProxyGrantingTicketStorage.class));
+        filter.setProxyReceptorUrl(request.getRequestURI());
+        assertNull(filter.attemptAuthentication(request, response));
+    }
+
+    // SEC-1592
+    @Test
+    public void testChainNotInvokedForProxy() throws Exception {
+        CasAuthenticationFilter filter = new CasAuthenticationFilter();
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        MockHttpServletResponse response = new MockHttpServletResponse();
+        FilterChain chain = mock(FilterChain.class);
+
+        request.setRequestURI("/pgtCallback");
+        filter.setProxyGrantingTicketStorage(mock(ProxyGrantingTicketStorage.class));
+        filter.setProxyReceptorUrl(request.getRequestURI());
+
+        filter.doFilter(request,response,chain);
+        verifyZeroInteractions(chain);
+    }
 }

config/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-parent</artifactId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <packaging>jar</packaging>
     <artifactId>spring-security-config</artifactId>

config/src/main/java/org/springframework/security/config/http/AuthenticationConfigBuilder.java

@@ -2,11 +2,6 @@ package org.springframework.security.config.http;
 
 import static org.springframework.security.config.http.SecurityFilters.*;
 
-import java.security.NoSuchAlgorithmException;
-import java.security.SecureRandom;
-import java.util.ArrayList;
-import java.util.List;
-
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.beans.BeanMetadataElement;
@@ -33,13 +28,16 @@ import org.springframework.security.web.authentication.preauth.PreAuthenticatedA
 import org.springframework.security.web.authentication.preauth.x509.SubjectDnX509PrincipalExtractor;
 import org.springframework.security.web.authentication.preauth.x509.X509AuthenticationFilter;
 import org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter;
-import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
 import org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint;
+import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
 import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
 import org.springframework.util.StringUtils;
 import org.springframework.util.xml.DomUtils;
 import org.w3c.dom.Element;
 
+import java.security.SecureRandom;
+import java.util.*;
+
 /**
  * Handles creation of authentication mechanism filters and related beans for <http> parsing.
  *
@@ -68,6 +66,8 @@ final class AuthenticationConfigBuilder {
 
     private static final String ATT_REF = "ref";
 
+    private static final String ATT_KEY = "key";
+
     private Element httpElt;
     private ParserContext pc;
 
@@ -81,10 +81,8 @@ final class AuthenticationConfigBuilder {
     private String rememberMeServicesId;
     private BeanReference rememberMeProviderRef;
     private BeanDefinition basicFilter;
-    private BeanReference basicEntryPoint;
-    private RootBeanDefinition formFilter;
+    private RuntimeBeanReference basicEntryPoint;
     private BeanDefinition formEntryPoint;
-    private RootBeanDefinition openIDFilter;
     private BeanDefinition openIDEntryPoint;
     private BeanReference openIDProviderRef;
     private String openIDProviderId;
@@ -99,8 +97,6 @@ final class AuthenticationConfigBuilder {
     private BeanDefinition etf;
     private BeanReference requestCache;
 
-    final SecureRandom random;
-
     public AuthenticationConfigBuilder(Element element, ParserContext pc, boolean allowSessionCreation,
             String portMapperName) {
         this.httpElt = element;
@@ -108,18 +104,9 @@ final class AuthenticationConfigBuilder {
         this.portMapperName = portMapperName;
         autoConfig = "true".equals(element.getAttribute(ATT_AUTO_CONFIG));
         this.allowSessionCreation = allowSessionCreation;
-        try {
-            random = SecureRandom.getInstance("SHA1PRNG");
-        } catch (NoSuchAlgorithmException e) {
-            // Shouldn't happen...
-            throw new RuntimeException("Failed find SHA1PRNG algorithm!");
-        }
     }
 
     void createRememberMeFilter(BeanReference authenticationManager) {
-        final String ATT_KEY = "key";
-        final String DEF_KEY = "SpringSecured";
-
         // Parse remember me before logout as RememberMeServices is also a LogoutHandler implementation.
         Element rememberMeElt = DomUtils.getChildElementByTagName(httpElt, Elements.REMEMBER_ME);
 
@@ -127,10 +114,10 @@ final class AuthenticationConfigBuilder {
             String key = rememberMeElt.getAttribute(ATT_KEY);
 
             if (!StringUtils.hasText(key)) {
-                key = DEF_KEY;
+                key = createKey();
             }
 
-            rememberMeFilter = (RootBeanDefinition) new RememberMeBeanDefinitionParser(key).parse(rememberMeElt, pc);
+            rememberMeFilter = new RememberMeBeanDefinitionParser(key).parse(rememberMeElt, pc);
             rememberMeFilter.getPropertyValues().addPropertyValue("authenticationManager", authenticationManager);
             rememberMeServicesId = ((RuntimeBeanReference) rememberMeFilter.getPropertyValues().getPropertyValue("rememberMeServices").getValue()).getBeanName();
             createRememberMeProvider(key);
@@ -152,6 +139,7 @@ final class AuthenticationConfigBuilder {
     void createFormLoginFilter(BeanReference sessionStrategy, BeanReference authManager) {
 
         Element formLoginElt = DomUtils.getChildElementByTagName(httpElt, Elements.FORM_LOGIN);
+        RootBeanDefinition formFilter = null;
 
         if (formLoginElt != null || autoConfig) {
             FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser("/j_spring_security_check",
@@ -176,6 +164,7 @@ final class AuthenticationConfigBuilder {
 
     void createOpenIDLoginFilter(BeanReference sessionStrategy, BeanReference authManager) {
         Element openIDLoginElt = DomUtils.getChildElementByTagName(httpElt, Elements.OPENID_LOGIN);
+        RootBeanDefinition openIDFilter = null;
 
         if (openIDLoginElt != null) {
             FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser("/j_spring_openid_security_check",
@@ -329,7 +318,7 @@ final class AuthenticationConfigBuilder {
 
 
     void createLoginPageFilterIfNeeded() {
-        boolean needLoginPage = formFilter != null || openIDFilter != null;
+        boolean needLoginPage = formFilterId != null || openIDFilterId != null;
         String formLoginPage = getLoginFormUrl(formEntryPoint);
         String openIDLoginPage = getLoginFormUrl(openIDEntryPoint);
 
@@ -340,11 +329,11 @@ final class AuthenticationConfigBuilder {
             BeanDefinitionBuilder loginPageFilter =
                 BeanDefinitionBuilder.rootBeanDefinition(DefaultLoginPageGeneratingFilter.class);
 
-            if (formFilter != null) {
+            if (formFilterId != null) {
                 loginPageFilter.addConstructorArgReference(formFilterId);
             }
 
-            if (openIDFilter != null) {
+            if (openIDFilterId != null) {
                 loginPageFilter.addConstructorArgReference(openIDFilterId);
             }
 
@@ -374,7 +363,7 @@ final class AuthenticationConfigBuilder {
         if (anonymousElt != null) {
             grantedAuthority = anonymousElt.getAttribute("granted-authority");
             username = anonymousElt.getAttribute("username");
-            key = anonymousElt.getAttribute("key");
+            key = anonymousElt.getAttribute(ATT_KEY);
             source = pc.extractSource(anonymousElt);
         }
 
@@ -388,7 +377,7 @@ final class AuthenticationConfigBuilder {
 
         if (!StringUtils.hasText(key)) {
             // Generate a random key for the Anonymous provider
-            key = Long.toString(random.nextLong());
+            key = createKey();
         }
 
         anonymousFilter = new RootBeanDefinition(AnonymousAuthenticationFilter.class);
@@ -408,6 +397,11 @@ final class AuthenticationConfigBuilder {
 
     }
 
+    private String createKey() {
+        SecureRandom random = new SecureRandom();
+        return Long.toString(random.nextLong());
+    }
+
     void createExceptionTranslationFilter() {
         BeanDefinitionBuilder etfBuilder = BeanDefinitionBuilder.rootBeanDefinition(ExceptionTranslationFilter.class);
         etfBuilder.addPropertyValue("accessDeniedHandler", createAccessDeniedHandler(httpElt, pc));
@@ -503,12 +497,12 @@ final class AuthenticationConfigBuilder {
                     "but not both.", pc.extractSource(openIDLoginElt));
         }
 
-        if (formFilter != null && openIDLoginPage == null) {
+        if (formFilterId != null && openIDLoginPage == null) {
             return formEntryPoint;
         }
 
         // Otherwise use OpenID if enabled
-        if (openIDFilter != null) {
+        if (openIDFilterId != null) {
             return openIDEntryPoint;
         }
 
@@ -572,12 +566,12 @@ final class AuthenticationConfigBuilder {
             filters.add(new OrderDecorator(x509Filter, X509_FILTER));
         }
 
-        if (formFilter != null) {
-            filters.add(new OrderDecorator(formFilter, FORM_LOGIN_FILTER));
+        if (formFilterId != null) {
+            filters.add(new OrderDecorator(new RuntimeBeanReference(formFilterId), FORM_LOGIN_FILTER));
         }
 
-        if (openIDFilter != null) {
-            filters.add(new OrderDecorator(openIDFilter, OPENID_FILTER));
+        if (openIDFilterId != null) {
+            filters.add(new OrderDecorator(new RuntimeBeanReference(openIDFilterId), OPENID_FILTER));
         }
 
         if (loginPageGenerationFilter != null) {

config/src/main/java/org/springframework/security/config/http/FilterInvocationSecurityMetadataSourceParser.java

@@ -1,5 +1,8 @@
 package org.springframework.security.config.http;
 
+import static org.springframework.security.config.http.HttpSecurityBeanDefinitionParser.*;
+import static org.springframework.security.config.Elements.*;
+
 import java.util.List;
 
 import org.apache.commons.logging.Log;
@@ -112,6 +115,13 @@ public class FilterInvocationSecurityMetadataSourceParser implements BeanDefinit
             if (!StringUtils.hasText(access)) {
                 continue;
             }
+            String filters = urlElt.getAttribute(ATT_FILTERS);
+            if(OPT_FILTERS_NONE.equals(filters)) {
+                parserContext.getReaderContext().error(
+                        "Ambiguous configuration. Cannot contain " + INTERCEPT_URL+"@" + ATT_FILTERS +
+                        "=\"" + OPT_FILTERS_NONE + "\" and " + INTERCEPT_URL + "@" + ATT_ACCESS,
+                        parserContext.extractSource(urlElt));
+            }
 
             String path = urlElt.getAttribute(ATT_PATTERN);
 

config/src/main/java/org/springframework/security/config/http/HttpConfigurationBuilder.java

@@ -2,6 +2,7 @@ package org.springframework.security.config.http;
 
 import static org.springframework.security.config.http.SecurityFilters.*;
 import static org.springframework.security.config.http.HttpSecurityBeanDefinitionParser.*;
+import static org.springframework.security.config.Elements.*;
 
 import java.util.ArrayList;
 import java.util.Collections;
@@ -393,6 +394,13 @@ class HttpConfigurationBuilder {
             String requiredChannel = urlElt.getAttribute(ATT_REQUIRES_CHANNEL);
 
             if (StringUtils.hasText(requiredChannel)) {
+                String filters = urlElt.getAttribute(ATT_FILTERS);
+                if(OPT_FILTERS_NONE.equals(filters)) {
+                    pc.getReaderContext().error(
+                            "Ambiguous configuration. Cannot contain " + INTERCEPT_URL+"@" + ATT_FILTERS +
+                            "=\"" + OPT_FILTERS_NONE + "\" and " + INTERCEPT_URL + "@" + ATT_REQUIRES_CHANNEL,
+                            pc.extractSource(urlElt));
+                }
                 BeanDefinition requestKey = new RootBeanDefinition(RequestKey.class);
                 requestKey.getConstructorArgumentValues().addGenericArgumentValue(path);
 

config/src/main/java/org/springframework/security/config/ldap/ContextSourceSettingPostProcessor.java

@@ -36,12 +36,12 @@ class ContextSourceSettingPostProcessor implements BeanFactoryPostProcessor, Ord
                     "jar file in your application", e);
         }
 
-        String[] sources = bf.getBeanNamesForType(contextSourceClass);
-
+        String[] sources = bf.getBeanNamesForType(contextSourceClass, false, false);
 
         if (sources.length == 0) {
             throw new ApplicationContextException("No BaseLdapPathContextSource instances found. Have you " +
-                    "added an <" + Elements.LDAP_SERVER + " /> element to your application context?");
+                    "added an <" + Elements.LDAP_SERVER + " /> element to your application context? If you have " +
+                    "declared an explicit bean, do not use lazy-init");
         }
 
         if (!bf.containsBean(BeanIds.CONTEXT_SOURCE) && defaultNameRequired) {

config/src/test/java/org/springframework/security/config/http/HttpSecurityBeanDefinitionParserTests.java

@@ -185,6 +185,29 @@ public class HttpSecurityBeanDefinitionParserTests {
         assertTrue(filters.size() == 0);
     }
 
+    @Test(expected=BeanDefinitionParsingException.class)
+    public void filtersEqualsNoneErrorsWithRequiresChannel() throws Exception {
+        setContext(
+                "    <http auto-config='true'>" +
+                "        <intercept-url pattern='/ambiguousConfig' requires-channel='https' filters='none' />" +
+                "    </http>" + AUTH_PROVIDER_XML);
+    }
+
+    @Test(expected=BeanDefinitionParsingException.class)
+    public void filtersEqualsNoneErrorsWithAccess() throws Exception {
+        setContext(
+                "    <http auto-config='true'>" +
+                "        <intercept-url pattern='/ambiguousConfig' access='ROLE_USER' filters='none' />" +
+                "    </http>" + AUTH_PROVIDER_XML);
+    }
+
+    @Test(expected=BeanDefinitionParsingException.class)
+    public void filtersEqualsNoneErrorsWithRequiresChannelAndAccess() throws Exception {
+        setContext(
+                "    <http auto-config='true'>" +
+                "        <intercept-url pattern='/ambiguousConfig' requires-channel='https' filters='none' />" +
+                "    </http>" + AUTH_PROVIDER_XML);
+    }
 
     @Test
     public void regexPathsWorkCorrectly() throws Exception {

core/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-parent</artifactId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <packaging>jar</packaging>
     <artifactId>spring-security-core</artifactId>

core/src/main/java/org/springframework/security/access/annotation/SecuredAnnotationSecurityMetadataSource.java

@@ -35,7 +35,7 @@ import org.springframework.security.access.method.AbstractFallbackMethodSecurity
 public class SecuredAnnotationSecurityMetadataSource extends AbstractFallbackMethodSecurityMetadataSource {
 
     protected Collection<ConfigAttribute> findAttributes(Class<?> clazz) {
-        return processAnnotation(clazz.getAnnotation(Secured.class));
+        return processAnnotation(AnnotationUtils.findAnnotation(clazz, Secured.class));
     }
 
     protected Collection<ConfigAttribute> findAttributes(Method method, Class<?> targetClass) {

core/src/main/java/org/springframework/security/access/intercept/AbstractSecurityInterceptor.java

@@ -40,6 +40,7 @@ import org.springframework.security.authentication.AuthenticationCredentialsNotF
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.SpringSecurityMessageSource;
+import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.util.Assert;
 
@@ -224,16 +225,18 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean, A
             }
 
             // no further work post-invocation
-            return new InterceptorStatusToken(authenticated, false, attributes, object);
+            return new InterceptorStatusToken(SecurityContextHolder.getContext(), false, attributes, object);
         } else {
             if (debug) {
                 logger.debug("Switching to RunAs Authentication: " + runAs);
             }
 
+            SecurityContext origCtx = SecurityContextHolder.getContext();
+            SecurityContextHolder.setContext(SecurityContextHolder.createEmptyContext());
             SecurityContextHolder.getContext().setAuthentication(runAs);
 
             // need to revert to token.Authenticated post-invocation
-            return new InterceptorStatusToken(authenticated, true, attributes, object);
+            return new InterceptorStatusToken(origCtx, true, attributes, object);
         }
     }
 
@@ -253,21 +256,22 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean, A
 
         if (token.isContextHolderRefreshRequired()) {
             if (logger.isDebugEnabled()) {
-                logger.debug("Reverting to original Authentication: " + token.getAuthentication().toString());
+                logger.debug("Reverting to original Authentication: " + token.getSecurityContext().getAuthentication());
             }
 
-            SecurityContextHolder.getContext().setAuthentication(token.getAuthentication());
+            SecurityContextHolder.setContext(token.getSecurityContext());
         }
 
         if (afterInvocationManager != null) {
             // Attempt after invocation handling
             try {
-                returnedObject = afterInvocationManager.decide(token.getAuthentication(), token.getSecureObject(),
+                returnedObject = afterInvocationManager.decide(token.getSecurityContext().getAuthentication(),
+                        token.getSecureObject(),
                         token.getAttributes(), returnedObject);
             }
             catch (AccessDeniedException accessDeniedException) {
                 AuthorizationFailureEvent event = new AuthorizationFailureEvent(token.getSecureObject(), token
-                        .getAttributes(), token.getAuthentication(), accessDeniedException);
+                        .getAttributes(), token.getSecurityContext().getAuthentication(), accessDeniedException);
                 publishEvent(event);
 
                 throw accessDeniedException;

core/src/main/java/org/springframework/security/access/intercept/InterceptorStatusToken.java

@@ -19,6 +19,7 @@ import java.util.Collection;
 
 import org.springframework.security.access.ConfigAttribute;
 import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContext;
 
 
 /**
@@ -33,16 +34,16 @@ import org.springframework.security.core.Authentication;
 public class InterceptorStatusToken {
     //~ Instance fields ================================================================================================
 
-    private Authentication authentication;
+    private SecurityContext securityContext;
     private Collection<ConfigAttribute> attr;
     private Object secureObject;
     private boolean contextHolderRefreshRequired;
 
     //~ Constructors ===================================================================================================
 
-    public InterceptorStatusToken(Authentication authentication, boolean contextHolderRefreshRequired,
+    public InterceptorStatusToken(SecurityContext securityContext, boolean contextHolderRefreshRequired,
             Collection<ConfigAttribute> attributes, Object secureObject) {
-        this.authentication = authentication;
+        this.securityContext = securityContext;
         this.contextHolderRefreshRequired = contextHolderRefreshRequired;
         this.attr = attributes;
         this.secureObject = secureObject;
@@ -54,8 +55,8 @@ public class InterceptorStatusToken {
         return attr;
     }
 
-    public Authentication getAuthentication() {
-        return authentication;
+    public SecurityContext getSecurityContext() {
+        return securityContext;
     }
 
     public Object getSecureObject() {

core/src/main/java/org/springframework/security/access/intercept/RunAsUserToken.java

@@ -73,7 +73,8 @@ public class RunAsUserToken extends AbstractAuthenticationToken {
 
     public String toString() {
         StringBuilder sb = new StringBuilder(super.toString());
-        sb.append("; Original Class: ").append(this.originalAuthentication.getName());
+        String className = this.originalAuthentication == null ? null : this.originalAuthentication.getName();
+        sb.append("; Original Class: ").append(className);
 
         return sb.toString();
     }

core/src/main/java/org/springframework/security/access/method/AbstractMethodSecurityMetadataSource.java

@@ -15,6 +15,7 @@
 
 package org.springframework.security.access.method;
 
+import org.springframework.aop.framework.AopProxyUtils;
 import org.springframework.security.access.ConfigAttribute;
 
 import org.aopalliance.intercept.MethodInvocation;
@@ -52,7 +53,12 @@ public abstract class AbstractMethodSecurityMetadataSource implements MethodSecu
             Class<?> targetClass = null;
 
             if (target != null) {
-                targetClass = target instanceof Class<?> ? (Class<?>)target : target.getClass();
+                targetClass = target instanceof Class<?> ? (Class<?>)target : AopProxyUtils.ultimateTargetClass(target);
+
+                if (targetClass == null) {
+                    // See SPR-7447. TODO: Only required for Spring < 3.0.4
+                    targetClass = target.getClass();
+                }
             }
 
             return getAttributes(mi.getMethod(), targetClass);

core/src/main/java/org/springframework/security/access/method/DelegatingMethodSecurityMetadataSource.java

@@ -88,6 +88,10 @@ public final class DelegatingMethodSecurityMetadataSource extends AbstractMethod
         this.methodSecurityMetadataSources = methodSecurityMetadataSources;
     }
 
+    public List<MethodSecurityMetadataSource> getMethodSecurityMetadataSources() {
+        return methodSecurityMetadataSources;
+    }
+
     //~ Inner Classes ==================================================================================================
 
     private static class DefaultCacheKey {

core/src/main/java/org/springframework/security/access/prepost/PrePostAnnotationSecurityMetadataSource.java

@@ -105,23 +105,13 @@ public class PrePostAnnotationSecurityMetadataSource extends AbstractMethodSecur
         }
 
         // Check the class-level (note declaringClass, not targetClass, which may not actually implement the method)
-        annotation = specificMethod.getDeclaringClass().getAnnotation(annotationClass);
+        annotation = AnnotationUtils.findAnnotation(specificMethod.getDeclaringClass(), annotationClass);
 
         if (annotation != null) {
             logger.debug(annotation + " found on: " + specificMethod.getDeclaringClass().getName());
             return annotation;
         }
 
-        // Check for a possible interface annotation which would not be inherited by the declaring class
-        if (specificMethod != method) {
-            annotation = method.getDeclaringClass().getAnnotation(annotationClass);
-
-            if (annotation != null) {
-                logger.debug(annotation + " found on: " + method.getDeclaringClass().getName());
-                return annotation;
-            }
-        }
-
         return null;
     }
 

core/src/main/java/org/springframework/security/authentication/AbstractAuthenticationManager.java

@@ -77,7 +77,9 @@ public abstract class AbstractAuthenticationManager implements AuthenticationMan
      * be serialized to the client. Defaults to 'false'.
      *
      * @see org.springframework.security.core.AuthenticationException#getExtraInformation()
+     * @deprecated the {@code extraInformation} property is deprecated
      */
+    @Deprecated
     public void setClearExtraInformation(boolean clearExtraInformation) {
         this.clearExtraInformation = clearExtraInformation;
     }

core/src/main/java/org/springframework/security/authentication/AccountStatusException.java

@@ -17,6 +17,7 @@ public abstract class AccountStatusException extends AuthenticationException {
         super(msg, t);
     }
 
+    @Deprecated
     protected AccountStatusException(String msg, Object extraInformation) {
         super(msg, extraInformation);
     }

core/src/main/java/org/springframework/security/authentication/AccountStatusUserDetailsChecker.java

@@ -14,20 +14,20 @@ public class AccountStatusUserDetailsChecker implements UserDetailsChecker {
 
     public void check(UserDetails user) {
         if (!user.isAccountNonLocked()) {
-            throw new LockedException(messages.getMessage("UserDetailsService.locked", "User account is locked"), user);
+            throw new LockedException(messages.getMessage("AccountStatusUserDetailsChecker.locked", "User account is locked"), user);
         }
 
         if (!user.isEnabled()) {
-            throw new DisabledException(messages.getMessage("UserDetailsService.disabled", "User is disabled"), user);
+            throw new DisabledException(messages.getMessage("AccountStatusUserDetailsChecker.disabled", "User is disabled"), user);
         }
 
         if (!user.isAccountNonExpired()) {
-            throw new AccountExpiredException(messages.getMessage("UserDetailsService.expired",
+            throw new AccountExpiredException(messages.getMessage("AccountStatusUserDetailsChecker.expired",
                     "User account has expired"), user);
         }
 
         if (!user.isCredentialsNonExpired()) {
-            throw new CredentialsExpiredException(messages.getMessage("UserDetailsService.credentialsExpired",
+            throw new CredentialsExpiredException(messages.getMessage("AccountStatusUserDetailsChecker.credentialsExpired",
                     "User credentials have expired"), user);
         }
     }

core/src/main/java/org/springframework/security/authentication/BadCredentialsException.java

@@ -36,6 +36,7 @@ public class BadCredentialsException extends AuthenticationException {
         super(msg);
     }
 
+    @Deprecated
     public BadCredentialsException(String msg, Object extraInformation) {
         super(msg, extraInformation);
     }

core/src/main/java/org/springframework/security/authentication/encoding/LdapShaPasswordEncoder.java

@@ -16,12 +16,12 @@
 package org.springframework.security.authentication.encoding;
 
 
-import java.io.UnsupportedEncodingException;
-import java.security.MessageDigest;
-
 import org.springframework.security.core.codec.Base64;
+import org.springframework.security.core.codec.Utf8;
 import org.springframework.util.Assert;
 
+import java.io.UnsupportedEncodingException;
+import java.security.MessageDigest;
 
 /**
  * A version of {@link ShaPasswordEncoder} which supports Ldap SHA and SSHA (salted-SHA) encodings. The values are
@@ -101,7 +101,7 @@ public class LdapShaPasswordEncoder implements PasswordEncoder {
             prefix = forceLowerCasePrefix ? SSHA_PREFIX_LC : SSHA_PREFIX;
         }
 
-        return prefix + new String(Base64.encode(hash));
+        return prefix + Utf8.decode(Base64.encode(hash));
     }
 
     private byte[] extractSalt(String encPass) {
@@ -145,7 +145,7 @@ public class LdapShaPasswordEncoder implements PasswordEncoder {
 
         String encodedRawPass = encodePassword(rawPass, salt).substring(startOfHash);
 
-        return encodedRawPass.equals(encPass.substring(startOfHash));
+        return PasswordEncoderUtils.equals(encodedRawPass,encPass.substring(startOfHash));
     }
 
     /**

core/src/main/java/org/springframework/security/authentication/encoding/Md4PasswordEncoder.java

@@ -14,10 +14,11 @@
  */
 package org.springframework.security.authentication.encoding;
 
-import java.io.UnsupportedEncodingException;
-
 import org.springframework.security.core.codec.Base64;
 import org.springframework.security.core.codec.Hex;
+import org.springframework.security.core.codec.Utf8;
+
+import java.io.UnsupportedEncodingException;
 
 /**
  * MD4 implementation of PasswordEncoder.
@@ -60,7 +61,7 @@ public class Md4PasswordEncoder extends BaseDigestPasswordEncoder {
         byte[] resBuf = md4.digest();
 
         if (getEncodeHashAsBase64()) {
-            return new String(Base64.encode(resBuf));
+            return Utf8.decode(Base64.encode(resBuf));
         } else {
             return new String(Hex.encode(resBuf));
         }
@@ -78,7 +79,7 @@ public class Md4PasswordEncoder extends BaseDigestPasswordEncoder {
     public boolean isPasswordValid(String encPass, String rawPass, Object salt) {
         String pass1 = "" + encPass;
         String pass2 = encodePassword(rawPass, salt);
-        return pass1.equals(pass2);
+        return PasswordEncoderUtils.equals(pass1,pass2);
     }
 
     public String getAlgorithm() {

core/src/main/java/org/springframework/security/authentication/encoding/MessageDigestPasswordEncoder.java

@@ -1,13 +1,14 @@
 package org.springframework.security.authentication.encoding;
 
+import org.springframework.security.core.codec.Base64;
+import org.springframework.security.core.codec.Hex;
+import org.springframework.security.core.codec.Utf8;
+import org.springframework.util.Assert;
+
 import java.io.UnsupportedEncodingException;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 
-import org.springframework.security.core.codec.Base64;
-import org.springframework.security.core.codec.Hex;
-import org.springframework.util.Assert;
-
 /**
  * Base for digest password encoders.
  * <p>
@@ -92,7 +93,7 @@ public class MessageDigestPasswordEncoder extends BaseDigestPasswordEncoder {
         }
 
         if (getEncodeHashAsBase64()) {
-            return new String(Base64.encode(digest));
+            return Utf8.decode(Base64.encode(digest));
         } else {
             return new String(Hex.encode(digest));
         }
@@ -126,7 +127,7 @@ public class MessageDigestPasswordEncoder extends BaseDigestPasswordEncoder {
         String pass1 = "" + encPass;
         String pass2 = encodePassword(rawPass, salt);
 
-        return pass1.equals(pass2);
+        return PasswordEncoderUtils.equals(pass1,pass2);
     }
 
     public String getAlgorithm() {

core/src/main/java/org/springframework/security/authentication/encoding/PasswordEncoderUtils.java

@@ -0,0 +1,45 @@
+package org.springframework.security.authentication.encoding;
+
+import java.io.UnsupportedEncodingException;
+
+/**
+ * Utility for constant time comparison to prevent against timing attacks.
+ *
+ * @author Rob Winch
+ */
+class PasswordEncoderUtils {
+
+    /**
+     * Constant time comparison to prevent against timing attacks.
+     * @param expected
+     * @param actual
+     * @return
+     */
+    static boolean equals(String expected, String actual) {
+        byte[] expectedBytes = bytesUtf8(expected);
+        byte[] actualBytes = bytesUtf8(actual);
+        int expectedLength = expectedBytes == null ? -1 : expectedBytes.length;
+        int actualLength = actualBytes == null ? -1 : actualBytes.length;
+        if (expectedLength != actualLength) {
+            return false;
+        }
+
+        int result = 0;
+        for (int i = 0; i < expectedLength; i++) {
+            result |= expectedBytes[i] ^ actualBytes[i];
+        }
+        return result == 0;
+    }
+
+    private static byte[] bytesUtf8(String s) {
+        if(s == null) {
+            return null;
+        }
+        try {
+            return s.getBytes("UTF-8");
+        } catch (UnsupportedEncodingException e) {
+            throw new IllegalStateException("Could not get bytes in UTF-8 format",e);
+        }
+    }
+    private PasswordEncoderUtils() {}
+}

core/src/main/java/org/springframework/security/authentication/encoding/PlaintextPasswordEncoder.java

@@ -15,6 +15,8 @@
 
 package org.springframework.security.authentication.encoding;
 
+import java.util.Locale;
+
 /**
  * <p>Plaintext implementation of PasswordEncoder.</p>
  *  <P>As callers may wish to extract the password and salts separately from the encoded password, the salt must
@@ -46,11 +48,12 @@ public class PlaintextPasswordEncoder extends BasePasswordEncoder {
         // authentication will fail as the encodePassword never allows them)
         String pass2 = mergePasswordAndSalt(rawPass, salt, false);
 
-        if (!ignorePasswordCase) {
-            return pass1.equals(pass2);
-        } else {
-            return pass1.equalsIgnoreCase(pass2);
+        if (ignorePasswordCase) {
+            // Note: per String javadoc to get correct results for Locale insensitive, use English
+            pass1 = pass1.toLowerCase(Locale.ENGLISH);
+            pass2 = pass2.toLowerCase(Locale.ENGLISH);
         }
+        return PasswordEncoderUtils.equals(pass1,pass2);
     }
 
     /**

core/src/main/java/org/springframework/security/authentication/jaas/JaasAuthenticationProvider.java

@@ -15,22 +15,6 @@
 
 package org.springframework.security.authentication.jaas;
 
-import java.io.File;
-import java.io.IOException;
-import java.net.URL;
-import java.security.Principal;
-import java.security.Security;
-import java.util.ArrayList;
-import java.util.HashSet;
-import java.util.Set;
-
-import javax.security.auth.callback.Callback;
-import javax.security.auth.callback.CallbackHandler;
-import javax.security.auth.callback.UnsupportedCallbackException;
-import javax.security.auth.login.Configuration;
-import javax.security.auth.login.LoginContext;
-import javax.security.auth.login.LoginException;
-
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.beans.factory.InitializingBean;
@@ -49,6 +33,19 @@ import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.session.SessionDestroyedEvent;
 import org.springframework.util.Assert;
 
+import javax.security.auth.callback.Callback;
+import javax.security.auth.callback.CallbackHandler;
+import javax.security.auth.callback.UnsupportedCallbackException;
+import javax.security.auth.login.Configuration;
+import javax.security.auth.login.LoginContext;
+import javax.security.auth.login.LoginException;
+import java.io.File;
+import java.io.IOException;
+import java.net.URL;
+import java.security.Principal;
+import java.security.Security;
+import java.util.*;
+
 
 /**
  * An {@link AuthenticationProvider} implementation that retrieves user details from a JAAS login configuration.
@@ -185,7 +182,6 @@ public class JaasAuthenticationProvider implements AuthenticationProvider, Appli
 
             // Create a set to hold the authorities, and add any that have already been applied.
             authorities = new HashSet<GrantedAuthority>();
-            authorities.addAll(request.getAuthorities());
 
             // Get the subject principals and pass them to each of the AuthorityGranters
             Set<Principal> principals = loginContext.getSubject().getPrincipals();
@@ -269,14 +265,20 @@ public class JaasAuthenticationProvider implements AuthenticationProvider, Appli
     }
 
     private String convertLoginConfigToUrl() throws IOException {
-        String loginConfigPath = loginConfig.getFile().getAbsolutePath();
-        loginConfigPath.replace(File.separatorChar, '/');
+        String loginConfigPath;
 
-        if (!loginConfigPath.startsWith("/")) {
-            loginConfigPath = "/" + loginConfigPath;
+        try {
+            loginConfigPath = loginConfig.getFile().getAbsolutePath().replace(File.separatorChar, '/');
+
+            if (!loginConfigPath.startsWith("/")) {
+                loginConfigPath = "/" + loginConfigPath;
+            }
+
+            return new URL("file", "", loginConfigPath).toString();
+        } catch (IOException e) {
+            // SEC-1700:  May be inside a jar
+            return loginConfig.getURL().toString();
         }
-
-        return new URL("file", "", loginConfigPath).toString();
     }
 
     /**
@@ -427,7 +429,7 @@ public class JaasAuthenticationProvider implements AuthenticationProvider, Appli
      * If set, a call to {@code Configuration#refresh()} will be made by {@code #configureJaas(Resource) }
      * method. Defaults to {@code true}.
      *
-     * @see <a href="https://jira.springsource.org/browse/SEC-1320">SEC-1230</a>
+     * @see <a href="https://jira.springsource.org/browse/SEC-1320">SEC-1320</a>
      *
      * @param refresh set to {@code false} to disable reloading of the configuration.
      * May be useful in some environments.

core/src/main/java/org/springframework/security/core/AuthenticationException.java

@@ -25,12 +25,12 @@ public abstract class AuthenticationException extends RuntimeException {
     //~ Instance fields ================================================================================================
 
     private Authentication authentication;
-    private Object extraInformation;
+    private transient Object extraInformation;
 
     //~ Constructors ===================================================================================================
 
     /**
-     * Constructs an <code>AuthenticationException</code> with the specified message and root cause.
+     * Constructs an {@code AuthenticationException} with the specified message and root cause.
      *
      * @param msg the detail message
      * @param t the root cause
@@ -40,7 +40,7 @@ public abstract class AuthenticationException extends RuntimeException {
     }
 
     /**
-     * Constructs an <code>AuthenticationException</code> with the specified message and no root cause.
+     * Constructs an {@code AuthenticationException} with the specified message and no root cause.
      *
      * @param msg the detail message
      */
@@ -48,15 +48,22 @@ public abstract class AuthenticationException extends RuntimeException {
         super(msg);
     }
 
+    /**
+     * @deprecated Use the exception message or use a custom exception if you really need additional information.
+     */
+    @Deprecated
     public AuthenticationException(String msg, Object extraInformation) {
         super(msg);
+        if (extraInformation instanceof CredentialsContainer) {
+            ((CredentialsContainer) extraInformation).eraseCredentials();
+        }
         this.extraInformation = extraInformation;
     }
 
     //~ Methods ========================================================================================================
 
     /**
-     * The authentication request which this exception corresponds to (may be <code>null</code>)
+     * The authentication request which this exception corresponds to (may be {@code null})
      */
     public Authentication getAuthentication() {
         return authentication;
@@ -67,14 +74,17 @@ public abstract class AuthenticationException extends RuntimeException {
     }
 
     /**
-     * Any additional information about the exception. Generally a <code>UserDetails</code> object.
+     * Any additional information about the exception. Generally a {@code UserDetails} object.
      *
-     * @return extra information or <code>null</code>
+     * @return extra information or {@code null}
+     * @deprecated Use the exception message or use a custom exception if you really need additional information.
      */
+    @Deprecated
     public Object getExtraInformation() {
         return extraInformation;
     }
 
+    @Deprecated
     public void clearExtraInformation() {
         this.extraInformation = null;
     }

core/src/main/java/org/springframework/security/core/SpringSecurityCoreVersion.java

@@ -25,8 +25,8 @@ public class SpringSecurityCoreVersion {
                         + springVersion + ". Please check your classpath for unwanted jar files.");
             }
 
-            if (springVersion.compareTo("3.0.3") < 0) {
-                logger.warn("You are advised to use Spring 3.0.3 or later with this version. You are running: " +
+            if (springVersion.compareTo("3.0.6") < 0) {
+                logger.warn("You are advised to use Spring 3.0.6 or later with this version. You are running: " +
                     springVersion);
             }
         }

core/src/main/java/org/springframework/security/core/codec/Base64.java

@@ -2,7 +2,7 @@ package org.springframework.security.core.codec;
 
 
 /**
- * Base64 encoder which is a reduced version of Robert Harder's public domain implementation.
+ * Base64 encoder which is a reduced version of Robert Harder's public domain implementation (version 2.3.7).
  * See <a href="http://iharder.net/base64">http://iharder.net/base64</a> for more information.
  * <p>
  * For internal use only.
@@ -101,8 +101,8 @@ public final class Base64 {
         -9,-9,-9,-9,-9,-9,                          // Decimal 91 - 96
         26,27,28,29,30,31,32,33,34,35,36,37,38,     // Letters 'a' through 'm'
         39,40,41,42,43,44,45,46,47,48,49,50,51,     // Letters 'n' through 'z'
-        -9,-9,-9,-9                                 // Decimal 123 - 126
-        /*,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 127 - 139
+        -9,-9,-9,-9,-9                              // Decimal 123 - 127
+        ,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,       // Decimal 128 - 139
         -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 140 - 152
         -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 153 - 165
         -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 166 - 178
@@ -111,7 +111,7 @@ public final class Base64 {
         -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 205 - 217
         -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 218 - 230
         -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 231 - 243
-        -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9         // Decimal 244 - 255 */
+        -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9         // Decimal 244 - 255
     };
 
 
@@ -163,8 +163,8 @@ public final class Base64 {
       -9,                                         // Decimal 96
       26,27,28,29,30,31,32,33,34,35,36,37,38,     // Letters 'a' through 'm'
       39,40,41,42,43,44,45,46,47,48,49,50,51,     // Letters 'n' through 'z'
-      -9,-9,-9,-9                                 // Decimal 123 - 126
-      /*,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 127 - 139
+      -9,-9,-9,-9,-9                              // Decimal 123 - 127
+      ,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 128 - 139
       -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 140 - 152
       -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 153 - 165
       -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 166 - 178
@@ -173,7 +173,7 @@ public final class Base64 {
       -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 205 - 217
       -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 218 - 230
       -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 231 - 243
-      -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9         // Decimal 244 - 255 */
+      -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9         // Decimal 244 - 255
     };
 
 
@@ -228,8 +228,8 @@ public final class Base64 {
       -9,                                         // Decimal 96
       38,39,40,41,42,43,44,45,46,47,48,49,50,     // Letters 'a' through 'm'
       51,52,53,54,55,56,57,58,59,60,61,62,63,     // Letters 'n' through 'z'
-      -9,-9,-9,-9                                 // Decimal 123 - 126
-      /*,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 127 - 139
+      -9,-9,-9,-9,-9                                 // Decimal 123 - 127
+       ,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 128 - 139
         -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 140 - 152
         -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 153 - 165
         -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 166 - 178
@@ -238,7 +238,7 @@ public final class Base64 {
         -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 205 - 217
         -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 218 - 230
         -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,     // Decimal 231 - 243
-        -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9         // Decimal 244 - 255 */
+        -9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9,-9         // Decimal 244 - 255
     };
 
 
@@ -370,10 +370,6 @@ public final class Base64 {
 
 
     /**
-     * Similar to {@link #encodeBytes(byte[], int, int, int)} but returns
-     * a byte array instead of instantiating a String. This is more efficient
-     * if you're working with I/O streams and have large data sets to encode.
-     *
      *
      * @param source The data to convert
      * @param off Offset in array where conversion should begin
@@ -444,7 +440,7 @@ public final class Base64 {
 
 
         // Only resize array if we didn't guess it right.
-        if( e < outBuff.length - 1 ){
+        if( e <= outBuff.length - 1 ){
             byte[] finalOut = new byte[e];
             System.arraycopy(outBuff,0, finalOut,0,e);
             //System.err.println("Having to resize array from " + outBuff.length + " to " + e );
@@ -601,26 +597,24 @@ public final class Base64 {
         byte[] b4        = new byte[4];     // Four byte buffer from source, eliminating white space
         int    b4Posn    = 0;               // Keep track of four byte input buffer
         int    i         = 0;               // Source array counter
-        byte   sbiCrop   = 0;               // Low seven bits (ASCII) of input
         byte   sbiDecode = 0;               // Special value from DECODABET
 
         for( i = off; i < off+len; i++ ) {  // Loop through source
 
-            sbiCrop = (byte)(source[i] & 0x7f); // Only the low seven bits
-            sbiDecode = DECODABET[ sbiCrop ];   // Special value
+            sbiDecode = DECODABET[ source[i]&0xFF ];
 
             // White space, Equals sign, or legit Base64 character
             // Note the values such as -5 and -9 in the
             // DECODABETs at the top of the file.
             if( sbiDecode >= WHITE_SPACE_ENC )  {
                 if( sbiDecode >= EQUALS_SIGN_ENC ) {
-                    b4[ b4Posn++ ] = sbiCrop;           // Save non-whitespace
+                    b4[ b4Posn++ ] = source[i];         // Save non-whitespace
                     if( b4Posn > 3 ) {                  // Time to decode?
                         outBuffPosn += decode4to3( b4, 0, outBuff, outBuffPosn, options );
                         b4Posn = 0;
 
                         // If that was the equals sign, break out of 'for' loop
-                        if( sbiCrop == EQUALS_SIGN ) {
+                        if( source[i] == EQUALS_SIGN ) {
                             break;
                         }
                     }
@@ -629,7 +623,7 @@ public final class Base64 {
             else {
                 // There's a bad input character in the Base64 stream.
                 throw new InvalidBase64CharacterException( String.format(
-                "Bad Base64 input character '%c' in array position %d", source[i], i ) );
+                "Bad Base64 input character decimal %d in array position %d", ((int)source[i])&0xFF, i ) );
             }
         }
 

core/src/main/java/org/springframework/security/core/codec/Utf8.java

@@ -0,0 +1,44 @@
+package org.springframework.security.core.codec;
+
+import java.nio.ByteBuffer;
+import java.nio.CharBuffer;
+import java.nio.charset.CharacterCodingException;
+import java.nio.charset.Charset;
+import java.util.*;
+
+/**
+ * UTF-8 Charset encoder/decoder.
+ * <p>
+ * For internal use only.
+ *
+ * @author Luke Taylor
+ */
+public final class Utf8 {
+    private static final Charset CHARSET = Charset.forName("UTF-8");
+
+    /**
+     * Get the bytes of the String in UTF-8 encoded form.
+     */
+    public static byte[] encode(CharSequence string) {
+        try {
+            ByteBuffer bytes = CHARSET.newEncoder().encode(CharBuffer.wrap(string));
+
+            byte[] copy = new byte[bytes.limit()];
+            System.arraycopy(bytes.array(), 0, copy, 0, bytes.limit());
+            return copy;
+        } catch (CharacterCodingException e) {
+            throw new IllegalArgumentException("Encoding failed", e);
+        }
+    }
+
+    /**
+     * Decode the bytes in UTF-8 form into a String.
+     */
+    public static String decode(byte[] bytes) {
+        try {
+            return CHARSET.newDecoder().decode(ByteBuffer.wrap(bytes)).toString();
+        } catch (CharacterCodingException e) {
+            throw new IllegalArgumentException("Decoding failed", e);
+        }
+    }
+}

core/src/main/java/org/springframework/security/core/userdetails/UsernameNotFoundException.java

@@ -37,19 +37,19 @@ public class UsernameNotFoundException extends AuthenticationException {
     }
 
     /**
-     * Constructs a <code>UsernameNotFoundException</code>, making use of the <tt>extraInformation</tt>
+     * Constructs a {@code UsernameNotFoundException}, making use of the {@code extraInformation}
      * property of the superclass.
      *
      * @param msg the detail message
      * @param extraInformation additional information such as the username.
      */
+    @Deprecated
     public UsernameNotFoundException(String msg, Object extraInformation) {
         super(msg, extraInformation);
     }
 
     /**
-     * Constructs a <code>UsernameNotFoundException</code> with the specified
-     * message and root cause.
+     * Constructs a {@code UsernameNotFoundException} with the specified message and root cause.
      *
      * @param msg the detail message.
      * @param t root cause

core/src/main/java/org/springframework/security/remoting/rmi/ContextPropagatingRemoteInvocation.java

@@ -15,32 +15,30 @@
 
 package org.springframework.security.remoting.rmi;
 
-import org.springframework.security.core.context.SecurityContext;
-import org.springframework.security.core.context.SecurityContextHolder;
-
 import org.aopalliance.intercept.MethodInvocation;
-
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
-
 import org.springframework.remoting.support.RemoteInvocation;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
 
 import java.lang.reflect.InvocationTargetException;
 
 
 /**
- * The actual <code>RemoteInvocation</code> that is passed from the client to the server, which contains the
- * contents of {@link SecurityContextHolder}, being a {@link SecurityContext} object.
+ * The actual {@code RemoteInvocation} that is passed from the client to the server.
  * <p>
- * When constructed on the client via {@link ContextPropagatingRemoteInvocationFactory}, the contents of the
- * <code>SecurityContext</code> are stored inside the object. The object is then passed to the server that is
- * processing the remote invocation. Upon the server invoking the remote invocation, it will retrieve the passed
- * contents of the <code>SecurityContextHolder</code> and set them on the server-side
- * <code>SecurityContextHolder</code> while the target object is invoked. When the target invocation has been
- * completed, the security context will be cleared using a call to {@link SecurityContextHolder#clearContext()}.
+ * The principal and credentials information will be extracted from the current
+ * security context and passed to the server as part of the invocation object.
+ * <p>
+ * To avoid potential serialization-based attacks, this implementation interprets the values as {@code String}s
+ * and creates a {@code UsernamePasswordAuthenticationToken} on the server side to hold them. If a different
+ * token type is required you can override the {@code createAuthenticationRequest} method.
  *
  * @author James Monaghan
  * @author Ben Alex
+ * @author Luke Taylor
  */
 public class ContextPropagatingRemoteInvocation extends RemoteInvocation {
     //~ Static fields/initializers =====================================================================================
@@ -49,34 +47,40 @@ public class ContextPropagatingRemoteInvocation extends RemoteInvocation {
 
     //~ Instance fields ================================================================================================
 
-    private SecurityContext securityContext;
+    private final String principal;
+    private final String credentials;
 
     //~ Constructors ===================================================================================================
 
     /**
-     * Constructs the object, storing the value of the client-side
-     * <code>SecurityContextHolder</code> inside the object.
+     * Constructs the object, storing the principal and credentials extracted from the client-side
+     * security context.
      *
      * @param methodInvocation the method to invoke
      */
     public ContextPropagatingRemoteInvocation(MethodInvocation methodInvocation) {
         super(methodInvocation);
-        securityContext = SecurityContextHolder.getContext();
+        Authentication currentUser = SecurityContextHolder.getContext().getAuthentication();
+
+        if (currentUser != null) {
+            principal = currentUser.getPrincipal().toString();
+            credentials = currentUser.getCredentials().toString();
+        } else {
+            principal = credentials = null;
+        }
 
         if (logger.isDebugEnabled()) {
-            logger.debug("RemoteInvocation now has SecurityContext: " + securityContext);
+            logger.debug("RemoteInvocation now has principal: " + principal);
         }
     }
 
     //~ Methods ========================================================================================================
 
     /**
-     * Invoked on the server-side as described in the class JavaDocs.
+     * Invoked on the server-side.
      * <p>
-     * Invocations will always have their {@link org.springframework.security.core.Authentication#setAuthenticated(boolean)}
-     * set to <code>false</code>, which is guaranteed to always be accepted by <code>Authentication</code>
-     * implementations. This ensures that even remotely authenticated <code>Authentication</code>s will be untrusted by
-     * the server-side, which is an appropriate security measure.
+     * The transmitted principal and credentials will be used to create an unauthenticated {@code Authentication}
+     * instance for processing by the {@code AuthenticationManager}.
      *
      * @param targetObject the target object to apply the invocation to
      *
@@ -88,15 +92,15 @@ public class ContextPropagatingRemoteInvocation extends RemoteInvocation {
      */
     public Object invoke(Object targetObject)
             throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
-        SecurityContextHolder.setContext(securityContext);
 
-        if ((SecurityContextHolder.getContext() != null)
-            && (SecurityContextHolder.getContext().getAuthentication() != null)) {
-            SecurityContextHolder.getContext().getAuthentication().setAuthenticated(false);
-        }
+        if (principal != null) {
+            Authentication request = createAuthenticationRequest(principal, credentials);
+            request.setAuthenticated(false);
+            SecurityContextHolder.getContext().setAuthentication(request);
 
-        if (logger.isDebugEnabled()) {
-            logger.debug("Set SecurityContextHolder to contain: " + securityContext);
+            if (logger.isDebugEnabled()) {
+                logger.debug("Set SecurityContextHolder to contain: " + request);
+            }
         }
 
         try {
@@ -109,4 +113,11 @@ public class ContextPropagatingRemoteInvocation extends RemoteInvocation {
             }
         }
     }
+
+    /**
+     * Creates the server-side authentication request object.
+     */
+    protected Authentication createAuthenticationRequest(String principal, String credentials) {
+        return new UsernamePasswordAuthenticationToken(principal, credentials);
+    }
 }

core/src/main/resources/org/springframework/security/messages.properties

@@ -1,54 +1,42 @@
-AuthByAdapterProvider.incorrectKey=The presented AuthByAdapter implementation does not contain the expected key
-BasicAclEntryAfterInvocationProvider.noPermission=Authentication {0} has NO permissions at all to the domain object {1}
-BasicAclEntryAfterInvocationProvider.insufficientPermission=Authentication {0} has ACL permissions to the domain object, but not the required ACL permission to the domain object {1}
-ConcurrentSessionControllerImpl.exceededAllowed=Maximum sessions of {0} for this principal exceeded
-ProviderManager.providerNotFound=No AuthenticationProvider found for {0}
-AnonymousAuthenticationProvider.incorrectKey=The presented AnonymousAuthenticationToken does not contain the expected key
-CasAuthenticationProvider.incorrectKey=The presented CasAuthenticationToken does not contain the expected key
-CasAuthenticationProvider.noServiceTicket=Failed to provide a CAS service ticket to validate
-NamedCasProxyDecider.untrusted=Nearest proxy {0} is untrusted
-RejectProxyTickets.reject=Proxy tickets are rejected
+AbstractAccessDecisionManager.accessDenied=Access is denied
 AbstractSecurityInterceptor.authenticationNotFound=An Authentication object was not found in the SecurityContext
-AbstractUserDetailsAuthenticationProvider.onlySupports=Only UsernamePasswordAuthenticationToken is supported
-AbstractUserDetailsAuthenticationProvider.locked=User account is locked
+AbstractUserDetailsAuthenticationProvider.badCredentials=Bad credentials
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=User credentials have expired
 AbstractUserDetailsAuthenticationProvider.disabled=User is disabled
 AbstractUserDetailsAuthenticationProvider.expired=User account has expired
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=User credentials have expired
-AbstractUserDetailsAuthenticationProvider.badCredentials=Bad credentials
-X509AuthenticationProvider.certificateNull=Certificate is null
-DaoX509AuthoritiesPopulator.noMatching=No matching pattern was found in subjectDN: {0}
+AbstractUserDetailsAuthenticationProvider.locked=User account is locked
+AbstractUserDetailsAuthenticationProvider.onlySupports=Only UsernamePasswordAuthenticationToken is supported
+AccountStatusUserDetailsChecker.credentialsExpired=User credentials have expired
+AccountStatusUserDetailsChecker.disabled=User is disabled
+AccountStatusUserDetailsChecker.expired=User account has expired
+AccountStatusUserDetailsChecker.locked=User account is locked
+AclEntryAfterInvocationProvider.noPermission=Authentication {0} has NO permissions to the domain object {1}
+AnonymousAuthenticationProvider.incorrectKey=The presented AnonymousAuthenticationToken does not contain the expected key
+BindAuthenticator.badCredentials=Bad credentials
+BindAuthenticator.emptyPassword=Emtpy Password
+CasAuthenticationProvider.incorrectKey=The presented CasAuthenticationToken does not contain the expected key
+CasAuthenticationProvider.noServiceTicket=Failed to provide a CAS service ticket to validate
+ConcurrentSessionControlStrategy.exceededAllowed=Maximum sessions of {0} for this principal exceeded
+DigestAuthenticationFilter.incorrectRealm=Response realm name {0} does not match system realm name of {1}
+DigestAuthenticationFilter.incorrectResponse=Incorrect response
+DigestAuthenticationFilter.missingAuth=Missing mandatory digest value for 'auth' QOP; received header {0}
+DigestAuthenticationFilter.missingMandatory=Missing mandatory digest value; received header {0}
+DigestAuthenticationFilter.nonceCompromised=Nonce token compromised {0}
+DigestAuthenticationFilter.nonceEncoding=Nonce is not encoded in Base64; received nonce {0}
+DigestAuthenticationFilter.nonceExpired=Nonce has expired/timed out
+DigestAuthenticationFilter.nonceNotNumeric=Nonce token should have yielded a numeric first token, but was {0}
+DigestAuthenticationFilter.nonceNotTwoTokens=Nonce should have yielded two tokens but was {0}
+DigestAuthenticationFilter.usernameNotFound=Username {0} not found
+JdbcDaoImpl.noAuthority=User {0} has no GrantedAuthority
+JdbcDaoImpl.notFound=User {0} not found
+LdapAuthenticationProvider.badCredentials=Bad credentials
+LdapAuthenticationProvider.emptyUsername=Empty username not allowed
+LdapAuthenticationProvider.onlySupports=Only UsernamePasswordAuthenticationToken is supported
+PasswordComparisonAuthenticator.badCredentials=Bad credentials
+PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound=No AuthenticationProvider found for {0}
 RememberMeAuthenticationProvider.incorrectKey=The presented RememberMeAuthenticationToken does not contain the expected key
 RunAsImplAuthenticationProvider.incorrectKey=The presented RunAsUserToken does not contain the expected key
-DigestProcessingFilter.missingMandatory=Missing mandatory digest value; received header {0}
-DigestProcessingFilter.missingAuth=Missing mandatory digest value for 'auth' QOP; received header {0}
-DigestProcessingFilter.incorrectRealm=Response realm name {0} does not match system realm name of {1}
-DigestProcessingFilter.nonceExpired=Nonce has expired/timed out
-DigestProcessingFilter.nonceEncoding=Nonce is not encoded in Base64; received nonce {0}
-DigestProcessingFilter.nonceNotTwoTokens=Nonce should have yielded two tokens but was {0}
-DigestProcessingFilter.nonceNotNumeric=Nonce token should have yielded a numeric first token, but was {0}
-DigestProcessingFilter.nonceCompromised=Nonce token compromised {0}
-DigestProcessingFilter.usernameNotFound=Username {0} not found
-DigestProcessingFilter.incorrectResponse=Incorrect response
-JdbcDaoImpl.notFound=User {0} not found
-JdbcDaoImpl.noAuthority=User {0} has no GrantedAuthority
-SwitchUserProcessingFilter.noCurrentUser=No current user associated with this request
-SwitchUserProcessingFilter.noOriginalAuthentication=Could not find original Authentication object
-SwitchUserProcessingFilter.usernameNotFound=Username {0} not found
-SwitchUserProcessingFilter.locked=User account is locked
-SwitchUserProcessingFilter.disabled=User is disabled
-SwitchUserProcessingFilter.expired=User account has expired
-SwitchUserProcessingFilter.credentialsExpired=User credentials have expired
-AbstractAccessDecisionManager.accessDenied=Access is denied
-LdapAuthenticationProvider.emptyUsername=Empty username not allowed
-LdapAuthenticationProvider.emptyPassword=Bad credentials
-DefaultIntitalDirContextFactory.communicationFailure=Unable to connect to LDAP server
-DefaultIntitalDirContextFactory.badCredentials=Bad credentials
-DefaultIntitalDirContextFactory.unexpectedException=Failed to obtain InitialDirContext due to unexpected exception
-PasswordComparisonAuthenticator.badCredentials=Bad credentials
-BindAuthenticator.badCredentials=Bad credentials
-BindAuthenticator.failedToLoadAttributes=Bad credentials
-UserDetailsService.locked=User account is locked
-UserDetailsService.disabled=User is disabled
-UserDetailsService.expired=User account has expired
-UserDetailsService.credentialsExpired=User credentials have expired
-
+SubjectDnX509PrincipalExtractor.noMatching=No matching pattern was found in subjectDN: {0}
+SwitchUserFilter.noCurrentUser=No current user associated with this request
+SwitchUserFilter.noOriginalAuthentication=Could not find original Authentication object

core/src/main/resources/org/springframework/security/messages_cs_CZ.properties

@@ -1,47 +1,42 @@
-AuthByAdapterProvider.incorrectKey=Pou\u017eit\u00e1 implementace AuthByAdapter neobsahuje o\u010dek\u00e1van\u00fd kl\u00ed\u010d
-BasicAclEntryAfterInvocationProvider.noPermission=Autentizovan\u00fd u\u017eivatel {0} nem\u00e1 \u017d\u00c1DN\u00c1 pr\u00e1va k objektu {1}
-BasicAclEntryAfterInvocationProvider.insufficientPermission=Autentizovan\u00fd u\u017eivatel {0} nem\u00e1 po\u017eadovan\u00e1 opr\u00e1vn\u011bn\u00ed k objektu {1}
-ConcurrentSessionControllerImpl.exceededAllowed=Maxim\u00e1ln\u00ed po\u010det sou\u010dasn\u00fdch p\u0159ihl\u00e1\u0161en\u00ed {0} tohoto u\u017eivatele je p\u0159ekro\u010den.
-ProviderManager.providerNotFound=Nebyl nalezen \u017e\u00e1dn\u00fd AuthenticationProvider pro {0}
-AnonymousAuthenticationProvider.incorrectKey=Pou\u017eit\u00fd AnonymousAuthenticationToken neobsahuje o\u010dek\u00e1van\u00fd kl\u00ed\u010d
-CasAuthenticationProvider.incorrectKey=Pou\u017eit\u00fd CasAuthenticationToken neobsahuje o\u010dek\u00e1van\u00fd kl\u00ed\u010d
-CasAuthenticationProvider.noServiceTicket=Nepoda\u0159ilo se z\u00edskat otisk CAS (centr\u00e1ln\u00ed autentiza\u010dn\u00ed autority) k ov\u011b\u0159en\u00ed autenticity u\u017eivatele.
-NamedCasProxyDecider.untrusted=Nelze v\u011b\u0159it nejbli\u017e\u0161\u00ed proxy {0}
-RejectProxyTickets.reject=Otisky proxy jsou odm\u00edtnuty
-AbstractSecurityInterceptor.authenticationNotFound=Nebyl nalezen \u017e\u00e1dn\u00fd Authentication objekt v SecurityContext
-AbstractUserDetailsAuthenticationProvider.onlySupports=Je podporov\u00e1n pouze UsernamePasswordAuthenticationToken
-AbstractUserDetailsAuthenticationProvider.locked=U\u017eivatelsk\u00fd \u00fa\u010det je uzam\u010den
-AbstractUserDetailsAuthenticationProvider.disabled=U\u017eivatelsk\u00fd \u00fa\u010det nen\u00ed aktivn\u00ed
-AbstractUserDetailsAuthenticationProvider.expired=Platnost u\u017eivatelsk\u00e9ho \u00fa\u010dtu vypr\u0161ela
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=Platnost u\u017eivatelsk\u00e9ho hesla vypr\u0161ela
-AbstractUserDetailsAuthenticationProvider.badCredentials=\u0160patn\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje
-X509AuthenticationProvider.certificateNull=Certifik\u00e1t je pr\u00e1zdn\u00fd
-DaoX509AuthoritiesPopulator.noMatching=V subjectDN nebyl nalezen \u017e\u00e1dn\u00fd \u0159et\u011bzec odpov\u00eddaj\u00edc\u00ed vy\u017eadovan\u00e9 masce: {0}
-RememberMeAuthenticationProvider.incorrectKey=Pou\u017eit\u00fd RememberMeAuthenticationToken neobsahuje o\u010dek\u00e1van\u00fd kl\u00ed\u010d
-RunAsImplAuthenticationProvider.incorrectKey=Pou\u017eit\u00fd RunAsUserToken neobsahuje o\u010dek\u00e1van\u00fd kl\u00ed\u010d
-DigestProcessingFilter.missingMandatory=Chyb\u00ed povinn\u00e1 kl\u00ed\u010dov\u00e1 polo\u017eka; p\u0159ijat\u00e1 hlavi\u010dka {0}
-DigestProcessingFilter.missingAuth=Chyb\u00ed povinn\u00e1 kl\u00ed\u010dov\u00e1 polo\u017eka 'auth' QOP (\u00farove\u0148 bezpe\u010dnosti RFC 2617); p\u0159ijat\u00e1 hlavi\u010dka {0}
-DigestProcessingFilter.incorrectRealm=Oblast odpov\u011bdi {0} neodpov\u00edd\u00e1 syst\u00e9mov\u00e9 oblasti {1}
-DigestProcessingFilter.nonceExpired=Kryptovan\u00fd kl\u00ed\u010d (nonce) vypr\u0161el
-DigestProcessingFilter.nonceEncoding=Kryptovan\u00fd kl\u00ed\u010d (nonce) nen\u00ed p\u0159ek\u00e9dov\u00e1n do Base60; p\u0159ijat\u00fd kl\u00ed\u010d {0}
-DigestProcessingFilter.nonceNotTwoTokens=Kryptovan\u00fd kl\u00ed\u010d (nonce) by m\u011bl b\u00fdt slo\u017een ze dvou \u010d\u00e1st\u00ed {0}
-DigestProcessingFilter.nonceNotNumeric=Kryptovan\u00fd kl\u00ed\u010d (nonce) by m\u011bl m\u00edt prvn\u00ed \u010d\u00e1st \u010d\u00edselnou, ale je {0}
-DigestProcessingFilter.nonceCompromised=Kryptovan\u00fd kl\u00ed\u010d (nonce) je znehodnocen\u00fd {0}
-DigestProcessingFilter.usernameNotFound=U\u017eivatelsk\u00e9 jm\u00e9no {0} nebylo nalezeno
-DigestProcessingFilter.incorrectResponse=Vadn\u00e1 odpov\u011b\u010f
-SwitchUserProcessingFilter.noCurrentUser=\u017d\u00e1dn\u00fd u\u017eivatel nen\u00ed asociov\u00e1n s t\u00edmto po\u017eadavkem
-SwitchUserProcessingFilter.noOriginalAuthentication=Nepoda\u0159ilo se nal\u00e9zt p\u016fvodn\u00ed Authentication objekt
-SwitchUserProcessingFilter.usernameNotFound=U\u017eivatelsk\u00e9 jm\u00e9no {0} nebylo nalezeno
-SwitchUserProcessingFilter.locked=U\u017eivatelsk\u00fd \u00fa\u010det je uzam\u010den
-SwitchUserProcessingFilter.disabled=U\u017eivatelsk\u00fd \u00fa\u010det nen\u00ed aktivn\u00ed
-SwitchUserProcessingFilter.expired=Platnost u\u017eivatelsk\u00e9ho \u00fa\u010dtu vypr\u0161ela
-SwitchUserProcessingFilter.credentialsExpired=Platnost u\u017eivatelsk\u00e9ho hesla vypr\u0161ela
-AbstractAccessDecisionManager.accessDenied=P\u0159\u00edstup odep\u0159en
-LdapAuthenticationProvider.emptyUsername=Nen\u00ed povoleno pr\u00e1zdn\u00e9 u\u017eivatelsk\u00e9 jm\u00e9no
-LdapAuthenticationProvider.emptyPassword=\u0160patn\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje
-DefaultIntitalDirContextFactory.communicationFailure=Nen\u00ed mo\u017en\u00e9 se p\u0159ipojit k LDAP serveru
-DefaultIntitalDirContextFactory.badCredentials=\u0160patn\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje
-DefaultIntitalDirContextFactory.unexpectedException=Nepoda\u0159ilo se z\u00edskat InitialDirContext d\u00edky neo\u010dek\u00e1van\u00e9 vyj\u00edmce
-PasswordComparisonAuthenticator.badCredentials=\u0160patn\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje
-BindAuthenticator.badCredentials=\u0160patn\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje
-BindAuthenticator.failedToLoadAttributes=\u0160patn\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje
+AbstractAccessDecisionManager.accessDenied=P\u0159\u00EDstup odep\u0159en
+AbstractSecurityInterceptor.authenticationNotFound=Nebyl nalezen \u017E\u00E1dn\u00FD Authentication objekt v SecurityContext
+AbstractUserDetailsAuthenticationProvider.badCredentials=\u0160patn\u00E9 p\u0159ihla\u0161ovac\u00ED \u00FAdaje
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=Platnost u\u017Eivatelsk\u00E9ho hesla vypr\u0161ela
+AbstractUserDetailsAuthenticationProvider.disabled=U\u017Eivatelsk\u00FD \u00FA\u010Det nen\u00ED aktivn\u00ED
+AbstractUserDetailsAuthenticationProvider.expired=Platnost u\u017Eivatelsk\u00E9ho \u00FA\u010Dtu vypr\u0161ela
+AbstractUserDetailsAuthenticationProvider.locked=U\u017Eivatelsk\u00FD \u00FA\u010Det je uzam\u010Den
+AbstractUserDetailsAuthenticationProvider.onlySupports=Je podporov\u00E1n pouze UsernamePasswordAuthenticationToken
+AccountStatusUserDetailsChecker.credentialsExpired=Platnost u\u017Eivatelsk\u00E9ho hesla vypr\u0161ela
+AccountStatusUserDetailsChecker.disabled=U\u017Eivatelsk\u00FD \u00FA\u010Det nen\u00ED aktivn\u00ED
+AccountStatusUserDetailsChecker.expired=Platnost u\u017Eivatelsk\u00E9ho \u00FA\u010Dtu vypr\u0161ela
+AccountStatusUserDetailsChecker.locked=U\u017Eivatelsk\u00FD \u00FA\u010Det je uzam\u010Den
+AclEntryAfterInvocationProvider.noPermission=Autentizovan\u00FD u\u017Eivatel {0} nem\u00E1 \u017D\u00C1DN\u00C1 pr\u00E1va k objektu {1}
+AnonymousAuthenticationProvider.incorrectKey=Pou\u017Eit\u00FD AnonymousAuthenticationToken neobsahuje o\u010Dek\u00E1van\u00FD kl\u00ED\u010D
+BindAuthenticator.badCredentials=\u0160patn\u00E9 p\u0159ihla\u0161ovac\u00ED \u00FAdaje
+BindAuthenticator.emptyPassword=\u0160patn\u00E9 p\u0159ihla\u0161ovac\u00ED \u00FAdaje
+CasAuthenticationProvider.incorrectKey=Pou\u017Eit\u00FD CasAuthenticationToken neobsahuje o\u010Dek\u00E1van\u00FD kl\u00ED\u010D
+CasAuthenticationProvider.noServiceTicket=Nepoda\u0159ilo se z\u00EDskat otisk CAS (centr\u00E1ln\u00ED autentiza\u010Dn\u00ED autority) k ov\u011B\u0159en\u00ED autenticity u\u017Eivatele.
+ConcurrentSessionControlStrategy.exceededAllowed=Maxim\u00E1ln\u00ED po\u010Det sou\u010Dasn\u00FDch p\u0159ihl\u00E1\u0161en\u00ED {0} tohoto u\u017Eivatele je p\u0159ekro\u010Den.
+DigestAuthenticationFilter.incorrectRealm=Oblast odpov\u011Bdi {0} neodpov\u00EDd\u00E1 syst\u00E9mov\u00E9 oblasti {1}
+DigestAuthenticationFilter.incorrectResponse=Vadn\u00E1 odpov\u011B\u010F
+DigestAuthenticationFilter.missingAuth=Chyb\u00ED povinn\u00E1 kl\u00ED\u010Dov\u00E1 polo\u017Eka 'auth' QOP (\u00FArove\u0148 bezpe\u010Dnosti RFC 2617); p\u0159ijat\u00E1 hlavi\u010Dka {0}
+DigestAuthenticationFilter.missingMandatory=Chyb\u00ED povinn\u00E1 kl\u00ED\u010Dov\u00E1 polo\u017Eka; p\u0159ijat\u00E1 hlavi\u010Dka {0}
+DigestAuthenticationFilter.nonceCompromised=Kryptovan\u00FD kl\u00ED\u010D (nonce) je znehodnocen\u00FD {0}
+DigestAuthenticationFilter.nonceEncoding=Kryptovan\u00FD kl\u00ED\u010D (nonce) nen\u00ED p\u0159ek\u00E9dov\u00E1n do Base60; p\u0159ijat\u00FD kl\u00ED\u010D {0}
+DigestAuthenticationFilter.nonceExpired=Kryptovan\u00FD kl\u00ED\u010D (nonce) vypr\u0161el
+DigestAuthenticationFilter.nonceNotNumeric=Kryptovan\u00FD kl\u00ED\u010D (nonce) by m\u011Bl m\u00EDt prvn\u00ED \u010D\u00E1st \u010D\u00EDselnou, ale je {0}
+DigestAuthenticationFilter.nonceNotTwoTokens=Kryptovan\u00FD kl\u00ED\u010D (nonce) by m\u011Bl b\u00FDt slo\u017Een ze dvou \u010D\u00E1st\u00ED {0}
+DigestAuthenticationFilter.usernameNotFound=U\u017Eivatelsk\u00E9 jm\u00E9no {0} nebylo nalezeno
+#JdbcDaoImpl.noAuthority=User {0} has no GrantedAuthority
+#JdbcDaoImpl.notFound=User {0} not found
+LdapAuthenticationProvider.badCredentials=\u0160patn\u00E9 p\u0159ihla\u0161ovac\u00ED \u00FAdaje
+LdapAuthenticationProvider.emptyUsername=Nen\u00ED povoleno pr\u00E1zdn\u00E9 u\u017Eivatelsk\u00E9 jm\u00E9no
+LdapAuthenticationProvider.onlySupports=Je podporov\u00E1n pouze UsernamePasswordAuthenticationToken
+PasswordComparisonAuthenticator.badCredentials=\u0160patn\u00E9 p\u0159ihla\u0161ovac\u00ED \u00FAdaje
+#PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound=Nebyl nalezen \u017E\u00E1dn\u00FD AuthenticationProvider pro {0}
+RememberMeAuthenticationProvider.incorrectKey=Pou\u017Eit\u00FD RememberMeAuthenticationToken neobsahuje o\u010Dek\u00E1van\u00FD kl\u00ED\u010D
+RunAsImplAuthenticationProvider.incorrectKey=Pou\u017Eit\u00FD RunAsUserToken neobsahuje o\u010Dek\u00E1van\u00FD kl\u00ED\u010D
+SubjectDnX509PrincipalExtractor.noMatching=V subjectDN nebyl nalezen \u017E\u00E1dn\u00FD \u0159et\u011Bzec odpov\u00EDdaj\u00EDc\u00ED vy\u017Eadovan\u00E9 masce\: {0}
+SwitchUserFilter.noCurrentUser=\u017D\u00E1dn\u00FD u\u017Eivatel nen\u00ED asociov\u00E1n s t\u00EDmto po\u017Eadavkem
+SwitchUserFilter.noOriginalAuthentication=Nepoda\u0159ilo se nal\u00E9zt p\u016Fvodn\u00ED Authentication objekt

core/src/main/resources/org/springframework/security/messages_de.properties

@@ -1,48 +1,42 @@
-AuthByAdapterProvider.incorrectKey=Die angegebene AuthByAdapter-Implementierung enthält nicht den erwarteten Schlüssel
-BasicAclEntryAfterInvocationProvider.noPermission=Authentifikation {0} hat KEINE Berechtigungen bezüglich des Domänen-Objekts {1}
-BasicAclEntryAfterInvocationProvider.insufficientPermission=Authentifikation {0} hat keine ausreichenden ACL-Berechtigungen bezüglich des Domänen-Objekts {1}
-ConcurrentSessionControllerImpl.exceededAllowed=Die maximale Sitzungs-Anzahl von {0} für diesen Nutzer wurde überschritten
-ProviderManager.providerNotFound=Für {0} wurde kein AuthenticationProvider gefunden
-AnonymousAuthenticationProvider.incorrectKey=Das angegebene AnonymousAuthenticationToken enthält nicht den erwarteten Schlüssel
-CasAuthenticationProvider.incorrectKey=Das angegebene CasAuthenticationToken enthält nicht den erwarteten Schlüssel
-CasAuthenticationProvider.noServiceTicket=Es konnte kein CAS Service-Ticket zur Prüfung geliefert werden
-NamedCasProxyDecider.untrusted=Der nächste Proxy {0} ist nicht vertrauenswürdig
-RejectProxyTickets.reject=Proxy-Tickets sind abgelehnt
-AbstractSecurityInterceptor.authenticationNotFound=Im SecurityContext wurde keine Authentifikation gefunden
-AbstractUserDetailsAuthenticationProvider.onlySupports=Nur UsernamePasswordAuthenticationToken wird unterstützt
-AbstractUserDetailsAuthenticationProvider.locked=Das Benutzerkonto ist gesperrt
-AbstractUserDetailsAuthenticationProvider.disabled=Der Benutzer ist deaktiviert
-AbstractUserDetailsAuthenticationProvider.expired=Die Gültigkeit des Benutzerkontos ist abgelaufen
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=Die Gültigkeit der Benutzerberechtigungen ist abgelaufen
-AbstractUserDetailsAuthenticationProvider.badCredentials=Ungültige Benutzerberechtigungen
-X509AuthenticationProvider.certificateNull=Zertifikat ist nicht gesetzt
-DaoX509AuthoritiesPopulator.noMatching=Kein passendes Muster gefunden in subjectDN: {0}
-RememberMeAuthenticationProvider.incorrectKey=Das angegebene RememberMeAuthenticationToken enthält nicht den erwarteten Schlüssel
-RunAsImplAuthenticationProvider.incorrectKey=Das angegebene RunAsUserToken enthält nicht den erwarteten Schlüssel
-DigestProcessingFilter.missingMandatory=Erforderlicher Digest-Wert fehlt; Empfangener Header {0}
-DigestProcessingFilter.missingAuth=Erforderlicher Digest-Wert fehlt für 'auth' QOP; Empfangener Header {0}
-DigestProcessingFilter.incorrectRealm=Realm-Name in Antwort {0} entspricht nicht dem Namen des System-Realms {1}
-DigestProcessingFilter.nonceExpired=Die Nonce ist nicht mehr gültig
-DigestProcessingFilter.nonceEncoding=Die Nonce ist nicht in Base64 kodiert; Empfangene Nonce {0}
-DigestProcessingFilter.nonceNotTwoTokens=Nonce sollte zwei Elemente beinhalten. Gefundener Inhalt: {0}
-DigestProcessingFilter.nonceNotNumeric=Das erste Element der Nonce sollte numerisch sein. Gefundener Inhalt: {0}
-DigestProcessingFilter.nonceCompromised=Das Nonce-Element ist kompromittiert {0}
-DigestProcessingFilter.usernameNotFound=Benutzername {0} wurde nicht gefunden
-DigestProcessingFilter.incorrectResponse=Fehlerhafte Antwort
-SwitchUserProcessingFilter.noCurrentUser=Mit dieser Anfrage ist kein aktueller Benutzer assoziiert
-SwitchUserProcessingFilter.noOriginalAuthentication=Kann das ursprüngliche Authentifikationsobjekt nicht finden
-SwitchUserProcessingFilter.usernameNotFound=Benutzername {0} wurde nicht gefunden
-SwitchUserProcessingFilter.locked=Das Benutzerkonto ist gesperrt
-SwitchUserProcessingFilter.disabled=Der Benutzer ist deaktiviert
-SwitchUserProcessingFilter.expired=Die Gültigkeit des Benutzerkontos ist abgelaufen
-SwitchUserProcessingFilter.credentialsExpired=Die Gültigkeit der Benutzerberechtigungen ist abgelaufen
 AbstractAccessDecisionManager.accessDenied=Zugriff verweigert
+AbstractSecurityInterceptor.authenticationNotFound=Im SecurityContext wurde keine Authentifikation gefunden
+AbstractUserDetailsAuthenticationProvider.badCredentials=Ung\u00FCltige Benutzerberechtigungen
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=Die G\u00FCltigkeit der Benutzerberechtigungen ist abgelaufen
+AbstractUserDetailsAuthenticationProvider.disabled=Der Benutzer ist deaktiviert
+AbstractUserDetailsAuthenticationProvider.expired=Die G\u00FCltigkeit des Benutzerkontos ist abgelaufen
+AbstractUserDetailsAuthenticationProvider.locked=Das Benutzerkonto ist gesperrt
+AbstractUserDetailsAuthenticationProvider.onlySupports=Nur UsernamePasswordAuthenticationToken wird unterst\u00FCtzt
+AccountStatusUserDetailsChecker.credentialsExpired=Die G\u00FCltigkeit der Benutzerberechtigungen ist abgelaufen
+AccountStatusUserDetailsChecker.disabled=Der Benutzer ist deaktiviert
+AccountStatusUserDetailsChecker.expired=Die G\u00FCltigkeit des Benutzerkontos ist abgelaufen
+AccountStatusUserDetailsChecker.locked=Das Benutzerkonto ist gesperrt
+AclEntryAfterInvocationProvider.noPermission=Authentifikation {0} hat KEINE Berechtigungen bez\u00FCglich des Dom\u00E4nen-Objekts {1}
+AnonymousAuthenticationProvider.incorrectKey=Das angegebene AnonymousAuthenticationToken enth\u00E4lt nicht den erwarteten Schl\u00FCssel
+BindAuthenticator.badCredentials=Ung\u00FCltige Benutzerberechtigungen
+BindAuthenticator.emptyPassword=Ung\u00FCltige Benutzerberechtigungen
+CasAuthenticationProvider.incorrectKey=Das angegebene CasAuthenticationToken enth\u00E4lt nicht den erwarteten Schl\u00FCssel
+CasAuthenticationProvider.noServiceTicket=Es konnte kein CAS Service-Ticket zur Pr\u00FCfung geliefert werden
+ConcurrentSessionControlStrategy.exceededAllowed=Die maximale Sitzungs-Anzahl von {0} f\u00FCr diesen Nutzer wurde \u00FCberschritten
+DigestAuthenticationFilter.incorrectRealm=Realm-Name in Antwort {0} entspricht nicht dem Namen des System-Realms {1}
+DigestAuthenticationFilter.incorrectResponse=Fehlerhafte Antwort
+DigestAuthenticationFilter.missingAuth=Erforderlicher Digest-Wert fehlt f\u00FCr 'auth' QOP; Empfangener Header {0}
+DigestAuthenticationFilter.missingMandatory=Erforderlicher Digest-Wert fehlt; Empfangener Header {0}
+DigestAuthenticationFilter.nonceCompromised=Das Nonce-Element ist kompromittiert {0}
+DigestAuthenticationFilter.nonceEncoding=Die Nonce ist nicht in Base64 kodiert; Empfangene Nonce {0}
+DigestAuthenticationFilter.nonceExpired=Die Nonce ist nicht mehr g\u00FCltig
+DigestAuthenticationFilter.nonceNotNumeric=Das erste Element der Nonce sollte numerisch sein. Gefundener Inhalt\: {0}
+DigestAuthenticationFilter.nonceNotTwoTokens=Nonce sollte zwei Elemente beinhalten. Gefundener Inhalt\: {0}
+DigestAuthenticationFilter.usernameNotFound=Benutzername {0} wurde nicht gefunden
+#JdbcDaoImpl.noAuthority=User {0} has no GrantedAuthority
+#JdbcDaoImpl.notFound=User {0} not found
+LdapAuthenticationProvider.badCredentials=Ung\u00FCltige Benutzerberechtigungen
 LdapAuthenticationProvider.emptyUsername=Ein leerer Benutzername ist nicht erlaubt
-LdapAuthenticationProvider.emptyPassword=Ungültige Benutzerberechtigungen
-DefaultIntitalDirContextFactory.communicationFailure=Kann keine Verbindung zum LDAP-Server herstellen
-DefaultIntitalDirContextFactory.badCredentials=Ungültige Benutzerberechtigungen
-DefaultIntitalDirContextFactory.unexpectedException=Auf den InitialDirContext kann aufgrund eines unerwarteten Fehlers nicht zugegriffen werden
-PasswordComparisonAuthenticator.badCredentials=Ungültige Benutzerberechtigungen
-BindAuthenticator.badCredentials=Ungültige Benutzerberechtigungen
-BindAuthenticator.failedToLoadAttributes=Ungültige Benutzerberechtigungen
-
+LdapAuthenticationProvider.onlySupports=Nur UsernamePasswordAuthenticationToken wird unterst\u00FCtzt
+PasswordComparisonAuthenticator.badCredentials=Ung\u00FCltige Benutzerberechtigungen
+#PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound=F\u00FCr {0} wurde kein AuthenticationProvider gefunden
+RememberMeAuthenticationProvider.incorrectKey=Das angegebene RememberMeAuthenticationToken enth\u00E4lt nicht den erwarteten Schl\u00FCssel
+RunAsImplAuthenticationProvider.incorrectKey=Das angegebene RunAsUserToken enth\u00E4lt nicht den erwarteten Schl\u00FCssel
+SubjectDnX509PrincipalExtractor.noMatching=Kein passendes Muster gefunden in subjectDN\: {0}
+SwitchUserFilter.noCurrentUser=Mit dieser Anfrage ist kein aktueller Benutzer assoziiert
+SwitchUserFilter.noOriginalAuthentication=Kann das urspr\u00FCngliche Authentifikationsobjekt nicht finden

core/src/main/resources/org/springframework/security/messages_es_ES.properties

@@ -1,53 +1,42 @@
-AuthByAdapterProvider.incorrectKey=La actual implementación de AuthByAdapter no contiene la clave esperada
-BasicAclEntryAfterInvocationProvider.noPermission=Authentication {0} NO tiene permisos para el objeto de dominio {1}
-BasicAclEntryAfterInvocationProvider.insufficientPermission=Authentication {0} tiene permisos ACL para objeto de dominio, pero no los permisos ACL requeridos para el objeto de dominio {1}
-ConcurrentSessionControllerImpl.exceededAllowed=Sesiones máximas de {0} para esta Identificación excedidas
-ProviderManager.providerNotFound=AuthenticationProvider no encontrado para {0}
+AbstractAccessDecisionManager.accessDenied=Acceso denegado
+AbstractSecurityInterceptor.authenticationNotFound=El objeto Authentication no ha sido encontrado en el SecurityContext
+AbstractUserDetailsAuthenticationProvider.badCredentials=Credenciales err\u00F3neas
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=Las credenciales del usuario han expirado
+AbstractUserDetailsAuthenticationProvider.disabled=El usuario est\u00E1 deshabilitado
+AbstractUserDetailsAuthenticationProvider.expired=La cuenta del usuario ha expirado
+AbstractUserDetailsAuthenticationProvider.locked=La cuenta del usuario est\u00E1 bloqueada
+AbstractUserDetailsAuthenticationProvider.onlySupports=S\u00F3lo UsernamePasswordAuthenticationToken es soportada
+AccountStatusUserDetailsChecker.credentialsExpired=Las credenciales del usuario han expirado
+AccountStatusUserDetailsChecker.disabled=El usuario est\u00E1 deshabilitado
+AccountStatusUserDetailsChecker.expired=La cuenta del usuario ha expirado
+AccountStatusUserDetailsChecker.locked=La cuenta del usuario est\u00E1 bloqueada
+AclEntryAfterInvocationProvider.noPermission=Authentication {0} NO tiene permisos para el objeto de dominio {1}
 AnonymousAuthenticationProvider.incorrectKey=El actual AnonymousAuthenticationToken no contiene la clave esperada
+BindAuthenticator.badCredentials=Credenciales err\u00F3neas
+BindAuthenticator.emptyPassword=Credenciales err\u00F3neas
 CasAuthenticationProvider.incorrectKey=El actual CasAuthenticationToken no contiene la clave esperada
 CasAuthenticationProvider.noServiceTicket=No se ha podido proporcionar un billete de servicio CAS para validar
-NamedCasProxyDecider.untrusted=El proxy más cercano {0} no es confiable
-RejectProxyTickets.reject=Las entradas del proxy han sido rechazadas
-AbstractSecurityInterceptor.authenticationNotFound=El objeto Authentication no ha sido encontrado en el SecurityContext
-AbstractUserDetailsAuthenticationProvider.onlySupports=Sólo UsernamePasswordAuthenticationToken es soportada
-AbstractUserDetailsAuthenticationProvider.locked=La cuenta del usuario está bloqueada
-AbstractUserDetailsAuthenticationProvider.disabled=El usuario está deshabilitado
-AbstractUserDetailsAuthenticationProvider.expired=La cuenta del usuario ha expirado
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=Las credenciales del usuario han expirado
-AbstractUserDetailsAuthenticationProvider.badCredentials=Credenciales erróneas
-X509AuthenticationProvider.certificateNull=Cerfificado nulo
-DaoX509AuthoritiesPopulator.noMatching=No se ha encontrado un patrón coincidente en subjectDN: {0}
+ConcurrentSessionControlStrategy.exceededAllowed=Sesiones m\u00E1ximas de {0} para esta Identificaci\u00F3n excedidas
+DigestAuthenticationFilter.incorrectRealm=Respuesta realm de nombre {0} no coincide con realm del sistema de nombre {1}
+DigestAuthenticationFilter.incorrectResponse=Respuesta incorrecta
+DigestAuthenticationFilter.missingAuth=Valor digest obligatorio perdido para 'auth' QOP; header recibido {0}
+DigestAuthenticationFilter.missingMandatory=Valor digest obligatorio perdido; header recibido {0}
+DigestAuthenticationFilter.nonceCompromised=Nonce token comprometido {0}
+DigestAuthenticationFilter.nonceEncoding=Nonce no est\u00E1 codificado en Base64; nonce recibido {0}
+DigestAuthenticationFilter.nonceExpired=Nonce ha expirado/fuera de tiempo
+DigestAuthenticationFilter.nonceNotNumeric=Nonce token deber\u00EDa tener primero un token num\u00E9rico, pero ten\u00EDa {0}
+DigestAuthenticationFilter.nonceNotTwoTokens=Nonce token deber\u00EDa tener dos fichas pero ten\u00EDa {0}
+DigestAuthenticationFilter.usernameNotFound=Usuario y nombre {0} no encontrado
+JdbcDaoImpl.noAuthority=Usuario {0} no tiene GrantedAuthority
+JdbcDaoImpl.notFound=Usuario {0} no encontrado
+LdapAuthenticationProvider.badCredentials=Credenciales err\u00F3neas
+LdapAuthenticationProvider.emptyUsername=Usuario y nombre no permitido
+LdapAuthenticationProvider.onlySupports=S\u00F3lo UsernamePasswordAuthenticationToken es soportada
+PasswordComparisonAuthenticator.badCredentials=Credenciales err\u00F3neas
+PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound=AuthenticationProvider no encontrado para {0}
 RememberMeAuthenticationProvider.incorrectKey=El actual RememberMeAuthenticationToken no contiene la clave esperada
 RunAsImplAuthenticationProvider.incorrectKey=El actual RunAsUserToken no contiene la clave esperada
-DigestProcessingFilter.missingMandatory=Valor digest obligatorio perdido; header recibido {0}
-DigestProcessingFilter.missingAuth=Valor digest obligatorio perdido para 'auth' QOP; header recibido {0}
-DigestProcessingFilter.incorrectRealm=Respuesta realm de nombre {0} no coincide con realm del sistema de nombre {1}
-DigestProcessingFilter.nonceExpired=Nonce ha expirado/fuera de tiempo
-DigestProcessingFilter.nonceEncoding=Nonce no está codificado en Base64; nonce recibido {0}
-DigestProcessingFilter.nonceNotTwoTokens=Nonce token debería tener dos fichas pero tenía {0}
-DigestProcessingFilter.nonceNotNumeric=Nonce token debería tener primero un token numérico, pero tenía {0}
-DigestProcessingFilter.nonceCompromised=Nonce token comprometido {0}
-DigestProcessingFilter.usernameNotFound=Usuario y nombre {0} no encontrado
-DigestProcessingFilter.incorrectResponse=Respuesta incorrecta
-JdbcDaoImpl.notFound=Usuario {0} no encontrado
-JdbcDaoImpl.noAuthority=Usuario {0} no tiene GrantedAuthority
-SwitchUserProcessingFilter.noCurrentUser=No hay usuario actual asociado con esta petición
-SwitchUserProcessingFilter.noOriginalAuthentication=No se puede encontrar el objeto Authentication original
-SwitchUserProcessingFilter.usernameNotFound=Usuario y nombre {0} no encontrado
-SwitchUserProcessingFilter.locked=La cuenta del usuario está bloqueada
-SwitchUserProcessingFilter.disabled=El usuario está deshabilitado
-SwitchUserProcessingFilter.expired=La cuenta del usuario ha expirado
-SwitchUserProcessingFilter.credentialsExpired=Las credenciales del usuario han expirado
-AbstractAccessDecisionManager.accessDenied=Acceso denegado
-LdapAuthenticationProvider.emptyUsername=Usuario y nombre no permitido
-LdapAuthenticationProvider.emptyPassword=Credenciales erróneas
-DefaultIntitalDirContextFactory.communicationFailure=No se puede conectar con el servidor LDAP
-DefaultIntitalDirContextFactory.badCredentials=Credenciales erróneas
-DefaultIntitalDirContextFactory.unexpectedException=Error al obtener el InitialDirContext debido a una excepción inesperada
-PasswordComparisonAuthenticator.badCredentials=Credenciales erróneas
-BindAuthenticator.badCredentials=Credenciales erróneas
-BindAuthenticator.failedToLoadAttributes=Credenciales erróneas
-UserDetailsService.locked=La cuenta del usuario está bloqueada
-UserDetailsService.disabled=El usuario está deshabilitado
-UserDetailsService.expired=La cuenta del usuario ha expirado
-UserDetailsService.credentialsExpired=Las credenciales del usuario han expirado
+SubjectDnX509PrincipalExtractor.noMatching=No se ha encontrado un patr\u00F3n coincidente en subjectDN\: {0}
+SwitchUserFilter.noCurrentUser=No hay usuario actual asociado con esta petici\u00F3n
+SwitchUserFilter.noOriginalAuthentication=No se puede encontrar el objeto Authentication original

core/src/main/resources/org/springframework/security/messages_fr.properties

@@ -2,57 +2,45 @@
 # Messages in French
 # Translation by Laurent Pireyn (laurent.pireyn@pisolutions.eu)
 # Translation by Valentin Crettaz (valentin.crettaz@consulthys.com)
-
-AuthByAdapterProvider.incorrectKey=L'implémentation de AuthByAdapter présentée ne contient pas la clé attendue
-BasicAclEntryAfterInvocationProvider.noPermission=L'authentification {0} n'a AUCUNE permission pour l'objet de domaine {1}
-BasicAclEntryAfterInvocationProvider.insufficientPermission=L'authentification {0} a des permissions ACL pour l'objet de domaine, mais pas la permission ACL requise pour l'objet de domaine {1}
-ConcurrentSessionControllerImpl.exceededAllowed=Le maximum de {0} sessions a été dépassé pour cet utilisateur
-ProviderManager.providerNotFound=Aucun AuthenticationProvider n'a été trouvé pour {0}
-AnonymousAuthenticationProvider.incorrectKey=L'AnonymousAuthenticationToken présenté ne contient pas la clé attendue
-CasAuthenticationProvider.incorrectKey=Le CasAuthenticationToken présenté ne contient pas la clé attendue
-CasAuthenticationProvider.noServiceTicket=Echec d'obtention d'un ticket CAS à valider
-NamedCasProxyDecider.untrusted=Le proxy {0} le plus proche n'est pas fiable
-RejectProxyTickets.reject=Des tickets proxy ont été rejetés
-AbstractSecurityInterceptor.authenticationNotFound=Aucun objet Authentication n'a été trouvé dans le SecurityContext
+AbstractAccessDecisionManager.accessDenied=Acc\u00E8s refus\u00E9
+AbstractSecurityInterceptor.authenticationNotFound=Aucun objet Authentication n'a \u00E9t\u00E9 trouv\u00E9 dans le SecurityContext
+AbstractUserDetailsAuthenticationProvider.badCredentials=Les cr\u00E9ances sont erron\u00E9es
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=Les cr\u00E9ances de l'utilisateur ont expir\u00E9
+AbstractUserDetailsAuthenticationProvider.disabled=Le compte utilisateur est d\u00E9sactiv\u00E9
+AbstractUserDetailsAuthenticationProvider.expired=Le compte utilisateur a expir\u00E9
+AbstractUserDetailsAuthenticationProvider.locked=Le compte utilisateur est bloqu\u00E9
 AbstractUserDetailsAuthenticationProvider.onlySupports=Seul UsernamePasswordAuthenticationToken est pris en charge
-AbstractUserDetailsAuthenticationProvider.locked=Le compte utilisateur est bloqué
-AbstractUserDetailsAuthenticationProvider.disabled=Le compte utilisateur est désactivé
-AbstractUserDetailsAuthenticationProvider.expired=Le compte utilisateur a expiré
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=Les créances de l'utilisateur ont expiré
-AbstractUserDetailsAuthenticationProvider.badCredentials=Les créances sont erronées
-X509AuthenticationProvider.certificateNull=Le certificat est null
-DaoX509AuthoritiesPopulator.noMatching=Aucun motif concordant n'a été trouvé dans le subjectDN: {0}
-RememberMeAuthenticationProvider.incorrectKey=Le RememberMeAuthenticationToken présenté ne contient pas la clé attendue
-RunAsImplAuthenticationProvider.incorrectKey=Le RunAsUserToken présenté ne contient pas la clé attendue
-DigestProcessingFilter.missingMandatory=Une valeur obligatoire manque au condensé; reçu l'entête {0}
-DigestProcessingFilter.missingAuth=Une valeur obligatoire manque au condensé pour 'auth' QOP; reçu l'entête {0}
-DigestProcessingFilter.incorrectRealm=Le nom de domaine de la réponse {0} ne correspond pas au nom de domaine du système {1}
-DigestProcessingFilter.nonceExpired=Le nonce a expiré
-DigestProcessingFilter.nonceEncoding=Le nonce n'est pas encodé en Base64; reçu le nonce {0}
-DigestProcessingFilter.nonceNotTwoTokens=Le nonce aurait dû générer deux jetons, mais était {0}
-DigestProcessingFilter.nonceNotNumeric=Le jeton nonce aurait dû générer d'abord un jeton numérique, mais était {0}
-DigestProcessingFilter.nonceCompromised=Le jeton nonce est compromis {0}
-DigestProcessingFilter.usernameNotFound=Le nom d'utilisateur {0} n'a pas été trouvé
-DigestProcessingFilter.incorrectResponse=Réponse incorrecte
-JdbcDaoImpl.notFound=Le nom d'utilisateur {0} n'a pas été trouvé
+AccountStatusUserDetailsChecker.credentialsExpired=Les cr\u00E9ances de l'utilisateur ont expir\u00E9
+AccountStatusUserDetailsChecker.disabled=Le compte utilisateur est d\u00E9sactiv\u00E9
+AccountStatusUserDetailsChecker.expired=Le compte utilisateur a expir\u00E9
+AccountStatusUserDetailsChecker.locked=Le compte utilisateur est bloqu\u00E9
+AclEntryAfterInvocationProvider.noPermission=L'authentification {0} n'a AUCUNE permission pour l'objet de domaine {1}
+AnonymousAuthenticationProvider.incorrectKey=L'AnonymousAuthenticationToken pr\u00E9sent\u00E9 ne contient pas la cl\u00E9 attendue
+BindAuthenticator.badCredentials=Les cr\u00E9ances sont erron\u00E9es
+BindAuthenticator.emptyPassword=Le mot de passe est obligatoire
+CasAuthenticationProvider.incorrectKey=Le CasAuthenticationToken pr\u00E9sent\u00E9 ne contient pas la cl\u00E9 attendue
+CasAuthenticationProvider.noServiceTicket=Echec d'obtention d'un ticket CAS \u00E0 valider
+ConcurrentSessionControlStrategy.exceededAllowed=Le maximum de {0} sessions a \u00E9t\u00E9 d\u00E9pass\u00E9 pour cet utilisateur
+DigestAuthenticationFilter.incorrectRealm=Le nom de domaine de la r\u00E9ponse {0} ne correspond pas au nom de domaine du syst\u00E8me {1}
+DigestAuthenticationFilter.incorrectResponse=R\u00E9ponse incorrecte
+DigestAuthenticationFilter.missingAuth=Une valeur obligatoire manque au condens\u00E9 pour 'auth' QOP; re\u00E7u l'ent\u00EAte {0}
+DigestAuthenticationFilter.missingMandatory=Une valeur obligatoire manque au condens\u00E9; re\u00E7u l'ent\u00EAte {0}
+DigestAuthenticationFilter.nonceCompromised=Le jeton nonce est compromis {0}
+DigestAuthenticationFilter.nonceEncoding=Le nonce n'est pas encod\u00E9 en Base64; re\u00E7u le nonce {0}
+DigestAuthenticationFilter.nonceExpired=Le nonce a expir\u00E9
+DigestAuthenticationFilter.nonceNotNumeric=Le jeton nonce aurait d\u00FB g\u00E9n\u00E9rer d'abord un jeton num\u00E9rique, mais \u00E9tait {0}
+DigestAuthenticationFilter.nonceNotTwoTokens=Le nonce aurait d\u00FB g\u00E9n\u00E9rer deux jetons, mais \u00E9tait {0}
+DigestAuthenticationFilter.usernameNotFound=Le nom d'utilisateur {0} n'a pas \u00E9t\u00E9 trouv\u00E9
 JdbcDaoImpl.noAuthority=Le compte utilisateur {0} n'a pas de permission
-SwitchUserProcessingFilter.noCurrentUser=Aucun utilisateur n'est associé à la requête en cours
-SwitchUserProcessingFilter.noOriginalAuthentication=L'objet Authentication original n'a pas été trouvé
-SwitchUserProcessingFilter.usernameNotFound=Le nom d'utilisateur {0} n'a pas été trouvé
-SwitchUserProcessingFilter.locked=Le compte utilisateur est bloqué
-SwitchUserProcessingFilter.disabled=Le compte utilisateur est désactivé
-SwitchUserProcessingFilter.expired=Le compte utilisateur a expiré
-SwitchUserProcessingFilter.credentialsExpired=Les créances de l'utilisateur ont expiré
-AbstractAccessDecisionManager.accessDenied=Accès refusé
+JdbcDaoImpl.notFound=Le nom d'utilisateur {0} n'a pas \u00E9t\u00E9 trouv\u00E9
+LdapAuthenticationProvider.badCredentials=Les cr\u00E9ances sont erron\u00E9es
 LdapAuthenticationProvider.emptyUsername=Le nom d'utilisateur est obligatoire
-LdapAuthenticationProvider.emptyPassword=Le mot de passe est obligatoire
-DefaultIntitalDirContextFactory.communicationFailure=Impossible de se connecter au serveur LDAP
-DefaultIntitalDirContextFactory.badCredentials=Les créances sont erronées
-DefaultIntitalDirContextFactory.unexpectedException=Impossible d'obtenir un InitialDirContext à cause d'une erreur inattendue
-PasswordComparisonAuthenticator.badCredentials=Les créances sont erronées
-BindAuthenticator.badCredentials=Les créances sont erronées
-BindAuthenticator.failedToLoadAttributes=Les créances sont erronées
-UserDetailsService.locked=Le compte utilisateur est bloqué
-UserDetailsService.disabled=Le compte utilisateur est désactivé
-UserDetailsService.expired=Le compte utilisateur a expiré
-UserDetailsService.credentialsExpired=Les créances de l'utilisateur ont expiré
+LdapAuthenticationProvider.onlySupports=Seul UsernamePasswordAuthenticationToken est pris en charge
+PasswordComparisonAuthenticator.badCredentials=Les cr\u00E9ances sont erron\u00E9es
+PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound=Aucun AuthenticationProvider n'a \u00E9t\u00E9 trouv\u00E9 pour {0}
+RememberMeAuthenticationProvider.incorrectKey=Le RememberMeAuthenticationToken pr\u00E9sent\u00E9 ne contient pas la cl\u00E9 attendue
+RunAsImplAuthenticationProvider.incorrectKey=Le RunAsUserToken pr\u00E9sent\u00E9 ne contient pas la cl\u00E9 attendue
+SubjectDnX509PrincipalExtractor.noMatching=Aucun motif concordant n'a \u00E9t\u00E9 trouv\u00E9 dans le subjectDN\: {0}
+SwitchUserFilter.noCurrentUser=Aucun utilisateur n'est associ\u00E9 \u00E0 la requ\u00EAte en cours
+SwitchUserFilter.noOriginalAuthentication=L'objet Authentication original n'a pas \u00E9t\u00E9 trouv\u00E9

core/src/main/resources/org/springframework/security/messages_it.properties

@@ -5,43 +5,38 @@ AbstractUserDetailsAuthenticationProvider.credentialsExpired=Credenziali dell'ut
 AbstractUserDetailsAuthenticationProvider.disabled=Utente disabilitato
 AbstractUserDetailsAuthenticationProvider.expired=Account dell'utente scadute
 AbstractUserDetailsAuthenticationProvider.locked=Account dell'utente bloccato
-AbstractUserDetailsAuthenticationProvider.onlySupports=Solo UsernamePasswordAuthenticationToken è supportata
+AbstractUserDetailsAuthenticationProvider.onlySupports=Solo UsernamePasswordAuthenticationToken \u00E8 supportata
+AccountStatusUserDetailsChecker.credentialsExpired=Credenziali dell'utente scadute
+AccountStatusUserDetailsChecker.disabled=Utente disabilitato
+AccountStatusUserDetailsChecker.expired=Account dell'utente scaduto
+AccountStatusUserDetailsChecker.locked=Account dell'utente bloccato
+AclEntryAfterInvocationProvider.noPermission=L'autenticazione {0} non ha nessun permesso sull'oggetto di dominio {1}
 AnonymousAuthenticationProvider.incorrectKey=AnonymousAuthenticationToken non contiene la chiave prevista
-AuthByAdapterProvider.incorrectKey=AuthByAdapter non contiene la chiave prevista
-BasicAclEntryAfterInvocationProvider.noPermission=L'autenticazione {0} non ha nessun permesso sull'oggetto di dominio {1}
-BasicAclEntryAfterInvocationProvider.insufficientPermission=L'autenticazione {0} ha permessi ACL sull'oggetto di dominio, ma non il permesso ACL richiesto dall'oggetto {1}
 BindAuthenticator.badCredentials=Credenziali non valide
-BindAuthenticator.failedToLoadAttributes=Credenziali non valide
+BindAuthenticator.emptyPassword=Credenziali non valide
 CasAuthenticationProvider.incorrectKey=CasAuthenticationToken non contiene la chiave prevista
 CasAuthenticationProvider.noServiceTicket=Non e' stato fornito un CAS service ticket valido
-ConcurrentSessionControllerImpl.exceededAllowed=Il numero massimo delle sessioni ({0}) per questo utente sono state superate
-DaoX509AuthoritiesPopulator.noMatching=Non e' stato validato correttamente il subjectDN: {0}
-DefaultIntitalDirContextFactory.communicationFailure=Impossibile connettersi al server LDAP
-DefaultIntitalDirContextFactory.badCredentials=Credenziali non valide
-DefaultIntitalDirContextFactory.unexpectedException=Impossibile creare l'InitialDirContext a causa di un errore imprevisto
-DigestProcessingFilter.missingMandatory=Valore digest obbligatorio mancante; ricevuto header {0}
-DigestProcessingFilter.missingAuth=Valore digest obbligatorio mancante per 'auth' QOP; ricevuto header {0}
-DigestProcessingFilter.incorrectRealm=Il response realm name {0} non corrisponde al realm name di sistema {1}
-DigestProcessingFilter.nonceExpired=Nonce scaduto/in timeout
-DigestProcessingFilter.nonceEncoding=Nonce non codificato in Base64; ricevuto nonce {0}
-DigestProcessingFilter.nonceNotTwoTokens=Nonce avrebbe dovuto dare due token invece di {0}
-DigestProcessingFilter.nonceNotNumeric=Nonce token avrebbe dovuto dare un primo token numerico invece di {0}
-DigestProcessingFilter.nonceCompromised=Nonce token corrotto {0}
-DigestProcessingFilter.usernameNotFound=Username {0} non trovato
-DigestProcessingFilter.incorrectResponse=Replica non corretta
+ConcurrentSessionControlStrategy.exceededAllowed=Il numero massimo delle sessioni ({0}) per questo utente sono state superate
+DigestAuthenticationFilter.incorrectRealm=Il response realm name {0} non corrisponde al realm name di sistema {1}
+DigestAuthenticationFilter.incorrectResponse=Replica non corretta
+DigestAuthenticationFilter.missingAuth=Valore digest obbligatorio mancante per 'auth' QOP; ricevuto header {0}
+DigestAuthenticationFilter.missingMandatory=Valore digest obbligatorio mancante; ricevuto header {0}
+DigestAuthenticationFilter.nonceCompromised=Nonce token corrotto {0}
+DigestAuthenticationFilter.nonceEncoding=Nonce non codificato in Base64; ricevuto nonce {0}
+DigestAuthenticationFilter.nonceExpired=Nonce scaduto/in timeout
+DigestAuthenticationFilter.nonceNotNumeric=Nonce token avrebbe dovuto dare un primo token numerico invece di {0}
+DigestAuthenticationFilter.nonceNotTwoTokens=Nonce avrebbe dovuto dare due token invece di {0}
+DigestAuthenticationFilter.usernameNotFound=Username {0} non trovato
+#JdbcDaoImpl.noAuthority=User {0} has no GrantedAuthority
+#JdbcDaoImpl.notFound=User {0} not found
+LdapAuthenticationProvider.badCredentials=Credenziali non valide
 LdapAuthenticationProvider.emptyUsername=Username vuoto non consentito
-LdapAuthenticationProvider.emptyPassword=Credenziali non valide
-NamedCasProxyDecider.untrusted=Il Proxy piu' vicino {0} non e' trusted
+LdapAuthenticationProvider.onlySupports=Solo UsernamePasswordAuthenticationToken \u00E8 supportata
 PasswordComparisonAuthenticator.badCredentials=Credenziali non valide
+#PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
 ProviderManager.providerNotFound=Nessun Provider di autenticazione trovato per {0}
-RejectProxyTickets.reject=Proxy tickets rifiutati
 RememberMeAuthenticationProvider.incorrectKey=RememberMeAuthenticationToken non contiene la chiave prevista
 RunAsImplAuthenticationProvider.incorrectKey=RunAsUserToken non contiene la chiave prevista
-SwitchUserProcessingFilter.noCurrentUser=Nessun utente corrente associato con questa richiesta
-SwitchUserProcessingFilter.noOriginalAuthentication=Impossibile trovare l'Authentication object originale
-SwitchUserProcessingFilter.usernameNotFound=Username {0} non trovato
-SwitchUserProcessingFilter.locked=Account dell'utente bloccato
-SwitchUserProcessingFilter.disabled=Account dell'utente disabilitato
-SwitchUserProcessingFilter.expired=Account dell'utente scaduto
-SwitchUserProcessingFilter.credentialsExpired=Credenziali dell'utente scadute
-X509AuthenticationProvider.certificateNull=Il certificato e' nullo
+SubjectDnX509PrincipalExtractor.noMatching=Non e' stato validato correttamente il subjectDN\: {0}
+SwitchUserFilter.noCurrentUser=Nessun utente corrente associato con questa richiesta
+SwitchUserFilter.noOriginalAuthentication=Impossibile trovare l'Authentication object originale

core/src/main/resources/org/springframework/security/messages_ko_KR.properties

@@ -1,54 +1,42 @@
-AuthByAdapterProvider.incorrectKey=\uc81c\uacf5\ub41c AuthByAdapter \uad6c\ud604\uc5d0\ub294 \ucc3e\ub294 key\uac00 \uc5c6\uc2b5\ub2c8\ub2e4.
-BasicAclEntryAfterInvocationProvider.noPermission=Authentication {0}\uc740/\ub294 domain object {1}\uc5d0 \ub300\ud55c \uad8c\ud55c\uc774 \uc5c6\uc2b5\ub2c8\ub2e4.
-BasicAclEntryAfterInvocationProvider.insufficientPermission=domain object {1}\uc5d0 \ub300\ud55c Authentication {0}\uc758 ACL \uad8c\ud55c\uc774 \ubd88\ucda9\ubd84\ud569\ub2c8\ub2e4.
-ConcurrentSessionControllerImpl.exceededAllowed={0}\uc758 \ucd5c\ub300 \uc138\uc158 \ud5c8\uc6a9 \uc218\ub97c \ucd08\uacfc\ud558\uc600\uc2b5\ub2c8\ub2e4.
-ProviderManager.providerNotFound={0}\uc744 \uc704\ud55c AuthenticationProvider\ub97c \ucc3e\uc744 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-AnonymousAuthenticationProvider.incorrectKey=\uc81c\uacf5\ub41c AnonymousAuthenticationToken\uc5d0\ub294 \ucc3e\ub294 key\uac00 \uc5c6\uc2b5\ub2c8\ub2e4.
-CasAuthenticationProvider.incorrectKey=\uc81c\uacf5\ub41c CasAuthenticationToken\uc5d0\ub294 \ucc3e\ub294 key\uac00 \uc5c6\uc2b5\ub2c8\ub2e4.
-CasAuthenticationProvider.noServiceTicket=\uac80\uc99d\uc744 \uc704\ud55c CAS \uc11c\ube44\uc2a4 \ud2f0\ucf13\uc744 \uc81c\uacf5\ud560 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-NamedCasProxyDecider.untrusted=\uac00\uc7a5 \uac00\uae4c\uc6b4 \ud504\ub77d\uc2dc {0}\ub294 \uc2e0\ub8b0\ud560 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-RejectProxyTickets.reject=\ud504\ub77d\uc2dc \ud2f0\ucf13\uc774 \uac70\ubd80\ub418\uc5c8\uc2b5\ub2c8\ub2e4.
-AbstractSecurityInterceptor.authenticationNotFound=SecurityContext\uc5d0\uc11c Authentication \uac1d\uccb4\ub97c \ucc3e\uc744 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-AbstractUserDetailsAuthenticationProvider.onlySupports=UsernamePasswordAuthenticationToken\ub9cc \uc9c0\uc6d0\ud569\ub2c8\ub2e4.
-AbstractUserDetailsAuthenticationProvider.locked=\uc0ac\uc6a9\uc790 \uacc4\uc815\uc774 \uc7a0\uaca8 \uc788\uc2b5\ub2c8\ub2e4.
-AbstractUserDetailsAuthenticationProvider.disabled=\uc874\uc7ac\ud558\uc9c0 \uc54a\ub294 \uc0ac\uc6a9\uc790 \uc785\ub2c8\ub2e4.
-AbstractUserDetailsAuthenticationProvider.expired=\uc0ac\uc6a9\uc790 \uacc4\uc815\uc758 \uc720\ud6a8 \uae30\uac04\uc774 \ub9cc\ub8cc \ub418\uc5c8\uc2b5\ub2c8\ub2e4.
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=\ube44\ubc00\ubc88\ud638(credential)\uc758 \uc720\ud6a8 \uae30\uac04\uc774 \ub9cc\ub8cc\ub418\uc5c8\uc2b5\ub2c8\ub2e4.
-AbstractUserDetailsAuthenticationProvider.badCredentials=\ube44\ubc00\ubc88\ud638(credential)\uac00 \ub9de\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.
-X509AuthenticationProvider.certificateNull=\ube44\ubc00\ubc88\ud638(credential)\uac00 null \uc785\ub2c8\ub2e4.
-DaoX509AuthoritiesPopulator.noMatching=subjectDN: {0}\uc5d0\uc11c \ub9e4\uce6d\ub418\ub294 \ud328\ud134\uc774 \uc5c6\uc2b5\ub2c8\ub2e4.
-RememberMeAuthenticationProvider.incorrectKey=\uc81c\uacf5\ub41c RememberMeAuthenticationToken\uc5d0\ub294 \ucc3e\ub294 key\uac00 \uc5c6\uc2b5\ub2c8\ub2e4.
-RunAsImplAuthenticationProvider.incorrectKey=\uc81c\uacf5\ub41c RunAsUserToken\uc5d0\ub294 \ucc3e\ub294 key\uac00 \uc5c6\uc2b5\ub2c8\ub2e4.
-DigestProcessingFilter.missingMandatory=\ud544\uc218 digest \ud30c\ub77c\ubbf8\ud130 \uac12\uc774 \ub204\ub77d\ub418\uc5c8\uc2b5\ub2c8\ub2e4. \ud604\uc7ac header\ub294 {0}\uc785\ub2c8\ub2e4.
-DigestProcessingFilter.missingAuth='auth' QOP\ub97c \uc704\ud55c \ud544\uc218 digest \ud30c\ub77c\ubbf8\ud130 \uac12\uc774 \ub204\ub77d\ub418\uc5c8\uc2b5\ub2c8\ub2e4. \ud604\uc7ac header\ub294 {0}\uc785\ub2c8\ub2e4.
-DigestProcessingFilter.incorrectRealm=\uc751\ub2f5 realm \uc774\ub984 {0}\uc774 \uc2dc\uc2a4\ud15c realm \uc774\ub984 {1}\uacfc \uc77c\uce58 \ud558\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.
-DigestProcessingFilter.nonceExpired=Nonce\uc758 \uc720\ud6a8 \uae30\uac04\uc774 \ub9cc\ub8cc\ub418\uc5c8\uc2b5\ub2c8\ub2e4.
-DigestProcessingFilter.nonceEncoding=Nonce\uac00 Base64\ub85c \uc778\ucf54\ub529 \ub418\uc5b4\uc788\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4. \ud604\uc7ac nonce\ub294 {0}\uc785\ub2c8\ub2e4.
-DigestProcessingFilter.nonceNotTwoTokens=Nonce\ub294 2\uac1c\uc758 \ud1a0\ud070\uc744 \ub9cc\ub4e4\uc5b4\uc57c \ud569\ub2c8\ub2e4. \ud604\uc7ac nonce\ub294 {0}\uc785\ub2c8\ub2e4.
-DigestProcessingFilter.nonceNotNumeric=Nonce \ud1a0\ud070\uc758 \uccab \uae00\uc790\ub294  \uc22b\uc790\ub85c \uc2dc\uc791\ud574\uc57c \ud569\ub2c8\ub2e4. \ud604\uc7ac nonce\ub294 {0}\uc785\ub2c8\ub2e4.
-DigestProcessingFilter.nonceCompromised=Nonce \ud1a0\ud070\uc774 \ud6fc\uc190\ub418\uc5c8\uc2b5\ub2c8\ub2e4. \ud604\uc7ac nonce\ub294 {0}\uc785\ub2c8\ub2e4.
-DigestProcessingFilter.usernameNotFound=\uc0ac\uc6a9\uc790 {0}\uc744/\ub97c \ucc3e\uc744 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-DigestProcessingFilter.incorrectResponse=\uc751\ub2f5\uc774 \uc815\ud655\ud558\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.
-JdbcDaoImpl.notFound=\uc0ac\uc6a9\uc790 {0}\uc744/\ub97c \ucc3e\uc744 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-JdbcDaoImpl.noAuthority=\uc0ac\uc6a9\uc790 {0}\uc740/\ub294 \uad8c\ud55c\uc774 \uc5c6\uc2b5\ub2c8\ub2e4.
-SwitchUserProcessingFilter.noCurrentUser=\uc0ac\uc6a9\uc790\uac00  \uc874\uc7ac\ud558\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.
-SwitchUserProcessingFilter.noOriginalAuthentication=Authentication\uc758 \uc6d0\ubcf8\uc744 \ucc3e\uc744 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-SwitchUserProcessingFilter.usernameNotFound=\uc0ac\uc6a9\uc790\uba85(username) {0}\uc744/\ub97c \ucc3e\uc744 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-SwitchUserProcessingFilter.locked=\uc0ac\uc6a9\uc790 \uacc4\uc815\uc774 \uc7a0\uaca8 \uc788\uc2b5\ub2c8\ub2e4.
-SwitchUserProcessingFilter.disabled=\uc0ac\uc6a9\uc790 \uacc4\uc815\uc744 \uc0ac\uc6a9\ud560 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-SwitchUserProcessingFilter.expired=\uc0ac\uc6a9\uc790 \uacc4\uc815\uc758 \uc720\ud6a8 \uae30\uac04\uc774 \ub9cc\ub8cc \ub418\uc5c8\uc2b5\ub2c8\ub2e4.
-SwitchUserProcessingFilter.credentialsExpired=\ube44\ubc00\ubc88\ud638(credential)\uc758 \uc720\ud6a8 \uae30\uac04\uc774 \ub9cc\ub8cc\ub418\uc5c8\uc2b5\ub2c8\ub2e4.
-AbstractAccessDecisionManager.accessDenied=\uc811\uadfc\uc774 \uac70\ubd80\ub418\uc5c8\uc2b5\ub2c8\ub2e4.
-LdapAuthenticationProvider.emptyUsername=\uc0ac\uc6a9\uc790\uba85(username)\uc5d0 \uacf5\ubc31\uc740 \ud5c8\uc6a9\ub418\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.
-LdapAuthenticationProvider.emptyPassword=\ube44\ubc00\ubc88\ud638(credential)\uac00 \ub9de\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.
-DefaultIntitalDirContextFactory.communicationFailure=LDAP \uc11c\ubc84\ub85c \uc811\uc18d\ud560 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-DefaultIntitalDirContextFactory.badCredentials=\ube44\ubc00\ubc88\ud638\uac00 \ub9de\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.
-DefaultIntitalDirContextFactory.unexpectedException=\uc54c \uc218 \uc5c6\ub294 \uc608\uc678\uac00 \ubc1c\uc0dd\ud558\uc5ec InitialDirContext\ub97c \uc5bb\uc5b4\uc62c \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-PasswordComparisonAuthenticator.badCredentials=\ube44\ubc00\ubc88\ud638\uac00 \ub9de\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.
-BindAuthenticator.badCredentials=\ube44\ubc00\ubc88\ud638\uac00 \ub9de\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.
-BindAuthenticator.failedToLoadAttributes=\ube44\ubc00\ubc88\ud638\uac00 \ub9de\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.
-UserDetailsService.locked=\uc0ac\uc6a9\uc790 \uacc4\uc815\uc774 \uc7a0\uaca8 \uc788\uc2b5\ub2c8\ub2e4.
-UserDetailsService.disabled=\uc0ac\uc6a9\uc790 \uacc4\uc815\uc744 \uc0ac\uc6a9\ud560 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4.
-UserDetailsService.expired=\uc0ac\uc6a9\uc790 \uacc4\uc815\uc758 \uc720\ud6a8 \uae30\uac04\uc774 \ub9cc\ub8cc \ub418\uc5c8\uc2b5\ub2c8\ub2e4.
-UserDetailsService.credentialsExpired=\ube44\ubc00\ubc88\ud638\uc758 \uc720\ud6a8 \uae30\uac04\uc774 \ub9cc\ub8cc\ub418\uc5c8\uc2b5\ub2c8\ub2e4.
-
+AbstractAccessDecisionManager.accessDenied=\uC811\uADFC\uC774 \uAC70\uBD80\uB418\uC5C8\uC2B5\uB2C8\uB2E4.
+AbstractSecurityInterceptor.authenticationNotFound=SecurityContext\uC5D0\uC11C Authentication \uAC1D\uCCB4\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.
+AbstractUserDetailsAuthenticationProvider.badCredentials=\uBE44\uBC00\uBC88\uD638(credential)\uAC00 \uB9DE\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=\uBE44\uBC00\uBC88\uD638(credential)\uC758 \uC720\uD6A8 \uAE30\uAC04\uC774 \uB9CC\uB8CC\uB418\uC5C8\uC2B5\uB2C8\uB2E4.
+AbstractUserDetailsAuthenticationProvider.disabled=\uC874\uC7AC\uD558\uC9C0 \uC54A\uB294 \uC0AC\uC6A9\uC790 \uC785\uB2C8\uB2E4.
+AbstractUserDetailsAuthenticationProvider.expired=\uC0AC\uC6A9\uC790 \uACC4\uC815\uC758 \uC720\uD6A8 \uAE30\uAC04\uC774 \uB9CC\uB8CC \uB418\uC5C8\uC2B5\uB2C8\uB2E4.
+AbstractUserDetailsAuthenticationProvider.locked=\uC0AC\uC6A9\uC790 \uACC4\uC815\uC774 \uC7A0\uACA8 \uC788\uC2B5\uB2C8\uB2E4.
+AbstractUserDetailsAuthenticationProvider.onlySupports=UsernamePasswordAuthenticationToken\uB9CC \uC9C0\uC6D0\uD569\uB2C8\uB2E4.
+AccountStatusUserDetailsChecker.credentialsExpired=\uBE44\uBC00\uBC88\uD638\uC758 \uC720\uD6A8 \uAE30\uAC04\uC774 \uB9CC\uB8CC\uB418\uC5C8\uC2B5\uB2C8\uB2E4.
+AccountStatusUserDetailsChecker.disabled=\uC0AC\uC6A9\uC790 \uACC4\uC815\uC744 \uC0AC\uC6A9\uD560 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.
+AccountStatusUserDetailsChecker.expired=\uC0AC\uC6A9\uC790 \uACC4\uC815\uC758 \uC720\uD6A8 \uAE30\uAC04\uC774 \uB9CC\uB8CC \uB418\uC5C8\uC2B5\uB2C8\uB2E4.
+AccountStatusUserDetailsChecker.locked=\uC0AC\uC6A9\uC790 \uACC4\uC815\uC774 \uC7A0\uACA8 \uC788\uC2B5\uB2C8\uB2E4.
+AclEntryAfterInvocationProvider.noPermission=Authentication {0}\uC740/\uB294 domain object {1}\uC5D0 \uB300\uD55C \uAD8C\uD55C\uC774 \uC5C6\uC2B5\uB2C8\uB2E4.
+AnonymousAuthenticationProvider.incorrectKey=\uC81C\uACF5\uB41C AnonymousAuthenticationToken\uC5D0\uB294 \uCC3E\uB294 key\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4.
+BindAuthenticator.badCredentials=\uBE44\uBC00\uBC88\uD638\uAC00 \uB9DE\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.
+BindAuthenticator.emptyPassword=\uBE44\uBC00\uBC88\uD638(credential)\uAC00 \uB9DE\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.
+CasAuthenticationProvider.incorrectKey=\uC81C\uACF5\uB41C CasAuthenticationToken\uC5D0\uB294 \uCC3E\uB294 key\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4.
+CasAuthenticationProvider.noServiceTicket=\uAC80\uC99D\uC744 \uC704\uD55C CAS \uC11C\uBE44\uC2A4 \uD2F0\uCF13\uC744 \uC81C\uACF5\uD560 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.
+ConcurrentSessionControlStrategy.exceededAllowed={0}\uC758 \uCD5C\uB300 \uC138\uC158 \uD5C8\uC6A9 \uC218\uB97C \uCD08\uACFC\uD558\uC600\uC2B5\uB2C8\uB2E4.
+DigestAuthenticationFilter.incorrectRealm=\uC751\uB2F5 realm \uC774\uB984 {0}\uC774 \uC2DC\uC2A4\uD15C realm \uC774\uB984 {1}\uACFC \uC77C\uCE58 \uD558\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.
+DigestAuthenticationFilter.incorrectResponse=\uC751\uB2F5\uC774 \uC815\uD655\uD558\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.
+DigestAuthenticationFilter.missingAuth='auth' QOP\uB97C \uC704\uD55C \uD544\uC218 digest \uD30C\uB77C\uBBF8\uD130 \uAC12\uC774 \uB204\uB77D\uB418\uC5C8\uC2B5\uB2C8\uB2E4. \uD604\uC7AC header\uB294 {0}\uC785\uB2C8\uB2E4.
+DigestAuthenticationFilter.missingMandatory=\uD544\uC218 digest \uD30C\uB77C\uBBF8\uD130 \uAC12\uC774 \uB204\uB77D\uB418\uC5C8\uC2B5\uB2C8\uB2E4. \uD604\uC7AC header\uB294 {0}\uC785\uB2C8\uB2E4.
+DigestAuthenticationFilter.nonceCompromised=Nonce \uD1A0\uD070\uC774 \uD6FC\uC190\uB418\uC5C8\uC2B5\uB2C8\uB2E4. \uD604\uC7AC nonce\uB294 {0}\uC785\uB2C8\uB2E4.
+DigestAuthenticationFilter.nonceEncoding=Nonce\uAC00 Base64\uB85C \uC778\uCF54\uB529 \uB418\uC5B4\uC788\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4. \uD604\uC7AC nonce\uB294 {0}\uC785\uB2C8\uB2E4.
+DigestAuthenticationFilter.nonceExpired=Nonce\uC758 \uC720\uD6A8 \uAE30\uAC04\uC774 \uB9CC\uB8CC\uB418\uC5C8\uC2B5\uB2C8\uB2E4.
+DigestAuthenticationFilter.nonceNotNumeric=Nonce \uD1A0\uD070\uC758 \uCCAB \uAE00\uC790\uB294  \uC22B\uC790\uB85C \uC2DC\uC791\uD574\uC57C \uD569\uB2C8\uB2E4. \uD604\uC7AC nonce\uB294 {0}\uC785\uB2C8\uB2E4.
+DigestAuthenticationFilter.nonceNotTwoTokens=Nonce\uB294 2\uAC1C\uC758 \uD1A0\uD070\uC744 \uB9CC\uB4E4\uC5B4\uC57C \uD569\uB2C8\uB2E4. \uD604\uC7AC nonce\uB294 {0}\uC785\uB2C8\uB2E4.
+DigestAuthenticationFilter.usernameNotFound=\uC0AC\uC6A9\uC790 {0}\uC744/\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.
+JdbcDaoImpl.noAuthority=\uC0AC\uC6A9\uC790 {0}\uC740/\uB294 \uAD8C\uD55C\uC774 \uC5C6\uC2B5\uB2C8\uB2E4.
+JdbcDaoImpl.notFound=\uC0AC\uC6A9\uC790 {0}\uC744/\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.
+LdapAuthenticationProvider.badCredentials=\uBE44\uBC00\uBC88\uD638\uAC00 \uB9DE\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.
+LdapAuthenticationProvider.emptyUsername=\uC0AC\uC6A9\uC790\uBA85(username)\uC5D0 \uACF5\uBC31\uC740 \uD5C8\uC6A9\uB418\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.
+LdapAuthenticationProvider.onlySupports=UsernamePasswordAuthenticationToken\uB9CC \uC9C0\uC6D0\uD569\uB2C8\uB2E4.
+PasswordComparisonAuthenticator.badCredentials=\uBE44\uBC00\uBC88\uD638\uAC00 \uB9DE\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.
+#PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound={0}\uC744 \uC704\uD55C AuthenticationProvider\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.
+RememberMeAuthenticationProvider.incorrectKey=\uC81C\uACF5\uB41C RememberMeAuthenticationToken\uC5D0\uB294 \uCC3E\uB294 key\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4.
+RunAsImplAuthenticationProvider.incorrectKey=\uC81C\uACF5\uB41C RunAsUserToken\uC5D0\uB294 \uCC3E\uB294 key\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4.
+SubjectDnX509PrincipalExtractor.noMatching=subjectDN\: {0}\uC5D0\uC11C \uB9E4\uCE6D\uB418\uB294 \uD328\uD134\uC774 \uC5C6\uC2B5\uB2C8\uB2E4.
+SwitchUserFilter.noCurrentUser=\uC0AC\uC6A9\uC790\uAC00  \uC874\uC7AC\uD558\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.
+SwitchUserFilter.noOriginalAuthentication=Authentication\uC758 \uC6D0\uBCF8\uC744 \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.

core/src/main/resources/org/springframework/security/messages_pl.properties

@@ -1,53 +1,42 @@
-AuthByAdapterProvider.incorrectKey=Podana implementacja AuthByAdapter nie zawiera oczekiwanego klucza
-BasicAclEntryAfterInvocationProvider.noPermission=U\u017cytkownik {0} nie posiada \u017bADNYCH uprawnie\u0144 do obiektu {1}
-BasicAclEntryAfterInvocationProvider.insufficientPermission=U\u017cytkownik {0} nie posiada wymaganych uprawnie\u0144 do obiektu {1}
-ConcurrentSessionControllerImpl.exceededAllowed=Maksymalna liczba sesji ({0}) dla tego u\u017cytkownika zosta\u0142a przekroczona
-ProviderManager.providerNotFound=AuthenticationProvider dla {0} nie zosta\u0142 znaleziony
+AbstractAccessDecisionManager.accessDenied=Dost\u0119p zabroniony
+AbstractSecurityInterceptor.authenticationNotFound=Obiekt Authentication nie zosta\u0142 odnaleziony w SecurityContext
+AbstractUserDetailsAuthenticationProvider.badCredentials=Niepoprawne dane uwierzytelniaj\u0105ce
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=Wa\u017Cno\u015B\u0107 danych uwierzytelniaj\u0105cych wygas\u0142a
+AbstractUserDetailsAuthenticationProvider.disabled=Konto u\u017Cytkownika jest wy\u0142\u0105czone
+AbstractUserDetailsAuthenticationProvider.expired=Wa\u017Cno\u015B\u0107 konta u\u017Cytkownika wygas\u0142a
+AbstractUserDetailsAuthenticationProvider.locked=Konto u\u017Cytkownika jest zablokowane
+AbstractUserDetailsAuthenticationProvider.onlySupports=Tylko UsernamePasswordAuthenticationToken jest obs\u0142ugiwany
+AccountStatusUserDetailsChecker.credentialsExpired=Wa\u017Cno\u015B\u0107 danych uwierzytelniaj\u0105cych wygas\u0142a
+AccountStatusUserDetailsChecker.disabled=Konto u\u017Cytkownika jest wy\u0142\u0105czone
+AccountStatusUserDetailsChecker.expired=Wa\u017Cno\u015B\u0107 konta u\u017Cytkownika wygas\u0142a
+AccountStatusUserDetailsChecker.locked=Konto u\u017Cytkownika jest zablokowane
+AclEntryAfterInvocationProvider.noPermission=U\u017Cytkownik {0} nie posiada \u017BADNYCH uprawnie\u0144 do obiektu {1}
 AnonymousAuthenticationProvider.incorrectKey=Podany AnonymousAuthenticationToken nie zawiera oczekiwanego klucza
+BindAuthenticator.badCredentials=Niepoprawne dane uwierzytelniaj\u0105ce
+BindAuthenticator.emptyPassword=Niepoprawne dane uwierzytelniaj\u0105ce
 CasAuthenticationProvider.incorrectKey=Podany CasAuthenticationToken nie zawiera oczekiwanego klucza
 CasAuthenticationProvider.noServiceTicket=Dostarczenie biletu serwisu CAS do walidacji nie powiod\u0142o si\u0119
-NamedCasProxyDecider.untrusted=Najbli\u017cszy serwer po\u015brednicz\u0105cy {0} jest niezaufany
-RejectProxyTickets.reject=Bilety serwera po\u015brednicz\u0105cego zosta\u0142y odrzucone
-AbstractSecurityInterceptor.authenticationNotFound=Obiekt Authentication nie zosta\u0142 odnaleziony w SecurityContext
-AbstractUserDetailsAuthenticationProvider.onlySupports=Tylko UsernamePasswordAuthenticationToken jest obs\u0142ugiwany
-AbstractUserDetailsAuthenticationProvider.locked=Konto u\u017cytkownika jest zablokowane
-AbstractUserDetailsAuthenticationProvider.disabled=Konto u\u017cytkownika jest wy\u0142\u0105czone
-AbstractUserDetailsAuthenticationProvider.expired=Wa\u017cno\u015b\u0107 konta u\u017cytkownika wygas\u0142a
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=Wa\u017cno\u015b\u0107 danych uwierzytelniaj\u0105cych wygas\u0142a
-AbstractUserDetailsAuthenticationProvider.badCredentials=Niepoprawne dane uwierzytelniaj\u0105ce
-X509AuthenticationProvider.certificateNull=Certyfikat jest pusty
-DaoX509AuthoritiesPopulator.noMatching=Nie odnaleziono pasuj\u0105cego wzorca w subjectDN: {0}
+ConcurrentSessionControlStrategy.exceededAllowed=Maksymalna liczba sesji ({0}) dla tego u\u017Cytkownika zosta\u0142a przekroczona
+DigestAuthenticationFilter.incorrectRealm=Nazwa domeny {0} w odpowiedzi nie jest zgodna z nazw\u0105 domeny {1} w systemie
+DigestAuthenticationFilter.incorrectResponse=Niepoprawna odpowied\u017A
+DigestAuthenticationFilter.missingAuth=Brakuje wymaganej warto\u015Bci skr\u00F3tu dla 'auth' QOP; otrzymany nag\u0142\u00F3wek {0}
+DigestAuthenticationFilter.missingMandatory=Brakuje wymaganej warto\u015Bci skr\u00F3tu; otrzymany nag\u0142\u00F3wek {0}
+DigestAuthenticationFilter.nonceCompromised=Niepoprawny kod jednorazowy (nonce) {0}
+DigestAuthenticationFilter.nonceEncoding=Kod jednorazowy (nonce) nie jest zakodowany w Base64; otrzymany kod {0}
+DigestAuthenticationFilter.nonceExpired=Wa\u017Cno\u015B\u0107 kodu jednorazowego (nonce) wygas\u0142a
+DigestAuthenticationFilter.nonceNotNumeric=Pierwsza warto\u015B\u0107 kodu jednorazowego (nonce) nie jest warto\u015Bci\u0105 numeryczn\u0105\: {0}
+DigestAuthenticationFilter.nonceNotTwoTokens=Kod jednorazowy (nonce) powinien zawiera\u0107 dwie warto\u015Bci {0}
+DigestAuthenticationFilter.usernameNotFound=Nazwa u\u017Cytkownika {0} nie zosta\u0142a odnaleziona
+JdbcDaoImpl.noAuthority=U\u017Cytkownik {0} nie posiada \u017Cadnych uprawnie\u0144 (GrantedAuthority)
+JdbcDaoImpl.notFound=Nazwa u\u017Cytkownika {0} nie zosta\u0142a odnaleziona
+LdapAuthenticationProvider.badCredentials=Niepoprawne dane uwierzytelniaj\u0105ce
+LdapAuthenticationProvider.emptyUsername=Pusta nazwa u\u017Cytkownika jest niedozwolona
+LdapAuthenticationProvider.onlySupports=Tylko UsernamePasswordAuthenticationToken jest obs\u0142ugiwany
+PasswordComparisonAuthenticator.badCredentials=Niepoprawne dane uwierzytelniaj\u0105ce
+#PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound=AuthenticationProvider dla {0} nie zosta\u0142 znaleziony
 RememberMeAuthenticationProvider.incorrectKey=Podany RememberMeAuthenticationToken nie zawiera oczekiwanego klucza
 RunAsImplAuthenticationProvider.incorrectKey=Podany RunAsUserToken nie zawiera oczekiwanego klucza
-DigestProcessingFilter.missingMandatory=Brakuje wymaganej warto\u015bci skr\u00f3tu; otrzymany nag\u0142\u00f3wek {0}
-DigestProcessingFilter.missingAuth=Brakuje wymaganej warto\u015bci skr\u00f3tu dla 'auth' QOP; otrzymany nag\u0142\u00f3wek {0}
-DigestProcessingFilter.incorrectRealm=Nazwa domeny {0} w odpowiedzi nie jest zgodna z nazw\u0105 domeny {1} w systemie
-DigestProcessingFilter.nonceExpired=Wa\u017cno\u015b\u0107 kodu jednorazowego (nonce) wygas\u0142a
-DigestProcessingFilter.nonceEncoding=Kod jednorazowy (nonce) nie jest zakodowany w Base64; otrzymany kod {0}
-DigestProcessingFilter.nonceNotTwoTokens=Kod jednorazowy (nonce) powinien zawiera\u0107 dwie warto\u015bci {0}
-DigestProcessingFilter.nonceNotNumeric=Pierwsza warto\u015b\u0107 kodu jednorazowego (nonce) nie jest warto\u015bci\u0105 numeryczn\u0105: {0}
-DigestProcessingFilter.nonceCompromised=Niepoprawny kod jednorazowy (nonce) {0}
-DigestProcessingFilter.usernameNotFound=Nazwa u\u017cytkownika {0} nie zosta\u0142a odnaleziona
-DigestProcessingFilter.incorrectResponse=Niepoprawna odpowied\u017a
-JdbcDaoImpl.notFound=Nazwa u\u017cytkownika {0} nie zosta\u0142a odnaleziona
-JdbcDaoImpl.noAuthority=U\u017cytkownik {0} nie posiada \u017cadnych uprawnie\u0144 (GrantedAuthority)
-SwitchUserProcessingFilter.noCurrentUser=\u017baden aktualny u\u017cytkownik nie jest powi\u0105zany z tym zapytaniem
-SwitchUserProcessingFilter.noOriginalAuthentication=Nie mo\u017cna by\u0142o odnale\u017a\u0107 oryginalnego obiektu Authentication
-SwitchUserProcessingFilter.usernameNotFound=Nazwa u\u017cytkownika {0} nie zosta\u0142a odnaleziona
-SwitchUserProcessingFilter.locked=Konto u\u017cytkownika jest zablokowane
-SwitchUserProcessingFilter.disabled=Konto u\u017cytkownika jest wy\u0142\u0105czone
-SwitchUserProcessingFilter.expired=Wa\u017cno\u015b\u0107 konta u\u017cytkownika wygas\u0142a
-SwitchUserProcessingFilter.credentialsExpired=Wa\u017cno\u015b\u0107 danych uwierzytelniaj\u0105cych wygas\u0142a
-AbstractAccessDecisionManager.accessDenied=Dost\u0119p zabroniony
-LdapAuthenticationProvider.emptyUsername=Pusta nazwa u\u017cytkownika jest niedozwolona
-LdapAuthenticationProvider.emptyPassword=Niepoprawne dane uwierzytelniaj\u0105ce
-DefaultIntitalDirContextFactory.communicationFailure=Po\u0142\u0105czenie z serwerem LDAP nie powiod\u0142o si\u0119
-DefaultIntitalDirContextFactory.badCredentials=Niepoprawne dane uwierzytelniaj\u0105ce
-DefaultIntitalDirContextFactory.unexpectedException=Nie mo\u017cna by\u0142o uzyska\u0107 InitialDirContext z powodu nieoczekiwanego wyj\u0105tku
-PasswordComparisonAuthenticator.badCredentials=Niepoprawne dane uwierzytelniaj\u0105ce
-BindAuthenticator.badCredentials=Niepoprawne dane uwierzytelniaj\u0105ce
-BindAuthenticator.failedToLoadAttributes=Niepoprawne dane uwierzytelniaj\u0105ce
-UserDetailsService.locked=Konto u\u017cytkownika jest zablokowane
-UserDetailsService.disabled=Konto u\u017cytkownika jest wy\u0142\u0105czone
-UserDetailsService.expired=Wa\u017cno\u015b\u0107 konta u\u017cytkownika wygas\u0142a
-UserDetailsService.credentialsExpired=Wa\u017cno\u015b\u0107 danych uwierzytelniaj\u0105cych wygas\u0142a
+SubjectDnX509PrincipalExtractor.noMatching=Nie odnaleziono pasuj\u0105cego wzorca w subjectDN\: {0}
+SwitchUserFilter.noCurrentUser=\u017Baden aktualny u\u017Cytkownik nie jest powi\u0105zany z tym zapytaniem
+SwitchUserFilter.noOriginalAuthentication=Nie mo\u017Cna by\u0142o odnale\u017A\u0107 oryginalnego obiektu Authentication

core/src/main/resources/org/springframework/security/messages_pt_BR.properties

@@ -1,58 +1,45 @@
 # Spring security
 # Messages in Brazilian Portuguese
 # Translation by Leonardo Pinto (leoviveiros@gmail.com)
-
-AuthByAdapterProvider.incorrectKey=A implementa\u00E7\u00E3o de AuthByAdapter apresentada n\u00E3o cont\u00E9m a chave esperada
-BasicAclEntryAfterInvocationProvider.noPermission=Autentica\u00E7\u00E3o {0} n\u00E3o possui permiss\u00F5es no objeto de dom\u00EDnio {1}
-BasicAclEntryAfterInvocationProvider.insufficientPermission=Autentica\u00E7\u00E3o {0} possui permiss\u00F5es ACL para o objeto de dom\u00EDnio, mas n\u00E3o a permiss\u00E3o ACL requerida para o objeto de dom\u00EDnio {1}
-ConcurrentSessionControllerImpl.exceededAllowed=Excedidas as sess\u00F5es m\u00E1ximas de {0} para este usu\u00E1rio
-ProviderManager.providerNotFound=Nenhum AuthenticationProvider encontrado para {0}
-AnonymousAuthenticationProvider.incorrectKey=O AnonymousAuthenticationToken apresentado n\u00E3o cont\u00E9m a chave esperada
-CasAuthenticationProvider.incorrectKey=O CasAuthenticationToken apresentado n\u00E3o cont\u00E9m a chave esperada
-CasAuthenticationProvider.noServiceTicket=N\u00E3o foi poss\u00EDvel prover um ticket de servi\u00E7o CAS para validar
-NamedCasProxyDecider.untrusted=O proxy mais pr\u00F3ximo {0} n\u00E3o \u00E9 confi\u00E1vel
-RejectProxyTickets.reject=Os tickets do proxy foram rejeitados
+AbstractAccessDecisionManager.accessDenied=Acesso negado
 AbstractSecurityInterceptor.authenticationNotFound=Um objeto de autentica\u00E7\u00E3o n\u00E3o foi encontrado no SecurityContext
-AbstractUserDetailsAuthenticationProvider.onlySupports=Somente UsernamePasswordAuthenticationToken \u00E9 suportado
-AbstractUserDetailsAuthenticationProvider.locked=Conta bloqueada
+AbstractUserDetailsAuthenticationProvider.badCredentials=Usu\u00E1rio inexistente ou senha inv\u00E1lida
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=Credenciais expiradas
 AbstractUserDetailsAuthenticationProvider.disabled=Usu\u00E1rio desabilitado
 AbstractUserDetailsAuthenticationProvider.expired=Conta expirada
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=Credenciais expiradas
-AbstractUserDetailsAuthenticationProvider.badCredentials=Usu\u00E1rio inexistente ou senha inv\u00E1lida
-X509AuthenticationProvider.certificateNull=Certificado nulo
-DaoX509AuthoritiesPopulator.noMatching=Nenhum padr\u00E3o compat\u00EDvel foi encontrado em subjectDN: {0}
+AbstractUserDetailsAuthenticationProvider.locked=Conta bloqueada
+AbstractUserDetailsAuthenticationProvider.onlySupports=Somente UsernamePasswordAuthenticationToken \u00E9 suportado
+AccountStatusUserDetailsChecker.credentialsExpired=Credenciais expiradas
+AccountStatusUserDetailsChecker.disabled=Usu\u00E1rio desabilitado
+AccountStatusUserDetailsChecker.expired=Conta expirada
+AccountStatusUserDetailsChecker.locked=Conta bloqueada
+AclEntryAfterInvocationProvider.noPermission=Autentica\u00E7\u00E3o {0} n\u00E3o possui permiss\u00F5es no objeto de dom\u00EDnio {1}
+AnonymousAuthenticationProvider.incorrectKey=O AnonymousAuthenticationToken apresentado n\u00E3o cont\u00E9m a chave esperada
+BindAuthenticator.badCredentials=Usu\u00E1rio inexistente ou senha inv\u00E1lida
+BindAuthenticator.emptyPassword=Usu\u00E1rio inexistente ou senha inv\u00E1lida
+CasAuthenticationProvider.incorrectKey=O CasAuthenticationToken apresentado n\u00E3o cont\u00E9m a chave esperada
+CasAuthenticationProvider.noServiceTicket=N\u00E3o foi poss\u00EDvel prover um ticket de servi\u00E7o CAS para validar
+ConcurrentSessionControlStrategy.exceededAllowed=Excedidas as sess\u00F5es m\u00E1ximas de {0} para este usu\u00E1rio
+DigestAuthenticationFilter.incorrectRealm=Resposta realm de nome {0} n\u00E3o coincide com realm de sistema de nome {1}
+DigestAuthenticationFilter.incorrectResponse=Resposta incorreta
+DigestAuthenticationFilter.missingAuth=Valor digest obrigat\u00F3rio perdido para 'auth' QOP; header recibido {0}
+DigestAuthenticationFilter.missingMandatory=Valor digest obrigat\u00F3rio perdido; header recibido {0}
+DigestAuthenticationFilter.nonceCompromised=Nonce token comprometido {0}
+DigestAuthenticationFilter.nonceEncoding=Nonce n\u00E3o est\u00E1 codificado em Base64; nonce recibido {0}
+DigestAuthenticationFilter.nonceExpired=Nonce expirou/tempo esgotado
+DigestAuthenticationFilter.nonceNotNumeric=Nonce token deveria ter um primero token num\u00E9rico, mas tem {0}
+DigestAuthenticationFilter.nonceNotTwoTokens=Nonce token deveria ter dois tokens mas tem {0}
+DigestAuthenticationFilter.usernameNotFound=Usu\u00E1rio {0} n\u00E3o encontrado
+JdbcDaoImpl.noAuthority=Usu\u00E1rio {0} n\u00E3o tem permiss\u00E3o
+JdbcDaoImpl.notFound=Usu\u00E1rio {0} n\u00E3o encontrado
+LdapAuthenticationProvider.badCredentials=Usu\u00E1rio inexistente ou senha inv\u00E1lida
+LdapAuthenticationProvider.emptyUsername=Nome vazio n\u00E3o permitido
+LdapAuthenticationProvider.onlySupports=Somente UsernamePasswordAuthenticationToken \u00E9 suportado
+PasswordComparisonAuthenticator.badCredentials=Usu\u00E1rio inexistente ou senha inv\u00E1lida
+#PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound=Nenhum AuthenticationProvider encontrado para {0}
 RememberMeAuthenticationProvider.incorrectKey=O RememberMeAuthenticationToken apresentado n\u00E3o cont\u00E9m a chave esperada
 RunAsImplAuthenticationProvider.incorrectKey=O RunAsUserToken apresentado n\u00E3o cont\u00E9m a chave esperada
-DigestProcessingFilter.missingMandatory=Valor digest obrigat\u00F3rio perdido; header recibido {0}
-DigestProcessingFilter.missingAuth=Valor digest obrigat\u00F3rio perdido para 'auth' QOP; header recibido {0}
-DigestProcessingFilter.incorrectRealm=Resposta realm de nome {0} n\u00E3o coincide com realm de sistema de nome {1}
-DigestProcessingFilter.nonceExpired=Nonce expirou/tempo esgotado
-DigestProcessingFilter.nonceEncoding=Nonce n\u00E3o est\u00E1 codificado em Base64; nonce recibido {0}
-DigestProcessingFilter.nonceNotTwoTokens=Nonce token deveria ter dois tokens mas tem {0}
-DigestProcessingFilter.nonceNotNumeric=Nonce token deveria ter um primero token num\u00E9rico, mas tem {0}
-DigestProcessingFilter.nonceCompromised=Nonce token comprometido {0}
-DigestProcessingFilter.usernameNotFound=Usu\u00E1rio {0} n\u00E3o encontrado
-DigestProcessingFilter.incorrectResponse=Resposta incorreta
-JdbcDaoImpl.notFound=Usu\u00E1rio {0} n\u00E3o encontrado
-JdbcDaoImpl.noAuthority=Usu\u00E1rio {0} n\u00E3o tem permiss\u00E3o
-SwitchUserProcessingFilter.noCurrentUser=Nenhum usu\u00E1rio associado a esta requisi\u00E7\u00E3o
-SwitchUserProcessingFilter.noOriginalAuthentication=N\u00E3o foi poss\u00EDvel encontrar o objeto Authentication original
-SwitchUserProcessingFilter.usernameNotFound=Usu\u00E1rio {0} n\u00E3o encontrado
-SwitchUserProcessingFilter.locked=Conta bloqueada
-SwitchUserProcessingFilter.disabled=Usu\u00E1rio desabilitado
-SwitchUserProcessingFilter.expired=Conta expirada
-SwitchUserProcessingFilter.credentialsExpired=Credenciais expiradas
-AbstractAccessDecisionManager.accessDenied=Acesso negado
-LdapAuthenticationProvider.emptyUsername=Nome vazio n\u00E3o permitido
-LdapAuthenticationProvider.emptyPassword=Usu\u00E1rio inexistente ou senha inv\u00E1lida
-DefaultIntitalDirContextFactory.communicationFailure=N\u00E3o foi poss\u00EDvel conectar ao servidor LDAP
-DefaultIntitalDirContextFactory.badCredentials=Usu\u00E1rio inexistente ou senha inv\u00E1lida
-DefaultIntitalDirContextFactory.unexpectedException=Falha ao obter InitialDirContext devido a uma exce\u00E7\u00E3o n\u00E3o esperada
-PasswordComparisonAuthenticator.badCredentials=Usu\u00E1rio inexistente ou senha inv\u00E1lida
-BindAuthenticator.badCredentials=Usu\u00E1rio inexistente ou senha inv\u00E1lida
-BindAuthenticator.failedToLoadAttributes=Usu\u00E1rio inexistente ou senha inv\u00E1lida
-UserDetailsService.locked=Conta bloqueada
-UserDetailsService.disabled=Usu\u00E1rio desabilitado
-UserDetailsService.expired=Conta expirada
-UserDetailsService.credentialsExpired=Credenciais expiradas
-
+SubjectDnX509PrincipalExtractor.noMatching=Nenhum padr\u00E3o compat\u00EDvel foi encontrado em subjectDN\: {0}
+SwitchUserFilter.noCurrentUser=Nenhum usu\u00E1rio associado a esta requisi\u00E7\u00E3o
+SwitchUserFilter.noOriginalAuthentication=N\u00E3o foi poss\u00EDvel encontrar o objeto Authentication original

core/src/main/resources/org/springframework/security/messages_pt_PT.properties

@@ -1,56 +1,44 @@
 # Spring Security Portuguese Resource Bundle
 # Author: José Santos
-
-AuthByAdapterProvider.incorrectKey=A implementação do AuthByAdapter especificado não contém a chave esperada
-BasicAclEntryAfterInvocationProvider.noPermission=A autenticação {0} não tem QUALQUER permissão para o objecto de domínio {1}
-BasicAclEntryAfterInvocationProvider.insufficientPermission=A autenticação {0} tem permissões ACL para o objecto de domínio {1}, mas não a permissão ACL requerida
-ConcurrentSessionControllerImpl.exceededAllowed=Número máximo de sessões ({0}) excedido para este utilizador
-ProviderManager.providerNotFound=Nenhum AuthenticationProvider encontrado para {0}
-AnonymousAuthenticationProvider.incorrectKey=O AnonymousAuthenticationToken especificado não contém a chave esperada
-CasAuthenticationProvider.incorrectKey=O CasAuthenticationToken especificado não contém a chave esperada
-CasAuthenticationProvider.noServiceTicket=Falha na obtenção de um ticket de serviço CAS de validação
-NamedCasProxyDecider.untrusted=O proxy mais próximo {0} não é fiável
-RejectProxyTickets.reject=Tickets proxy rejeitados
-AbstractSecurityInterceptor.authenticationNotFound=Objecto Authentication não encontrado em SecurityContext
-AbstractUserDetailsAuthenticationProvider.onlySupports=Apenas UsernamePasswordAuthenticationToken é suportado
-AbstractUserDetailsAuthenticationProvider.locked=A conta de utilizador está bloqueada
-AbstractUserDetailsAuthenticationProvider.disabled=O utilizador está desactivado
-AbstractUserDetailsAuthenticationProvider.expired=A conta de utilizador expirou
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=As credenciais do utilizador expiraram
-AbstractUserDetailsAuthenticationProvider.badCredentials=Credenciais inválidas
-X509AuthenticationProvider.certificateNull=Certificado nulo
-DaoX509AuthoritiesPopulator.noMatching=Formato do subjectDN {0} incorrecto
-RememberMeAuthenticationProvider.incorrectKey=O RememberMeAuthenticationToken especificado não contém a chave esperada
-RunAsImplAuthenticationProvider.incorrectKey=O RunAsUserToken especificado não contém a chave esperada
-DigestProcessingFilter.missingMandatory=Valor digest obrigatório em falta; cabeçalho recebido {0}
-DigestProcessingFilter.missingAuth=Valor digest obrigatório em falta para 'auth' QOP; cabeçalho recebido {0}
-DigestProcessingFilter.incorrectRealm=Nome de domínio na resposta {0} não corresponde ao nome de domínio do sistema {1}
-DigestProcessingFilter.nonceExpired=O nonce expirou
-DigestProcessingFilter.nonceEncoding=O nonce não está codificado em Base64; nonce recebido {0}
-DigestProcessingFilter.nonceNotTwoTokens=O nonce deve ser constituído por 2 tokens, não por {0}
-DigestProcessingFilter.nonceNotNumeric=O primeiro elemento do token nonce ({0}) deve ser numérico
-DigestProcessingFilter.nonceCompromised=Token nonce comprometido {0}
-DigestProcessingFilter.usernameNotFound=Nome de utilizador {0} não encontrado
-DigestProcessingFilter.incorrectResponse=Resposta incorrecta
-JdbcDaoImpl.notFound=Utilizador {0} não encontrado
-JdbcDaoImpl.noAuthority=Utilizador {0} não tem GrantedAuthority
-SwitchUserProcessingFilter.noCurrentUser=Nenhum utilizador associado a este pedido
-SwitchUserProcessingFilter.noOriginalAuthentication=Objecto Authentication original não encontrado
-SwitchUserProcessingFilter.usernameNotFound=Nome de utilizador {0} não encontrado
-SwitchUserProcessingFilter.locked=A conta de utilizador está bloqueada
-SwitchUserProcessingFilter.disabled=O utilizador está desactivado
-SwitchUserProcessingFilter.expired=A conta de utilizador expirou
-SwitchUserProcessingFilter.credentialsExpired=As credenciais do utilizador expiraram
 AbstractAccessDecisionManager.accessDenied=Acesso negado
-LdapAuthenticationProvider.emptyUsername=Nome de utilizador vazio não permitido
-LdapAuthenticationProvider.emptyPassword=Credenciais inválidas
-DefaultIntitalDirContextFactory.communicationFailure=Falha na ligação ao servidor LDAP
-DefaultIntitalDirContextFactory.badCredentials=Credenciais inválidas
-DefaultIntitalDirContextFactory.unexpectedException=Falha na obtenção do InitialDirContext devido a erro desconhecido
-PasswordComparisonAuthenticator.badCredentials=Credenciais inválidas
-BindAuthenticator.badCredentials=Credenciais inválidas
-BindAuthenticator.failedToLoadAttributes=Credenciais inválidas
-UserDetailsService.locked=A conta de utilizador está bloqueada
-UserDetailsService.disabled=O utilizador está desactivado
-UserDetailsService.expired=A conta de utilizador expirou
-UserDetailsService.credentialsExpired=As credenciais do utilizador expiraram
+AbstractSecurityInterceptor.authenticationNotFound=Objecto Authentication n\u00E3o encontrado em SecurityContext
+AbstractUserDetailsAuthenticationProvider.badCredentials=Credenciais inv\u00E1lidas
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=As credenciais do utilizador expiraram
+AbstractUserDetailsAuthenticationProvider.disabled=O utilizador est\u00E1 desactivado
+AbstractUserDetailsAuthenticationProvider.expired=A conta de utilizador expirou
+AbstractUserDetailsAuthenticationProvider.locked=A conta de utilizador est\u00E1 bloqueada
+AbstractUserDetailsAuthenticationProvider.onlySupports=Apenas UsernamePasswordAuthenticationToken \u00E9 suportado
+AccountStatusUserDetailsChecker.credentialsExpired=As credenciais do utilizador expiraram
+AccountStatusUserDetailsChecker.disabled=O utilizador est\u00E1 desactivado
+AccountStatusUserDetailsChecker.expired=A conta de utilizador expirou
+AccountStatusUserDetailsChecker.locked=A conta de utilizador est\u00E1 bloqueada
+AclEntryAfterInvocationProvider.noPermission=A autentica\u00E7\u00E3o {0} n\u00E3o tem QUALQUER permiss\u00E3o para o objecto de dom\u00EDnio {1}
+AnonymousAuthenticationProvider.incorrectKey=O AnonymousAuthenticationToken especificado n\u00E3o cont\u00E9m a chave esperada
+BindAuthenticator.badCredentials=Credenciais inv\u00E1lidas
+BindAuthenticator.emptyPassword=Credenciais inv\u00E1lidas
+CasAuthenticationProvider.incorrectKey=O CasAuthenticationToken especificado n\u00E3o cont\u00E9m a chave esperada
+CasAuthenticationProvider.noServiceTicket=Falha na obten\u00E7\u00E3o de um ticket de servi\u00E7o CAS de valida\u00E7\u00E3o
+ConcurrentSessionControlStrategy.exceededAllowed=N\u00FAmero m\u00E1ximo de sess\u00F5es ({0}) excedido para este utilizador
+DigestAuthenticationFilter.incorrectRealm=Nome de dom\u00EDnio na resposta {0} n\u00E3o corresponde ao nome de dom\u00EDnio do sistema {1}
+DigestAuthenticationFilter.incorrectResponse=Resposta incorrecta
+DigestAuthenticationFilter.missingAuth=Valor digest obrigat\u00F3rio em falta para 'auth' QOP; cabe\u00E7alho recebido {0}
+DigestAuthenticationFilter.missingMandatory=Valor digest obrigat\u00F3rio em falta; cabe\u00E7alho recebido {0}
+DigestAuthenticationFilter.nonceCompromised=Token nonce comprometido {0}
+DigestAuthenticationFilter.nonceEncoding=O nonce n\u00E3o est\u00E1 codificado em Base64; nonce recebido {0}
+DigestAuthenticationFilter.nonceExpired=O nonce expirou
+DigestAuthenticationFilter.nonceNotNumeric=O primeiro elemento do token nonce ({0}) deve ser num\u00E9rico
+DigestAuthenticationFilter.nonceNotTwoTokens=O nonce deve ser constitu\u00EDdo por 2 tokens, n\u00E3o por {0}
+DigestAuthenticationFilter.usernameNotFound=Nome de utilizador {0} n\u00E3o encontrado
+JdbcDaoImpl.noAuthority=Utilizador {0} n\u00E3o tem GrantedAuthority
+JdbcDaoImpl.notFound=Utilizador {0} n\u00E3o encontrado
+LdapAuthenticationProvider.badCredentials=Credenciais inv\u00E1lidas
+LdapAuthenticationProvider.emptyUsername=Nome de utilizador vazio n\u00E3o permitido
+LdapAuthenticationProvider.onlySupports=Apenas UsernamePasswordAuthenticationToken \u00E9 suportado
+PasswordComparisonAuthenticator.badCredentials=Credenciais inv\u00E1lidas
+#PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound=Nenhum AuthenticationProvider encontrado para {0}
+RememberMeAuthenticationProvider.incorrectKey=O RememberMeAuthenticationToken especificado n\u00E3o cont\u00E9m a chave esperada
+RunAsImplAuthenticationProvider.incorrectKey=O RunAsUserToken especificado n\u00E3o cont\u00E9m a chave esperada
+SubjectDnX509PrincipalExtractor.noMatching=Formato do subjectDN {0} incorrecto
+SwitchUserFilter.noCurrentUser=Nenhum utilizador associado a este pedido
+SwitchUserFilter.noOriginalAuthentication=Objecto Authentication original n\u00E3o encontrado

core/src/main/resources/org/springframework/security/messages_uk_UA.properties

@@ -1,53 +1,42 @@
-AuthByAdapterProvider.incorrectKey=\u0414\u0430\u043D\u0430 \u0456\u043C\u043F\u043B\u0435\u043C\u0435\u043D\u0442\u0430\u0446\u0456\u044F AuthByAdapter \u043D\u0435 \u043C\u0456\u0441\u0442\u0438\u0442\u044C \u043E\u0447\u0456\u043A\u0443\u0432\u0430\u043D\u043E\u0433\u043E \u043A\u043B\u044E\u0447\u0430
-BasicAclEntryAfterInvocationProvider.noPermission=\u0410\u0443\u0442\u0435\u043D\u0442\u0438\u0444\u0456\u043A\u0430\u0446\u0456\u044F {0} \u043D\u0435 \u043C\u0430\u0454 \u0436\u043E\u0434\u043D\u043E\u0433\u043E \u0434\u043E\u0437\u0432\u043E\u043B\u0443 \u0434\u043B\u044F \u0434\u043E\u0441\u0442\u0443\u043F\u0443 \u0434\u043E \u043E\u0431'\u0454\u043A\u0442\u0443 \u0434\u043E\u043C\u0435\u043D\u0443 {1}
-BasicAclEntryAfterInvocationProvider.insufficientPermission=\u0410\u0443\u0442\u0435\u043D\u0442\u0438\u0444\u0456\u043A\u0430\u0446\u0456\u044F {0} \u043C\u0430\u0454 ACL \u0434\u043E\u0437\u0432\u043E\u043B\u0438, \u0430\u043B\u0435 \u043D\u0435 \u043C\u0430\u0454 \u043D\u0435\u043E\u0431\u0445\u0456\u0434\u043D\u043E\u0433\u043E \u0434\u043E\u0437\u0432\u043E\u043B\u0443 \u0434\u043B\u044F \u0434\u043E\u0441\u0442\u0443\u043F\u0443 \u0434\u043E \u043E\u0431'\u0454\u043A\u0442\u0443 \u0434\u043E\u043C\u0435\u043D\u0443 {1}
-ConcurrentSessionControllerImpl.exceededAllowed=\u041C\u0430\u043A\u0441\u0438\u043C\u0430\u043B\u044C\u043D\u0430 \u043A\u0456\u043B\u044C\u043A\u0456\u0441\u0442\u044C \u0441\u0435\u0441\u0456\u0439 ({0}) \u0434\u043B\u044F \u0446\u044C\u043E\u0433\u043E \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u043D\u0430
-ProviderManager.providerNotFound=AuthenticationProvider \u0434\u043B\u044F {0} \u043D\u0435 \u0437\u043D\u0430\u0439\u0434\u0435\u043D\u0438\u0439
-AnonymousAuthenticationProvider.incorrectKey=\u0414\u0430\u043D\u0438\u0439 AnonymousAuthenticationToken \u043D\u0435 \u043C\u0456\u0441\u0442\u0438\u0442\u044C \u043E\u0447\u0456\u043A\u0443\u0432\u0430\u043D\u043E\u0433\u043E \u043A\u043B\u044E\u0447\u0430
-CasAuthenticationProvider.incorrectKey=\u0414\u0430\u043D\u0438\u0439 CasAuthenticationToken \u043D\u0435 \u043C\u0456\u0441\u0442\u0438\u0442\u044C \u043E\u0447\u0456\u043A\u0443\u0432\u0430\u043D\u043E\u0433\u043E \u043A\u043B\u044E\u0447\u0430
-CasAuthenticationProvider.noServiceTicket=\u041D\u0435 \u043C\u043E\u0436\u043B\u0438\u0432\u043E \u043D\u0430\u0434\u0430\u0442\u0438 \u0431\u0456\u043B\u0435\u0442 \u0441\u0435\u0440\u0432\u0456\u0441\u0443 CAS \u0434\u043B\u044F \u0432\u0430\u043B\u0456\u0434\u0430\u0446\u0456\u0457
-NamedCasProxyDecider.untrusted=\u041D\u0430\u0439\u0431\u043B\u0438\u0436\u0447\u0438\u0439 \u043F\u0440\u043E\u043A\u0441\u0456-\u0441\u0435\u0440\u0432\u0435\u0440 {0} \u0454 \u043D\u0435\u043D\u0430\u0434\u0456\u0439\u043D\u0438\u043C
-RejectProxyTickets.reject=\u0411\u0456\u043B\u0435\u0442\u0438 \u043F\u0440\u043E\u043A\u0441\u0456-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0432\u0456\u0434\u0445\u0438\u043B\u0435\u043D\u0456
+AbstractAccessDecisionManager.accessDenied=\u0414\u043E\u0441\u0442\u0443\u043F \u0437\u0430\u0431\u043E\u0440\u043E\u043D\u0435\u043D\u0438\u0439
 AbstractSecurityInterceptor.authenticationNotFound=\u041E\u0431'\u0454\u043A\u0442 Authentication \u043D\u0435 \u0437\u043D\u0430\u0439\u0434\u0435\u043D\u0438\u0439 \u0432 SecurityContext
-AbstractUserDetailsAuthenticationProvider.onlySupports=\u0422\u0456\u043B\u044C\u043A\u0438 UsernamePasswordAuthenticationToken \u043F\u0456\u0434\u0442\u0440\u0438\u043C\u0443\u0454\u0442\u044C\u0441\u044F
-AbstractUserDetailsAuthenticationProvider.locked=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0437\u0430\u0431\u043B\u043E\u043A\u043E\u0432\u0430\u043D\u0438\u0439
+AbstractUserDetailsAuthenticationProvider.badCredentials=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=\u041F\u043E\u0432\u043D\u043E\u0432\u0430\u0436\u0435\u043D\u043D\u044F \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u043B\u0438 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
 AbstractUserDetailsAuthenticationProvider.disabled=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0437\u0430\u0431\u043E\u0440\u043E\u043D\u0435\u043D\u0438\u0439
 AbstractUserDetailsAuthenticationProvider.expired=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u0432 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=\u041F\u043E\u0432\u043D\u043E\u0432\u0430\u0436\u0435\u043D\u043D\u044F \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u043B\u0438 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
-AbstractUserDetailsAuthenticationProvider.badCredentials=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
-X509AuthenticationProvider.certificateNull=\u0421\u0435\u0440\u0442\u0438\u0444\u0456\u043A\u0430\u0442 \u043F\u043E\u0440\u043E\u0436\u043D\u0456\u0439
-DaoX509AuthoritiesPopulator.noMatching=\u041D\u0435 \u0437\u043D\u0430\u0439\u0434\u0435\u043D\u043E \u0432\u0456\u0434\u043F\u043E\u0432\u0456\u0434\u043D\u043E\u0433\u043E \u0448\u0430\u0431\u043B\u043E\u043D\u0443 \u0432 subjectDN: {0}
+AbstractUserDetailsAuthenticationProvider.locked=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0437\u0430\u0431\u043B\u043E\u043A\u043E\u0432\u0430\u043D\u0438\u0439
+AbstractUserDetailsAuthenticationProvider.onlySupports=\u0422\u0456\u043B\u044C\u043A\u0438 UsernamePasswordAuthenticationToken \u043F\u0456\u0434\u0442\u0440\u0438\u043C\u0443\u0454\u0442\u044C\u0441\u044F
+AccountStatusUserDetailsChecker.credentialsExpired=\u041F\u043E\u0432\u043D\u043E\u0432\u0430\u0436\u0435\u043D\u043D\u044F \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u043B\u0438 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
+AccountStatusUserDetailsChecker.disabled=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0437\u0430\u0431\u043E\u0440\u043E\u043D\u0435\u043D\u0438\u0439
+AccountStatusUserDetailsChecker.expired=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u0432 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
+AccountStatusUserDetailsChecker.locked=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0437\u0430\u0431\u043B\u043E\u043A\u043E\u0432\u0430\u043D\u0438\u0439
+AclEntryAfterInvocationProvider.noPermission=\u0410\u0443\u0442\u0435\u043D\u0442\u0438\u0444\u0456\u043A\u0430\u0446\u0456\u044F {0} \u043D\u0435 \u043C\u0430\u0454 \u0436\u043E\u0434\u043D\u043E\u0433\u043E \u0434\u043E\u0437\u0432\u043E\u043B\u0443 \u0434\u043B\u044F \u0434\u043E\u0441\u0442\u0443\u043F\u0443 \u0434\u043E \u043E\u0431'\u0454\u043A\u0442\u0443 \u0434\u043E\u043C\u0435\u043D\u0443 {1}
+AnonymousAuthenticationProvider.incorrectKey=\u0414\u0430\u043D\u0438\u0439 AnonymousAuthenticationToken \u043D\u0435 \u043C\u0456\u0441\u0442\u0438\u0442\u044C \u043E\u0447\u0456\u043A\u0443\u0432\u0430\u043D\u043E\u0433\u043E \u043A\u043B\u044E\u0447\u0430
+BindAuthenticator.badCredentials=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
+BindAuthenticator.emptyPassword=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
+CasAuthenticationProvider.incorrectKey=\u0414\u0430\u043D\u0438\u0439 CasAuthenticationToken \u043D\u0435 \u043C\u0456\u0441\u0442\u0438\u0442\u044C \u043E\u0447\u0456\u043A\u0443\u0432\u0430\u043D\u043E\u0433\u043E \u043A\u043B\u044E\u0447\u0430
+CasAuthenticationProvider.noServiceTicket=\u041D\u0435 \u043C\u043E\u0436\u043B\u0438\u0432\u043E \u043D\u0430\u0434\u0430\u0442\u0438 \u0431\u0456\u043B\u0435\u0442 \u0441\u0435\u0440\u0432\u0456\u0441\u0443 CAS \u0434\u043B\u044F \u0432\u0430\u043B\u0456\u0434\u0430\u0446\u0456\u0457
+ConcurrentSessionControlStrategy.exceededAllowed=\u041C\u0430\u043A\u0441\u0438\u043C\u0430\u043B\u044C\u043D\u0430 \u043A\u0456\u043B\u044C\u043A\u0456\u0441\u0442\u044C \u0441\u0435\u0441\u0456\u0439 ({0}) \u0434\u043B\u044F \u0446\u044C\u043E\u0433\u043E \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u043D\u0430
+DigestAuthenticationFilter.incorrectRealm=\u041D\u0430\u0437\u0432\u0430 \u0434\u043E\u043C\u0435\u043D\u0443 {0} \u0443 \u0432\u0456\u0434\u043F\u043E\u0432\u0456\u0434\u0456 \u043D\u0435 \u0432\u0456\u0434\u043F\u043E\u0432\u0456\u0434\u0430\u0454 \u043D\u0430\u0437\u0432\u0456 \u0434\u043E\u043C\u0435\u043D\u0443 {1} \u0432 \u0441\u0438\u0441\u0442\u0435\u043C\u0456
+DigestAuthenticationFilter.incorrectResponse=\u041D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0430 \u0432\u0456\u0434\u043F\u043E\u0432\u0456\u0434\u044C
+DigestAuthenticationFilter.missingAuth=\u0412\u0456\u0434\u0441\u0443\u0442\u043D\u0454 \u043E\u0431\u043E\u0432'\u044F\u0437\u043A\u043E\u0432\u0435 \u0437\u043D\u0430\u0447\u0435\u043D\u043D\u044F \u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442\u0430 \u0434\u043B\u044F 'auth' QOP; \u043E\u0442\u0440\u0438\u043C\u0430\u043D\u0438\u0439 \u0437\u0430\u0433\u043E\u043B\u043E\u0432\u043E\u043A {0}
+DigestAuthenticationFilter.missingMandatory=\u0412\u0456\u0434\u0441\u0443\u0442\u043D\u0454 \u043E\u0431\u043E\u0432'\u044F\u0437\u043A\u043E\u0432\u0435 \u0437\u043D\u0430\u0447\u0435\u043D\u043D\u044F \u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442\u0430; \u043E\u0442\u0440\u0438\u043C\u0430\u043D\u0438\u0439 \u0437\u0430\u0433\u043E\u043B\u043E\u0432\u043E\u043A {0}
+DigestAuthenticationFilter.nonceCompromised=\u041A\u043E\u0434 (nonce) \u0441\u043A\u043E\u043C\u043F\u0440\u043E\u043C\u0435\u0442\u043E\u0432\u0430\u043D\u0438\u0439 {0}
+DigestAuthenticationFilter.nonceEncoding=\u041A\u043E\u0434 (nonce) \u043D\u0435 \u0437\u0430\u0448\u0438\u0444\u0440\u043E\u0432\u0430\u043D\u0438\u0439 \u0432 Base64; \u043E\u0442\u0440\u0438\u043C\u0430\u043D\u0438\u0439 \u043A\u043E\u0434 {0}
+DigestAuthenticationFilter.nonceExpired=\u041A\u043E\u0434 (nonce) \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u0432 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
+DigestAuthenticationFilter.nonceNotNumeric=\u041F\u0435\u0440\u0448\u0438\u0439 \u0441\u0438\u043C\u0432\u043E\u043B (token) \u043A\u043E\u0434 \u043F\u043E\u0432\u0438\u043D\u0435\u043D \u043C\u0456\u0441\u0442\u0438\u0442\u0438 \u0446\u0438\u0444\u0440\u043E\u0432\u0435 \u0437\u043D\u0430\u0447\u0435\u043D\u043D\u044F, \u0430 \u043C\u0456\u0441\u0442\u0438\u0442\u044C\: {0}
+DigestAuthenticationFilter.nonceNotTwoTokens=\u041A\u043E\u0434 (nonce) \u043F\u043E\u0432\u0438\u043D\u0435\u043D \u043C\u0456\u0441\u0442\u0438\u0442\u0438 \u0434\u0432\u0430 \u0441\u0438\u043C\u0432\u043E\u043B\u0438 (tokens), \u0430\u043B\u0435 \u043C\u0456\u0441\u0442\u0438\u0442\u044C {0}
+DigestAuthenticationFilter.usernameNotFound=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 {0} \u043D\u0435 \u0437\u043D\u0430\u0439\u0434\u0435\u043D\u0438\u0439
+JdbcDaoImpl.noAuthority=\u041A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447 {0} \u043D\u0435 \u043C\u0430\u0454 \u043F\u043E\u0432\u043D\u043E\u0432\u0430\u0436\u0435\u043D\u044C (GrantedAuthority)
+JdbcDaoImpl.notFound=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 {0} \u043D\u0435 \u0437\u043D\u0430\u0439\u0434\u0435\u043D\u0438\u0439
+LdapAuthenticationProvider.badCredentials=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
+LdapAuthenticationProvider.emptyUsername=\u041F\u043E\u0440\u043E\u0436\u043D\u0454 \u0456\u043C'\u044F \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0454 \u0437\u0430\u0431\u043E\u0440\u043E\u043D\u0435\u043D\u0438\u043C
+LdapAuthenticationProvider.onlySupports=\u0422\u0456\u043B\u044C\u043A\u0438 UsernamePasswordAuthenticationToken \u043F\u0456\u0434\u0442\u0440\u0438\u043C\u0443\u0454\u0442\u044C\u0441\u044F
+PasswordComparisonAuthenticator.badCredentials=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
+#PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound=AuthenticationProvider \u0434\u043B\u044F {0} \u043D\u0435 \u0437\u043D\u0430\u0439\u0434\u0435\u043D\u0438\u0439
 RememberMeAuthenticationProvider.incorrectKey=\u0414\u0430\u043D\u0438\u0439 RememberMeAuthenticationToken \u043D\u0435 \u043C\u0456\u0441\u0442\u0438\u0442\u044C \u043E\u0447\u0456\u043A\u0443\u0432\u0430\u043D\u043E\u0433\u043E \u043A\u043B\u044E\u0447\u0430
 RunAsImplAuthenticationProvider.incorrectKey=\u0414\u0430\u043D\u0438\u0439 RunAsUserToken \u043D\u0435 \u043C\u0456\u0441\u0442\u0438\u0442\u044C \u043E\u0447\u0456\u043A\u0443\u0432\u0430\u043D\u043E\u0433\u043E \u043A\u043B\u044E\u0447\u0430
-DigestProcessingFilter.missingMandatory=\u0412\u0456\u0434\u0441\u0443\u0442\u043D\u0454 \u043E\u0431\u043E\u0432'\u044F\u0437\u043A\u043E\u0432\u0435 \u0437\u043D\u0430\u0447\u0435\u043D\u043D\u044F \u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442\u0430; \u043E\u0442\u0440\u0438\u043C\u0430\u043D\u0438\u0439 \u0437\u0430\u0433\u043E\u043B\u043E\u0432\u043E\u043A {0}
-DigestProcessingFilter.missingAuth=\u0412\u0456\u0434\u0441\u0443\u0442\u043D\u0454 \u043E\u0431\u043E\u0432'\u044F\u0437\u043A\u043E\u0432\u0435 \u0437\u043D\u0430\u0447\u0435\u043D\u043D\u044F \u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442\u0430 \u0434\u043B\u044F 'auth' QOP; \u043E\u0442\u0440\u0438\u043C\u0430\u043D\u0438\u0439 \u0437\u0430\u0433\u043E\u043B\u043E\u0432\u043E\u043A {0}
-DigestProcessingFilter.incorrectRealm=\u041D\u0430\u0437\u0432\u0430 \u0434\u043E\u043C\u0435\u043D\u0443 {0} \u0443 \u0432\u0456\u0434\u043F\u043E\u0432\u0456\u0434\u0456 \u043D\u0435 \u0432\u0456\u0434\u043F\u043E\u0432\u0456\u0434\u0430\u0454 \u043D\u0430\u0437\u0432\u0456 \u0434\u043E\u043C\u0435\u043D\u0443 {1} \u0432 \u0441\u0438\u0441\u0442\u0435\u043C\u0456
-DigestProcessingFilter.nonceExpired=\u041A\u043E\u0434 (nonce) \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u0432 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
-DigestProcessingFilter.nonceEncoding=\u041A\u043E\u0434 (nonce) \u043D\u0435 \u0437\u0430\u0448\u0438\u0444\u0440\u043E\u0432\u0430\u043D\u0438\u0439 \u0432 Base64; \u043E\u0442\u0440\u0438\u043C\u0430\u043D\u0438\u0439 \u043A\u043E\u0434 {0}
-DigestProcessingFilter.nonceNotTwoTokens=\u041A\u043E\u0434 (nonce) \u043F\u043E\u0432\u0438\u043D\u0435\u043D \u043C\u0456\u0441\u0442\u0438\u0442\u0438 \u0434\u0432\u0430 \u0441\u0438\u043C\u0432\u043E\u043B\u0438 (tokens), \u0430\u043B\u0435 \u043C\u0456\u0441\u0442\u0438\u0442\u044C {0}
-DigestProcessingFilter.nonceNotNumeric=\u041F\u0435\u0440\u0448\u0438\u0439 \u0441\u0438\u043C\u0432\u043E\u043B (token) \u043A\u043E\u0434 \u043F\u043E\u0432\u0438\u043D\u0435\u043D \u043C\u0456\u0441\u0442\u0438\u0442\u0438 \u0446\u0438\u0444\u0440\u043E\u0432\u0435 \u0437\u043D\u0430\u0447\u0435\u043D\u043D\u044F, \u0430 \u043C\u0456\u0441\u0442\u0438\u0442\u044C: {0}
-DigestProcessingFilter.nonceCompromised=\u041A\u043E\u0434 (nonce) \u0441\u043A\u043E\u043C\u043F\u0440\u043E\u043C\u0435\u0442\u043E\u0432\u0430\u043D\u0438\u0439 {0}
-DigestProcessingFilter.usernameNotFound=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 {0} \u043D\u0435 \u0437\u043D\u0430\u0439\u0434\u0435\u043D\u0438\u0439
-DigestProcessingFilter.incorrectResponse=\u041D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0430 \u0432\u0456\u0434\u043F\u043E\u0432\u0456\u0434\u044C
-JdbcDaoImpl.notFound=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 {0} \u043D\u0435 \u0437\u043D\u0430\u0439\u0434\u0435\u043D\u0438\u0439
-JdbcDaoImpl.noAuthority=\u041A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447 {0} \u043D\u0435 \u043C\u0430\u0454 \u043F\u043E\u0432\u043D\u043E\u0432\u0430\u0436\u0435\u043D\u044C (GrantedAuthority)
-SwitchUserProcessingFilter.noCurrentUser=\u041D\u0435\u043C\u0430\u0454 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430, \u043F\u043E\u0432'\u044F\u0437\u0430\u043D\u043E\u0433\u043E \u0456\u0437 \u0434\u0430\u043D\u0438\u043C \u0437\u0430\u043F\u0438\u0442\u043E\u043C
-SwitchUserProcessingFilter.noOriginalAuthentication=\u041D\u0435 \u043C\u043E\u0436\u043B\u0438\u0432\u043E \u0437\u043D\u0430\u0439\u0442\u0438 \u043E\u0440\u0438\u0433\u0456\u043D\u0430\u043B\u044C\u043D\u0438\u0439 \u043E\u0431'\u0454\u043A\u0442 Authentication
-SwitchUserProcessingFilter.usernameNotFound=\u0406\u043C'\u044F \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 {0} \u043D\u0435 \u0437\u043D\u0430\u0439\u0434\u0435\u043D\u0435
-SwitchUserProcessingFilter.locked=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0437\u0430\u0431\u043B\u043E\u043A\u043E\u0432\u0430\u043D\u0438\u0439
-SwitchUserProcessingFilter.disabled=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0437\u0430\u0431\u043E\u0440\u043E\u043D\u0435\u043D\u0438\u0439
-SwitchUserProcessingFilter.expired=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u0432 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
-SwitchUserProcessingFilter.credentialsExpired=\u041F\u043E\u0432\u043D\u043E\u0432\u0430\u0436\u0435\u043D\u043D\u044F \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u043B\u0438 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
-AbstractAccessDecisionManager.accessDenied=\u0414\u043E\u0441\u0442\u0443\u043F \u0437\u0430\u0431\u043E\u0440\u043E\u043D\u0435\u043D\u0438\u0439
-LdapAuthenticationProvider.emptyUsername=\u041F\u043E\u0440\u043E\u0436\u043D\u0454 \u0456\u043C'\u044F \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0454 \u0437\u0430\u0431\u043E\u0440\u043E\u043D\u0435\u043D\u0438\u043C
-LdapAuthenticationProvider.emptyPassword=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
-DefaultIntitalDirContextFactory.communicationFailure=\u041D\u0435\u043C\u043E\u0436\u043B\u0438\u0432\u043E \u0437'\u0454\u0434\u043D\u0430\u0442\u0438\u0441\u044F \u0437  LDAP \u0441\u0435\u0440\u0432\u0435\u0440\u043E\u043C
-DefaultIntitalDirContextFactory.badCredentials=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
-DefaultIntitalDirContextFactory.unexpectedException=\u041D\u0435\u043C\u043E\u0436\u043B\u0438\u0432\u043E \u043E\u0442\u0440\u0438\u043C\u0430\u0442\u0438 InitialDirContext \u0447\u0435\u0440\u0435\u0437 \u0432\u0438\u043D\u0438\u043A\u043D\u0435\u043D\u043D\u044F \u043D\u0435\u043E\u0447\u0456\u043A\u0443\u0432\u0430\u043D\u043E\u0457 \u043F\u043E\u043C\u0438\u043B\u043A\u0438
-PasswordComparisonAuthenticator.badCredentials=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
-BindAuthenticator.badCredentials=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
-BindAuthenticator.failedToLoadAttributes=\u0414\u0430\u043D\u0456 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u043D\u0435\u043A\u043E\u0440\u0435\u043A\u0442\u043D\u0456
-UserDetailsService.locked=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0437\u0430\u0431\u043B\u043E\u043A\u043E\u0432\u0430\u043D\u0438\u0439
-UserDetailsService.disabled=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0437\u0430\u0431\u043E\u0440\u043E\u043D\u0435\u043D\u0438\u0439
-UserDetailsService.expired=\u041E\u0431\u043B\u0456\u043A\u043E\u0432\u0438\u0439 \u0437\u0430\u043F\u0438\u0441 \u043A\u043E\u0440\u0443\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u0432 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
-UserDetailsService.credentialsExpired=\u041F\u043E\u0432\u043D\u043E\u0432\u0430\u0436\u0435\u043D\u043D\u044F \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430 \u0432\u0438\u0447\u0435\u0440\u043F\u0430\u043B\u0438 \u0442\u0435\u0440\u043C\u0456\u043D \u0434\u0456\u0457
+SubjectDnX509PrincipalExtractor.noMatching=\u041D\u0435 \u0437\u043D\u0430\u0439\u0434\u0435\u043D\u043E \u0432\u0456\u0434\u043F\u043E\u0432\u0456\u0434\u043D\u043E\u0433\u043E \u0448\u0430\u0431\u043B\u043E\u043D\u0443 \u0432 subjectDN\: {0}
+SwitchUserFilter.noCurrentUser=\u041D\u0435\u043C\u0430\u0454 \u043A\u043E\u0440\u0438\u0441\u0442\u0443\u0432\u0430\u0447\u0430, \u043F\u043E\u0432'\u044F\u0437\u0430\u043D\u043E\u0433\u043E \u0456\u0437 \u0434\u0430\u043D\u0438\u043C \u0437\u0430\u043F\u0438\u0442\u043E\u043C
+SwitchUserFilter.noOriginalAuthentication=\u041D\u0435 \u043C\u043E\u0436\u043B\u0438\u0432\u043E \u0437\u043D\u0430\u0439\u0442\u0438 \u043E\u0440\u0438\u0433\u0456\u043D\u0430\u043B\u044C\u043D\u0438\u0439 \u043E\u0431'\u0454\u043A\u0442 Authentication

core/src/main/resources/org/springframework/security/messages_zh_CN.properties

@@ -1,54 +1,42 @@
-AuthByAdapterProvider.incorrectKey=\u5c55\u793a\u7684AuthByAdapter\u5b9e\u73b0\u4e0d\u542b\u6709\u9884\u671f\u7684key
-BasicAclEntryAfterInvocationProvider.noPermission=\u7ed9\u5b9a\u7684Authentication\u5bf9\u8c61({0})\u6839\u672c\u65e0\u6743\u64cd\u63a7\u9886\u57df\u5bf9\u8c61({1})
-BasicAclEntryAfterInvocationProvider.insufficientPermission=Authentication\u5bf9\u8c61({0})\u786e\u5b9e\u542b\u6709ACL\u6743\u9650\uff0c\u4f46\u5e76\u4e0d\u662f\u76ee\u6807\u9886\u57df\u5bf9\u8c61\u6240\u8981\u6c42\u7684({1})
-ConcurrentSessionControllerImpl.exceededAllowed=\u5df2\u7ecf\u8d85\u8fc7\u4e86\u5f53\u524d\u4e3b\u4f53({0})\u88ab\u5141\u8bb8\u7684\u6700\u5927\u4f1a\u8bdd\u6570\u91cf
-ProviderManager.providerNotFound=\u672a\u67e5\u627e\u5230\u9488\u5bf9{0}\u7684AuthenticationProvider
-AnonymousAuthenticationProvider.incorrectKey=\u5c55\u793a\u7684AnonymousAuthenticationToken\u4e0d\u542b\u6709\u9884\u671f\u7684key
-CasAuthenticationProvider.incorrectKey=\u5c55\u793a\u7684CasAuthenticationToken\u4e0d\u542b\u6709\u9884\u671f\u7684key
-CasAuthenticationProvider.noServiceTicket=\u672a\u80fd\u591f\u6b63\u786e\u63d0\u4f9b\u5f85\u9a8c\u8bc1\u7684CAS\u670d\u52a1\u7968\u6839
-NamedCasProxyDecider.untrusted=\u4ee3\u7406({0})\u4e0d\u53d7\u4fe1\u4efb
-RejectProxyTickets.reject=Proxy\u7968\u6839\u88ab\u62d2\u7edd
-AbstractSecurityInterceptor.authenticationNotFound=\u672a\u5728SecurityContext\u4e2d\u67e5\u627e\u5230\u8ba4\u8bc1\u5bf9\u8c61
-AbstractUserDetailsAuthenticationProvider.onlySupports=\u4ec5\u4ec5\u652f\u6301UsernamePasswordAuthenticationToken
-AbstractUserDetailsAuthenticationProvider.locked=\u7528\u6237\u5e10\u53f7\u5df2\u88ab\u9501\u5b9a
-AbstractUserDetailsAuthenticationProvider.disabled=\u7528\u6237\u5df2\u5931\u6548
-AbstractUserDetailsAuthenticationProvider.expired=\u7528\u6237\u5e10\u53f7\u5df2\u8fc7\u671f
-AbstractUserDetailsAuthenticationProvider.credentialsExpired=\u7528\u6237\u51ed\u8bc1\u5df2\u8fc7\u671f
-AbstractUserDetailsAuthenticationProvider.badCredentials=\u574f\u7684\u51ed\u8bc1
-X509AuthenticationProvider.certificateNull=\u672a\u63d0\u4f9b\u8bc1\u4e66
-DaoX509AuthoritiesPopulator.noMatching=\u672a\u5728subjectDN: {0}\u4e2d\u627e\u5230\u5339\u914d\u7684\u6a21\u5f0f
-RememberMeAuthenticationProvider.incorrectKey=\u5c55\u793aRememberMeAuthenticationToken\u4e0d\u542b\u6709\u9884\u671f\u7684key
-RunAsImplAuthenticationProvider.incorrectKey=\u5c55\u793a\u7684RunAsUserToken\u4e0d\u542b\u6709\u9884\u671f\u7684key
-DigestProcessingFilter.missingMandatory=\u9057\u6f0f\u4e86\u5fc5\u987b\u7ed9\u5b9a\u7684\u6458\u8981\u53d6\u503c; \u63a5\u6536\u5230\u7684\u5934\u4fe1\u606f\u4e3a{0}
-DigestProcessingFilter.missingAuth=\u9057\u6f0f\u4e86\u9488\u5bf9'auth' QOP\u7684\u3001\u5fc5\u987b\u7ed9\u5b9a\u7684\u6458\u8981\u53d6\u503c; \u63a5\u6536\u5230\u7684\u5934\u4fe1\u606f\u4e3a{0}
-DigestProcessingFilter.incorrectRealm=\u54cd\u5e94\u7ed3\u679c\u4e2d\u7684Realm\u540d\u5b57({0})\u540c\u7cfb\u7edf\u6307\u5b9a\u7684Realm\u540d\u5b57({1})\u4e0d\u543b\u5408
-DigestProcessingFilter.nonceExpired=Nonce\u5df2\u7ecf\u8fc7\u671f/\u8d85\u65f6
-DigestProcessingFilter.nonceEncoding=Nonce\u672a\u7ecf\u8fc7Base64\u7f16\u7801; \u76f8\u5e94\u7684nonce\u53d6\u503c\u4e3a {0}
-DigestProcessingFilter.nonceNotTwoTokens=Nonce\u5e94\u8be5\u7531\u4e24\u90e8\u5206\u53d6\u503c\u6784\u6210\uff0c\u4f46\u7ed3\u679c\u5374\u662f{0}
-DigestProcessingFilter.nonceNotNumeric=Nonce\u4ee4\u724c\u7684\u7b2c1\u90e8\u5206\u5e94\u8be5\u662f\u6570\u5b57\uff0c\u4f46\u7ed3\u679c\u5374\u662f{0}
-DigestProcessingFilter.nonceCompromised=Nonce\u4ee4\u724c\u5df2\u7ecf\u5b58\u5728\u95ee\u9898\u4e86\uff0c{0}
-DigestProcessingFilter.usernameNotFound=\u7528\u6237\u540d{0}\u672a\u627e\u5230
-DigestProcessingFilter.incorrectResponse=\u9519\u8bef\u7684\u54cd\u5e94\u7ed3\u679c
-JdbcDaoImpl.notFound=\u672a\u627e\u5230\u7528\u6237{0}
-JdbcDaoImpl.noAuthority=\u6ca1\u6709\u4e3a\u7528\u6237{0}\u6307\u5b9a\u89d2\u8272
-SwitchUserProcessingFilter.noCurrentUser=\u4e0d\u5b58\u5728\u5f53\u524d\u7528\u6237
-SwitchUserProcessingFilter.noOriginalAuthentication=\u4e0d\u80fd\u591f\u67e5\u627e\u5230\u539f\u5148\u7684\u5df2\u8ba4\u8bc1\u5bf9\u8c61
-SwitchUserProcessingFilter.usernameNotFound=\u7528\u6237\u540d{0}\u672a\u627e\u5230
-SwitchUserProcessingFilter.locked=\u7528\u6237\u5e10\u53f7\u5df2\u88ab\u9501\u5b9a
-SwitchUserProcessingFilter.disabled=\u7528\u6237\u5df2\u5931\u6548
-SwitchUserProcessingFilter.expired=\u7528\u6237\u5e10\u53f7\u5df2\u8fc7\u671f
-SwitchUserProcessingFilter.credentialsExpired=\u7528\u6237\u51ed\u8bc1\u5df2\u8fc7\u671f
-AbstractAccessDecisionManager.accessDenied=\u4e0d\u5141\u8bb8\u8bbf\u95ee
-LdapAuthenticationProvider.emptyUsername=\u7528\u6237\u540d\u4e0d\u5141\u8bb8\u4e3a\u7a7a
-LdapAuthenticationProvider.emptyPassword=\u574f\u7684\u51ed\u8bc1
-DefaultIntitalDirContextFactory.communicationFailure=\u4e0d\u80fd\u591f\u8fde\u63a5\u5230LDAP\u670d\u52a1\u5668
-DefaultIntitalDirContextFactory.badCredentials=\u574f\u7684\u51ed\u8bc1
-DefaultIntitalDirContextFactory.unexpectedException=\u7531\u4e8e\u672a\u9884\u671f\u5f02\u5e38\u800c\u4e0d\u80fd\u591f\u83b7\u5f97InitialDirContext
-PasswordComparisonAuthenticator.badCredentials=\u574f\u7684\u51ed\u8bc1
-BindAuthenticator.badCredentials=\u574f\u7684\u51ed\u8bc1
-BindAuthenticator.failedToLoadAttributes=\u574f\u7684\u51ed\u8bc1
-UserDetailsService.locked=\u7528\u6237\u5e10\u53f7\u5df2\u88ab\u9501\u5b9a
-UserDetailsService.disabled=\u7528\u6237\u5df2\u5931\u6548
-UserDetailsService.expired=\u7528\u6237\u5e10\u53f7\u5df2\u8fc7\u671f
-UserDetailsService.credentialsExpired=\u7528\u6237\u51ed\u8bc1\u5df2\u8fc7\u671f
-
+AbstractAccessDecisionManager.accessDenied=\u4E0D\u5141\u8BB8\u8BBF\u95EE
+AbstractSecurityInterceptor.authenticationNotFound=\u672A\u5728SecurityContext\u4E2D\u67E5\u627E\u5230\u8BA4\u8BC1\u5BF9\u8C61
+AbstractUserDetailsAuthenticationProvider.badCredentials=\u574F\u7684\u51ED\u8BC1
+AbstractUserDetailsAuthenticationProvider.credentialsExpired=\u7528\u6237\u51ED\u8BC1\u5DF2\u8FC7\u671F
+AbstractUserDetailsAuthenticationProvider.disabled=\u7528\u6237\u5DF2\u5931\u6548
+AbstractUserDetailsAuthenticationProvider.expired=\u7528\u6237\u5E10\u53F7\u5DF2\u8FC7\u671F
+AbstractUserDetailsAuthenticationProvider.locked=\u7528\u6237\u5E10\u53F7\u5DF2\u88AB\u9501\u5B9A
+AbstractUserDetailsAuthenticationProvider.onlySupports=\u4EC5\u4EC5\u652F\u6301UsernamePasswordAuthenticationToken
+AccountStatusUserDetailsChecker.credentialsExpired=\u7528\u6237\u51ED\u8BC1\u5DF2\u8FC7\u671F
+AccountStatusUserDetailsChecker.disabled=\u7528\u6237\u5DF2\u5931\u6548
+AccountStatusUserDetailsChecker.expired=\u7528\u6237\u5E10\u53F7\u5DF2\u8FC7\u671F
+AccountStatusUserDetailsChecker.locked=\u7528\u6237\u5E10\u53F7\u5DF2\u88AB\u9501\u5B9A
+AclEntryAfterInvocationProvider.noPermission=\u7ED9\u5B9A\u7684Authentication\u5BF9\u8C61({0})\u6839\u672C\u65E0\u6743\u64CD\u63A7\u9886\u57DF\u5BF9\u8C61({1})
+AnonymousAuthenticationProvider.incorrectKey=\u5C55\u793A\u7684AnonymousAuthenticationToken\u4E0D\u542B\u6709\u9884\u671F\u7684key
+BindAuthenticator.badCredentials=\u574F\u7684\u51ED\u8BC1
+BindAuthenticator.emptyPassword=\u574F\u7684\u51ED\u8BC1
+CasAuthenticationProvider.incorrectKey=\u5C55\u793A\u7684CasAuthenticationToken\u4E0D\u542B\u6709\u9884\u671F\u7684key
+CasAuthenticationProvider.noServiceTicket=\u672A\u80FD\u591F\u6B63\u786E\u63D0\u4F9B\u5F85\u9A8C\u8BC1\u7684CAS\u670D\u52A1\u7968\u6839
+ConcurrentSessionControlStrategy.exceededAllowed=\u5DF2\u7ECF\u8D85\u8FC7\u4E86\u5F53\u524D\u4E3B\u4F53({0})\u88AB\u5141\u8BB8\u7684\u6700\u5927\u4F1A\u8BDD\u6570\u91CF
+DigestAuthenticationFilter.incorrectRealm=\u54CD\u5E94\u7ED3\u679C\u4E2D\u7684Realm\u540D\u5B57({0})\u540C\u7CFB\u7EDF\u6307\u5B9A\u7684Realm\u540D\u5B57({1})\u4E0D\u543B\u5408
+DigestAuthenticationFilter.incorrectResponse=\u9519\u8BEF\u7684\u54CD\u5E94\u7ED3\u679C
+DigestAuthenticationFilter.missingAuth=\u9057\u6F0F\u4E86\u9488\u5BF9'auth' QOP\u7684\u3001\u5FC5\u987B\u7ED9\u5B9A\u7684\u6458\u8981\u53D6\u503C; \u63A5\u6536\u5230\u7684\u5934\u4FE1\u606F\u4E3A{0}
+DigestAuthenticationFilter.missingMandatory=\u9057\u6F0F\u4E86\u5FC5\u987B\u7ED9\u5B9A\u7684\u6458\u8981\u53D6\u503C; \u63A5\u6536\u5230\u7684\u5934\u4FE1\u606F\u4E3A{0}
+DigestAuthenticationFilter.nonceCompromised=Nonce\u4EE4\u724C\u5DF2\u7ECF\u5B58\u5728\u95EE\u9898\u4E86\uFF0C{0}
+DigestAuthenticationFilter.nonceEncoding=Nonce\u672A\u7ECF\u8FC7Base64\u7F16\u7801; \u76F8\u5E94\u7684nonce\u53D6\u503C\u4E3A {0}
+DigestAuthenticationFilter.nonceExpired=Nonce\u5DF2\u7ECF\u8FC7\u671F/\u8D85\u65F6
+DigestAuthenticationFilter.nonceNotNumeric=Nonce\u4EE4\u724C\u7684\u7B2C1\u90E8\u5206\u5E94\u8BE5\u662F\u6570\u5B57\uFF0C\u4F46\u7ED3\u679C\u5374\u662F{0}
+DigestAuthenticationFilter.nonceNotTwoTokens=Nonce\u5E94\u8BE5\u7531\u4E24\u90E8\u5206\u53D6\u503C\u6784\u6210\uFF0C\u4F46\u7ED3\u679C\u5374\u662F{0}
+DigestAuthenticationFilter.usernameNotFound=\u7528\u6237\u540D{0}\u672A\u627E\u5230
+JdbcDaoImpl.noAuthority=\u6CA1\u6709\u4E3A\u7528\u6237{0}\u6307\u5B9A\u89D2\u8272
+JdbcDaoImpl.notFound=\u672A\u627E\u5230\u7528\u6237{0}
+LdapAuthenticationProvider.badCredentials=\u574F\u7684\u51ED\u8BC1
+LdapAuthenticationProvider.emptyUsername=\u7528\u6237\u540D\u4E0D\u5141\u8BB8\u4E3A\u7A7A
+LdapAuthenticationProvider.onlySupports=\u4EC5\u4EC5\u652F\u6301UsernamePasswordAuthenticationToken
+PasswordComparisonAuthenticator.badCredentials=\u574F\u7684\u51ED\u8BC1
+#PersistentTokenBasedRememberMeServices.cookieStolen=Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
+ProviderManager.providerNotFound=\u672A\u67E5\u627E\u5230\u9488\u5BF9{0}\u7684AuthenticationProvider
+RememberMeAuthenticationProvider.incorrectKey=\u5C55\u793ARememberMeAuthenticationToken\u4E0D\u542B\u6709\u9884\u671F\u7684key
+RunAsImplAuthenticationProvider.incorrectKey=\u5C55\u793A\u7684RunAsUserToken\u4E0D\u542B\u6709\u9884\u671F\u7684key
+SubjectDnX509PrincipalExtractor.noMatching=\u672A\u5728subjectDN\: {0}\u4E2D\u627E\u5230\u5339\u914D\u7684\u6A21\u5F0F
+SwitchUserFilter.noCurrentUser=\u4E0D\u5B58\u5728\u5F53\u524D\u7528\u6237
+SwitchUserFilter.noOriginalAuthentication=\u4E0D\u80FD\u591F\u67E5\u627E\u5230\u539F\u5148\u7684\u5DF2\u8BA4\u8BC1\u5BF9\u8C61

core/src/test/java/org/springframework/security/access/intercept/InterceptorStatusTokenTests.java

@@ -15,8 +15,7 @@
 
 package org.springframework.security.access.intercept;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.*;
 
 import java.util.List;
 
@@ -24,8 +23,8 @@ import org.aopalliance.intercept.MethodInvocation;
 import org.junit.Test;
 import org.springframework.security.access.ConfigAttribute;
 import org.springframework.security.access.SecurityConfig;
-import org.springframework.security.access.intercept.InterceptorStatusToken;
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.util.SimpleMethodInvocation;
 
 
@@ -40,12 +39,12 @@ public class InterceptorStatusTokenTests {
     public void testOperation() {
         List<ConfigAttribute> attr = SecurityConfig.createList("FOO");
         MethodInvocation mi = new SimpleMethodInvocation();
-        InterceptorStatusToken token = new InterceptorStatusToken(new UsernamePasswordAuthenticationToken("rod",
-                    "koala"), true, attr, mi);
+        SecurityContext ctx = SecurityContextHolder.createEmptyContext();
+        InterceptorStatusToken token = new InterceptorStatusToken(ctx, true, attr, mi);
 
         assertTrue(token.isContextHolderRefreshRequired());
         assertEquals(attr, token.getAttributes());
         assertEquals(mi, token.getSecureObject());
-        assertEquals("rod", token.getAuthentication().getPrincipal());
+        assertSame(ctx, token.getSecurityContext());
     }
 }

core/src/test/java/org/springframework/security/access/intercept/RunAsUserTokenTests.java

@@ -84,6 +84,14 @@ public class RunAsUserTokenTests extends TestCase {
         RunAsUserToken token = new RunAsUserToken("my_password", "Test", "Password",
                 new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_ONE"), new GrantedAuthorityImpl("ROLE_TWO")},
                 UsernamePasswordAuthenticationToken.class);
-        assertTrue(token.toString().lastIndexOf("Original Class:") != -1);
+        assertTrue(token.toString().lastIndexOf("Original Class: "+UsernamePasswordAuthenticationToken.class.getName().toString()) != -1);
+    }
+
+    // SEC-1792
+    public void testToStringNullOriginalAuthentication() {
+        RunAsUserToken token = new RunAsUserToken("my_password", "Test", "Password",
+                new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_ONE"), new GrantedAuthorityImpl("ROLE_TWO")},
+                null);
+        assertTrue(token.toString().lastIndexOf("Original Class: null") != -1);
     }
 }

core/src/test/java/org/springframework/security/access/intercept/aopalliance/MethodSecurityInterceptorTests.java

@@ -15,8 +15,7 @@
 
 package org.springframework.security.access.intercept.aopalliance;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.*;
 
 import java.util.List;
 
@@ -44,6 +43,7 @@ import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
 
 /**
@@ -276,7 +276,8 @@ public class MethodSecurityInterceptorTests {
 
     @Test
     public void runAsReplacementIsCorrectlySet() throws Exception {
-        SecurityContextHolder.getContext().setAuthentication(token);
+        SecurityContext ctx = SecurityContextHolder.getContext();
+        ctx.setAuthentication(token);
         token.setAuthenticated(true);
         final RunAsManager runAs = jmock.mock(RunAsManager.class);
         final RunAsUserToken runAsToken =
@@ -292,7 +293,8 @@ public class MethodSecurityInterceptorTests {
         String result = advisedTarget.makeUpperCase("hello");
         assertEquals("HELLO org.springframework.security.access.intercept.RunAsUserToken true", result);
         // Check we've changed back
-        assertEquals(token, SecurityContextHolder.getContext().getAuthentication());
+        assertSame(ctx, SecurityContextHolder.getContext());
+        assertSame(token, SecurityContextHolder.getContext().getAuthentication());
     }
 
     @Test(expected=AuthenticationCredentialsNotFoundException.class)

core/src/test/java/org/springframework/security/authentication/encoding/PasswordEncoderUtilsTests.java

@@ -0,0 +1,33 @@
+package org.springframework.security.authentication.encoding;
+
+import static org.junit.Assert.*;
+
+import org.junit.Test;
+/**
+ * @author Rob Winch
+ */
+public class PasswordEncoderUtilsTests {
+
+    @Test
+    public void differentLength() {
+        assertFalse(PasswordEncoderUtils.equals("abc", "a"));
+        assertFalse(PasswordEncoderUtils.equals("a", "abc"));
+    }
+
+    @Test
+    public void equalsNull() {
+        assertFalse(PasswordEncoderUtils.equals(null, "a"));
+        assertFalse(PasswordEncoderUtils.equals("a", null));
+        assertTrue(PasswordEncoderUtils.equals(null, null));
+    }
+
+    @Test
+    public void equalsCaseSensitive() {
+        assertFalse(PasswordEncoderUtils.equals("aBc", "abc"));
+    }
+
+    @Test
+    public void equalsSuccess() {
+        assertTrue(PasswordEncoderUtils.equals("abcdef", "abcdef"));
+    }
+}

core/src/test/java/org/springframework/security/authentication/jaas/JaasAuthenticationProviderTests.java

@@ -179,7 +179,7 @@ public class JaasAuthenticationProviderTests {
 
     @Test
     public void testFull() throws Exception {
-        List<GrantedAuthority> defaultAuths = AuthorityUtils.createAuthorityList("ROLE_ONE", "ROLE_TWO");
+        List<GrantedAuthority> defaultAuths = AuthorityUtils.createAuthorityList("ROLE_ONE");
         UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("user", "password",
                 defaultAuths);
 
@@ -196,8 +196,7 @@ public class JaasAuthenticationProviderTests {
 
         assertTrue("GrantedAuthorities should contain ROLE_TEST1", list.contains(new GrantedAuthorityImpl("ROLE_TEST1")));
         assertTrue("GrantedAuthorities should contain ROLE_TEST2", list.contains(new GrantedAuthorityImpl("ROLE_TEST2")));
-        assertTrue("GrantedAuthorities should contain ROLE_1", list.contains(defaultAuths.get(0)));
-        assertTrue("GrantedAuthorities should contain ROLE_2", list.contains(defaultAuths.get(1)));
+        assertFalse("GrantedAuthorities should not contain ROLE_ONE", list.contains(defaultAuths.get(0)));
 
         boolean foundit = false;
 

core/src/test/java/org/springframework/security/core/SpringSecurityMessageSourceTests.java

@@ -32,7 +32,7 @@ public class SpringSecurityMessageSourceTests extends TestCase {
 
     public void testOperation() {
         SpringSecurityMessageSource msgs = new SpringSecurityMessageSource();
-        assertEquals("Proxy\u7968\u6839\u88ab\u62d2\u7edd", msgs.getMessage("RejectProxyTickets.reject", null, Locale.SIMPLIFIED_CHINESE));
+        assertEquals("\u4E0D\u5141\u8BB8\u8BBF\u95EE", msgs.getMessage("AbstractAccessDecisionManager.accessDenied", null, Locale.SIMPLIFIED_CHINESE));
     }
 
     public void testReplacableLookup() {
@@ -43,7 +43,7 @@ public class SpringSecurityMessageSourceTests extends TestCase {
         // Cause a message to be generated
         MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
         assertEquals("Le jeton nonce est compromis FOOBAR",
-            messages.getMessage("DigestProcessingFilter.nonceCompromised", new Object[] {"FOOBAR"},
+            messages.getMessage("DigestAuthenticationFilter.nonceCompromised", new Object[] {"FOOBAR"},
                 "ERROR - FAILED TO LOOKUP"));
 
         // Revert to original Locale

core/src/test/java/org/springframework/security/remoting/rmi/ContextPropagatingRemoteInvocationTests.java

@@ -16,20 +16,13 @@
 package org.springframework.security.remoting.rmi;
 
 import junit.framework.TestCase;
-
+import org.aopalliance.intercept.MethodInvocation;
 import org.springframework.security.TargetObject;
-
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
-
-import org.springframework.security.remoting.rmi.ContextPropagatingRemoteInvocation;
-import org.springframework.security.remoting.rmi.ContextPropagatingRemoteInvocationFactory;
-
 import org.springframework.security.util.SimpleMethodInvocation;
 
-import org.aopalliance.intercept.MethodInvocation;
-
 import java.lang.reflect.Method;
 
 
@@ -57,8 +50,7 @@ public class ContextPropagatingRemoteInvocationTests extends TestCase {
         return (ContextPropagatingRemoteInvocation) factory.createRemoteInvocation(mi);
     }
 
-    public void testContextIsResetEvenIfExceptionOccurs()
-        throws Exception {
+    public void testContextIsResetEvenIfExceptionOccurs() throws Exception {
         // Setup client-side context
         Authentication clientSideAuthentication = new UsernamePasswordAuthenticationToken("rod", "koala");
         SecurityContextHolder.getContext().setAuthentication(clientSideAuthentication);
@@ -96,10 +88,10 @@ public class ContextPropagatingRemoteInvocationTests extends TestCase {
     }
 
     public void testNullContextHolderDoesNotCauseInvocationProblems() throws Exception {
-        SecurityContextHolder.getContext().setAuthentication(null); // just to be explicit
+        SecurityContextHolder.clearContext(); // just to be explicit
 
         ContextPropagatingRemoteInvocation remoteInvocation = getRemoteInvocation();
-        SecurityContextHolder.getContext().setAuthentication(null); // unnecessary, but for explicitness
+        SecurityContextHolder.clearContext(); // unnecessary, but for explicitness
 
         assertEquals("some_string Authentication empty", remoteInvocation.invoke(new TargetObject()));
     }

docs/manual/src/docbook/appendix-namespace.xml

@@ -15,30 +15,29 @@
         explaining their purpose. The namespace is written in <link
         xlink:href="http://www.relaxng.org/">RELAX NG</link> Compact format and later converted into
         an XSD schema. If you are familiar with this format, you may wish to examine the <link
-        xlink:href="https://fisheye.springsource.org/browse/spring-security/config/src/main/resources/org/springframework/security/config/spring-security-3.1.rnc"
+        xlink:href="http://git.springsource.org/spring-security/spring-security/blobs/3.0.x/config/src/main/resources/org/springframework/security/config/spring-security-3.0.4.rnc"
         >schema file</link> directly.</para>
     <section xml:id="nsa-http">
         <title>Web Application Security - the <literal>&lt;http&gt;</literal> Element</title>
-        <para> If you use an <literal>&lt;http&gt;</literal> element within your application, a
-            <classname>FilterChainProxy</classname> bean named "springSecurityFilterChain" is
-            created and the configuration within the element is used to build a filter chain within
-            <classname>FilterChainProxy</classname>. As of Spring Security 3.1, additional
-            <literal>http</literal> elements can be used to add extra filter chains <footnote>
+        <para> The <literal>&lt;http&gt;</literal> element encapsulates the security configuration
+            for the web layer of your application. It creates a
+            <classname>FilterChainProxy</classname> bean named "springSecurityFilterChain" which
+            maintains the stack of security filters which make up the web security configuration <footnote>
             <para>See the <link xlink:href="#ns-web-xml"> introductory chapter</link> for how to set
                 up the mapping from your <literal>web.xml</literal></para>
-            </footnote>. Some core filters are always created in a filter chain and others will be
-            added to the stack depending on the attributes and child elements which are present. The
-            positions of the standard filters are fixed (see <link xlink:href="#filter-stack">the
-            filter order table</link> in the namespace introduction), removing a common source of
-            errors with previous versions of the framework when users had to configure the filter
-            chain explicitly in the<classname>FilterChainProxy</classname> bean. You can, of course,
-            still do this if you need full control of the configuration. </para>
+            </footnote>. Some core filters are always created and others will be added to the stack
+            depending on the attributes child elements which are present. The positions of the
+            standard filters are fixed (see <link xlink:href="#filter-stack">the filter order
+            table</link> in the namespace introduction), removing a common source of errors with
+            previous versions of the framework when users had to configure the filter chain
+            explicitly in the<classname>FilterChainProxy</classname> bean. You can, of course, still
+            do this if you need full control of the configuration. </para>
         <para> All filters which require a reference to the
             <interfacename>AuthenticationManager</interfacename> will be automatically injected with
             the internal instance created by the namespace configuration (see the <link
             xlink:href="#ns-auth-manager"> introductory chapter</link> for more on the
             <interfacename>AuthenticationManager</interfacename>). </para>
-        <para> Each <literal>&lt;http&gt;</literal> namespace block always creates an
+        <para> The <literal>&lt;http&gt;</literal> namespace block always creates an
             <classname>SecurityContextPersistenceFilter</classname>, an
             <classname>ExceptionTranslationFilter</classname> and a
             <classname>FilterSecurityInterceptor</classname>. These are fixed and cannot be replaced
@@ -47,50 +46,25 @@
             <title><literal>&lt;http&gt;</literal> Attributes</title>
             <para> The attributes on the <literal>&lt;http&gt;</literal> element control some of the
                 properties on the core filters. </para>
-            <section xml:id="nsa-http-pattern">
-                <title><literal>pattern</literal></title>
-                <para>Defining a pattern for the <literal>http</literal> element controls the
-                    requests which will be filtered through the list of filters which it defines.
-                    The interpretation is dependent on the configured <link
-                    xlink:href="#nsa-path-type">request-matcher</link>. If no pattern is defined,
-                    all requests will be matched, so the most specific patterns should be declared
-                    first. </para>
-            </section>
-            <section xml:id="nsa-http-secured">
-                <title><literal>security</literal></title>
-                <para>A request pattern can be mapped to an empty filter chain, by setting this
-                    attribute to <literal>none</literal>. No security will be applied and none of
-                    Spring Security's features will be available. </para>
-            </section>
             <section xml:id="nsa-servlet-api-provision">
                 <title><literal>servlet-api-provision</literal></title>
                 <para> Provides versions of <literal>HttpServletRequest</literal> security methods
                     such as <literal>isUserInRole()</literal> and <literal>getPrincipal()</literal>
                     which are implemented by adding a
                     <classname>SecurityContextHolderAwareRequestFilter</classname> bean to the
-                    stack. Defaults to "true".</para>
-            </section>
-            <section xml:id="nsa-jaas-api-provision">
-                <title><literal>jaas-api-provision</literal></title>
-                <para>If available, runs the request as the <literal>Subject</literal> acquired from
-                    the <classname>JaasAuthenticationToken</classname> which is implemented by
-                    adding a <classname>JaasApiIntegrationFilter</classname> bean to the stack.
-                    Defaults to "false".</para>
+                    stack. Defaults to "true". </para>
             </section>
             <section xml:id="nsa-path-type">
-                <title><literal>request-matcher</literal></title>
-                <para> Defines the <interfacename>RequestMatcher</interfacename> strategy used in
-                    the <classname>FilterChainProxy</classname> and the beans created by the
-                    <literal>intercept-url</literal> to match incoming requests. Options are
-                    currently <literal>ant</literal>, <literal>regex</literal> and
-                    <literal>ciRegex</literal>, for ant, regular-expression and case-insensitive
-                    regular-expression repsectively. A separate instance is created for each
-                    <literal>intercept-url</literal> element using its <literal>pattern</literal>
-                    and <literal>method</literal> attributes (see below). Ant paths are matched
-                    using an <classname>AntPathRequestMatcher</classname> and regular expressions
-                    are matched using a <classname>RegexRequestMatcher</classname>. See the Javadoc
-                    for these classes for more details on exactly how the matching is preformed. Ant
-                    paths are the default strategy.</para>
+                <title><literal>path-type</literal></title>
+                <para> Controls whether URL patterns are interpreted as ant paths (the default) or
+                    regular expressions. In practice this sets a particular
+                    <interfacename>UrlMatcher</interfacename> instance on the
+                    <classname>FilterChainProxy</classname>. </para>
+            </section>
+            <section xml:id="nsa-lowercase-comparisons">
+                <title><literal>lowercase-comparisons</literal></title>
+                <para> Whether test URLs should be converted to lower case prior to comparing with
+                    defined path patterns. If unspecified, defaults to "true" </para>
             </section>
             <section xml:id="nsa-realm">
                 <title><literal>realm</literal></title>
@@ -106,12 +80,6 @@
                     <interfacename>AuthenticationEntryPoint</interfacename> bean which will start
                     the authentication process. </para>
             </section>
-            <section xml:id="nsa-security-context-repo-ref">
-                <title><literal>security-context-repository-ref</literal></title>
-                <para> Allows injection of a custom
-                    <interfacename>SecurityContextRepository</interfacename> into the
-                    <classname>SecurityContextPersistenceFilter</classname>. </para>
-            </section>
             <section xml:id="nsa-access-decision-manager-ref">
                 <title><literal>access-decision-manager-ref</literal></title>
                 <para> Optional attribute specifying the ID of the
@@ -131,13 +99,13 @@
                 <para> Corresponds to the <literal>observeOncePerRequest</literal> property of
                     <classname>FilterSecurityInterceptor</classname>. Defaults to "true". </para>
             </section>
-            <section xml:id="nsa-create-session">
+            <section xml:id="create-session">
                 <title><literal>create-session</literal></title>
                 <para> Controls the eagerness with which an HTTP session is created. If not set,
                     defaults to "ifRequired". Other options are "always" and "never". The setting of
                     this attribute affect the <literal>allowSessionCreation</literal> and
                     <literal>forceEagerSessionCreation</literal> properties of
-                    <classname>HttpSessionContextIntegrationFilter</classname>.
+                    <classname>SecurityContextPersistenceFilter</classname>.
                     <literal>allowSessionCreation</literal> will always be true unless this
                     attribute is set to "never". <literal>forceEagerSessionCreation</literal> is
                     "false" unless it is set to "always". So the default configuration allows
@@ -145,7 +113,7 @@
                     control is enabled, when <literal>forceEagerSessionCreation</literal> will be
                     set to true, regardless of what the setting is here. Using "never" would then
                     cause an exception during the initialization of
-                    <classname>HttpSessionContextIntegrationFilter</classname>. </para>
+                    <classname>SecurityContextPersistenceFilter</classname>. </para>
             </section>
             <section xml:id="nsa-use-expressions">
                 <title><literal>use-expressions</literal></title>
@@ -174,17 +142,19 @@
             <para> This element is used to define the set of URL patterns that the application is
                 interested in and to configure how they should be handled. It is used to construct
                 the <interfacename>FilterInvocationSecurityMetadataSource</interfacename> used by
-                the <classname>FilterSecurityInterceptor</classname>. It is also responsible for
-                configuring a <classname>ChannelAuthenticationFilter</classname> if particular URLs
-                need to be accessed by HTTPS, for example. When matching the specified patterns
-                against an incoming request, the matching is done in the order in which the elements
-                are declared. So the most specific matches patterns should come first and the most
+                the <classname>FilterSecurityInterceptor</classname> and to exclude particular
+                patterns from the filter chain entirely (by setting the attribute
+                <literal>filters="none"</literal>). It is also responsible for configuring a
+                <classname>ChannelAuthenticationFilter</classname> if particular URLs need to be
+                accessed by HTTPS, for example. When matching the specified patterns against an
+                incoming request, the matching is done in the order in which the elements are
+                declared. So the most specific matches patterns should come first and the most
                 general should come last.</para>
             <section xml:id="nsa-pattern">
                 <title><literal>pattern</literal></title>
                 <para> The pattern which defines the URL path. The content will depend on the
-                    <literal>request-matcher</literal> attribute from the containing http element,
-                    so will default to ant path syntax. </para>
+                    <literal>path-type</literal> attribute from the containing http element, so will
+                    default to ant path syntax. </para>
             </section>
             <section xml:id="nsa-method">
                 <title><literal>method</literal></title>
@@ -242,7 +212,7 @@
                 filter stack and an <classname>LoginUrlAuthenticationEntryPoint</classname> to the
                 application context to provide authentication on demand. This will always take
                 precedence over other namespace-created entry points. If no attributes are supplied,
-                a login page will be generated automatically at the URL "/spring_security_login" <footnote>
+                a login page will be generated automatically at the URL "/spring-security-login" <footnote>
                 <para>This feature is really just provided for convenience and is not intended for
                     production (where a view technology will have been chosen and can be used to
                     render a customized login page). The class
@@ -255,7 +225,7 @@
                 <para> The URL that should be used to render the login page. Maps to the
                     <literal>loginFormUrl</literal> property of the
                     <classname>LoginUrlAuthenticationEntryPoint</classname>. Defaults to
-                    "/spring_security_login". </para>
+                    "/spring-security-login". </para>
             </section>
             <section>
                 <title><literal>login-processing-url</literal></title>
@@ -293,11 +263,9 @@
                 <title><literal>authentication-success-handler-ref</literal></title>
                 <para>This can be used as an alternative to <literal>default-target-url</literal>
                     and <literal>always-use-default-target</literal>, giving you full control over
-                    the navigation flow after a successful authentication. The value should be the
+                    the navigation flow after a successful authentication. The value should be he
                     name of an <interfacename>AuthenticationSuccessHandler</interfacename> bean in
-                    the application context. By default, an imlementation of
-                    <classname>SavedRequestAwareAuthenticationSuccessHandler</classname> is used and
-                    injected with the <literal>default-target-url</literal>.</para>
+                    the application context. </para>
             </section>
             <section>
                 <title><literal>authentication-failure-handler-ref</literal></title>
@@ -329,13 +297,18 @@
                     will be used and configured with a
                     <classname>JdbcTokenRepositoryImpl</classname> instance. </para>
             </section>
+            <section>
+                <title><literal>token-repository-ref</literal></title>
+                <para> Configures a <classname>PersistentTokenBasedRememberMeServices</classname>
+                    but allows the use of a custom
+                    <interfacename>PersistentTokenRepository</interfacename> bean. </para>
+            </section>
             <section>
                 <title><literal>services-ref</literal></title>
                 <para> Allows complete control of the
                     <interfacename>RememberMeServices</interfacename> implementation that will be
-                    used by the filter. The value should be the <literal>id</literal> of a bean in the application
-                    context which implements this interface. Should also implement
-                    <interfacename>LogoutHandler</interfacename> if a logout filter is in use.</para>
+                    used by the filter. The value should be the Id of a bean in the application
+                    context which implements this interface. </para>
             </section>
             <section>
                 <title><literal>token-repository-ref</literal></title>
@@ -367,7 +340,7 @@
                     <interfacename>UserDetailsService</interfacename>, so there has to be one
                     defined in the application context. If there is only one, it will be selected
                     and used automatically by the namespace configuration. If there are multiple
-                    instances, you can specify a bean <literal>id</literal> explicitly using this attribute. </para>
+                    instances, you can specify a bean Id explicitly using this attribute. </para>
             </section>
         </section>
         <section xml:id="nsa-session-mgmt">
@@ -382,7 +355,7 @@
                     a new session and copy the session attributes to the new session. Defaults to
                     "migrateSession".</para>
                 <para> If session fixation protection is enabled, the
-                    <classname>SessionManagementFilter</classname> is inected with a appropriately
+                    <classname>SessionManagementFilter</classname> is injected with an appropriately
                     configured <classname>DefaultSessionAuthenticationStrategy</classname>. See the
                     Javadoc for this class for more details. </para>
             </section>
@@ -470,17 +443,8 @@
                 <classname>OpenIDAuthenticationFilter</classname> and
                 <classname>OpenIDAuthenticationProvider</classname> will be registered. The latter
                 requires a reference to a <interfacename>UserDetailsService</interfacename>. Again,
-                this can be specified by <literal>id</literal>, using the <literal>user-service-ref</literal>
+                this can be specified by Id, using the <literal>user-service-ref</literal>
                 attribute, or will be located automatically in the application context. </para>
-            <section>
-                <title>The <literal>&lt;attribute-exchange></literal> Element</title>
-                <para>The <literal>attribute-exchange</literal> element defines the list of
-                    attributes which should be requested from the identity provider. More than one
-                    can be used, in which case each must have an <literal>identifier-match</literal>
-                    attribute, containing a regular expression which is matched against the supplied
-                    OpenID identifer. This allows different attribute lists to be fetched from
-                    different providers (Google, Yahoo etc).</para>
-            </section>
         </section>
         <section xml:id="nsa-logout">
             <title>The <literal>&lt;logout&gt;</literal> Element</title>
@@ -496,22 +460,11 @@
                 <para> The destination URL which the user will be taken to after logging out.
                     Defaults to "/". </para>
             </section>
-            <section>
-                <title>The <literal>success-handler-ref</literal> attribute</title>
-                <para>May be used to supply an instance of <interfacename>LogoutSuccessHandler</interfacename>
-                    which will be invoked to control the navigation after logging out.
-                </para>
-            </section>
             <section>
                 <title>The <literal>invalidate-session</literal> attribute</title>
                 <para> Maps to the <literal>invalidateHttpSession</literal> of the
                     <classname>SecurityContextLogoutHandler</classname>. Defaults to "true", so the
-                    session will be invalidated on logout.</para>
-            </section>
-            <section>
-                <title>The <literal>delete-cookies</literal> attribute</title>
-                <para>A comma-separated list of the names of cookies which should be deleted when the user logs out.
-                </para>
+                    session will be invalidated on logout. </para>
             </section>
         </section>
         <section>
@@ -627,13 +580,6 @@
                     you do this if you are using a custom implementation and want to use these
                     annotations. </para>
             </section>
-            <section xml:id="nsa-gms-mode">
-                <title>The <literal>mode</literal> Attribute</title>
-                <para>This attribute can be set to <quote>aspectj</quote> to specify that AspectJ
-                    should be used instead of the default Spring AOP. Secured methods must be woven
-                    with the <classname>AnnotationSecurityAspect</classname> from the
-                    <literal>spring-security-aspects</literal> module. </para>
-            </section>
             <section>
                 <title>Securing Methods using <literal>&lt;protect-pointcut&gt;</literal></title>
                 <para> Rather than defining security attributes on an individual method or class

docs/manual/src/docbook/cas-auth-provider.xml

@@ -275,7 +275,7 @@
       <programlisting><![CDATA[
 <security:http entry-point-ref="casEntryPoint">
    ...
-   <custom-filter position="FORM_LOGIN_FILTER" ref="myFilter" />
+   <security:custom-filter position="CAS_FILTER" ref="casFilter" />
 </security:http>
 
 <bean id="casFilter"

docs/manual/src/docbook/namespace-config.xml

@@ -259,7 +259,22 @@
           attributes such as <literal>requires-channel</literal>, so you will not be able to access
           information on the current user or call secured methods during the request. Use
             <literal>access='IS_AUTHENTICATED_ANONYMOUSLY'</literal> as an alternative if you still
-          want the security filter chain to be applied.</para>
+          want the security filter chain to be applied.
+          <note>
+              <para>Using <literal>filters="none"</literal> operates by creating an empty filter
+                        chain in Spring Security's <classname>FilterChainProxy</classname>, whereas
+                        the access attributes are used to configure the
+                        <classname>FilterSecurityInterceptor</classname> in the single filter chain
+                        which is created by the namespace configuration. The two are applied
+                        independently, so if you have an access contraint for a sub-pattern of a
+                        pattern which has a <literal>filters="none"</literal> attribute, the access
+                        constraint will be ignored, even if it is listed first. It isn't possible to
+                        apply a <literal>filters="none"</literal> attribute to the pattern
+                        <literal>/**</literal> since this is used by the namespace filter chain. In
+                        version 3.1 things are more flexible. You can define multiple filter chains
+                        and the <literal>filters</literal> attribute is no longer supported.</para>
+          </note>
+        </para>
         <para>If you want to use basic authentication instead of form login, then change the
           configuration to <programlisting language="xml"><![CDATA[
   <http auto-config='true'>

docs/manual/src/docbook/preauth.xml

@@ -143,7 +143,7 @@
   </security:http>
 
     <bean id="siteminderFilter" class=
-"org.springframework.security.web.authentication.preauth.header.RequestHeaderAuthenticationFilter">
+"org.springframework.security.web.authentication.preauth.RequestHeaderAuthenticationFilter">
     <property name="principalRequestHeader" value="SM_USER"/>
     <property name="authenticationManager" ref="authenticationManager" />
   </bean>

docs/manual/src/docbook/security-filter-chain.xml

@@ -48,18 +48,20 @@
   </section>
   <section xml:id="filter-chain-proxy">
     <title><classname>FilterChainProxy</classname></title>
-    <para> It should now be clear that you can declare each Spring Security filter bean that you
-      require in your application context file and add a corresponding
-        <classname>DelegatingFilterProxy</classname> entry to <filename>web.xml</filename> for each
-      filter, making sure that they are ordered correctly. This is a cumbersome approach and
-      clutters up the <filename>web.xml</filename> file quickly if we have a lot of filters. We
-      would prefer to just add a single entry to <filename>web.xml</filename> and deal entirely with
-      the application context file for managing our web security beans. This is where Spring
-      Secuiryt's <classname>FilterChainProxy</classname> comes in. It is wired using a
-        <literal>DelegatingFilterProxy</literal>, just like in the example above, but with the
-        <literal>filter-name</literal> set to the bean name <quote>filterChainProxy</quote>. The
-      filter chain is then declared in the application context with the same bean name. Here's an
-      example: <programlisting language="xml"><![CDATA[
+      <para>Spring Security's web infrastructure should only be used by delegating to an
+          instance of <classname>FilterChainProxy</classname>. The security filters should not
+          be used by themselves In theory you could declare each Spring Security filter bean
+          that you require in your application context file and add a corresponding
+          <classname>DelegatingFilterProxy</classname> entry to <filename>web.xml</filename>
+          for each filter, making sure that they are ordered correctly, but this would be
+          cumbersome and would clutter up the <filename>web.xml</filename> file quickly if you
+          have a lot of filters. <classname>FilterChainProxy</classname> lets us add a single
+          entry to <filename>web.xml</filename> and deal entirely with the application context
+          file for managing our web security beans. It is wired using a
+          <literal>DelegatingFilterProxy</literal>, just like in the example above, but with
+          the <literal>filter-name</literal> set to the bean name
+          <quote>filterChainProxy</quote>. The filter chain is then declared in the
+          application context with the same bean name. Here's an example: <programlisting language="xml"><![CDATA[
 <bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy">
   <sec:filter-chain-map path-type="ant">
      <sec:filter-chain pattern="/webServices/**" filters="
@@ -166,6 +168,78 @@
             to protect web URIs and raise exceptions when access is
         denied</para></listitem></orderedlist></para>
   </section>
+    <section xml:id="request-matching">
+        <title>Request Matching and <interfacename>HttpFirewall</interfacename></title>
+        <para>Spring Security has several areas where patterns you have defined are tested
+            against incoming requests in order to decide how the request should be handled. This
+            occurs when the <classname>FilterChainProxy</classname> decides which filter chain a
+            request should be passed through and also when the
+            <classname>FilterSecurityInterceptor</classname> decides which security constraints
+            apply to a request. It's important to understand what the mechanism is and what URL
+            value is used when testing against the patterns that you define.</para>
+        <para>The Servlet Specification defines several properties for the
+            <interfacename>HttpServletRequest</interfacename> which are accessible via getter
+            methods, and which we might want to match against. These are the
+            <literal>contextPath</literal>, <literal>servletPath</literal>,
+            <literal>pathInfo</literal> and <literal>queryString</literal>. Spring Security is
+            only interested in securing paths within the application, so the
+            <literal>contextPath</literal> is ignored. Unfortunately, the servlet spec does not
+            define exactly what the values of <literal>servletPath</literal> and
+            <literal>pathInfo</literal> will contain for a particular request URI. For example,
+            each path segment of a URL may contain parameters, as defined in <link
+                xlink:href="http://www.ietf.org/rfc/rfc2396.txt">RFC 2396</link><footnote>
+                    <para>You have probably seen this when a browser doesn't support cookies and the
+                        <literal>jsessionid</literal> parameter is appended to the URL after a
+                        semi-colon. However the RFC allows the presence of these parameters in any path
+                        segment of the URL</para>
+                </footnote>. The Specification does not clearly state whether these should be
+            included in the <literal>servletPath</literal> and <literal>pathInfo</literal>
+            values and the behaviour varies between different servlet containers. There is a
+            danger that when an application is deployed in a container which does not strip path
+            parameters from these values, an attacker could add them to the requested URL in
+            order to cause a pattern match to succeed or fail unexpectedly.<footnote>
+                <para>The original values will be returned once the request leaves the
+                    <classname>FilterChainProxy</classname>, so will still be available to the
+                    application.</para>
+            </footnote>. Other variations in the incoming URL are also possible. For example, it
+            could contain path-traversal sequences (like <literal>/../</literal>) or multiple
+            forward slashes (<literal>//</literal>) which could also cause pattern-matches to
+            fail. Some containers normalize these out before performing the servlet mapping, but
+            others don't. To protect against issues like these,
+            <classname>FilterChainProxy</classname> uses an
+            <interfacename>HttpFirewall</interfacename> strategy to check and wrap the request.
+            Un-normalized requests are automatically rejected by default, and path parameters
+            and duplicate slashes are removed for matching purposes.<footnote>
+                <para>So, for example, an original request path
+                    <literal>/secure;hack=1/somefile.html;hack=2</literal> will be returned as
+                    <literal>/secure/somefile.html</literal>.</para>
+            </footnote>. It is therefore essential that a
+            <classname>FilterChainProxy</classname> is used to manage the security filter chain.
+            Note that the <literal>servletPath</literal> and <literal>pathInfo</literal> values
+            are decoded by the container, so your application should not have any valid paths
+            which contain semi-colons, as these parts will be removed for matching purposes. </para>
+        <para>As mentioned above, the default strategy is to use Ant-style paths for matching
+            and this is likely to be the best choice for most users. The strategy is implemented
+            in the class <classname>AntPathRequestMatcher</classname> which uses Spring's
+            <classname>AntPathMatcher</classname> to perform a case-insensitive match of the
+            pattern against the concatenated <literal>servletPath</literal> and
+            <literal>pathInfo</literal>, ignoring the <literal>queryString</literal>.</para>
+        <para>If for some reason, you need a more powerful matching strategy, you can use
+            regular expressions. The strategy implementation is then
+            <classname>RegexRequestMatcher</classname>. See the Javadoc for this class for more
+            information.</para>
+        <para>In practice we recommend that you use method security at your service layer, to
+            control access to your application, and do not rely entirely on the use of security
+            constraints defined at the web-application level. URLs change and it is difficult to
+            take account of all the possible URLs that an application might support and how
+            requests might be manipulated. You should try and restrict yourself to using a few
+            simple ant paths which are simple to understand. Always try to use a
+            <quote>deny-by-default</quote> approach where you have a catch-all wildcard
+            (<literal>**</literal>) defined last and denying access.</para>
+        <para>Security defined at the service layer is much more robust and harder to bypass, so
+            you should always take advantage of Spring Security's method security
+            options.</para>
+    </section>
   <section>
     <title>Use with other Filter-Based Frameworks</title>
     <para>If you're using some other framework that is also filter-based, then you need to make sure

docs/manual/src/docbook/web-infrastructure.xml

@@ -1,395 +0,0 @@
-<chapter xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="web-infrastructure"
-  xmlns:xlink="http://www.w3.org/1999/xlink">
-  <info>
-    <title>Web Application Infrastructure</title>
-  </info>
-
-  <section xml:id="filters">
-    <title>The Security Filter Chain</title>
-    <para>Spring Security's web infrastructure is based entirely on standard servlet filters. It
-      doesn't use servlets or any other servlet-based frameworks (such as Spring MVC) internally, so
-      it has no strong links to any particular web technology. It deals in
-        <classname>HttpServletRequest</classname>s and <classname>HttpServletResponse</classname>s
-      and doesn't care whether the requests come from a browser, a web service client, an
-        <classname>HttpInvoker</classname> or an AJAX application. </para>
-    <para> Spring Security maintains a filter chain internally where each of the filters has a
-      particular responsibility and filters are added or removed from the configuration depending on
-      which services are required. The ordering of the filters is important as there are
-      dependencies between them. If you have been using <link xlink:href="#ns-config">namespace
-        configuration</link>, then the filters are automatically configured for you and you don't
-      have to define any Spring beans explicitly but here may be times when you want full control
-      over the security filter chain, either because you are using features which aren't supported
-      in the namespace, or you are using your own customized versions of classes.</para>
-    <section xml:id="delegating-filter-proxy">
-      <title><classname>DelegatingFilterProxy</classname></title>
-      <para> When using servlet filters, you obviously need to declare them in your
-          <filename>web.xml</filename>, or they will be ignored by the servlet container. In Spring
-        Security, the filter classes are also Spring beans defined in the application context and
-        thus able to take advantage of Spring's rich dependency-injection facilities and lifecycle
-        interfaces. Spring's <classname>DelegatingFilterProxy</classname> provides the link between
-          <filename>web.xml</filename> and the application context. </para>
-      <para>When using <classname>DelegatingFilterProxy</classname>, you will see something like
-        this in the <filename>web.xml</filename> file: <programlisting><![CDATA[
-  <filter>
-    <filter-name>myFilter</filter-name>
-    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
-  </filter>
-
-  <filter-mapping>
-    <filter-name>myFilter</filter-name>
-    <url-pattern>/*</url-pattern>
-  </filter-mapping>]]>
-        </programlisting> Notice that the filter is actually a
-                <literal>DelegatingFilterProxy</literal>, and not the class that will actually
-                implement the logic of the filter. What <classname>DelegatingFilterProxy</classname>
-                does is delegate the <interfacename>Filter</interfacename>'s methods through to a
-                bean which is obtained from the Spring application context. This enables the bean to
-                benefit from the Spring web application context lifecycle support and configuration
-                flexibility. The bean must implement
-                <interfacename>javax.servlet.Filter</interfacename> and it must have the same name
-                as that in the <literal>filter-name</literal> element. Read the Javadoc for
-                <classname>DelegatingFilterProxy</classname> for more information</para>
-        </section>
-        <section xml:id="filter-chain-proxy">
-            <title><classname>FilterChainProxy</classname></title>
-            <para>Spring Security's web infrastructure should only be used by delegating to an
-                instance of <classname>FilterChainProxy</classname>. The security filters should not
-                be used by themselves In theory you could declare each Spring Security filter bean
-                that you require in your application context file and add a corresponding
-                <classname>DelegatingFilterProxy</classname> entry to <filename>web.xml</filename>
-                for each filter, making sure that they are ordered correctly, but this would be
-                cumbersome and would clutter up the <filename>web.xml</filename> file quickly if you
-                have a lot of filters. <classname>FilterChainProxy</classname> lets us add a single
-                entry to <filename>web.xml</filename> and deal entirely with the application context
-                file for managing our web security beans. It is wired using a
-                <literal>DelegatingFilterProxy</literal>, just like in the example above, but with
-                the <literal>filter-name</literal> set to the bean name
-                <quote>filterChainProxy</quote>. The filter chain is then declared in the
-                application context with the same bean name. Here's an example: <programlisting language="xml"><![CDATA[
-<bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy">
-  <sec:filter-chain-map path-type="ant">
-     <sec:filter-chain pattern="/webServices/**" filters="
-           securityContextPersistenceFilterWithASCFalse,
-           basicProcessingFilter,
-           exceptionTranslationFilter,
-           filterSecurityInterceptor" />
-     <sec:filter-chain pattern="/**" filters="
-           securityContextPersistenceFilterWithASCTrue,
-           authenticationProcessingFilter,
-           exceptionTranslationFilter,
-           filterSecurityInterceptor" />
-  </sec:filter-chain-map>
-</bean>
-]]>
-      </programlisting> The namespace element <literal>filter-chain-map</literal> is used to set
-                up the security filter chain(s) which are required within the application<footnote>
-                <para>Note that you'll need to include the security namespace in your application
-                    context XML file in order to use this syntax.</para>
-                </footnote>. It maps a particular URL pattern to a chain of filters built up from
-                the bean names specified in the <literal>filters</literal> element. Both regular
-                expressions and Ant Paths are supported, and the most specific URLs appear first. At
-                runtime the <classname>FilterChainProxy</classname> will locate the first URL
-                pattern that matches the current web request and the list of filter beans specified
-                by the <literal>filters</literal> attribute will be applied to that request. The
-                filters will be invoked in the order they are defined, so you have complete control
-                over the filter chain which is applied to a particular URL.</para>
-            <para>You may have noticed we have declared two
-                <classname>SecurityContextPersistenceFilter</classname>s in the filter chain
-                (<literal>ASC</literal> is short for <literal>allowSessionCreation</literal>, a
-                property of <classname>SecurityContextPersistenceFilter</classname>). As web
-                services will never present a <literal>jsessionid</literal> on future requests,
-                creating <literal>HttpSession</literal>s for such user agents would be wasteful. If
-                you had a high-volume application which required maximum scalability, we recommend
-                you use the approach shown above. For smaller applications, using a single
-                <classname>SecurityContextPersistenceFilter</classname> (with its default
-                <literal>allowSessionCreation</literal> as <literal>true</literal>) would likely be
-                sufficient.</para>
-            <para>Note that <classname>FilterChainProxy</classname> does not invoke standard filter
-                lifecycle methods on the filters it is configured with. We recommend you use
-                Spring's application context lifecycle interfaces as an alternative, just as you
-                would for any other Spring bean.</para>
-            <para> When we looked at how to set up web security using <link
-                xlink:href="#namespace-auto-config">namespace configuration</link>, we used a
-                <literal>DelegatingFilterProxy</literal> with the name
-                <quote>springSecurityFilterChain</quote>. You should now be able to see that this is
-                the name of the <classname>FilterChainProxy</classname> which is created by the
-                namespace. </para>
-            <section>
-                <title>Bypassing the Filter Chain</title>
-                <para>As with the namespace, you can use the attribute <literal>filters = "none"</literal> as an
-                    alternative to supplying a filter bean list. This will omit the request pattern
-                    from the security filter chain entirely. Note that anything matching this path
-                    will then have no authentication or authorization services applied and will be
-                    freely accessible. If you want to make use of the contents of the
-                    <classname>SecurityContext</classname> contents during a request, then it must
-                    have passed through the security filter chain. Otherwise the
-                    <classname>SecurityContextHolder</classname> will not have been populated and
-                    the contents will be null.</para>
-            </section>
-        </section>
-        <section>
-            <title>Filter Ordering</title>
-            <para>The order that filters are defined in the chain is very important. Irrespective of
-                which filters you are actually using, the order should be as follows: <orderedlist>
-                <listitem>
-                    <para><classname>ChannelProcessingFilter</classname>, because it might need to
-                        redirect to a different protocol</para>
-                </listitem>
-                <listitem>
-                    <para><classname>ConcurrentSessionFilter</classname>, because it doesn't use any
-                        <classname>SecurityContextHolder</classname> functionality but needs to
-                        update the <interfacename>SessionRegistry</interfacename> to reflect ongoing
-                        requests from the principal</para>
-                </listitem>
-                <listitem>
-                    <para><classname>SecurityContextPersistenceFilter</classname>, so a
-                        <interfacename>SecurityContext</interfacename> can be set up in the
-                        <classname>SecurityContextHolder</classname> at the beginning of a web
-                        request, and any changes to the
-                        <interfacename>SecurityContext</interfacename> can be copied to the
-                        <literal>HttpSession</literal> when the web request ends (ready for use with
-                        the next web request)</para>
-                </listitem>
-                <listitem>
-                    <para>Authentication processing mechanisms -
-                        <classname>UsernamePasswordAuthenticationFilter</classname>,
-                        <classname>CasProcessingFilter</classname>,
-                        <classname>BasicProcessingFilter</classname> etc - so that the
-                        <classname>SecurityContextHolder</classname> can be modified to contain a
-                        valid <interfacename>Authentication</interfacename> request token</para>
-                </listitem>
-                <listitem>
-                    <para>The <literal>SecurityContextHolderAwareRequestFilter</literal>, if you are
-                        using it to install a Spring Security aware
-                        <literal>HttpServletRequestWrapper</literal> into your servlet
-                        container</para>
-                </listitem>
-                <listitem>
-                    <para><classname>RememberMeProcessingFilter</classname>, so that if no earlier
-                        authentication processing mechanism updated the
-                        <classname>SecurityContextHolder</classname>, and the request presents a
-                        cookie that enables remember-me services to take place, a suitable
-                        remembered <interfacename>Authentication</interfacename> object will be put
-                        there</para>
-                </listitem>
-                <listitem>
-                    <para><classname>AnonymousProcessingFilter</classname>, so that if no earlier
-                        authentication processing mechanism updated the
-                        <classname>SecurityContextHolder</classname>, an anonymous
-                        <interfacename>Authentication</interfacename> object will be put
-                        there</para>
-                </listitem>
-                <listitem>
-                    <para><classname>ExceptionTranslationFilter</classname>, to catch any Spring
-                        Security exceptions so that either an HTTP error response can be returned or
-                        an appropriate <interfacename>AuthenticationEntryPoint</interfacename> can
-                        be launched</para>
-                </listitem>
-                <listitem>
-                    <para><classname>FilterSecurityInterceptor</classname>, to protect web URIs and
-                        raise exceptions when access is denied</para>
-                </listitem>
-                </orderedlist></para>
-        </section>
-        <section xml:id="request-matching">
-            <title>Request Matching and <interfacename>HttpFirewall</interfacename></title>
-            <para>Spring Security has several areas where patterns you have defined are tested
-                against incoming requests in order to decide how the request should be handled. This
-                occurs when the <classname>FilterChainProxy</classname> decides which filter chain a
-                request should be passed through and also when the
-                <classname>FilterSecurityInterceptor</classname> decides which security constraints
-                apply to a request. It's important to understand what the mechanism is and what URL
-                value is used when testing against the patterns that you define.</para>
-            <para>The Servlet Specification defines several properties for the
-                <interfacename>HttpServletRequest</interfacename> which are accessible via getter
-                methods, and which we might want to match against. These are the
-                <literal>contextPath</literal>, <literal>servletPath</literal>,
-                <literal>pathInfo</literal> and <literal>queryString</literal>. Spring Security is
-                only interested in securing paths within the application, so the
-                <literal>contextPath</literal> is ignored. Unfortunately, the servlet spec does not
-                define exactly what the values of <literal>servletPath</literal> and
-                <literal>pathInfo</literal> will contain for a particular request URI. For example,
-                each path segment of a URL may contain parameters, as defined in <link
-                xlink:href="http://www.ietf.org/rfc/rfc2396.txt">RFC 2396</link><footnote>
-                <para>You have probably seen this when a browser doesn't support cookies and the
-                    <literal>jsessionid</literal> parameter is appended to the URL after a
-                    semi-colon. However the RFC allows the presence of these parameters in any path
-                    segment of the URL</para>
-                </footnote>. The Specification does not clearly state whether these should be
-                included in the <literal>servletPath</literal> and <literal>pathInfo</literal>
-                values and the behaviour varies between different servlet containers. There is a
-                danger that when an application is deployed in a container which does not strip path
-                parameters from these values, an attacker could add them to the requested URL in
-                order to cause a pattern match to succeed or fail unexpectedly.<footnote>
-                <para>The original values will be returned once the request leaves the
-                    <classname>FilterChainProxy</classname>, so will still be available to the
-                    application.</para>
-                </footnote>. Other variations in the incoming URL are also possible. For example, it
-                could contain path-traversal sequences (like <literal>/../</literal>) or multiple
-                forward slashes (<literal>//</literal>) which could also cause pattern-matches to
-                fail. Some containers normalize these out before performing the servlet mapping, but
-                others don't. To protect against issues like these,
-                <classname>FilterChainProxy</classname> uses an
-                <interfacename>HttpFirewall</interfacename> strategy to check and wrap the request.
-                Un-normalized requests are automatically rejected by default, and path parameters
-                and duplicate slashes are removed for matching purposes.<footnote>
-                <para>So, for example, an original request path
-                    <literal>/secure;hack=1/somefile.html;hack=2</literal> will be returned as
-                    <literal>/secure/somefile.html</literal>.</para>
-                </footnote>. It is therefore essential that a
-                <classname>FilterChainProxy</classname> is used to manage the security filter chain.
-                Note that the <literal>servletPath</literal> and <literal>pathInfo</literal> values
-                are decoded by the container, so your application should not have any valid paths
-                which contain semi-colons, as these parts will be removed for matching purposes. </para>
-            <para>As mentioned above, the default strategy is to use Ant-style paths for matching
-                and this is likely to be the best choice for most users. The strategy is implemented
-                in the class <classname>AntPathRequestMatcher</classname> which uses Spring's
-                <classname>AntPathMatcher</classname> to perform a case-insensitive match of the
-                pattern against the concatenated <literal>servletPath</literal> and
-                <literal>pathInfo</literal>, ignoring the <literal>queryString</literal>.</para>
-            <para>If for some reason, you need a more powerful matching strategy, you can use
-                regular expressions. The strategy implementation is then
-                <classname>RegexRequestMatcher</classname>. See the Javadoc for this class for more
-                information.</para>
-            <para>In practice we recommend that you use method security at your service layer, to
-                control access to your application, and do not rely entirely on the use of security
-                constraints defined at the web-application level. URLs change and it is difficult to
-                take account of all the possible URLs that an application might support and how
-                requests might be manipulated. You should try and restrict yourself to using a few
-                simple ant paths which are simple to understand. Always try to use a
-                <quote>deny-by-default</quote> approach where you have a catch-all wildcard
-                (<literal>/**</literal>) defined last and denying access.</para>
-            <para>Security defined at the service layer is much more robust and harder to bypass, so
-                you should always take advantage of Spring Security's method security
-                options.</para>
-        </section>
-        <section>
-            <title>Use with other Filter-Based Frameworks</title>
-            <para>If you're using some other framework that is also filter-based, then you need to
-                make sure that the Spring Security filters come first. This enables the
-                <classname>SecurityContextHolder</classname> to be populated in time for use by the
-                other filters. Examples are the use of SiteMesh to decorate your web pages or a web
-                framework like Wicket which uses a filter to handle its requests. </para>
-        </section>
-    </section>
-    <section>
-      <title>Filter Ordering</title>
-      <para>The order that filters are defined in the chain is very important. Irrespective of which
-        filters you are actually using, the order should be as follows:
-        <orderedlist>
-          <listitem>
-            <para><classname>ChannelProcessingFilter</classname>, because it might need to redirect
-              to a different protocol</para>
-          </listitem>
-          <listitem>
-            <para><classname>ConcurrentSessionFilter</classname>, because it doesn't use any
-                <classname>SecurityContextHolder</classname> functionality but needs to update the
-                <interfacename>SessionRegistry</interfacename> to reflect ongoing requests from the
-              principal</para>
-          </listitem>
-          <listitem>
-            <para><classname>SecurityContextPersistenceFilter</classname>, so a
-                <interfacename>SecurityContext</interfacename> can be set up in the
-                <classname>SecurityContextHolder</classname> at the beginning of a web request, and
-              any changes to the <interfacename>SecurityContext</interfacename> can be copied to the
-                <literal>HttpSession</literal> when the web request ends (ready for use with the
-              next web request)</para>
-          </listitem>
-          <listitem>
-            <para>Authentication processing mechanisms -
-                <classname>UsernamePasswordAuthenticationFilter</classname>,
-                <classname>CasProcessingFilter</classname>,
-                <classname>BasicProcessingFilter</classname> etc - so that the
-                <classname>SecurityContextHolder</classname> can be modified to contain a valid
-                <interfacename>Authentication</interfacename> request token</para>
-          </listitem>
-          <listitem>
-            <para>The <literal>SecurityContextHolderAwareRequestFilter</literal>, if you are using
-              it to install a Spring Security aware <literal>HttpServletRequestWrapper</literal>
-              into your servlet container</para>
-          </listitem>
-          <listitem>
-            <para><classname>RememberMeProcessingFilter</classname>, so that if no earlier
-              authentication processing mechanism updated the
-                <classname>SecurityContextHolder</classname>, and the request presents a cookie that
-              enables remember-me services to take place, a suitable remembered
-                <interfacename>Authentication</interfacename> object will be put there</para>
-          </listitem>
-          <listitem>
-            <para><classname>AnonymousProcessingFilter</classname>, so that if no earlier
-              authentication processing mechanism updated the
-                <classname>SecurityContextHolder</classname>, an anonymous
-                <interfacename>Authentication</interfacename> object will be put there</para>
-          </listitem>
-          <listitem>
-            <para><classname>ExceptionTranslationFilter</classname>, to catch any Spring Security
-              exceptions so that either an HTTP error response can be returned or an appropriate
-                <interfacename>AuthenticationEntryPoint</interfacename> can be launched</para>
-          </listitem>
-          <listitem>
-            <para><classname>FilterSecurityInterceptor</classname>, to protect web URIs and raise
-              exceptions when access is denied</para>
-          </listitem>
-        </orderedlist></para>
-    </section>
-    <section>
-      <title>Use with other Filter-Based Frameworks</title>
-      <para>If you're using some other framework that is also filter-based, then you need to make
-        sure that the Spring Security filters come first. This enables the
-          <classname>SecurityContextHolder</classname> to be populated in time for use by the other
-        filters. Examples are the use of SiteMesh to decorate your web pages or a web framework like
-        Wicket which uses a filter to handle its requests. </para>
-    </section>
-  </section>
-<!--
-  <section xml:id="taglib">
-    <info>
-      <title>Tag Libraries</title>
-    </info>
-    <para>Spring Security comes bundled with several JSP tag libraries which provide a range of
-      different services.</para>
-    <section xml:id="taglib-config">
-      <info>
-        <title>Configuration</title>
-      </info>
-      <para>All taglib classes are included in the core
-          <literal>spring-security-taglibs-&lt;version>.jar</literal> file, with the
-          <literal>security.tld</literal> located in the JAR's <literal>META-INF</literal>
-        directory. This means for JSP 1.2+ web containers you can simply include the JAR in the
-        WAR's <literal>WEB-INF/lib</literal> directory and it will be available.</para>
-    </section>
-    <section xml:id="taglib-usage">
-      <info>
-        <title>Usage</title>
-      </info>
-      <para>Now that you've configured the tag libraries, refer to the individual reference guide
-        sections for details on how to use them. Note that when using the tags, you should include
-        the taglib reference in your JSP:
-        <programlisting>
-  &lt;%@ taglib prefix='security' uri='http://www.springframework.org/security/tags' %&gt;
-</programlisting></para>
-    </section>
-  </section>
-
-<section xml:id="authentication-taglibs">
-<info>
-<title>Authentication Tag Libraries</title>
-</info>
-<para><literal>AuthenticationTag</literal> is used to simply output a property of the current
-<interfacename>Authentication</interfacename> object to the web page.</para>
-<para>The following JSP fragment illustrates how to use the
-<literal>AuthenticationTag</literal>:</para>
-<para>
-<programlisting>&lt;security:authentication property="principal.username"/&gt;</programlisting>
-</para>
-<para>This tag would cause the principal's name to be output. Here we are assuming the
-<literal>Authentication.getPrincipal()</literal> is a
-<interfacename>UserDetails</interfacename> object, which is generally the case when using
-one of Spring Security's stadard <classname>AuthenticationProvider</classname>
-implementations.</para>
-</section>
-
-
-
--->
-</chapter>

gradle/javaprojects.gradle

@@ -9,6 +9,8 @@ apacheDsVersion = '1.5.5'
 jstlVersion = '1.1.2'
 jettyVersion = '6.1.22'
 hsqlVersion = '1.8.0.10'
+slf4jVersion = '1.6.1'
+logbackVersion = '0.9.29'
 
 configurations {
     provided

itest/context/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-itest</artifactId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <artifactId>spring-security-itest-context</artifactId>
     <name>Spring Security - Miscellaneous Application Context Integration Tests</name>

itest/misc/pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-itest</artifactId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <artifactId>spring-security-itest-misc</artifactId>
     <name>Spring Security - Miscellaneous Integration Tests</name>

itest/pom.xml

@@ -3,12 +3,12 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-parent</artifactId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <artifactId>spring-security-itest</artifactId>
     <name>Spring Security - Integration Tests</name>
     <packaging>pom</packaging>
-    <version>3.0.5.RELEASE</version>
+    <version>3.0.6.RELEASE</version>
     <modules>
         <module>web</module>
         <!-- module>webflow</module-->

itest/web/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-itest</artifactId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <artifactId>spring-security-itest-web</artifactId>
     <name>Spring Security - Web Integration Tests</name>

ldap/openldaptest.ldif

@@ -8,6 +8,21 @@ objectClass: organizationalUnit
 objectClass: top
 ou: users
 
+dn: ou=\"quoted people\",dc=springsource,dc=com
+objectclass: top
+objectclass: organizationalUnit
+ou: "quoted people"
+
+dn: cn=quoteguy,ou=\"quoted people\",dc=springsource,dc=com
+objectclass: top
+objectclass: person
+objectclass: organizationalPerson
+objectclass: inetOrgPerson
+cn: quoteguy
+sn: Quote
+uid: quoteguy
+userPassword: quoteguyspassword
+
 dn: uid=luke,ou=users,dc=springsource,dc=com
 objectClass: person
 objectClass: organizationalPerson

ldap/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-parent</artifactId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <packaging>jar</packaging>
     <artifactId>spring-security-ldap</artifactId>

ldap/run_slapd.sh

@@ -1,7 +1,7 @@
 #! /bin/sh
 
-rm -Rf target/openldap
-mkdir -p target/openldap
+rm -Rf build/openldap
+mkdir -p build/openldap
 /opt/local/libexec/slapd -h ldap://localhost:22389 -d -1 -f slapd.conf &
 sleep 2
 ldapadd -h localhost -p 22389 -D cn=admin,dc=springsource,dc=com -w password -x -f openldaptest.ldif

ldap/slapd.conf

@@ -4,8 +4,8 @@ include     /opt/local/etc/openldap/schema/inetorgperson.schema
 include     /opt/local/etc/openldap/schema/ppolicy.schema
 
 
-pidfile		./target/slapd.pid
-argsfile	./target/slapd.args
+pidfile		./build/slapd.pid
+argsfile	./build/slapd.args
 
 # Load dynamic backend modules:
 modulepath	/usr/lib/openldap/modules
@@ -14,7 +14,7 @@ modulepath	/usr/lib/openldap/modules
 # moduleload	back_monitor.la
 # moduleload	back_perl.la
 
-disallow bind_anon
+#disallow bind_anon
 require authc
 
 access to dn.base=""
@@ -28,7 +28,7 @@ rootdn          "cn=admin,dc=springsource,dc=com"
 
 rootpw          password
 
-directory       ./target/openldap
+directory       ./build/openldap
 
 index   uid     eq
 index   cn      eq
@@ -44,10 +44,8 @@ access to dn.subtree="ou=users,dc=qbe,dc=com"
   by *        read
 
 
-overlay ppolicy
-ppolicy_default "cn=default,ou=policies,dc=springsource,dc=com"
-ppolicy_use_lockout
-ppolicy_hash_cleartext
-
-
+#overlay ppolicy
+#ppolicy_default "cn=default,ou=policies,dc=springsource,dc=com"
+#ppolicy_use_lockout
+#ppolicy_hash_cleartext
 

ldap/src/main/java/org/springframework/security/ldap/SpringSecurityLdapTemplate.java

@@ -20,6 +20,7 @@ import java.util.Arrays;
 import java.util.HashSet;
 import java.util.Set;
 
+import javax.naming.CompositeName;
 import javax.naming.NamingEnumeration;
 import javax.naming.NamingException;
 import javax.naming.PartialResultException;
@@ -194,11 +195,13 @@ public class SpringSecurityLdapTemplate extends LdapTemplate {
 
         return (DirContextOperations) executeReadOnly(new ContextExecutor() {
                 public Object executeWithContext(DirContext ctx) throws NamingException {
-                    DistinguishedName ctxBaseDn = new DistinguishedName(ctx.getNameInNamespace());
-                    NamingEnumeration<SearchResult> resultsEnum = ctx.search(base, filter, params, searchControls);
+                    final DistinguishedName ctxBaseDn = new DistinguishedName(ctx.getNameInNamespace());
+                    final DistinguishedName searchBaseDn = new DistinguishedName(base);
+                    final NamingEnumeration<SearchResult> resultsEnum = ctx.search(searchBaseDn, filter, params, searchControls);
+
                     if (logger.isDebugEnabled()) {
-                        logger.debug("Searching for entry in under DN '" + ctxBaseDn
-                                + "', base = '" + base + "', filter = '" + filter + "'");
+                        logger.debug("Searching for entry under DN '" + ctxBaseDn
+                                + "', base = '" + searchBaseDn + "', filter = '" + filter + "'");
                     }
 
                     Set<DirContextOperations> results = new HashSet<DirContextOperations>();
@@ -206,10 +209,10 @@ public class SpringSecurityLdapTemplate extends LdapTemplate {
                         while (resultsEnum.hasMore()) {
                             SearchResult searchResult = resultsEnum.next();
                             // Work out the DN of the matched entry
-                            DistinguishedName dn = new DistinguishedName(searchResult.getName());
+                            DistinguishedName dn = new DistinguishedName(new CompositeName(searchResult.getName()));
 
                             if (base.length() > 0) {
-                                dn.prepend(new DistinguishedName(base));
+                                dn.prepend(searchBaseDn);
                             }
 
                             if (logger.isDebugEnabled()) {

ldap/src/main/java/org/springframework/security/ldap/authentication/BindAuthenticator.java

@@ -72,7 +72,7 @@ public class BindAuthenticator extends AbstractLdapAuthenticator {
 
         if (!StringUtils.hasLength(password)) {
             logger.debug("Rejecting empty password for user " + username);
-            throw new BadCredentialsException(messages.getMessage("LdapAuthenticationProvider.emptyPassword",
+            throw new BadCredentialsException(messages.getMessage("BindAuthenticator.emptyPassword",
                     "Empty Password"));
         }
 
@@ -113,6 +113,8 @@ public class BindAuthenticator extends AbstractLdapAuthenticator {
             // Check for password policy control
             PasswordPolicyControl ppolicy = PasswordPolicyControlExtractor.extractControl(ctx);
 
+            logger.debug("Retrieving attributes...");
+
             Attributes attrs = ctx.getAttributes(userDn, getUserAttributes());
 
             DirContextAdapter result = new DirContextAdapter(attrs, userDn, ctxSource.getBaseLdapPath());

ldap/src/main/java/org/springframework/security/ldap/authentication/LdapAuthenticationProvider.java

@@ -87,15 +87,15 @@ import org.springframework.util.StringUtils;
  *   </bean>
  *
  *   <bean id="ldapAuthProvider"
- *       class="org.springframework.security.authentication.ldap.LdapAuthenticationProvider">
+ *       class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider">
  *     <constructor-arg>
- *       <bean class="org.springframework.security.authentication.ldap.authenticator.BindAuthenticator">
+ *       <bean class="org.springframework.security.ldap.authentication.BindAuthenticator">
  *           <constructor-arg ref="contextSource"/>
  *           <property name="userDnPatterns"><list><value>uid={0},ou=people</value></list></property>
  *       </bean>
  *     </constructor-arg>
  *     <constructor-arg>
- *       <bean class="org.springframework.security.ldap.populator.DefaultLdapAuthoritiesPopulator">
+ *       <bean class="org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator">
  *           <constructor-arg ref="contextSource"/>
  *           <constructor-arg value="ou=groups"/>
  *           <property name="groupRoleAttribute" value="ou"/>
@@ -229,7 +229,7 @@ public class LdapAuthenticationProvider implements AuthenticationProvider, Messa
 
     public Authentication authenticate(Authentication authentication) throws AuthenticationException {
         Assert.isInstanceOf(UsernamePasswordAuthenticationToken.class, authentication,
-            messages.getMessage("AbstractUserDetailsAuthenticationProvider.onlySupports",
+            messages.getMessage("LdapAuthenticationProvider.onlySupports",
                 "Only UsernamePasswordAuthenticationToken is supported"));
 
         final UsernamePasswordAuthenticationToken userToken = (UsernamePasswordAuthenticationToken)authentication;

ldap/src/main/java/org/springframework/security/ldap/userdetails/DefaultLdapAuthoritiesPopulator.java

@@ -63,7 +63,7 @@ import java.util.Set;
  * </pre>
  * <p>
  * The group search is performed within a DN specified by the <tt>groupSearchBase</tt> property, which should
- * be relative to the root DN of its <tt>InitialDirContextFactory</tt>. If the search base is null, group searching is
+ * be relative to the root DN of its <tt>ContextSource</tt>. If the search base is null, group searching is
  * disabled. The filter used in the search is defined by the <tt>groupSearchFilter</tt> property, with the filter
  * argument {0} being the full DN of the user. You can also optionally use the parameter {1}, which will be substituted
  * with the username. You can also specify which attribute defines the role name by setting
@@ -124,12 +124,6 @@ public class DefaultLdapAuthoritiesPopulator implements LdapAuthoritiesPopulator
      * The pattern to be used for the user search. {0} is the user's DN
      */
     private String groupSearchFilter = "(member={0})";
-
-    /**
-     * Attributes of the User's LDAP Object that contain role name information.
-     */
-
-//    private String[] userRoleAttributes = null;
     private String rolePrefix = "ROLE_";
     private boolean convertToUpperCase = true;
 
@@ -141,13 +135,19 @@ public class DefaultLdapAuthoritiesPopulator implements LdapAuthoritiesPopulator
      *
      * @param contextSource supplies the contexts used to search for user roles.
      * @param groupSearchBase          if this is an empty string the search will be performed from the root DN of the
-     *                                 context factory.
+     *                                 context factory. If null, no search will be performed.
      */
     public DefaultLdapAuthoritiesPopulator(ContextSource contextSource, String groupSearchBase) {
         Assert.notNull(contextSource, "contextSource must not be null");
         ldapTemplate = new SpringSecurityLdapTemplate(contextSource);
         ldapTemplate.setSearchControls(searchControls);
-        setGroupSearchBase(groupSearchBase);
+        this.groupSearchBase = groupSearchBase;
+
+        if (groupSearchBase == null) {
+            logger.info("groupSearchBase is null. No group search will be performed.");
+        } else if (groupSearchBase.length() == 0) {
+            logger.info("groupSearchBase is empty. Searches will be performed from the context source base");
+        }
     }
 
     //~ Methods ========================================================================================================
@@ -199,7 +199,7 @@ public class DefaultLdapAuthoritiesPopulator implements LdapAuthoritiesPopulator
 
     public Set<GrantedAuthority> getGroupMembershipRoles(String userDn, String username) {
         if (getGroupSearchBase() == null) {
-            return Collections.emptySet();
+            return new HashSet<GrantedAuthority>();
         }
 
         Set<GrantedAuthority> authorities = new HashSet<GrantedAuthority>();
@@ -232,20 +232,6 @@ public class DefaultLdapAuthoritiesPopulator implements LdapAuthoritiesPopulator
         return ldapTemplate.getContextSource();
     }
 
-    /**
-     * Set the group search base (name to search under)
-     *
-     * @param groupSearchBase if this is an empty string the search will be performed from the root DN of the context
-     *                        factory.
-     */
-    private void setGroupSearchBase(String groupSearchBase) {
-        Assert.notNull(groupSearchBase, "The groupSearchBase (name to search under), must not be null.");
-        this.groupSearchBase = groupSearchBase;
-        if (groupSearchBase.length() == 0) {
-            logger.info("groupSearchBase is empty. Searches will be performed from the context source base");
-        }
-    }
-
     protected String getGroupSearchBase() {
         return groupSearchBase;
     }

ldap/src/test/java/org/springframework/security/ldap/AbstractLdapIntegrationTests.java

@@ -40,7 +40,7 @@ import org.springframework.security.ldap.server.ApacheDSContainer;
 public abstract class AbstractLdapIntegrationTests {
 //    private static InMemoryXmlApplicationContext appContext;
     private static ApacheDSContainer server;
-    private static BaseLdapPathContextSource contextSource;
+    private static DefaultSpringSecurityContextSource contextSource;
 
     protected AbstractLdapIntegrationTests() {
     }
@@ -48,7 +48,11 @@ public abstract class AbstractLdapIntegrationTests {
     @BeforeClass
     public static void startServer() throws Exception {
         contextSource = new DefaultSpringSecurityContextSource("ldap://127.0.0.1:53389/dc=springframework,dc=org");
-        ((DefaultSpringSecurityContextSource)contextSource).afterPropertiesSet();
+// OpenLDAP configuration
+//        contextSource = new DefaultSpringSecurityContextSource("ldap://127.0.0.1:22389/dc=springsource,dc=com");
+//        contextSource.setUserDn("cn=admin,dc=springsource,dc=com");
+//        contextSource.setPassword("password");
+        contextSource.afterPropertiesSet();
         server = new ApacheDSContainer("dc=springframework,dc=org", "classpath:test-server.ldif");
         server.afterPropertiesSet();
     }
@@ -98,7 +102,7 @@ public abstract class AbstractLdapIntegrationTests {
         try {
             enumeration = ctx.listBindings(name);
             while (enumeration.hasMore()) {
-                Binding element = (Binding) enumeration.next();
+                Binding element = enumeration.next();
                 DistinguishedName childName = new DistinguishedName(element.getName());
                 childName.prepend((DistinguishedName) name);
 

ldap/src/test/java/org/springframework/security/ldap/authentication/BindAuthenticatorTests.java

@@ -17,7 +17,7 @@ package org.springframework.security.ldap.authentication;
 
 import static org.junit.Assert.*;
 
-import org.junit.Test;
+import org.junit.*;
 import org.springframework.ldap.core.DirContextOperations;
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
@@ -80,8 +80,36 @@ public class BindAuthenticatorTests extends AbstractLdapIntegrationTests {
         authenticator.setUserSearch(new FilterBasedLdapUserSearch("ou=people", "(cn={0})", getContextSource()));
         authenticator.authenticate(new UsernamePasswordAuthenticationToken("mouse, jerry", "jerryspassword"));
         authenticator.authenticate(new UsernamePasswordAuthenticationToken("slash/guy", "slashguyspassword"));
+        // SEC-1661
+        authenticator.setUserSearch(new FilterBasedLdapUserSearch("ou=\\\"quoted people\\\"", "(cn={0})", getContextSource()));
+        authenticator.authenticate(new UsernamePasswordAuthenticationToken("quote\"guy", "quoteguyspassword"));
+        authenticator.setUserSearch(new FilterBasedLdapUserSearch("", "(cn={0})", getContextSource()));
+        authenticator.authenticate(new UsernamePasswordAuthenticationToken("quote\"guy", "quoteguyspassword"));
     }
+/*
+    @Test
+    public void messingWithEscapedChars() throws Exception {
+        Hashtable<String,String> env = new Hashtable<String,String>();
+        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
+        env.put(Context.PROVIDER_URL, "ldap://127.0.0.1:22389/dc=springsource,dc=com");
+        env.put(Context.SECURITY_AUTHENTICATION, "simple");
+        env.put(Context.SECURITY_PRINCIPAL, "cn=admin,dc=springsource,dc=com");
+        env.put(Context.SECURITY_CREDENTIALS, "password");
 
+        InitialDirContext idc = new InitialDirContext(env);
+        SearchControls searchControls = new SearchControls();
+        searchControls.setSearchScope(SearchControls.SUBTREE_SCOPE);
+        DistinguishedName baseDn = new DistinguishedName("ou=\\\"quoted people\\\"");
+        NamingEnumeration<SearchResult> matches = idc.search(baseDn, "(cn=*)", new Object[] {"quoteguy"}, searchControls);
+
+        while(matches.hasMore()) {
+            SearchResult match = matches.next();
+            DistinguishedName dn = new DistinguishedName(match.getName());
+            System.out.println("**** Match: " + match.getName() + " ***** " + dn);
+
+        }
+    }
+*/
     @Test
     public void testAuthenticationWithWrongPasswordFails() {
         authenticator.setUserDnPatterns(new String[] {"uid={0},ou=people"});

ldap/src/test/java/org/springframework/security/ldap/populator/DefaultLdapAuthoritiesPopulatorTests.java

@@ -56,6 +56,17 @@ public class DefaultLdapAuthoritiesPopulatorTests extends AbstractLdapIntegratio
         assertTrue(AuthorityUtils.authorityListToSet(authorities).contains("ROLE_USER"));
     }
 
+    @Test
+    public void nullSearchBaseIsAccepted() throws Exception {
+        populator = new DefaultLdapAuthoritiesPopulator(getContextSource(), null);
+        populator.setDefaultRole("ROLE_USER");
+
+        Collection<GrantedAuthority> authorities = populator.getGrantedAuthorities(
+                new DirContextAdapter(new DistinguishedName("cn=notfound")), "notfound");
+        assertEquals(1, authorities.size());
+        assertTrue(AuthorityUtils.authorityListToSet(authorities).contains("ROLE_USER"));
+    }
+
     @Test
     public void groupSearchReturnsExpectedRoles() {
         populator.setRolePrefix("ROLE_");

ldap/src/test/resources/test-server.ldif

@@ -13,6 +13,11 @@ objectclass: top
 objectclass: organizationalUnit
 ou: people
 
+dn: ou=\"quoted people\",dc=springframework,dc=org
+objectclass: top
+objectclass: organizationalUnit
+ou: "quoted people"
+
 dn: ou=otherpeople,dc=springframework,dc=org
 objectclass: top
 objectclass: organizationalUnit
@@ -68,6 +73,17 @@ sn: Slash
 uid: slashguy
 userPassword: slashguyspassword
 
+dn: cn=quote\"guy,ou=\"quoted people\",dc=springframework,dc=org
+objectclass: top
+objectclass: person
+objectclass: organizationalPerson
+objectclass: inetOrgPerson
+cn: quote\"guy
+sn: Quote
+uid: quoteguy
+userPassword: quoteguyspassword
+
+
 dn: cn=developers,ou=groups,dc=springframework,dc=org
 objectclass: top
 objectclass: groupOfNames

openid/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-parent</artifactId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <artifactId>spring-security-openid</artifactId>
     <name>Spring Security - OpenID support</name>

openid/src/main/java/org/springframework/security/openid/OpenIDAuthenticationFilter.java

@@ -15,19 +15,6 @@
 
 package org.springframework.security.openid;
 
-import java.io.IOException;
-import java.net.MalformedURLException;
-import java.net.URL;
-import java.util.Collections;
-import java.util.HashSet;
-import java.util.Iterator;
-import java.util.Map;
-import java.util.Set;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
-
 import org.openid4java.consumer.ConsumerException;
 import org.springframework.security.authentication.AuthenticationServiceException;
 import org.springframework.security.core.Authentication;
@@ -38,6 +25,14 @@ import org.springframework.security.web.authentication.rememberme.AbstractRememb
 import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;
 
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+import java.io.IOException;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.util.*;
+
 
 /**
  * Filter which processes OpenID authentication requests.
@@ -239,7 +234,14 @@ public class OpenIDAuthenticationFilter extends AbstractAuthenticationProcessing
      * Reads the <tt>claimedIdentityFieldName</tt> from the submitted request.
      */
     protected String obtainUsername(HttpServletRequest req) {
-        return req.getParameter(claimedIdentityFieldName);
+        String claimedIdentity = req.getParameter(claimedIdentityFieldName);
+
+        if (!StringUtils.hasText(claimedIdentity)) {
+            logger.error("No claimed identity supplied in authentication request");
+            return "";
+        }
+
+        return claimedIdentity.trim();
     }
 
     /**

openid/src/test/java/org/springframework/security/openid/OpenIDAuthenticationFilterTests.java

@@ -45,7 +45,7 @@ public class OpenIDAuthenticationFilterTests {
         MockHttpServletRequest req = new MockHttpServletRequest("GET", REQUEST_PATH);
         MockHttpServletResponse response = new MockHttpServletResponse();
 
-        req.setParameter("openid_identifier", CLAIMED_IDENTITY_URL);
+        req.setParameter("openid_identifier", " " + CLAIMED_IDENTITY_URL);
         req.setRemoteHost("www.example.com");
 
         filter.setConsumer(new MockOpenIDConsumer() {

pom.xml

@@ -3,7 +3,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>org.springframework.security</groupId>
     <artifactId>spring-security-parent</artifactId>
-    <version>3.0.5.RELEASE</version>
+    <version>3.0.6.RELEASE</version>
     <name>Spring Security</name>
     <packaging>pom</packaging>
 
@@ -18,7 +18,7 @@
         <module>taglibs</module>
         <module>aspects</module>
         <module>samples</module>
-        <!--module>itest</module-->
+        <!-- module>itest</module -->
   </modules>
 
     <description>Spring Security</description>
@@ -527,7 +527,7 @@
             <dependency>
                 <groupId>org.springframework.ldap</groupId>
                 <artifactId>spring-ldap-core</artifactId>
-                <version>1.3.0.RELEASE</version>
+                <version>1.3.1.RELEASE</version>
                 <exclusions>
                     <exclusion>
                         <groupId>org.springframework</groupId>
@@ -615,7 +615,7 @@
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
-        <spring.version>3.0.3.RELEASE</spring.version>
+        <spring.version>3.0.6.RELEASE</spring.version>
         <jstl.version>1.1.2</jstl.version>
         <jetty.version>6.1.22</jetty.version>
     </properties>

samples/aspectj/pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-parent</artifactId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <artifactId>spring-security-samples-aspectj</artifactId>
     <packaging>jar</packaging>

samples/cas/client/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-samples-cas</artifactId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <groupId>org.springframework.security</groupId>
     <artifactId>spring-security-samples-cas-client</artifactId>

samples/cas/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-samples</artifactId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <groupId>org.springframework.security</groupId>
     <artifactId>spring-security-samples-cas</artifactId>

samples/cas/server/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-samples-cas</artifactId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <groupId>org.springframework.security</groupId>
     <artifactId>spring-security-samples-cas-server</artifactId>

samples/contacts/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-samples</artifactId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <artifactId>spring-security-samples-contacts</artifactId>
     <name>Spring Security - Contacts sample</name>

samples/dms/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-samples</artifactId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <artifactId>spring-security-samples-dms</artifactId>
     <name>Spring Security - DMS sample</name>

samples/ldap/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-samples</artifactId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <groupId>org.springframework.security</groupId>
     <artifactId>spring-security-samples-ldap</artifactId>

samples/openid/openid.gradle

@@ -6,8 +6,13 @@ apply plugin: 'jetty'
 dependencies {
     providedCompile 'javax.servlet:servlet-api:2.5@jar'
 
-    runtime project(':spring-security-web'),
-            project(':spring-security-config'),
-            project(':spring-security-openid'),
-            'log4j:log4j:1.2.15@jar'
-}
+    runtime project(':spring-security-config'),
+            project(':spring-security-taglibs'),
+//            'xerces:xercesImpl:2.9.1',
+//            'net.sourceforge.nekohtml:nekohtml:1.9.7',
+            "javax.servlet:jstl:$jstlVersion",
+            "org.slf4j:jcl-over-slf4j:$slf4jVersion",
+            "ch.qos.logback:logback-classic:$logbackVersion"
+}
+
+[jettyRun, jettyRunWar]*.contextPath = "/openid"

samples/openid/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-samples</artifactId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <groupId>org.springframework.security</groupId>
     <artifactId>spring-security-samples-openid</artifactId>

samples/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-parent</artifactId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <groupId>org.springframework.security</groupId>
     <artifactId>spring-security-samples</artifactId>

samples/preauth/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-samples</artifactId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <groupId>org.springframework.security</groupId>
     <artifactId>spring-security-samples-preauth</artifactId>

samples/tutorial/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-samples</artifactId>
-        <version>3.0.5.RELEASE</version>
+        <version>3.0.6.RELEASE</version>
     </parent>
     <groupId>org.springframework.security</groupId>
     <artifactId>spring-security-samples-tutorial</artifactId>

samples/tutorial/src/main/webapp/WEB-INF/applicationContext-security.xml

@@ -33,7 +33,7 @@
         <x509 />
 -->
         <!-- Uncomment to limit the number of sessions a user can have -->
-        <session-management invalid-session-url="/timeout.jsp">
+        <session-management>
             <concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
         </session-management>
 

samples/tutorial/src/main/webapp/WEB-INF/jsp/listAccounts.jsp

@@ -1,6 +1,14 @@
 <%@ taglib prefix="c" uri="http://java.sun.com/jstl/core_rt"%>
 
 <h1>Accounts</h1>
+<p>
+Anyone can view this page, but posting to an Account requires login and must be authorized. Below are some users to try posting to Accounts with.
+</p>
+<ul>
+<li>rod/koala - can post to any Account</li>
+<li>dianne/emu - can post to Accounts as long as the balance remains above the overdraft amount</li>
+<li>scott/wombat - cannot post to any Accounts</li>
+</ul>
 
 <a href="index.jsp">Home</a><br><br>
 

samples/tutorial/src/main/webapp/index.jsp

@@ -6,7 +6,7 @@
 Anyone can view this page.
 </p>
 <p>
-If you're logged in, you can <a href="listAccounts.html">list accounts</a>.
+While anyone can also view the <a href="listAccounts.html">list accounts</a> page, you must be authorized to post to an Account from the list accounts page.
 </p>
 <p>
 Your principal object is....: <%= request.getUserPrincipal() %>