Release version 3.2.4.RELEASE

SEC-2607: CAS Server logouts out synchronously
SEC-2579: Ignore springio props in release checks
2026-09-08 10:19:53 +00:00 · 2014-05-21 14:27:27 -07:00 · 2014-05-21 15:43:05 -05:00 · 2014-05-21 14:04:18 -05:00 · 2014-05-21 06:49:00 -05:00 · 2014-05-20 23:14:11 -05:00
141 changed files with 1800 additions and 900 deletions
@@ -18,5 +18,4 @@ build/
 *.ipr
 *.iws
 .gradle/
-atlassian-ide-plugin.xml
-/samples
+atlassian-ide-plugin.xml
@@ -8,7 +8,7 @@ dependencies {
            "org.springframework:spring-tx:$springVersion",
            "org.springframework:spring-jdbc:$springVersion"

-    optional "net.sf.ehcache:ehcache:$ehcacheVersion"
+    optional "net.sf.ehcache:ehcache-core:$ehcacheVersion"

    testCompile "org.springframework:spring-beans:$springVersion",
                "org.springframework:spring-context-support:$springVersion",
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-acl</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <name>spring-security-acl</name>
  <description>spring-security-acl</description>
  <url>http://spring.io/spring-security</url>
@@ -42,12 +42,6 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
      <groupId>aopalliance</groupId>
@@ -58,7 +52,7 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -106,8 +100,8 @@
    </dependency>
    <dependency>
      <groupId>net.sf.ehcache</groupId>
-      <artifactId>ehcache</artifactId>
-      <version>1.6.2</version>
+      <artifactId>ehcache-core</artifactId>
+      <version>1.7.2</version>
      <scope>compile</scope>
      <optional>true</optional>
    </dependency>
@@ -120,7 +114,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -1,11 +1,28 @@
 package org.springframework.security.acls.jdbc;

+import static org.mockito.Mockito.*;
 import static org.junit.Assert.*;
+import static org.fest.assertions.Assertions.*;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
+import java.io.Serializable;
+import java.util.List;

-import net.sf.ehcache.Cache;
-import net.sf.ehcache.CacheManager;
 import net.sf.ehcache.Ehcache;
-import org.junit.*;
+import net.sf.ehcache.Element;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Captor;
+import org.mockito.Mock;
+import org.mockito.runners.MockitoJUnitRunner;
 import org.springframework.security.acls.domain.AclAuthorizationStrategy;
 import org.springframework.security.acls.domain.AclAuthorizationStrategyImpl;
 import org.springframework.security.acls.domain.AclImpl;
@@ -19,50 +36,43 @@ import org.springframework.security.core.Authentication;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.util.FieldUtils;
-
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileOutputStream;
-import java.io.ObjectInputStream;
-import java.io.ObjectOutputStream;
-import java.io.Serializable;
-import java.util.*;
+import org.springframework.test.util.ReflectionTestUtils;

 /**
 * Tests {@link EhCacheBasedAclCache}
 *
 * @author Andrei Stefan
 */
+@RunWith(MockitoJUnitRunner.class)
 public class EhCacheBasedAclCacheTests {
    private static final String TARGET_CLASS = "org.springframework.security.acls.TargetObject";

-    private static CacheManager cacheManager;
+    @Mock
+    private Ehcache cache;
+    @Captor
+    private ArgumentCaptor<Element> element;

-    @BeforeClass
-    public static void initCacheManaer() {
-        cacheManager = CacheManager.create();
-        // Use disk caching immediately (to test for serialization issue reported in SEC-527)
-        cacheManager.addCache(new Cache("ehcachebasedacltests", 0, true, false, 600, 300));
-    }
+    private EhCacheBasedAclCache myCache;

-    @AfterClass
-    public static void shutdownCacheManager() {
-        cacheManager.removalAll();
-        cacheManager.shutdown();
+    private MutableAcl acl;
+
+    @Before
+    public void setup() {
+        myCache = new EhCacheBasedAclCache(cache);
+
+        ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(100));
+        AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
+                new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
+                new SimpleGrantedAuthority("ROLE_GENERAL"));
+
+        acl = new AclImpl(identity, Long.valueOf(1), aclAuthorizationStrategy, new ConsoleAuditLogger());
    }

    @After
-    public void clearContext() {
+    public void cleanup() {
        SecurityContextHolder.clearContext();
    }

-    private Ehcache getCache() {
-        Ehcache cache = cacheManager.getCache("ehcachebasedacltests");
-        cache.removeAll();
-
-        return cache;
-    }
-
    @Test(expected=IllegalArgumentException.class)
    public void constructorRejectsNullParameters() throws Exception {
        new EhCacheBasedAclCache(null);
@@ -70,9 +80,6 @@ public class EhCacheBasedAclCacheTests {

    @Test
    public void methodsRejectNullParameters() throws Exception {
-        Ehcache cache = new MockEhcache();
-        EhCacheBasedAclCache myCache = new EhCacheBasedAclCache(cache);
-
        try {
            Serializable id = null;
            myCache.evictFromCache(id);
@@ -122,12 +129,6 @@ public class EhCacheBasedAclCacheTests {
    // SEC-527
    @Test
    public void testDiskSerializationOfMutableAclObjectInstance() throws Exception {
-        ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(100));
-        AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
-                new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
-                new SimpleGrantedAuthority("ROLE_GENERAL"));
-        MutableAcl acl = new AclImpl(identity, Long.valueOf(1), aclAuthorizationStrategy, new ConsoleAuditLogger());
-
        // Serialization test
        File file = File.createTempFile("SEC_TEST", ".object");
        FileOutputStream fos = new FileOutputStream(file);
@@ -150,111 +151,117 @@ public class EhCacheBasedAclCacheTests {
    }

    @Test
-    public void cacheOperationsAclWithoutParent() throws Exception {
-        Ehcache cache = getCache();
-        EhCacheBasedAclCache myCache = new EhCacheBasedAclCache(cache);
+    public void clearCache() throws Exception {
+        myCache.clearCache();

-        ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(100));
-        AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
-                new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
-                new SimpleGrantedAuthority("ROLE_GENERAL"));
-        MutableAcl acl = new AclImpl(identity, Long.valueOf(1), aclAuthorizationStrategy, new ConsoleAuditLogger());
-
-        assertEquals(0, cache.getDiskStoreSize());
-        myCache.putInCache(acl);
-        assertEquals(cache.getSize(), 2);
-        assertEquals(2, cache.getDiskStoreSize());
-        assertTrue(cache.isElementOnDisk(acl.getObjectIdentity()));
-        assertFalse(cache.isElementInMemory(acl.getObjectIdentity()));
-
-        // Check we can get from cache the same objects we put in
-        assertEquals(myCache.getFromCache(Long.valueOf(1)), acl);
-        assertEquals(myCache.getFromCache(identity), acl);
-
-        // Put another object in cache
-        ObjectIdentity identity2 = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(101));
-        MutableAcl acl2 = new AclImpl(identity2, Long.valueOf(2), aclAuthorizationStrategy, new ConsoleAuditLogger());
-
-        myCache.putInCache(acl2);
-        assertEquals(cache.getSize(), 4);
-        assertEquals(4, cache.getDiskStoreSize());
-
-        // Try to evict an entry that doesn't exist
-        myCache.evictFromCache(Long.valueOf(3));
-        myCache.evictFromCache(new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(102)));
-        assertEquals(cache.getSize(), 4);
-        assertEquals(4, cache.getDiskStoreSize());
-
-        myCache.evictFromCache(Long.valueOf(1));
-        assertEquals(cache.getSize(), 2);
-        assertEquals(2, cache.getDiskStoreSize());
-
-        // Check the second object inserted
-        assertEquals(myCache.getFromCache(Long.valueOf(2)), acl2);
-        assertEquals(myCache.getFromCache(identity2), acl2);
-
-        myCache.evictFromCache(identity2);
-        assertEquals(cache.getSize(), 0);
+        verify(cache).removeAll();
    }

-    @SuppressWarnings("unchecked")
    @Test
-    public void cacheOperationsAclWithParent() throws Exception {
-        Ehcache cache = getCache();
-        EhCacheBasedAclCache myCache = new EhCacheBasedAclCache(cache);
+    public void putInCache() throws Exception {
+        myCache.putInCache(acl);

+        verify(cache, times(2)).put(element.capture());
+        assertThat(element.getValue().getKey()).isEqualTo(acl.getId());
+        assertThat(element.getValue().getObjectValue()).isEqualTo(acl);
+        assertThat(element.getAllValues().get(0).getKey()).isEqualTo(acl.getObjectIdentity());
+        assertThat(element.getAllValues().get(0).getObjectValue()).isEqualTo(acl);
+    }
+
+    @Test
+    public void putInCacheAclWithParent() throws Exception {
        Authentication auth = new TestingAuthenticationToken("user", "password", "ROLE_GENERAL");
        auth.setAuthenticated(true);
        SecurityContextHolder.getContext().setAuthentication(auth);

-        ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(1));
        ObjectIdentity identityParent = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(2));
        AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
                new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
                new SimpleGrantedAuthority("ROLE_GENERAL"));
-        MutableAcl acl = new AclImpl(identity, Long.valueOf(1), aclAuthorizationStrategy, new ConsoleAuditLogger());
        MutableAcl parentAcl = new AclImpl(identityParent, Long.valueOf(2), aclAuthorizationStrategy, new ConsoleAuditLogger());
-
        acl.setParent(parentAcl);

-        assertEquals(0, cache.getDiskStoreSize());
        myCache.putInCache(acl);
-        assertEquals(cache.getSize(), 4);
-        assertEquals(4, cache.getDiskStoreSize());
-        assertTrue(cache.isElementOnDisk(acl.getObjectIdentity()));
-        assertTrue(cache.isElementOnDisk(Long.valueOf(1)));
-        assertFalse(cache.isElementInMemory(acl.getObjectIdentity()));
-        assertFalse(cache.isElementInMemory(Long.valueOf(1)));
-        cache.flush();
-        // Wait for the spool to be written to disk (it's asynchronous)
-        Map spool = (Map) FieldUtils.getFieldValue(cache, "diskStore.spool");

-        while(spool.size() > 0) {
-            Thread.sleep(50);
-        }
+        verify(cache, times(4)).put(element.capture());

-        // Check we can get from cache the same objects we put in
-        AclImpl aclFromCache = (AclImpl) myCache.getFromCache(Long.valueOf(1));
-        // For the checks on transient fields, we need to be sure that the object is being loaded from the cache,
-        // not from the ehcache spool or elsewhere...
-        assertFalse(acl == aclFromCache);
-        assertEquals(acl, aclFromCache);
-        // SEC-951 check transient fields are set on parent
-        assertNotNull(FieldUtils.getFieldValue(aclFromCache.getParentAcl(), "aclAuthorizationStrategy"));
-        assertNotNull(FieldUtils.getFieldValue(aclFromCache.getParentAcl(), "permissionGrantingStrategy"));
-        assertEquals(acl, myCache.getFromCache(identity));
-        assertNotNull(FieldUtils.getFieldValue(aclFromCache, "aclAuthorizationStrategy"));
-        AclImpl parentAclFromCache = (AclImpl) myCache.getFromCache(Long.valueOf(2));
-        assertEquals(parentAcl, parentAclFromCache);
-        assertNotNull(FieldUtils.getFieldValue(parentAclFromCache, "aclAuthorizationStrategy"));
-        assertEquals(parentAcl, myCache.getFromCache(identityParent));
+        List<Element> allValues = element.getAllValues();
+
+        assertThat(allValues.get(0).getKey()).isEqualTo(parentAcl.getObjectIdentity());
+        assertThat(allValues.get(0).getObjectValue()).isEqualTo(parentAcl);
+
+        assertThat(allValues.get(1).getKey()).isEqualTo(parentAcl.getId());
+        assertThat(allValues.get(1).getObjectValue()).isEqualTo(parentAcl);
+
+
+        assertThat(allValues.get(2).getKey()).isEqualTo(acl.getObjectIdentity());
+        assertThat(allValues.get(2).getObjectValue()).isEqualTo(acl);
+
+        assertThat(allValues.get(3).getKey()).isEqualTo(acl.getId());
+        assertThat(allValues.get(3).getObjectValue()).isEqualTo(acl);
    }

-    //~ Inner Classes ==================================================================================================
+    @Test
+    public void getFromCacheSerializable() throws Exception {
+        when(cache.get(acl.getId())).thenReturn(new Element(acl.getId(),acl));

-    private class MockEhcache extends Cache {
-        public MockEhcache() {
-            super("cache", 0, true, true, 0, 0);
-        }
+        assertThat(myCache.getFromCache(acl.getId())).isEqualTo(acl);
+    }
+
+    @Test
+    public void getFromCacheSerializablePopulatesTransient() throws Exception {
+        when(cache.get(acl.getId())).thenReturn(new Element(acl.getId(),acl));
+
+        myCache.putInCache(acl);
+
+        ReflectionTestUtils.setField(acl, "permissionGrantingStrategy", null);
+        ReflectionTestUtils.setField(acl, "aclAuthorizationStrategy", null);
+
+        MutableAcl fromCache = myCache.getFromCache(acl.getId());
+
+        assertThat(ReflectionTestUtils.getField(fromCache, "aclAuthorizationStrategy")).isNotNull();
+        assertThat(ReflectionTestUtils.getField(fromCache, "permissionGrantingStrategy")).isNotNull();
+    }
+
+    @Test
+    public void getFromCacheObjectIdentity() throws Exception {
+        when(cache.get(acl.getId())).thenReturn(new Element(acl.getId(),acl));
+
+        assertThat(myCache.getFromCache(acl.getId())).isEqualTo(acl);
+    }
+
+    @Test
+    public void getFromCacheObjectIdentityPopulatesTransient() throws Exception {
+        when(cache.get(acl.getObjectIdentity())).thenReturn(new Element(acl.getId(),acl));
+
+        myCache.putInCache(acl);
+
+        ReflectionTestUtils.setField(acl, "permissionGrantingStrategy", null);
+        ReflectionTestUtils.setField(acl, "aclAuthorizationStrategy", null);
+
+        MutableAcl fromCache = myCache.getFromCache(acl.getObjectIdentity());
+
+        assertThat(ReflectionTestUtils.getField(fromCache, "aclAuthorizationStrategy")).isNotNull();
+        assertThat(ReflectionTestUtils.getField(fromCache, "permissionGrantingStrategy")).isNotNull();
+    }
+
+    @Test
+    public void evictCacheSerializable() throws Exception {
+        when(cache.get(acl.getObjectIdentity())).thenReturn(new Element(acl.getId(),acl));
+
+        myCache.evictFromCache(acl.getObjectIdentity());
+
+        verify(cache).remove(acl.getId());
+        verify(cache).remove(acl.getObjectIdentity());
+    }
+
+    @Test
+    public void evictCacheObjectIdentity() throws Exception {
+        when(cache.get(acl.getId())).thenReturn(new Element(acl.getId(),acl));
+
+        myCache.evictFromCache(acl.getId());
+
+        verify(cache).remove(acl.getId());
+        verify(cache).remove(acl.getObjectIdentity());
    }
 }
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-aspects</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <name>spring-security-aspects</name>
  <description>spring-security-aspects</description>
  <url>http://spring.io/spring-security</url>
@@ -42,17 +42,11 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -108,7 +102,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -2,11 +2,12 @@ import groovy.text.SimpleTemplateEngine

 buildscript {
    repositories {
-        maven { url "http://repo.springsource.org/plugins-release" }
+        maven { url "https://repo.spring.io/plugins-release" }
    }
    dependencies {
-        classpath("org.springframework.build.gradle:propdeps-plugin:0.0.5")
+        classpath("org.springframework.build.gradle:propdeps-plugin:0.0.6")
        classpath("org.springframework.build.gradle:bundlor-plugin:0.1.2")
+        classpath("org.springframework.build.gradle:spring-io-plugin:0.0.3.RELEASE")
        classpath("org.gradle.api.plugins:gradle-tomcat-plugin:0.9.8")
        classpath('me.champeau.gradle:gradle-javadoc-hotfix-plugin:0.1')
        classpath('org.asciidoctor:asciidoctor-gradle-plugin:0.7.0')
@@ -100,6 +101,9 @@ configure(javaProjects) {
 configure(coreModuleProjects) {
    apply plugin: 'bundlor'
    apply plugin: 'emma'
+    apply plugin: 'spring-io'
+
+    ext.springIoVersion = project.hasProperty('platformVersion') ? platformVersion : '1.0.0.BUILD-SNAPSHOT'

    bundlor.doFirst {
        def templateText = file("template.mf").text
@@ -107,27 +111,10 @@ configure(coreModuleProjects) {
    }
    configurations {
        jacoco //Configuration Group used by Sonar to provide Code Coverage using JaCoCo
-        spring4TestRuntime.extendsFrom testRuntime
    }
-    configurations.spring4TestRuntime {
-        resolutionStrategy.eachDependency { DependencyResolveDetails details ->
-            if (details.requested.group == 'org.springframework') {
-                details.useVersion spring4Version
-            }
-            if (details.requested.name == 'ehcache') {
-                details.useVersion '2.6.5'
-            }
-            if (details.requested.name == 'ehcache-terracotta') {
-                details.useVersion '2.1.1'
-            }
-            if (details.requested.group == 'org.springframework.ldap') {
-                details.useVersion springLdap2Version
-            }
-        }
-    }
-
    dependencies {
        jacoco "org.jacoco:org.jacoco.agent:0.6.2.201302030002:runtime"
+        springIoVersions "io.spring.platform:platform-versions:${springIoVersion}@properties"
    }
    test {
        jvmArgs "-javaagent:${configurations.jacoco.asPath}=destfile=${buildDir}/jacoco.exec,includes=${project.group}.*"
@@ -135,14 +122,6 @@ configure(coreModuleProjects) {
    integrationTest {
        jvmArgs "-javaagent:${configurations.jacoco.asPath}=destfile=${buildDir}/jacoco.exec,includes=${project.group}.*"
    }
-    task spring4Test(type: Test) {
-        jvmArgs = ['-ea', '-Xmx500m', '-XX:MaxPermSize=128M']
-        exclude "**/EhCacheBasedAclCacheTests.class", "**/Issue55Tests.class"
-        classpath = sourceSets.test.output + sourceSets.main.output + configurations.spring4TestRuntime
-        testResultsDir = file("$buildDir/spring4-test-results/")
-        testReportDir = file("$buildDir/reports/spring4-tests/")
-    }
-    check.dependsOn spring4Test
 }

 configure (aspectjProjects) {
@@ -7,7 +7,7 @@ dependencies {
            "org.springframework:spring-web:$springVersion",
            "org.jasig.cas.client:cas-client-core:3.2.1"

-    optional "net.sf.ehcache:ehcache:$ehcacheVersion"
+    optional "net.sf.ehcache:ehcache-core:$ehcacheVersion"

-    provided "org.apache.tomcat:tomcat-servlet-api:$servletApiVersion"
+    provided "javax.servlet:javax.servlet-api:$servletApiVersion"
 }
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-cas</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <name>spring-security-cas</name>
  <description>spring-security-cas</description>
  <url>http://spring.io/spring-security</url>
@@ -42,12 +42,6 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
      <groupId>org.jasig.cas.client</groupId>
@@ -58,13 +52,13 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -106,15 +100,15 @@
    </dependency>
    <dependency>
      <groupId>net.sf.ehcache</groupId>
-      <artifactId>ehcache</artifactId>
-      <version>1.6.2</version>
+      <artifactId>ehcache-core</artifactId>
+      <version>1.7.2</version>
      <scope>compile</scope>
      <optional>true</optional>
    </dependency>
    <dependency>
-      <groupId>org.apache.tomcat</groupId>
-      <artifactId>tomcat-servlet-api</artifactId>
-      <version>7.0.33</version>
+      <groupId>javax.servlet</groupId>
+      <artifactId>javax.servlet-api</artifactId>
+      <version>3.0.1</version>
      <scope>provided</scope>
    </dependency>
    <dependency>
@@ -126,7 +120,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -24,7 +24,7 @@ dependencies {
             "org.springframework:spring-jdbc:$springVersion",
             "org.springframework:spring-tx:$springVersion"

-    provided "org.apache.tomcat:tomcat-servlet-api:$servletApiVersion"
+    provided "javax.servlet:javax.servlet-api:$servletApiVersion"

    testCompile project(':spring-security-cas'),
                project(':spring-security-core').sourceSets.test.output,
@@ -34,10 +34,8 @@ dependencies {
                "org.springframework:spring-jdbc:$springVersion",
                "org.springframework:spring-orm:$springVersion",
                "org.springframework:spring-tx:$springVersion",
-                "org.spockframework:spock-core:$spockVersion",
-                "org.spockframework:spock-spring:$spockVersion",
                "org.slf4j:jcl-over-slf4j:$slf4jVersion",
-                "org.hibernate.javax.persistence:hibernate-jpa-2.0-api:1.0.1.Final",
+                "org.eclipse.persistence:javax.persistence:2.0.5",
                "org.hibernate:hibernate-entitymanager:4.1.0.Final",
                "org.codehaus.groovy:groovy-all:$groovyVersion",
                "org.apache.directory.server:apacheds-core:$apacheDsVersion",
@@ -48,12 +46,15 @@ dependencies {
                'org.apache.directory.shared:shared-ldap:0.9.15',
                'ldapsdk:ldapsdk:4.1',
                powerMockDependencies,
-                "org.springframework.data:spring-data-jpa:1.2.0.RELEASE",
-                "org.hibernate.javax.persistence:hibernate-jpa-2.0-api:1.0.0.Final",
                 "org.hibernate:hibernate-entitymanager:3.6.10.Final",
-                "org.hsqldb:hsqldb:2.2.8"
+                "org.hsqldb:hsqldb:2.2.8",
+                spockDependencies
+
    testCompile('org.openid4java:openid4java-nodeps:0.9.6') {
-       exclude group: 'com.google.code.guice', module: 'guice'
+        exclude group: 'com.google.code.guice', module: 'guice'
+    }
+    testCompile('org.springframework.data:spring-data-jpa:1.4.1.RELEASE') {
+        exclude group: 'org.aspectj', module: 'aspectjrt'
    }

    testRuntime "org.hsqldb:hsqldb:$hsqlVersion",
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-config</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <name>spring-security-config</name>
  <description>spring-security-config</description>
  <url>http://spring.io/spring-security</url>
@@ -42,12 +42,6 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
      <groupId>aopalliance</groupId>
@@ -58,7 +52,7 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -108,21 +102,21 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-ldap</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
      <optional>true</optional>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-openid</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
      <optional>true</optional>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
      <optional>true</optional>
    </dependency>
@@ -155,9 +149,9 @@
      <optional>true</optional>
    </dependency>
    <dependency>
-      <groupId>org.apache.tomcat</groupId>
-      <artifactId>tomcat-servlet-api</artifactId>
-      <version>7.0.33</version>
+      <groupId>javax.servlet</groupId>
+      <artifactId>javax.servlet-api</artifactId>
+      <version>3.0.1</version>
      <scope>provided</scope>
    </dependency>
    <dependency>
@@ -181,7 +175,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -239,15 +233,9 @@
      <scope>test</scope>
    </dependency>
    <dependency>
-      <groupId>org.hibernate.javax.persistence</groupId>
-      <artifactId>hibernate-jpa-2.0-api</artifactId>
-      <version>1.0.0.Final</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.hibernate.javax.persistence</groupId>
-      <artifactId>hibernate-jpa-2.0-api</artifactId>
-      <version>1.0.1.Final</version>
+      <groupId>org.eclipse.persistence</groupId>
+      <artifactId>javax.persistence</artifactId>
+      <version>2.0.5</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -297,6 +285,12 @@
      <artifactId>powermock-api-mockito</artifactId>
      <version>1.5.1</version>
      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>mockito-all</artifactId>
+          <groupId>org.mockito</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.powermock</groupId>
@@ -339,18 +333,36 @@
      <artifactId>spock-core</artifactId>
      <version>0.7-groovy-2.0</version>
      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>junit-dep</artifactId>
+          <groupId>junit</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.spockframework</groupId>
      <artifactId>spock-spring</artifactId>
      <version>0.7-groovy-2.0</version>
      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>junit-dep</artifactId>
+          <groupId>junit</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.springframework.data</groupId>
      <artifactId>spring-data-jpa</artifactId>
-      <version>1.2.0.RELEASE</version>
+      <version>1.4.1.RELEASE</version>
      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>aspectjrt</artifactId>
+          <groupId>org.aspectj</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.springframework.ldap</groupId>
@@ -361,7 +373,7 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-cas</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -1,7 +1,13 @@
 package org.springframework.security.config.ldap

+
+import static org.mockito.Mockito.*
+
 import java.text.MessageFormat
+
 import org.springframework.beans.factory.config.PropertyPlaceholderConfigurer
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder
 import org.springframework.security.config.AbstractXmlConfigTests
 import org.springframework.security.config.BeanIds
 import org.springframework.security.util.FieldUtils
@@ -36,7 +42,7 @@ class LdapProviderBeanDefinitionParserTests extends AbstractXmlConfigTests {


    def simpleProviderAuthenticatesCorrectly() {
-        xml.'ldap-server'()
+        xml.'ldap-server'(ldif:'test-server.ldif')
        xml.'authentication-manager'{
            'ldap-authentication-provider'('group-search-filter':'member={0}')
        }
@@ -66,7 +72,7 @@ class LdapProviderBeanDefinitionParserTests extends AbstractXmlConfigTests {
    }

    def supportsPasswordComparisonAuthentication() {
-        xml.'ldap-server'()
+        xml.'ldap-server'(ldif:'test-server.ldif')
        xml.'authentication-manager'{
            'ldap-authentication-provider'('user-dn-pattern': 'uid={0},ou=people')
            'password-compare'
@@ -83,7 +89,7 @@ class LdapProviderBeanDefinitionParserTests extends AbstractXmlConfigTests {
    }

    def supportsPasswordComparisonAuthenticationWithHashAttribute() {
-        xml.'ldap-server'()
+        xml.'ldap-server'(ldif:'test-server.ldif')
        xml.'authentication-manager'{
            'ldap-authentication-provider'('user-dn-pattern': 'uid={0},ou=people') {
                'password-compare'('password-attribute': 'uid', hash: 'plaintext')
@@ -102,7 +108,7 @@ class LdapProviderBeanDefinitionParserTests extends AbstractXmlConfigTests {
    }

    def supportsPasswordComparisonAuthenticationWithPasswordEncoder() {
-        xml.'ldap-server'()
+        xml.'ldap-server'(ldif:'test-server.ldif')
        xml.'authentication-manager'{
            'ldap-authentication-provider'('user-dn-pattern': 'uid={0},ou=people') {
                'password-compare'('password-attribute': 'uid') {
@@ -122,6 +128,28 @@ class LdapProviderBeanDefinitionParserTests extends AbstractXmlConfigTests {
        notThrown(AuthenticationException)
    }

+    def 'SEC-2472: Supports Crypto PasswordEncoder'() {
+        setup:
+        xml.'ldap-server'(ldif:'test-server.ldif')
+        xml.'authentication-manager'{
+            'ldap-authentication-provider'('user-dn-pattern': 'uid={0},ou=people') {
+                'password-compare'() {
+                    'password-encoder'(ref: 'pe')
+                }
+            }
+        }
+        xml.'b:bean'(id:'pe','class':BCryptPasswordEncoder.class.name)
+
+        createAppContext('')
+        def am = appContext.getBean(BeanIds.AUTHENTICATION_MANAGER)
+
+        when:
+        def auth = am.authenticate(new UsernamePasswordAuthenticationToken("bcrypt", 'password'))
+
+        then:
+        auth != null
+    }
+
    def inetOrgContextMapperIsSupported()  {
        xml.'ldap-server'(url: 'ldap://127.0.0.1:343/dc=springframework,dc=org')
        xml.'authentication-manager'{
@@ -28,6 +28,7 @@ import org.springframework.security.config.annotation.BaseSpringSpec
 import org.springframework.security.config.annotation.SecurityBuilder;
 import org.springframework.security.config.annotation.authentication.AuthenticationManagerBuilder
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.crypto.password.PasswordEncoder
 import org.springframework.security.ldap.DefaultSpringSecurityContextSource;
 import org.springframework.security.ldap.authentication.LdapAuthenticationProvider;
 import org.springframework.security.ldap.server.ApacheDSContainer;
@@ -134,6 +135,30 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
        }
    }

+    def "SEC-2472: Can use crypto PasswordEncoder"() {
+        setup:
+        PasswordEncoderConfig.PE = Mock(PasswordEncoder)
+        loadConfig(PasswordEncoderConfig)
+        when:
+        AuthenticationManager auth = context.getBean(AuthenticationManager)
+        then:
+        auth.authenticate(new UsernamePasswordAuthenticationToken("admin","password")).authorities.collect { it.authority }.sort() == ["ROLE_ADMIN","ROLE_USER"]
+        PasswordEncoderConfig.PE.matches(_, _) << true
+    }
+
+    @Configuration
+    static class PasswordEncoderConfig extends BaseLdapServerConfig {
+        static PasswordEncoder PE
+        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
+            auth
+                .ldapAuthentication()
+                    .contextSource(contextSource())
+                    .passwordEncoder(PE)
+                    .groupSearchBase("ou=groups")
+                    .userDnPatterns("uid={0},ou=people");
+        }
+    }
+
    def ldapProvider() {
        context.getBean(AuthenticationManager).providers[0]
    }
@@ -28,6 +28,16 @@ sn: Alex
 uid: ben
 userPassword: {SHA}nFCebWjxfaLbHHG1Qk5UU4trbvQ=

+dn: uid=bcrypt,ou=people,dc=springframework,dc=org
+objectclass: top
+objectclass: person
+objectclass: organizationalPerson
+objectclass: inetOrgPerson
+cn: BCrypt user
+sn: BCrypt
+uid: bcrypt
+userPassword: $2a$10$FBAKClV1zBIOOC9XMXf3AO8RoGXYVYsfvUdoLxGkd/BnXEn4tqT3u
+
 dn: uid=bob,ou=people,dc=springframework,dc=org
 objectclass: top
 objectclass: person
@@ -29,8 +29,6 @@ import org.springframework.security.config.annotation.web.builders.WebSecurity;
 import org.springframework.util.Assert;
 import org.springframework.web.filter.DelegatingFilterProxy;

-import com.google.inject.internal.ImmutableList.Builder;
-
 /**
 * <p>A base {@link SecurityBuilder} that allows {@link SecurityConfigurer} to be
 * applied to it. This makes modifying the {@link SecurityBuilder} a strategy
@@ -78,6 +78,9 @@ public class AuthenticationManagerBuilder extends AbstractConfiguredSecurityBuil
     */
    public AuthenticationManagerBuilder parentAuthenticationManager(
            AuthenticationManager authenticationManager) {
+        if(authenticationManager instanceof ProviderManager) {
+            eraseCredentials(((ProviderManager) authenticationManager).isEraseCredentialsAfterAuthentication());
+        }
        this.parentAuthenticationManager = authenticationManager;
        return this;
    }
@@ -135,19 +138,31 @@ public class AuthenticationManagerBuilder extends AbstractConfiguredSecurityBuil

    /**
     * Add JDBC authentication to the {@link AuthenticationManagerBuilder} and
-     * return a {@link JdbcUserDetailsManagerConfigurer} to allow customization of the
-     * JDBC authentication.
+     * return a {@link JdbcUserDetailsManagerConfigurer} to allow customization
+     * of the JDBC authentication.
+     *
+     * <p>
+     * When using with a persistent data store, it is best to add users external
+     * of configuration using something like <a
+     * href="http://flywaydb.org/">Flyway</a> or <a
+     * href="http://www.liquibase.org/">Liquibase</a> to create the schema and
+     * adding users to ensure these steps are only done once and that the
+     * optimal SQL is used.
+     * </p>
     *
     * <p>
     * This method also ensure that a {@link UserDetailsService} is available
     * for the {@link #getDefaultUserDetailsService()} method. Note that
     * additional {@link UserDetailsService}'s may override this
-     * {@link UserDetailsService} as the default.
+     * {@link UserDetailsService} as the default. See the <a href=
+     * "http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#user-schema"
+     * >User Schema</a> section of the reference for the default schema.
     * </p>
     *
-     * @return a {@link JdbcUserDetailsManagerConfigurer} to allow customization of the
-     * JDBC authentication
-     * @throws Exception if an error occurs when adding the JDBC authentication
+     * @return a {@link JdbcUserDetailsManagerConfigurer} to allow customization
+     *         of the JDBC authentication
+     * @throws Exception
+     *             if an error occurs when adding the JDBC authentication
     */
    public JdbcUserDetailsManagerConfigurer<AuthenticationManagerBuilder> jdbcAuthentication()
            throws Exception {
@@ -113,8 +113,8 @@ public class AuthenticationConfiguration {
        lazyTargetSource.setTargetBeanName(beanNamesForType[0]);
        lazyTargetSource.setBeanFactory(applicationContext);
        ProxyFactoryBean proxyFactory = new ProxyFactoryBean();
+        proxyFactory = objectPostProcessor.postProcess(proxyFactory);
        proxyFactory.setTargetSource(lazyTargetSource);
-        proxyFactory.setInterfaces(new Class[] { interfaceName, LazyBean.class });
        return (T) proxyFactory.getObject();
    }

@@ -122,8 +122,6 @@ public class AuthenticationConfiguration {
        return lazyBean(AuthenticationManager.class);
    }

-    private interface LazyBean {}
-
    private static class EnableGlobalAuthenticationAutowiredConfigurer extends GlobalAuthenticationConfigurerAdapter {
        private final ApplicationContext context;
        private static final Log logger = LogFactory.getLog(EnableGlobalAuthenticationAutowiredConfigurer.class);
@@ -40,6 +40,7 @@ import org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator;
 import org.springframework.security.ldap.userdetails.LdapUserDetailsMapper;
 import org.springframework.security.ldap.userdetails.PersonContextMapper;
 import org.springframework.security.ldap.userdetails.UserDetailsContextMapper;
+import org.springframework.util.Assert;

 /**
 * Configures LDAP {@link AuthenticationProvider} in the {@link ProviderManagerBuilder}.
@@ -204,12 +205,40 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
     *
     * @param passwordEncoder the {@link PasswordEncoder} to use
     * @return the {@link LdapAuthenticationProviderConfigurer} for further customization
+     * @deprecated Use {@link #passwordEncoder(org.springframework.security.crypto.password.PasswordEncoder)} instead
     */
    public LdapAuthenticationProviderConfigurer<B> passwordEncoder(PasswordEncoder passwordEncoder) {
        this.passwordEncoder = passwordEncoder;
        return this;
    }

+    /**
+     * Specifies the {@link org.springframework.security.crypto.password.PasswordEncoder} to be used when authenticating with
+     * password comparison.
+     *
+     * @param passwordEncoder the {@link org.springframework.security.crypto.password.PasswordEncoder} to use
+     * @return the {@link LdapAuthenticationProviderConfigurer} for further customization
+     */
+    public LdapAuthenticationProviderConfigurer<B> passwordEncoder(final org.springframework.security.crypto.password.PasswordEncoder passwordEncoder) {
+        Assert.notNull(passwordEncoder, "passwordEncoder must not be null.");
+        passwordEncoder(new PasswordEncoder() {
+            public String encodePassword(String rawPass, Object salt) {
+                checkSalt(salt);
+                return passwordEncoder.encode(rawPass);
+            }
+
+            public boolean isPasswordValid(String encPass, String rawPass, Object salt) {
+                checkSalt(salt);
+                return passwordEncoder.matches(rawPass, encPass);
+            }
+
+            private void checkSalt(Object salt) {
+                Assert.isNull(salt, "Salt value must be null when used with crypto module PasswordEncoder");
+            }
+        });
+        return this;
+    }
+
    /**
     * If your users are at a fixed location in the directory (i.e. you can work
     * out the DN directly from the username without doing a directory search),
@@ -18,11 +18,18 @@ package org.springframework.security.config.annotation.web.configuration;

 import java.lang.reflect.Field;
 import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;

 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+import org.springframework.aop.TargetSource;
+import org.springframework.aop.framework.Advised;
+import org.springframework.aop.target.LazyInitTargetSource;
 import org.springframework.beans.FatalBeanException;
+import org.springframework.beans.factory.BeanFactoryUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.ApplicationContext;
 import org.springframework.core.annotation.Order;
@@ -210,7 +217,7 @@ public abstract class WebSecurityConfigurerAdapter implements WebSecurityConfigu
     * @throws Exception
     */
    public AuthenticationManager authenticationManagerBean() throws Exception {
-        return new AuthenticationManagerDelegator(authenticationBuilder);
+        return new AuthenticationManagerDelegator(authenticationBuilder, context);
    }

    /**
@@ -413,12 +420,14 @@ public abstract class WebSecurityConfigurerAdapter implements WebSecurityConfigu
        private AuthenticationManagerBuilder delegateBuilder;
        private AuthenticationManager delegate;
        private final Object delegateMonitor = new Object();
+        private Set<String> beanNames;

-        AuthenticationManagerDelegator(AuthenticationManagerBuilder delegateBuilder) {
+        AuthenticationManagerDelegator(AuthenticationManagerBuilder delegateBuilder, ApplicationContext context) {
            Assert.notNull(delegateBuilder,"delegateBuilder cannot be null");
            Field parentAuthMgrField = ReflectionUtils.findField(AuthenticationManagerBuilder.class, "parentAuthenticationManager");
            ReflectionUtils.makeAccessible(parentAuthMgrField);
-            validateBeanCycle(ReflectionUtils.getField(parentAuthMgrField, delegateBuilder));
+            beanNames = getAuthenticationManagerBeanNames(context);
+            validateBeanCycle(ReflectionUtils.getField(parentAuthMgrField, delegateBuilder), beanNames);
            this.delegateBuilder = delegateBuilder;
        }

@@ -437,16 +446,24 @@ public abstract class WebSecurityConfigurerAdapter implements WebSecurityConfigu
            return delegate.authenticate(authentication);
        }

-        private static void validateBeanCycle(Object auth) {
-            if(auth != null) {
-                String lazyBeanClassName = AuthenticationConfiguration.class.getName() + "$LazyBean";
-                Class<?>[] interfaces = auth.getClass().getInterfaces();
-                for(Class<?> i : interfaces) {
-                    String className = i.getName();
-                    if(className.equals(lazyBeanClassName)) {
-                        throw new FatalBeanException("A dependency cycle was detected when trying to resolve the AuthenticationManager. Please ensure you have configured authentication.");
+        private static Set<String> getAuthenticationManagerBeanNames(ApplicationContext applicationContext) {
+             String[] beanNamesForType = BeanFactoryUtils.beanNamesForTypeIncludingAncestors(applicationContext, AuthenticationManager.class);
+             return new HashSet<String>(Arrays.asList(beanNamesForType));
+        }
+
+        private static void validateBeanCycle(Object auth, Set<String> beanNames) {
+            if(auth != null && !beanNames.isEmpty()) {
+                if(auth instanceof Advised){
+                    Advised advised = (Advised) auth;
+                    TargetSource targetSource = advised.getTargetSource();
+                    if(targetSource instanceof LazyInitTargetSource) {
+                        LazyInitTargetSource lits = (LazyInitTargetSource) targetSource;
+                        if(beanNames.contains(lits.getTargetBeanName())) {
+                            throw new FatalBeanException("A dependency cycle was detected when trying to resolve the AuthenticationManager. Please ensure you have configured authentication.");
+                        }
                    }
                }
+                beanNames = Collections.emptySet();
            }
        }
    }
@@ -294,7 +294,9 @@ public final class LogoutConfigurer<H extends HttpSecurityBuilder<H>> extends Ab
        }
        if(http.getConfigurer(CsrfConfigurer.class) != null) {
            this.logoutRequestMatcher = new AntPathRequestMatcher(this.logoutUrl, "POST");
+        } else {
+            this.logoutRequestMatcher = new AntPathRequestMatcher(this.logoutUrl);
        }
-        return new AntPathRequestMatcher(this.logoutUrl);
+        return this.logoutRequestMatcher;
    }
 }
@@ -15,7 +15,9 @@
 */
 package org.springframework.security.config.annotation.web.configurers;

+import java.util.ArrayList;
 import java.util.Collections;
+import java.util.List;

 import org.springframework.http.MediaType;
 import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
@@ -114,12 +116,13 @@ public final class RequestCacheConfigurer<H extends HttpSecurityBuilder<H>> exte
        return defaultCache;
    }

+    @SuppressWarnings("unchecked")
    private RequestMatcher createDefaultSavedRequestMatcher(H http) {
        ContentNegotiationStrategy contentNegotiationStrategy = http.getSharedObject(ContentNegotiationStrategy.class);
        if(contentNegotiationStrategy == null) {
            contentNegotiationStrategy = new HeaderContentNegotiationStrategy();
        }
-        RequestMatcher getRequests = new AntPathRequestMatcher("/**", "GET");
+
        RequestMatcher notFavIcon = new NegatedRequestMatcher(new AntPathRequestMatcher("/**/favicon.ico"));

        MediaTypeRequestMatcher jsonRequest = new MediaTypeRequestMatcher(contentNegotiationStrategy, MediaType.APPLICATION_JSON);
@@ -127,6 +130,18 @@ public final class RequestCacheConfigurer<H extends HttpSecurityBuilder<H>> exte
        RequestMatcher notJson = new NegatedRequestMatcher(jsonRequest);

        RequestMatcher notXRequestedWith = new NegatedRequestMatcher(new RequestHeaderRequestMatcher("X-Requested-With","XMLHttpRequest"));
-        return new AndRequestMatcher(getRequests, notFavIcon, notJson, notXRequestedWith);
+
+        boolean isCsrfEnabled = http.getConfigurer(CsrfConfigurer.class) != null;
+
+        List<RequestMatcher> matchers = new ArrayList<RequestMatcher>();
+        if(isCsrfEnabled) {
+            RequestMatcher getRequests = new AntPathRequestMatcher("/**", "GET");
+            matchers.add(0, getRequests);
+        }
+        matchers.add(notFavIcon);
+        matchers.add(notJson);
+        matchers.add(notXRequestedWith);
+
+        return new AndRequestMatcher(matchers);
    }
 }
@@ -123,7 +123,8 @@ abstract class BaseSpringSpec extends Specification {
    AuthenticationManager getAuthenticationManager() {
        try {
            authenticationManager().delegateBuilder.getObject()
-        } catch(NoSuchBeanDefinitionException e) {}
+        } catch(NoSuchBeanDefinitionException e) {
+        } catch(MissingPropertyException e) {}
        findFilter(FilterSecurityInterceptor).authenticationManager
    }

@@ -15,6 +15,7 @@
 */
 package org.springframework.security.config.annotation.authentication

+import org.springframework.beans.factory.annotation.Autowired
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
 import org.springframework.security.authentication.AuthenticationManager
@@ -89,4 +90,25 @@ class NamespaceAuthenticationManagerTests extends BaseSpringSpec {
            return super.authenticationManagerBean();
        }
    }
+
+    def "SEC-2533: global authentication-manager@erase-credentials=false"() {
+        when:
+            loadConfig(GlobalEraseCredentialsFalseConfig)
+            Authentication auth = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("user","password"))
+        then:
+            auth.credentials == "password"
+            auth.principal.password == "password"
+    }
+
+    @EnableWebSecurity
+    @Configuration
+    static class GlobalEraseCredentialsFalseConfig extends WebSecurityConfigurerAdapter {
+        @Autowired
+        public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
+            auth
+                .eraseCredentials(false)
+                .inMemoryAuthentication()
+                    .withUser("user").password("password").roles("USER")
+        }
+    }
 }
@@ -15,7 +15,9 @@
 */
 package org.springframework.security.config.annotation.authentication.configuration;

+import org.springframework.aop.framework.ProxyFactoryBean
 import org.springframework.beans.factory.annotation.Autowired
+import org.springframework.context.ApplicationContext
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
 import org.springframework.context.annotation.Import
@@ -25,8 +27,9 @@ import org.springframework.security.access.annotation.Secured
 import org.springframework.security.authentication.AuthenticationManager
 import org.springframework.security.authentication.TestingAuthenticationToken
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
-import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
+import org.springframework.security.authentication.dao.DaoAuthenticationProvider
 import org.springframework.security.config.annotation.BaseSpringSpec
+import org.springframework.security.config.annotation.ObjectPostProcessor
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder
 import org.springframework.security.config.annotation.authentication.configurers.GlobalAuthenticationConfigurerAdapter
 import org.springframework.security.config.annotation.configuration.ObjectPostProcessorConfiguration
@@ -292,4 +295,34 @@ class AuthenticationConfigurationTests extends BaseSpringSpec {
            auth.authenticationProvider(provider)
        }
    }
+
+    def "SEC-2531: AuthenticationConfiguration#lazyBean should use BeanClassLoader on ProxyFactoryBean"() {
+        setup:
+            ObjectPostProcessor opp = Mock()
+            Sec2531Config. opp = opp
+            loadConfig(Sec2531Config)
+        when:
+            AuthenticationConfiguration config = context.getBean(AuthenticationConfiguration)
+            config.getAuthenticationManager()
+        then:
+            1 * opp.postProcess(_ as ProxyFactoryBean) >> { args ->
+                args[0]
+            }
+    }
+
+    @Configuration
+    @Import(AuthenticationConfiguration)
+    static class Sec2531Config {
+        static ObjectPostProcessor opp
+
+        @Bean
+        public ObjectPostProcessor objectPostProcessor() {
+            opp
+        }
+
+        @Bean
+        public AuthenticationManager manager() {
+            null
+        }
+    }
 }
@@ -15,10 +15,13 @@
 */
 package org.springframework.security.config.annotation.web.configuration;

+import org.springframework.beans.factory.annotation.Autowired
 import org.springframework.beans.FatalBeanException;
+import org.springframework.context.annotation.AnnotationConfigApplicationContext
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
 import org.springframework.security.authentication.AuthenticationManager
+import org.springframework.security.authentication.TestingAuthenticationToken
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
 import org.springframework.security.config.annotation.BaseSpringSpec
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
@@ -44,6 +47,48 @@ public class Sec2515Tests extends BaseSpringSpec {
        }
    }

+    def "Custom Name Prevent StackOverflow with bean graph cycle"() {
+        when:
+           loadConfig(StackOverflowSecurityConfig)
+        then:
+            thrown(FatalBeanException)
+    }
+
+    @EnableWebSecurity
+    @Configuration
+    static class CustomBeanNameStackOverflowSecurityConfig extends WebSecurityConfigurerAdapter {
+
+        @Override
+        @Bean(name="custom")
+        public AuthenticationManager authenticationManagerBean()
+                throws Exception {
+            return super.authenticationManagerBean();
+        }
+    }
+
+    def "SEC-2549: Can load with child classloader"() {
+        setup:
+            CanLoadWithChildConfig.AM = Mock(AuthenticationManager)
+            context = new AnnotationConfigApplicationContext()
+            context.classLoader = new URLClassLoader(new URL[0], context.classLoader)
+            context.register(CanLoadWithChildConfig)
+            context.refresh()
+        when:
+            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("user", "password"))
+        then:
+            noExceptionThrown()
+            1 * CanLoadWithChildConfig.AM.authenticate(_) >> new TestingAuthenticationToken("user","password","ROLE_USER")
+    }
+
+    @EnableWebSecurity
+    @Configuration
+    static class CanLoadWithChildConfig extends WebSecurityConfigurerAdapter {
+        static AuthenticationManager AM
+        @Bean
+        public AuthenticationManager am() {
+            AM
+        }
+    }

    def "SEC-2515: @Bean still works when configure(AuthenticationManagerBuilder) used"() {
        when:
@@ -15,6 +15,8 @@
 */
 package org.springframework.security.config.annotation.web.configurers

+import org.springframework.security.web.util.matcher.AntPathRequestMatcher
+
 import javax.servlet.http.HttpServletResponse

 import org.springframework.context.annotation.Configuration
@@ -102,6 +104,49 @@ class CsrfConfigurerTests extends BaseSpringSpec {
        }
    }

+    def "SEC-2498: Disable CSRF enables RequestCache for any method"() {
+        setup:
+            loadConfig(DisableCsrfEnablesRequestCacheConfig)
+            request.requestURI = '/tosave'
+            request.method = "POST"
+            clearCsrfToken()
+        when:
+            springSecurityFilterChain.doFilter(request,response,chain)
+        then:
+            response.redirectedUrl
+        when:
+            super.setupWeb(request.session)
+            request.method = "POST"
+            request.servletPath = '/login'
+            request.parameters['username'] = ['user'] as String[]
+            request.parameters['password'] = ['password'] as String[]
+            springSecurityFilterChain.doFilter(request,response,chain)
+        then:
+            response.redirectedUrl == 'http://localhost/tosave'
+    }
+
+    @Configuration
+    @EnableWebSecurity
+    static class DisableCsrfEnablesRequestCacheConfig extends WebSecurityConfigurerAdapter {
+
+        @Override
+        protected void configure(HttpSecurity http) throws Exception {
+            http
+                .authorizeRequests()
+                    .anyRequest().authenticated()
+                    .and()
+                .formLogin().and()
+                .csrf().disable()
+
+        }
+        @Override
+        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
+            auth
+                .inMemoryAuthentication()
+                    .withUser("user").password("password").roles("USER")
+        }
+    }
+
    def "SEC-2422: csrf expire CSRF token and session-management invalid-session-url"() {
        setup:
            loadConfig(InvalidSessionUrlConfig)
@@ -293,6 +338,18 @@ class CsrfConfigurerTests extends BaseSpringSpec {
            currentAuthentication != null
    }

+    def "SEC-2543: CSRF means logout requires POST"() {
+        setup:
+            loadConfig(LogoutConfig)
+            login()
+            request.servletPath = "/logout"
+            request.method = "GET"
+        when:
+            springSecurityFilterChain.doFilter(request,response,chain)
+        then: "logout with GET is not performed"
+            currentAuthentication != null
+    }
+
    @Configuration
    @EnableWebSecurity
    static class LogoutConfig extends WebSecurityConfigurerAdapter {
@@ -305,6 +362,32 @@ class CsrfConfigurerTests extends BaseSpringSpec {
        }
    }

+    def "CSRF can explicitly enable GET for logout"() {
+        setup:
+            loadConfig(LogoutAllowsGetConfig)
+            login()
+            request.servletPath = "/logout"
+            request.method = "GET"
+        when:
+            springSecurityFilterChain.doFilter(request,response,chain)
+        then: "logout with GET is not performed"
+            currentAuthentication == null
+    }
+
+    @Configuration
+    @EnableWebSecurity
+    static class LogoutAllowsGetConfig extends WebSecurityConfigurerAdapter {
+        static AccessDeniedHandler deniedHandler
+
+        @Override
+        protected void configure(HttpSecurity http) throws Exception {
+            http
+                .formLogin().and()
+                .logout()
+                    .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
+        }
+    }
+
    def "csrf disables POST requests from RequestCache"() {
        setup:
            CsrfDisablesPostRequestFromRequestCacheConfig.repo = Mock(CsrfTokenRepository)
@@ -8,6 +8,8 @@ configurations {
    included

    compile.extendsFrom included
+
+    testCompile.exclude group: 'org.mockito', module: 'mockito-all'
 }

 dependencies {
@@ -17,7 +19,7 @@ dependencies {
            "org.springframework:spring-context:$springVersion",
            "org.springframework:spring-expression:$springVersion"

-    optional "net.sf.ehcache:ehcache:$ehcacheVersion",
+    optional "net.sf.ehcache:ehcache-core:$ehcacheVersion",
             'javax.annotation:jsr250-api:1.0',
             "org.aspectj:aspectjrt:$aspectjVersion",
             "org.springframework:spring-jdbc:$springVersion",
@@ -30,8 +32,7 @@ dependencies {
                "org.slf4j:jcl-over-slf4j:$slf4jVersion",
                powerMockDependencies

-    testRuntime "org.hsqldb:hsqldb:$hsqlVersion",
-                "cglib:cglib-nodep:$cglibVersion"
+    testRuntime "org.hsqldb:hsqldb:$hsqlVersion"
 }

 classes.doLast {
@@ -43,7 +44,7 @@ classes.doLast {

 sourceJar.from cryptoProject.sourceSets.main.java

-configure([test,spring4Test]) {
+configure(project.tasks.withType(Test)) {
    systemProperties['springSecurityVersion'] = version
    systemProperties['springVersion'] = springVersion
 }
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-core</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <name>spring-security-core</name>
  <description>spring-security-core</description>
  <url>http://spring.io/spring-security</url>
@@ -42,12 +42,6 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
      <groupId>aopalliance</groupId>
@@ -107,8 +101,8 @@
    </dependency>
    <dependency>
      <groupId>net.sf.ehcache</groupId>
-      <artifactId>ehcache</artifactId>
-      <version>1.6.2</version>
+      <artifactId>ehcache-core</artifactId>
+      <version>1.7.2</version>
      <scope>compile</scope>
      <optional>true</optional>
    </dependency>
@@ -133,12 +127,6 @@
      <scope>compile</scope>
      <optional>true</optional>
    </dependency>
-    <dependency>
-      <groupId>cglib</groupId>
-      <artifactId>cglib-nodep</artifactId>
-      <version>2.2</version>
-      <scope>test</scope>
-    </dependency>
    <dependency>
      <groupId>ch.qos.logback</groupId>
      <artifactId>logback-classic</artifactId>
@@ -150,18 +138,36 @@
      <artifactId>commons-collections</artifactId>
      <version>3.2</version>
      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>mockito-all</artifactId>
+          <groupId>org.mockito</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>mockito-all</artifactId>
+          <groupId>org.mockito</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.easytesting</groupId>
      <artifactId>fest-assert</artifactId>
      <version>1.4</version>
      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>mockito-all</artifactId>
+          <groupId>org.mockito</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.hsqldb</groupId>
@@ -174,54 +180,108 @@
      <artifactId>mockito-core</artifactId>
      <version>1.9.5</version>
      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>mockito-all</artifactId>
+          <groupId>org.mockito</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.powermock</groupId>
      <artifactId>powermock-api-mockito</artifactId>
      <version>1.5.1</version>
      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>mockito-all</artifactId>
+          <groupId>org.mockito</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.powermock</groupId>
      <artifactId>powermock-api-support</artifactId>
      <version>1.5.1</version>
      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>mockito-all</artifactId>
+          <groupId>org.mockito</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.powermock</groupId>
      <artifactId>powermock-core</artifactId>
      <version>1.5.1</version>
      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>mockito-all</artifactId>
+          <groupId>org.mockito</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.powermock</groupId>
      <artifactId>powermock-module-junit4</artifactId>
      <version>1.5.1</version>
      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>mockito-all</artifactId>
+          <groupId>org.mockito</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.powermock</groupId>
      <artifactId>powermock-module-junit4-common</artifactId>
      <version>1.5.1</version>
      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>mockito-all</artifactId>
+          <groupId>org.mockito</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.powermock</groupId>
      <artifactId>powermock-reflect</artifactId>
      <version>1.5.1</version>
      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>mockito-all</artifactId>
+          <groupId>org.mockito</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.slf4j</groupId>
      <artifactId>jcl-over-slf4j</artifactId>
      <version>1.7.5</version>
      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>mockito-all</artifactId>
+          <groupId>org.mockito</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-test</artifactId>
      <version>3.2.8.RELEASE</version>
      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>mockito-all</artifactId>
+          <groupId>org.mockito</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
  </dependencies>
 </project>
@@ -85,7 +85,7 @@ public class UsernamePasswordAuthenticationToken extends AbstractAuthenticationT
    public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
        if (isAuthenticated) {
            throw new IllegalArgumentException(
-                "Cannot set this token to trusted - use constructor which takes a GrantedAuthority list instead");
+                "Once created you cannot set this token to authenticated. Create a new instance using the constructor which takes a GrantedAuthority list will mark this as authenticated.");
        }

        super.setAuthenticated(false);
@@ -18,6 +18,7 @@ package org.springframework.security.authentication.dao;
 import org.springframework.security.authentication.AuthenticationProvider;
 import org.springframework.security.authentication.AuthenticationServiceException;
 import org.springframework.security.authentication.BadCredentialsException;
+import org.springframework.security.authentication.InternalAuthenticationServiceException;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.authentication.encoding.PasswordEncoder;
 import org.springframework.security.authentication.encoding.PlaintextPasswordEncoder;
@@ -106,11 +107,11 @@ public class DaoAuthenticationProvider extends AbstractUserDetailsAuthentication
            }
            throw notFound;
        } catch (Exception repositoryProblem) {
-            throw new AuthenticationServiceException(repositoryProblem.getMessage(), repositoryProblem);
+            throw new InternalAuthenticationServiceException(repositoryProblem.getMessage(), repositoryProblem);
        }

        if (loadedUser == null) {
-            throw new AuthenticationServiceException(
+            throw new InternalAuthenticationServiceException(
                    "UserDetailsService returned null, which is an interface contract violation");
        }
        return loadedUser;
@@ -35,7 +35,7 @@ public interface UserDetailsService {

    /**
     * Locates the user based on the username. In the actual implementation, the search may possibly be case
-     * insensitive, or case insensitive depending on how the implementation instance is configured. In this case, the
+     * sensitive, or case insensitive depending on how the implementation instance is configured. In this case, the
     * <code>UserDetails</code> object that comes back may have a username that is of a different case than what was
     * actually requested..
     *
@@ -15,6 +15,7 @@

 package org.springframework.security.authentication;

+import static org.fest.assertions.Assertions.assertThat;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
@@ -58,6 +59,8 @@ public class UsernamePasswordAuthenticationTokenTests {
            token.setAuthenticated(true);
            fail("Should have prohibited setAuthenticated(true)");
        } catch (IllegalArgumentException expected) {
+            // SEC-2540
+            assertThat(expected).hasMessage("Once created you cannot set this token to authenticated. Create a new instance using the constructor which takes a GrantedAuthority list will mark this as authenticated.");
        }
    }

@@ -34,6 +34,7 @@ import org.springframework.security.authentication.AuthenticationServiceExceptio
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.authentication.CredentialsExpiredException;
 import org.springframework.security.authentication.DisabledException;
+import org.springframework.security.authentication.InternalAuthenticationServiceException;
 import org.springframework.security.authentication.LockedException;
 import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
@@ -172,9 +173,8 @@ public class DaoAuthenticationProviderTests extends TestCase {

        try {
            provider.authenticate(token);
-            fail("Should have thrown AuthenticationServiceException");
-        } catch (AuthenticationServiceException expected) {
-            assertTrue(true);
+            fail("Should have thrown InternalAuthenticationServiceException");
+        } catch (InternalAuthenticationServiceException expected) {
        }
    }

@@ -4,7 +4,7 @@
 // isJdk6 = jdkVersion >= '1.6'
 int maxAESKeySize = javax.crypto.Cipher.getMaxAllowedKeyLength('AES')

-configure([test,spring4Test]) {
+configure(project.tasks.withType(Test)) {
    if (maxAESKeySize < 256) {
        println "AES keysize limited to $maxAESKeySize, skipping EncryptorsTests"
        exclude '**/EncryptorsTests.class'
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-crypto</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <name>spring-security-crypto</name>
  <description>spring-security-crypto</description>
  <url>http://spring.io/spring-security</url>
@@ -42,12 +42,6 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
      <groupId>org.springframework</groupId>
@@ -77,7 +71,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -77,7 +77,7 @@ public class RootConfiguration {

 The `@ComponentScan` is loading all configuration within the same package (and child packages) as `RootConfiguration`. Since <<security-config-java,SecurityConfig>> is in this package, it will be loaded with our existing setup and there is nothing more to do.

-NOTE: Had <<security-config-java,SecurityConfig>> not been loaded, we could have used an `@Import(SecurityConfig)` above the class definition of <<root-configuration-java,RootConfiguration>> or added <<security-config-java,SecurityConfig>> as one of the results for `getRootConfigClasses()`.
+NOTE: Had <<security-config-java,SecurityConfig>> not been loaded, we could have used an `@Import(SecurityConfig.class)` above the class definition of <<root-configuration-java,RootConfiguration>> or added <<security-config-java,SecurityConfig>> as one of the results for `getRootConfigClasses()`.

 include::{hello-include-dir}/exploring-the-secured-application.asc[]

@@ -2078,7 +2078,7 @@ Each supported secure object type has its own interceptor class, which is a subc

 [[tech-intro-config-attributes]]
 ===== What are Configuration Attributes?
-A "configuration attribute" can be thought of as a String that has special meaning to the classes used by`AbstractSecurityInterceptor`. They are represented by the interface `ConfigAttribute` within the framework. They may be simple role names or have more complex meaning, depending on the how sophisticated the `AccessDecisionManager` implementation is. The `AbstractSecurityInterceptor` is configured with a `SecurityMetadataSource` which it uses to look up the attributes for a secure object. Usually this configuration will be hidden from the user. Configuration attributes will be entered as annotations on secured methods or as access attributes on secured URLs. For example, when we saw something like `<intercept-url pattern='/secure/**' access='ROLE_A,ROLE_B'/>` in the namespace introduction, this is saying that the configuration attributes `ROLE_A` and `ROLE_B` apply to web requests matching the given pattern. In practice, with the default `AccessDecisionManager` configuration, this means that anyone who has a `GrantedAuthority` matching either of these two attributes will be allowed access. Strictly speaking though, they are just attributes and the interpretation is dependent on the `AccessDecisionManager` implementation. The use of the prefix `ROLE_` is a marker to indicate that these attributes are roles and should be consumed by Spring Security's`RoleVoter`. This is only relevant when a voter-based `AccessDecisionManager` is in use. We'll see how the `AccessDecisionManager` is implemented in the <<authz-arch,authorization chapter>>.
+A "configuration attribute" can be thought of as a String that has special meaning to the classes used by `AbstractSecurityInterceptor`. They are represented by the interface `ConfigAttribute` within the framework. They may be simple role names or have more complex meaning, depending on the how sophisticated the `AccessDecisionManager` implementation is. The `AbstractSecurityInterceptor` is configured with a `SecurityMetadataSource` which it uses to look up the attributes for a secure object. Usually this configuration will be hidden from the user. Configuration attributes will be entered as annotations on secured methods or as access attributes on secured URLs. For example, when we saw something like `<intercept-url pattern='/secure/**' access='ROLE_A,ROLE_B'/>` in the namespace introduction, this is saying that the configuration attributes `ROLE_A` and `ROLE_B` apply to web requests matching the given pattern. In practice, with the default `AccessDecisionManager` configuration, this means that anyone who has a `GrantedAuthority` matching either of these two attributes will be allowed access. Strictly speaking though, they are just attributes and the interpretation is dependent on the `AccessDecisionManager` implementation. The use of the prefix `ROLE_` is a marker to indicate that these attributes are roles and should be consumed by Spring Security's`RoleVoter`. This is only relevant when a voter-based `AccessDecisionManager` is in use. We'll see how the `AccessDecisionManager` is implemented in the <<authz-arch,authorization chapter>>.


 ===== RunAsManager
@@ -1 +1 @@
-version=3.2.2.CI-SNAPSHOT
+version=3.2.4.RELEASE
@@ -1,6 +1,7 @@
 import org.gradle.plugins.ide.eclipse.model.SourceFolder

 apply plugin: 'java'
+apply plugin: 'groovy'
 apply plugin: 'javadocHotfix'
 apply plugin: 'eclipse-wtp'
 apply plugin: 'propdeps'
@@ -11,33 +12,44 @@ apply plugin: 'propdeps-eclipse'
 sourceCompatibility = 1.5
 targetCompatibility = 1.5

-ext.ehcacheVersion = '1.6.2'
+ext.ehcacheVersion = '1.7.2'
 ext.aspectjVersion = '1.6.10'
 ext.apacheDsVersion = '1.5.5'
-ext.jstlVersion = '1.2'
+ext.jstlVersion = '1.2.1'
 ext.jettyVersion = '6.1.26'
 ext.hsqlVersion = '2.3.1'
 ext.slf4jVersion = '1.7.5'
 ext.logbackVersion = '0.9.29'
 ext.cglibVersion = '2.2'
 ext.powerMockVersion = '1.5.1'
-ext.servletApiVersion = '7.0.33'
+ext.servletApiVersion = '3.0.1'
 ext.seleniumVersion = '2.33.0'
 ext.groovyVersion = '2.0.5'
 ext.spockVersion = '0.7-groovy-2.0'
 ext.gebVersion = '0.9.0'
 ext.thymeleafVersion = '2.1.2.RELEASE'

+ext.spockDependencies = [
+    dependencies.create("org.spockframework:spock-spring:$spockVersion") {
+        exclude group: 'junit', module: 'junit-dep'
+    },
+    dependencies.create("org.spockframework:spock-core:$spockVersion") {
+        exclude group: 'junit', module: 'junit-dep'
+    }
+]
+
 ext.powerMockDependencies = [
    "org.powermock:powermock-core:$powerMockVersion",
    "org.powermock:powermock-api-support:$powerMockVersion",
    "org.powermock:powermock-module-junit4-common:$powerMockVersion",
    "org.powermock:powermock-module-junit4:$powerMockVersion",
-    "org.powermock:powermock-api-mockito:$powerMockVersion",
+    dependencies.create("org.powermock:powermock-api-mockito:$powerMockVersion") {
+        exclude group: 'org.mockito', module: 'mockito-all'
+    },
    "org.powermock:powermock-reflect:$powerMockVersion"
 ]

-ext.apacheds_libs = [
+ext.apachedsDependencies = [
         "org.apache.directory.server:apacheds-core:$apacheDsVersion",
         "org.apache.directory.server:apacheds-core-entry:$apacheDsVersion",
         "org.apache.directory.server:apacheds-protocol-shared:$apacheDsVersion",
@@ -75,6 +87,7 @@ configurations {
 sourceSets {
    integrationTest {
        java.srcDir file('src/integration-test/java')
+        groovy.srcDirs file('src/integration-test/groovy')
        resources.srcDir file('src/integration-test/resources')
        compileClasspath = sourceSets.main.output + sourceSets.test.output + configurations.integrationTestCompile
        runtimeClasspath = output + compileClasspath + configurations.integrationTestRuntime
@@ -86,6 +99,10 @@ task integrationTest(type: Test, dependsOn: jar) {
    logging.captureStandardOutput(LogLevel.INFO)
    classpath = sourceSets.integrationTest.runtimeClasspath
    maxParallelForks = 1
+    reports {
+        html.destination = project.file("$project.buildDir/reports/integration-tests/")
+        junitXml.destination = project.file("$project.buildDir/integration-test-results/")
+    }
 }
 project.conf2ScopeMappings.addMapping(MavenPlugin.TEST_COMPILE_PRIORITY + 1, project.configurations.getByName("integrationTestCompile"), Conf2ScopeMappingContainer.TEST)
 project.conf2ScopeMappings.addMapping(MavenPlugin.TEST_COMPILE_PRIORITY + 2, project.configurations.getByName("integrationTestRuntime"), Conf2ScopeMappingContainer.TEST)
@@ -98,7 +115,7 @@ dependencies {
        exclude(group: 'commons-logging', module: 'commons-logging')
    }

-    testCompile 'junit:junit:4.10',
+    testCompile 'junit:junit:4.11',
            'org.mockito:mockito-core:1.9.5',
            "org.springframework:spring-test:$springVersion",
            'org.easytesting:fest-assert:1.4'
@@ -108,7 +125,7 @@ dependencies {
                "ch.qos.logback:logback-classic:$logbackVersion"
 }

-[configurations.runtime, configurations.default]*.exclude(module: 'commons-logging')
+[configurations.runtime, configurations.default, configurations.testCompile]*.exclude(module: 'commons-logging')

 configurations.all {
    resolutionStrategy.eachDependency { DependencyResolveDetails details ->
@@ -120,8 +137,8 @@ configurations.all {

 [compileJava, compileTestJava]*.options*.encoding = 'UTF-8'

-test {
-    jvmArgs = ['-ea', '-Xmx500m', '-XX:MaxPermSize=128M']
+project.tasks.matching { it instanceof Test && it.name != 'integrationTest' }.all {
+    jvmArgs = ['-ea', '-Xmx500m', '-XX:MaxPermSize=256M']
    maxParallelForks = guessMaxForks()
    logging.captureStandardOutput(LogLevel.INFO)
 }
@@ -11,7 +11,11 @@ if(!snapshotBuild) {
 }

 def verifyNoDependenciesMatchingVersion(def pattern) {
-    def dependencies = configurations.all*.allDependencies*.findAll { d -> d.version?.matches(pattern) }.flatten().toSet().join("\n    ")
+    def dependencies = configurations.all*.allDependencies*.findAll { d ->
+        def ignored = 'io.spring.platform:platform-versions'
+        def groupAndName = "$d.group:$d.name".toString()
+        ignored != groupAndName && 	d.version?.matches(pattern)
+    }.flatten().toSet().join("\n    ")
    if(dependencies) {
        throw new GradleException("${project.name} cannot have dependencies with a version that matches $pattern when its version is ${project.version}. Got\n    $dependencies")
    }
@@ -10,7 +10,7 @@ dependencies {
                "org.springframework:spring-beans:$springVersion"

    testCompile project(':spring-security-web'),
-                "org.apache.tomcat:tomcat-servlet-api:$servletApiVersion",
+                "javax.servlet:javax.servlet-api:$servletApiVersion",
                "org.springframework:spring-web:$springVersion"
    testRuntime project(':spring-security-config'),
                "org.aspectj:aspectjweaver:$aspectjVersion"
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>itest-context</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <name>itest-context</name>
  <description>itest-context</description>
  <url>http://spring.io/spring-security</url>
@@ -42,12 +42,6 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
      <groupId>aopalliance</groupId>
@@ -64,7 +58,7 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -117,15 +111,15 @@
      <scope>test</scope>
    </dependency>
    <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <groupId>javax.servlet</groupId>
+      <artifactId>javax.servlet-api</artifactId>
+      <version>3.0.1</version>
      <scope>test</scope>
    </dependency>
    <dependency>
-      <groupId>org.apache.tomcat</groupId>
-      <artifactId>tomcat-servlet-api</artifactId>
-      <version>7.0.33</version>
+      <groupId>junit</groupId>
+      <artifactId>junit</artifactId>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -155,13 +149,13 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -3,29 +3,34 @@ dependencies {
    compile     "org.springframework:spring-context:$springVersion",
                "org.springframework:spring-web:$springVersion"

-    provided "org.apache.tomcat:tomcat-servlet-api:$servletApiVersion"
+    provided "javax.servlet:javax.servlet-api:$servletApiVersion"

    testCompile project(':spring-security-core'),
                project(':spring-security-web'),
                project(':spring-security-taglibs'),
                "org.springframework:spring-beans:$springVersion",
                "org.springframework:spring-webmvc:$springVersion",
-                "org.mortbay.jetty:jetty:$jettyVersion",
                "org.mortbay.jetty:jetty-util:$jettyVersion",
-                'net.sourceforge.jwebunit:jwebunit-core:2.2',
                "org.testng:testng:5.11:jdk15"
+    testCompile ("org.mortbay.jetty:jetty:$jettyVersion") {
+        exclude group: 'org.mortbay.jetty', module: 'servlet-api'
+    }
+    testCompile ('net.sourceforge.jwebunit:jwebunit-core:2.2') {
+        exclude group: 'javax.servlet', module: 'servlet-api'
+        exclude group: 'regexp', module: 'regexp'
+    }

    testRuntime project(':spring-security-config'),
                project(':spring-security-ldap'),
                "org.mortbay.jetty:jsp-2.1-jetty:$jettyVersion",
-                'net.sourceforge.jwebunit:jwebunit-htmlunit-plugin:2.2'
+    testRuntime ('net.sourceforge.jwebunit:jwebunit-htmlunit-plugin:2.2') {
+        exclude group: 'javax.servlet', module: 'servlet-api'
+    }
 }

 integrationTest {
    useTestNG();
-    options {
-        jvmArgs = ["-ea", '-Xms128m', '-Xmx500m']
-        systemProperties = ['webapp.dir': "$projectDir/src/main/webapp"]
-    }
+    jvmArgs = ["-ea", '-Xms128m', '-Xmx500m']
+    systemProperty 'webapp.dir', "$projectDir/src/main/webapp"
    maxParallelForks = 1
 }
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>itest-web</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <name>itest-web</name>
  <description>itest-web</description>
  <url>http://spring.io/spring-security</url>
@@ -42,12 +42,6 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
      <groupId>org.springframework</groupId>
@@ -81,9 +75,9 @@
      <optional>true</optional>
    </dependency>
    <dependency>
-      <groupId>org.apache.tomcat</groupId>
-      <artifactId>tomcat-servlet-api</artifactId>
-      <version>7.0.33</version>
+      <groupId>javax.servlet</groupId>
+      <artifactId>javax.servlet-api</artifactId>
+      <version>3.0.1</version>
      <scope>provided</scope>
    </dependency>
    <dependency>
@@ -95,7 +89,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -103,12 +97,28 @@
      <artifactId>jwebunit-core</artifactId>
      <version>2.2</version>
      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>regexp</artifactId>
+          <groupId>regexp</groupId>
+        </exclusion>
+        <exclusion>
+          <artifactId>servlet-api</artifactId>
+          <groupId>javax.servlet</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
    <dependency>
      <groupId>net.sourceforge.jwebunit</groupId>
      <artifactId>jwebunit-htmlunit-plugin</artifactId>
      <version>2.2</version>
      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>servlet-api</artifactId>
+          <groupId>javax.servlet</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.easytesting</groupId>
@@ -127,6 +137,12 @@
      <artifactId>jetty</artifactId>
      <version>6.1.26</version>
      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>servlet-api</artifactId>
+          <groupId>org.mortbay.jetty</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.mortbay.jetty</groupId>
@@ -149,31 +165,31 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-ldap</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-taglibs</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-ldap</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <name>spring-security-ldap</name>
  <description>spring-security-ldap</description>
  <url>http://spring.io/spring-security</url>
@@ -42,12 +42,6 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
      <groupId>org.springframework.ldap</groupId>
@@ -76,7 +70,7 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -174,7 +168,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -25,7 +25,8 @@ public abstract class AbstractLdapIntegrationTests {

    @BeforeClass
    public static void createContextSource() throws Exception {
-        contextSource = new DefaultSpringSecurityContextSource("ldap://127.0.0.1:53389/dc=springframework,dc=org");
+        int serverPort = ApacheDSServerIntegrationTests.getServerPort();
+        contextSource = new DefaultSpringSecurityContextSource("ldap://127.0.0.1:" + serverPort + "/dc=springframework,dc=org");
 // OpenLDAP configuration
 //        contextSource = new DefaultSpringSecurityContextSource("ldap://127.0.0.1:22389/dc=springsource,dc=com");
 //        contextSource.setUserDn("cn=admin,dc=springsource,dc=com");
@@ -1,5 +1,8 @@
 package org.springframework.security.ldap;

+import java.io.IOException;
+import java.net.ServerSocket;
+
 import org.junit.*;
 import org.junit.runner.RunWith;
 import org.junit.runners.Suite;
@@ -26,6 +29,7 @@ import org.springframework.security.ldap.userdetails.LdapUserDetailsManagerTests
 )
 public final class ApacheDSServerIntegrationTests {
    private static ApacheDSContainer server;
+    private static Integer serverPort;

    @BeforeClass
    public static void startServer() throws Exception {
@@ -34,12 +38,15 @@ public final class ApacheDSServerIntegrationTests {
 //        contextSource.setUserDn("cn=admin,dc=springsource,dc=com");
 //        contextSource.setPassword("password");
        server = new ApacheDSContainer("dc=springframework,dc=org", "classpath:test-server.ldif");
-        server.setPort(53389);
+        int port = getAvailablePort();
+        server.setPort(port);
        server.afterPropertiesSet();
+        serverPort = port;
    }

    @AfterClass
    public static void stopServer() throws Exception {
+        serverPort = null;
        if (server != null) {
            server.stop();
        }
@@ -53,6 +60,12 @@ public final class ApacheDSServerIntegrationTests {
        server.afterPropertiesSet();
    }

+    public static int getServerPort() {
+        if(serverPort == null) {
+            throw new IllegalStateException("The ApacheDSContainer is not currently running");
+        }
+        return serverPort;
+    }
 /*
    @After
    public final void reloadServerDataIfDirty() throws Exception {
@@ -105,4 +118,18 @@ public final class ApacheDSServerIntegrationTests {
        }
    }
    */
+
+    private static int getAvailablePort() throws IOException {
+        ServerSocket serverSocket =  null;
+        try {
+            serverSocket = new ServerSocket(0);
+            return serverSocket.getLocalPort();
+        } finally {
+            if(serverSocket != null) {
+                try {
+                    serverSocket.close();
+                } catch (IOException e) {}
+            }
+        }
+    }
 }
@@ -71,7 +71,7 @@ public class DefaultSpringSecurityContextSourceTests extends AbstractLdapIntegra
    @Test
    public void serverUrlWithSpacesIsSupported() throws Exception {
        DefaultSpringSecurityContextSource
-                contextSource = new DefaultSpringSecurityContextSource("ldap://127.0.0.1:53389/ou=space%20cadets,dc=springframework,dc=org");
+                contextSource = new DefaultSpringSecurityContextSource("ldap://127.0.0.1:" + ApacheDSServerIntegrationTests.getServerPort() + "/ou=space%20cadets,dc=springframework,dc=org");
        contextSource.afterPropertiesSet();
        contextSource.getContext("uid=space cadet,ou=space cadets,dc=springframework,dc=org", "spacecadetspassword");
    }
@@ -121,7 +121,7 @@ public class SpringSecurityLdapTemplateITests extends AbstractLdapIntegrationTes
    public void nonSpringLdapSearchCodeTestMethod() throws Exception {
        java.util.Hashtable<String, String> env = new java.util.Hashtable<String, String>();
        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
-        env.put(Context.PROVIDER_URL, "ldap://localhost:53389");
+        env.put(Context.PROVIDER_URL, "ldap://localhost:" + ApacheDSServerIntegrationTests.getServerPort());
        env.put(Context.SECURITY_PRINCIPAL, "");
        env.put(Context.SECURITY_CREDENTIALS, "");

@@ -20,6 +20,7 @@ import org.junit.*;
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.authentication.encoding.LdapShaPasswordEncoder;
+import org.springframework.security.authentication.encoding.PasswordEncoder;
 import org.springframework.security.authentication.encoding.PlaintextPasswordEncoder;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.userdetails.UsernameNotFoundException;
@@ -112,7 +113,7 @@ public class PasswordComparisonAuthenticatorTests extends AbstractLdapIntegratio

    @Test(expected = IllegalArgumentException.class)
    public void testPasswordEncoderCantBeNull() {
-        authenticator.setPasswordEncoder(null);
+        authenticator.setPasswordEncoder((PasswordEncoder)null);
    }

    @Test
@@ -17,6 +17,11 @@ package org.springframework.security.ldap.server;

 import static junit.framework.Assert.fail;

+import java.io.IOException;
+import java.net.ServerSocket;
+import java.util.ArrayList;
+import java.util.List;
+
 import org.junit.Test;

 /**
@@ -32,7 +37,10 @@ public class ApacheDSContainerTests {
    @Test
    public void failsToStartThrowsException() throws Exception {
        ApacheDSContainer server1 = new ApacheDSContainer("dc=springframework,dc=org", "classpath:test-server.ldif");
-        ApacheDSContainer server2 = new ApacheDSContainer("dc=springframework,dc=org", "classpath:test-server.ldif");
+        ApacheDSContainer server2 = new ApacheDSContainer("dc=springframework,dc=org", "classpath:missing.ldif");
+        List<Integer> ports = getDefaultPorts(1);
+        server1.setPort(ports.get(0));
+        server2.setPort(ports.get(0));
        try {
            server1.afterPropertiesSet();
            try {
@@ -54,6 +62,9 @@ public class ApacheDSContainerTests {
    public void multipleInstancesSimultanciously() throws Exception {
        ApacheDSContainer server1 = new ApacheDSContainer("dc=springframework,dc=org", "classpath:test-server.ldif");
        ApacheDSContainer server2 = new ApacheDSContainer("dc=springframework,dc=org", "classpath:test-server.ldif");
+        List<Integer> ports = getDefaultPorts(2);
+        server1.setPort(ports.get(0));
+        server2.setPort(ports.get(1));
        try {
            server1.afterPropertiesSet();
            server2.afterPropertiesSet();
@@ -66,4 +77,21 @@ public class ApacheDSContainerTests {
            }catch(Throwable t) {}
        }
    }
+
+    private List<Integer> getDefaultPorts(int count) throws IOException {
+        List<ServerSocket> connections = new ArrayList<ServerSocket>();
+        List<Integer> availablePorts = new ArrayList<Integer>(count);
+        try {
+            for(int i=0;i<count;i++) {
+                ServerSocket socket = new ServerSocket(0);
+                connections.add(socket);
+                availablePorts.add(socket.getLocalPort());
+            }
+            return availablePorts;
+        } finally {
+            for(ServerSocket conn : connections) {
+                conn.close();
+            }
+        }
+    }
 }
@@ -18,6 +18,7 @@ package org.springframework.security.ldap.authentication;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.ldap.NameNotFoundException;
+import org.springframework.ldap.NamingException;
 import org.springframework.ldap.core.DirContextOperations;
 import org.springframework.ldap.core.support.BaseLdapPathContextSource;
 import org.springframework.security.authentication.BadCredentialsException;
@@ -52,6 +53,7 @@ public final class PasswordComparisonAuthenticator extends AbstractLdapAuthentic

    private PasswordEncoder passwordEncoder = new LdapShaPasswordEncoder();
    private String passwordAttributeName = "userPassword";
+    private boolean usePasswordAttrCompare = false;

    //~ Constructors ===================================================================================================

@@ -95,15 +97,25 @@ public final class PasswordComparisonAuthenticator extends AbstractLdapAuthentic
                    user.getDn() +"'");
        }

+        if (usePasswordAttrCompare && isPasswordAttrCompare(user, password)) {
+            return user;
+        } else if(isLdapPasswordCompare(user, ldapTemplate, password)) {
+            return user;
+        }
+        throw new BadCredentialsException(messages.getMessage("PasswordComparisonAuthenticator.badCredentials",
+                "Bad credentials"));
+    }
+
+    private boolean isPasswordAttrCompare(DirContextOperations user, String password) {
+        Object passwordAttrValue = user.getObjectAttribute(passwordAttributeName);
+        return passwordEncoder.isPasswordValid(new String((byte[])passwordAttrValue), password, null);
+    }
+
+    private boolean isLdapPasswordCompare(DirContextOperations user,
+            SpringSecurityLdapTemplate ldapTemplate, String password) {
        String encodedPassword = passwordEncoder.encodePassword(password, null);
        byte[] passwordBytes = Utf8.encode(encodedPassword);
-
-        if (!ldapTemplate.compare(user.getDn().toString(), passwordAttributeName, passwordBytes)) {
-            throw new BadCredentialsException(messages.getMessage("PasswordComparisonAuthenticator.badCredentials",
-                    "Bad credentials"));
-        }
-
-        return user;
+        return ldapTemplate.compare(user.getDn().toString(), passwordAttributeName, passwordBytes);
    }

    public void setPasswordAttributeName(String passwordAttribute) {
@@ -111,8 +123,40 @@ public final class PasswordComparisonAuthenticator extends AbstractLdapAuthentic
        this.passwordAttributeName = passwordAttribute;
    }

-    public void setPasswordEncoder(PasswordEncoder passwordEncoder) {
+    private void setPasswordEncoder(PasswordEncoder passwordEncoder) {
        Assert.notNull(passwordEncoder, "passwordEncoder must not be null.");
        this.passwordEncoder = passwordEncoder;
    }
+
+    public void setPasswordEncoder(Object passwordEncoder) {
+        if (passwordEncoder instanceof PasswordEncoder) {
+            this.usePasswordAttrCompare = false;
+            setPasswordEncoder((PasswordEncoder) passwordEncoder);
+            return;
+        }
+
+        if (passwordEncoder instanceof org.springframework.security.crypto.password.PasswordEncoder) {
+            final org.springframework.security.crypto.password.PasswordEncoder delegate =
+                    (org.springframework.security.crypto.password.PasswordEncoder)passwordEncoder;
+            setPasswordEncoder(new PasswordEncoder() {
+                public String encodePassword(String rawPass, Object salt) {
+                    checkSalt(salt);
+                    return delegate.encode(rawPass);
+                }
+
+                public boolean isPasswordValid(String encPass, String rawPass, Object salt) {
+                    checkSalt(salt);
+                    return delegate.matches(rawPass, encPass);
+                }
+
+                private void checkSalt(Object salt) {
+                    Assert.isNull(salt, "Salt value must be null when used with crypto module PasswordEncoder");
+                }
+            });
+            this.usePasswordAttrCompare = true;
+            return;
+        }
+
+        throw new IllegalArgumentException("passwordEncoder must be a PasswordEncoder instance");
+    }
 }
@@ -16,7 +16,8 @@ dependencies {
    }
    compile 'com.google.inject:guice:2.0'

-    provided "org.apache.tomcat:tomcat-servlet-api:$servletApiVersion"
+    provided "javax.servlet:javax.servlet-api:$servletApiVersion"

-    runtime 'org.apache.httpcomponents:httpclient:4.2.3'
+    runtime 'org.apache.httpcomponents:httpclient:4.2.3',
+            'net.sourceforge.nekohtml:nekohtml:1.9.20'
 }
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-openid</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <name>spring-security-openid</name>
  <description>spring-security-openid</description>
  <url>http://spring.io/spring-security</url>
@@ -42,12 +42,6 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
      <groupId>com.google.inject</groupId>
@@ -70,13 +64,13 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -123,11 +117,17 @@
      <optional>true</optional>
    </dependency>
    <dependency>
-      <groupId>org.apache.tomcat</groupId>
-      <artifactId>tomcat-servlet-api</artifactId>
-      <version>7.0.33</version>
+      <groupId>javax.servlet</groupId>
+      <artifactId>javax.servlet-api</artifactId>
+      <version>3.0.1</version>
      <scope>provided</scope>
    </dependency>
+    <dependency>
+      <groupId>net.sourceforge.nekohtml</groupId>
+      <artifactId>nekohtml</artifactId>
+      <version>1.9.20</version>
+      <scope>runtime</scope>
+    </dependency>
    <dependency>
      <groupId>org.apache.httpcomponents</groupId>
      <artifactId>httpclient</artifactId>
@@ -143,7 +143,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-remoting</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <name>spring-security-remoting</name>
  <description>spring-security-remoting</description>
  <url>http://spring.io/spring-security</url>
@@ -42,12 +42,6 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
      <groupId>aopalliance</groupId>
@@ -58,7 +52,7 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -107,7 +101,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-samples-aspectj-xml</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <name>spring-security-samples-aspectj-xml</name>
  <description>spring-security-samples-aspectj-xml</description>
  <url>http://spring.io/spring-security</url>
@@ -42,17 +42,11 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -84,13 +78,13 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-aspects</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
@@ -102,7 +96,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -26,7 +26,7 @@ sourceSets {
 eclipse.classpath.plusConfigurations += configurations.integrationTestRuntime

 dependencies {
-    providedCompile "org.apache.tomcat:tomcat-servlet-api:$servletApiVersion"
+    providedCompile "javax.servlet:javax.servlet-api:$servletApiVersion"

    compile project(':spring-security-core'),
            project(':spring-security-cas'),
@@ -36,16 +36,17 @@ dependencies {
            project(':spring-security-config'),
            "org.slf4j:jcl-over-slf4j:$slf4jVersion",
            "ch.qos.logback:logback-classic:$logbackVersion",
-            "net.sf.ehcache:ehcache:$ehcacheVersion"
+            "net.sf.ehcache:ehcache-core:$ehcacheVersion"

    integrationTestCompile project(':spring-security-cas'),
                   "org.seleniumhq.selenium:selenium-htmlunit-driver:$seleniumVersion",
-                   "org.spockframework:spock-core:$spockVersion",
                   "org.gebish:geb-spock:$gebVersion",
                   'commons-httpclient:commons-httpclient:3.1',
                   "org.eclipse.jetty:jetty-server:$jettyVersion",
                   "org.eclipse.jetty:jetty-servlet:$jettyVersion",
-                   "org.codehaus.groovy:groovy:$groovyVersion"
+                   "org.codehaus.groovy:groovy:$groovyVersion",
+                   "org.slf4j:jcl-over-slf4j:$slf4jVersion",
+                   spockDependencies
 }

 [jettyRun, jettyRunWar]*.configure {
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-samples-cassample-xml</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <packaging>war</packaging>
  <name>spring-security-samples-cassample-xml</name>
  <description>spring-security-samples-cassample-xml</description>
@@ -50,12 +50,6 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
      <groupId>org.jasig.cas.client</groupId>
@@ -66,13 +60,13 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-cas</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -95,9 +89,9 @@
      <optional>true</optional>
    </dependency>
    <dependency>
-      <groupId>org.apache.tomcat</groupId>
-      <artifactId>tomcat-servlet-api</artifactId>
-      <version>7.0.33</version>
+      <groupId>javax.servlet</groupId>
+      <artifactId>javax.servlet-api</artifactId>
+      <version>3.0.1</version>
      <scope>provided</scope>
    </dependency>
    <dependency>
@@ -108,8 +102,8 @@
    </dependency>
    <dependency>
      <groupId>net.sf.ehcache</groupId>
-      <artifactId>ehcache</artifactId>
-      <version>1.6.2</version>
+      <artifactId>ehcache-core</artifactId>
+      <version>1.7.2</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
@@ -121,13 +115,13 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
@@ -139,7 +133,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -189,6 +183,24 @@
      <artifactId>spock-core</artifactId>
      <version>0.7-groovy-2.0</version>
      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>junit-dep</artifactId>
+          <groupId>junit</groupId>
+        </exclusion>
+      </exclusions>
+    </dependency>
+    <dependency>
+      <groupId>org.spockframework</groupId>
+      <artifactId>spock-spring</artifactId>
+      <version>0.7-groovy-2.0</version>
+      <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>junit-dep</artifactId>
+          <groupId>junit</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-samples-casserver</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <packaging>war</packaging>
  <name>spring-security-samples-casserver</name>
  <description>spring-security-samples-casserver</description>
@@ -50,12 +50,6 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
      <groupId>org.springframework</groupId>
@@ -85,7 +79,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -0,0 +1,96 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns:p="http://www.springframework.org/schema/p" xmlns:aop="http://www.springframework.org/schema/aop"
+       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.0.xsd">
+    <description>
+        This is the main Spring configuration file with some of the main "core" classes defined. You shouldn't really
+        modify this unless you
+        know what you're doing!
+    </description>
+
+    <!--
+      Including this aspectj-autoproxy element will cause spring to automatically
+      create proxies around any beans defined in this file that match the pointcuts
+      of any aspects defined in this file.
+    -->
+    <aop:aspectj-autoproxy/>
+
+    <!--
+      Declare the TimingAspect that we want to weave into the other beans
+      defined in this config file.
+    -->
+    <bean id="timingAspect" class="org.perf4j.log4j.aop.TimingAspect"/>
+
+
+    <!-- Message source for this context, loaded from localized "messages_xx" files -->
+    <bean id="messageSource" class="org.springframework.context.support.ResourceBundleMessageSource"
+          p:basename="messages"/>
+
+    <bean
+            id="servicesManager"
+            class="org.jasig.cas.services.DefaultServicesManagerImpl">
+        <constructor-arg index="0" ref="serviceRegistryDao"/>
+    </bean>
+
+    <!--
+        Job to periodically reload services from service registry.
+        This job is needed for a clustered CAS environment since service changes
+        in one CAS node are not known to the other until a reload.
+    -->
+    <bean id="serviceRegistryReloaderJobDetail"
+          class="org.springframework.scheduling.quartz.MethodInvokingJobDetailFactoryBean"
+          p:targetObject-ref="servicesManager"
+          p:targetMethod="reload"/>
+
+    <bean id="periodicServiceRegistryReloaderTrigger" class="org.springframework.scheduling.quartz.SimpleTriggerBean"
+          p:jobDetail-ref="serviceRegistryReloaderJobDetail"
+          p:startDelay="120000"
+          p:repeatInterval="120000"/>
+
+    <bean id="persistentIdGenerator"
+          class="org.jasig.cas.authentication.principal.ShibbolethCompatiblePersistentIdGenerator"
+          p:salt="casrocks"/>
+
+    <!-- CentralAuthenticationService -->
+    <bean id="centralAuthenticationService" class="org.jasig.cas.CentralAuthenticationServiceImpl"
+          p:ticketGrantingTicketExpirationPolicy-ref="grantingTicketExpirationPolicy"
+          p:serviceTicketExpirationPolicy-ref="serviceTicketExpirationPolicy"
+          p:authenticationManager-ref="authenticationManager"
+          p:ticketGrantingTicketUniqueTicketIdGenerator-ref="ticketGrantingTicketUniqueIdGenerator"
+          p:ticketRegistry-ref="ticketRegistry"
+          p:servicesManager-ref="servicesManager"
+          p:persistentIdGenerator-ref="persistentIdGenerator"
+          p:uniqueTicketIdGeneratorsForService-ref="uniqueIdGeneratorsMap"/>
+
+    <bean id="proxy10Handler" class="org.jasig.cas.ticket.proxy.support.Cas10ProxyHandler"/>
+
+    <bean id="proxy20Handler" class="org.jasig.cas.ticket.proxy.support.Cas20ProxyHandler"
+          p:httpClient-ref="httpClient"
+          p:uniqueTicketIdGenerator-ref="proxy20TicketUniqueIdGenerator"/>
+
+    <!-- ADVISORS -->
+    <bean id="advisorAutoProxyCreator"
+          class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"/>
+
+    <bean id="validationAnnotationBeanPostProcessor" class="org.jasig.cas.util.CustomBeanValidationPostProcessor" />
+
+    <!-- The scheduler bean wires up any triggers that define scheduled tasks -->
+    <bean id="scheduler" class="org.jasig.cas.util.AutowiringSchedulerFactoryBean"/>
+
+    <!-- Customizations -->
+
+
+    <!-- Make requests synchronous. This ensures that Single Logout has completed before the Logout page renders. -->
+    <bean id="httpClient" class="org.jasig.cas.util.HttpClient"
+      p:readTimeout="5000"
+      p:connectionTimeout="5000">
+      <property name="executorService">
+        <bean class="org.springframework.core.task.support.ExecutorServiceAdapter">
+            <constructor-arg>
+                <bean class="org.springframework.core.task.SyncTaskExecutor"/>
+            </constructor-arg>
+        </bean>
+      </property>
+    </bean>
+</beans>
@@ -1,22 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xmlns:p="http://www.springframework.org/schema/p" xmlns:aop="http://www.springframework.org/schema/aop"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.0.xsd">
-    <description>
-        Customizations to the CAS Server. The name starts with zzz to ensure it is the last file loaded to override other bean definitions.
-    </description>
-
-    <!-- Make requests synchronous. This ensures that Single Logout has completed before the Logout page renders. -->
-    <bean id="httpClient" class="org.jasig.cas.util.HttpClient"
-      p:readTimeout="5000"
-      p:connectionTimeout="5000">
-      <property name="executorService">
-        <bean class="org.springframework.core.task.support.ExecutorServiceAdapter">
-            <constructor-arg>
-                <bean class="org.springframework.core.task.SyncTaskExecutor"/>
-            </constructor-arg>
-        </bean>
-      </property>
-    </bean>
-</beans>
@@ -15,7 +15,7 @@ dependencies {
            "org.slf4j:log4j-over-slf4j:$slf4jVersion",
            "org.slf4j:jul-to-slf4j:$slf4jVersion",
            "org.slf4j:jcl-over-slf4j:$slf4jVersion",
-            "javax.servlet:jstl:1.2",
+            "javax.servlet.jsp.jstl:javax.servlet.jsp.jstl-api:$jstlVersion",
            "javax.validation:validation-api:1.0.0.GA",
            "org.hibernate:hibernate-validator:4.2.0.Final"

@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-samples-concurrency-jc</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <packaging>war</packaging>
  <name>spring-security-samples-concurrency-jc</name>
  <description>spring-security-samples-concurrency-jc</description>
@@ -50,17 +50,11 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
-      <groupId>javax.servlet</groupId>
-      <artifactId>jstl</artifactId>
-      <version>1.2</version>
+      <groupId>javax.servlet.jsp.jstl</groupId>
+      <artifactId>javax.servlet.jsp.jstl-api</artifactId>
+      <version>1.2.1</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -102,25 +96,25 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-samples-messages-jc</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -193,7 +187,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -3,7 +3,7 @@
 apply from: WAR_SAMPLE_GRADLE

 dependencies {
-    providedCompile "org.apache.tomcat:tomcat-servlet-api:$servletApiVersion"
+    providedCompile "javax.servlet:javax.servlet-api:$servletApiVersion"

    compile project(':spring-security-core'),
            project(':spring-security-acl'),
@@ -19,10 +19,10 @@ dependencies {
            project(':spring-security-config'),
            project(':spring-security-taglibs'),
            "org.springframework:spring-context-support:$springVersion",
-            "javax.servlet:jstl:$jstlVersion",
+            "javax.servlet.jsp.jstl:javax.servlet.jsp.jstl-api:$jstlVersion",
            "org.hsqldb:hsqldb:$hsqlVersion",
            "org.slf4j:jcl-over-slf4j:$slf4jVersion",
            "ch.qos.logback:logback-classic:$logbackVersion",
-            "net.sf.ehcache:ehcache:$ehcacheVersion"
+            "net.sf.ehcache:ehcache-core:$ehcacheVersion"

 }
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-samples-contacts-xml</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <packaging>war</packaging>
  <name>spring-security-samples-contacts-xml</name>
  <description>spring-security-samples-contacts-xml</description>
@@ -50,23 +50,17 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-acl</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -131,9 +125,9 @@
      <optional>true</optional>
    </dependency>
    <dependency>
-      <groupId>org.apache.tomcat</groupId>
-      <artifactId>tomcat-servlet-api</artifactId>
-      <version>7.0.33</version>
+      <groupId>javax.servlet</groupId>
+      <artifactId>javax.servlet-api</artifactId>
+      <version>3.0.1</version>
      <scope>provided</scope>
    </dependency>
    <dependency>
@@ -143,15 +137,15 @@
      <scope>runtime</scope>
    </dependency>
    <dependency>
-      <groupId>javax.servlet</groupId>
-      <artifactId>jstl</artifactId>
-      <version>1.2</version>
+      <groupId>javax.servlet.jsp.jstl</groupId>
+      <artifactId>javax.servlet.jsp.jstl-api</artifactId>
+      <version>1.2.1</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
      <groupId>net.sf.ehcache</groupId>
-      <artifactId>ehcache</artifactId>
-      <version>1.6.2</version>
+      <artifactId>ehcache-core</artifactId>
+      <version>1.7.2</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
@@ -169,19 +163,19 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-taglibs</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
@@ -193,7 +187,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -12,5 +12,5 @@ dependencies {
            "org.hsqldb:hsqldb:$hsqlVersion",
            "org.springframework:spring-context-support:$springVersion"

-    optional "net.sf.ehcache:ehcache:$ehcacheVersion"
+    optional "net.sf.ehcache:ehcache-core:$ehcacheVersion"
 }
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-samples-dms-xml</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <name>spring-security-samples-dms-xml</name>
  <description>spring-security-samples-dms-xml</description>
  <url>http://spring.io/spring-security</url>
@@ -42,23 +42,17 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-acl</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -100,8 +94,8 @@
    </dependency>
    <dependency>
      <groupId>net.sf.ehcache</groupId>
-      <artifactId>ehcache</artifactId>
-      <version>1.6.2</version>
+      <artifactId>ehcache-core</artifactId>
+      <version>1.7.2</version>
      <scope>compile</scope>
      <optional>true</optional>
    </dependency>
@@ -114,7 +108,7 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
@@ -132,7 +126,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -15,7 +15,7 @@ dependencies {
            "org.slf4j:log4j-over-slf4j:$slf4jVersion",
            "org.slf4j:jul-to-slf4j:$slf4jVersion",
            "org.slf4j:jcl-over-slf4j:$slf4jVersion",
-            "javax.servlet:jstl:1.2",
+            "javax.servlet.jsp.jstl:javax.servlet.jsp.jstl-api:$jstlVersion",
            "javax.validation:validation-api:1.0.0.GA",
            "org.hibernate:hibernate-validator:4.2.0.Final"

@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-samples-form-jc</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <packaging>war</packaging>
  <name>spring-security-samples-form-jc</name>
  <description>spring-security-samples-form-jc</description>
@@ -50,17 +50,11 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
-      <groupId>javax.servlet</groupId>
-      <artifactId>jstl</artifactId>
-      <version>1.2</version>
+      <groupId>javax.servlet.jsp.jstl</groupId>
+      <artifactId>javax.servlet.jsp.jstl-api</artifactId>
+      <version>1.2.1</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -102,25 +96,25 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-samples-messages-jc</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -193,7 +187,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -21,7 +21,7 @@ repositories {
 configurations.runtime.exclude(group: 'ch.qos.logback')

 dependencies {
-    providedCompile "org.apache.tomcat:tomcat-servlet-api:$servletApiVersion"
+    providedCompile "javax.servlet:javax.servlet-api:$servletApiVersion"

    compile project(':spring-security-core'),
            project(':spring-security-web'),
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-samples-gae-xml</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <packaging>war</packaging>
  <name>spring-security-samples-gae-xml</name>
  <description>spring-security-samples-gae-xml</description>
@@ -50,12 +50,6 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
      <groupId>com.google.appengine</groupId>
@@ -84,13 +78,13 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -143,9 +137,9 @@
      <optional>true</optional>
    </dependency>
    <dependency>
-      <groupId>org.apache.tomcat</groupId>
-      <artifactId>tomcat-servlet-api</artifactId>
-      <version>7.0.33</version>
+      <groupId>javax.servlet</groupId>
+      <artifactId>javax.servlet-api</artifactId>
+      <version>3.0.1</version>
      <scope>provided</scope>
    </dependency>
    <dependency>
@@ -163,13 +157,13 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-taglibs</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
@@ -199,7 +193,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -15,7 +15,7 @@ dependencies {
            "org.slf4j:log4j-over-slf4j:$slf4jVersion",
            "org.slf4j:jul-to-slf4j:$slf4jVersion",
            "org.slf4j:jcl-over-slf4j:$slf4jVersion",
-            "javax.servlet:jstl:1.2",
+            "javax.servlet.jsp.jstl:javax.servlet.jsp.jstl-api:$jstlVersion",
            "javax.validation:validation-api:1.0.0.GA",
            "org.hibernate:hibernate-validator:4.2.0.Final",
            "com.fasterxml.jackson.core:jackson-databind:2.2.1"
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-samples-hellojs-jc</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <packaging>war</packaging>
  <name>spring-security-samples-hellojs-jc</name>
  <description>spring-security-samples-hellojs-jc</description>
@@ -50,12 +50,6 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
      <groupId>com.fasterxml.jackson.core</groupId>
@@ -64,9 +58,9 @@
      <scope>compile</scope>
    </dependency>
    <dependency>
-      <groupId>javax.servlet</groupId>
-      <artifactId>jstl</artifactId>
-      <version>1.2</version>
+      <groupId>javax.servlet.jsp.jstl</groupId>
+      <artifactId>javax.servlet.jsp.jstl-api</artifactId>
+      <version>1.2.1</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -108,25 +102,25 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-samples-messages-jc</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -199,7 +193,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -0,0 +1,41 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.samples.mvc.config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.core.Ordered;
+import org.thymeleaf.spring3.SpringTemplateEngine;
+import org.thymeleaf.spring3.view.ThymeleafViewResolver;
+
+/**
+ * Disable tiles so that we can provide our custom view without being decorated.
+ *
+ * @author Rob Winch
+ *
+ */
+@Configuration
+public class CustomMvcConfig {
+
+    @Bean
+    public ThymeleafViewResolver thymeleafViewResolver(SpringTemplateEngine templateEngine) {
+        ThymeleafViewResolver viewResolver = new ThymeleafViewResolver();
+        viewResolver.setOrder(Ordered.HIGHEST_PRECEDENCE - 10);
+        viewResolver.setTemplateEngine(templateEngine);
+        return viewResolver;
+    }
+
+}
@@ -0,0 +1,158 @@
+<html xmlns:th="http://www.thymeleaf.org">
+  <head>
+    <title>SecureMail</title>
+    <link rel="icon" type="image/x-icon" th:href="@{/resources/img/favicon.ico}"/>
+    <link th:href="@{/resources/css/bootstrap.css}" rel="stylesheet"></link>
+    <style type="text/css">
+      /* Sticky footer styles
+      -------------------------------------------------- */
+
+      html,
+      body {
+        height: 100%;
+        /* The html and body elements cannot have any padding or margin. */
+      }
+
+      /* Wrapper for page content to push down footer */
+      #wrap {
+        min-height: 100%;
+        height: auto !important;
+        height: 100%;
+        /* Negative indent footer by it's height */
+        margin: 0 auto -60px;
+      }
+
+      /* Set the fixed height of the footer here */
+      #push,
+      #footer {
+        height: 60px;
+      }
+      #footer {
+        background-color: #f5f5f5;
+      }
+
+      /* Lastly, apply responsive CSS fixes as necessary */
+      @media (max-width: 767px) {
+        #footer {
+          margin-left: -20px;
+          margin-right: -20px;
+          padding-left: 20px;
+          padding-right: 20px;
+        }
+      }
+
+
+
+      /* Custom page CSS
+      -------------------------------------------------- */
+      /* Not required for template or sticky footer method. */
+
+      .container {
+        width: auto;
+        max-width: 680px;
+      }
+      .container .credit {
+        margin: 20px 0;
+        text-align: center;
+      }
+      a {
+          color: green;
+      }
+      .navbar-form {
+        margin-left: 1em;
+      }
+    </style>
+    <link th:href="@{/resources/css/bootstrap-responsive.css}" rel="stylesheet"></link>
+
+    <!-- HTML5 shim, for IE6-8 support of HTML5 elements -->
+    <!--[if lt IE 9]>
+      <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
+    <![endif]-->
+    <meta name="_csrf" th:content="${_csrf.token}"/>
+    <meta name="_csrf_header" th:content="${_csrf.headerName}"/>
+  </head>
+
+
+  <body>
+    <div id="wrap">
+      <div class="navbar navbar-inverse navbar-static-top">
+        <div class="navbar-inner">
+          <div class="container">
+            <a class="brand" th:href="@{/}"><img th:src="@{/resources/img/logo.png}" alt="Spring Security Sample"/></a>
+            <div class="nav-collapse collapse">
+              <div th:if="${#httpServletRequest.remoteUser != null}">
+                  <form class="navbar-form pull-right" th:action="@{/logout}" method="post">
+                      <input type="submit" value="Log out" />
+                  </form>
+                  <p class="navbar-text pull-right" th:text="${#httpServletRequest.remoteUser}">
+                    sample_user
+                  </p>
+              </div>
+              <ul class="nav">
+                <li><a data-bind="click: $root.goToInbox" th:href="@{/}">Inbox</a></li>
+                <li><a data-bind="click: $root.goToCompose" th:href="@{/(form)}">Compose</a></li>
+              </ul>
+            </div>
+          </div>
+      </div>
+    </div>
+      <!-- Begin page content -->
+      <div class="container">
+        <div data-bind="with: inbox">
+            <h1>Inbox</h1>
+            <table class="table">
+                <thead>
+                    <tr>
+                        <th>Created</th>
+                        <th>Summary</th>
+                    </tr>
+                </thead>
+                <tbody data-bind="foreach: $root.messages">
+                    <tr data-bind="click: $root.goToMessage">
+                        <td data-bind="text: created"></td>
+                        <td><a data-bind="text: summary, attr: { href: id}"></a></td>
+                    </tr>
+                </tbody>
+            </table>
+        </div>
+
+        <div class="container" data-bind="with: chosenMessageData">
+              <h1>Message : <span data-bind="text: summary"></span></h1>
+              <dl>
+                  <dt>Created</dt>
+                  <dd data-bind="text: created"></dd>
+                  <dt>Message</dt>
+                  <dd data-bind="html: text"></dd>
+              </dl>
+          </div>
+
+          <div class="container" data-bind="with: compose">
+                <h1>Messages : Create</h1>
+                <div class="alert alert-error" data-bind="foreach: $root.errors, visible: $root.errors().length">
+                    <p data-bind="text: $data"></p>
+                </div>
+                <form action="./" method="post">
+                    <label for="summary">Summary</label>
+                    <input type="text" id="summary" data-bind="value: summary" name="summary" class="input-xxlarge" />
+                    <label for="text">Message</label>
+                    <textarea name="text" id="text" data-bind="value: text" class="input-xxlarge"><!--  --></textarea>
+                    <div class="form-actions">
+                        <input type="button" data-bind="click: $root.save" value="Create" />
+                    </div>
+                </form>
+            </div>
+      </div>
+
+      <div id="push"><!--  --></div>
+    </div>
+    <div id="footer">
+      <div class="container">
+        <p class="muted credit">Visit the <a href="#">Spring Security</a> site for more <a href="#">samples</a>.</p>
+      </div>
+    </div>
+
+    <script type="text/javascript" th:src="@{/resources/js/jquery-1.8.3.js}"><!-- --></script>
+    <script type="text/javascript" th:src="@{/resources/js/knockout-2.3.0.js}"><!-- --></script>
+    <script type="text/javascript" th:src="@{/resources/js/message.js}"><!-- --></script>
+  </body>
+</html>
@@ -15,7 +15,7 @@ dependencies {
            "org.slf4j:log4j-over-slf4j:$slf4jVersion",
            "org.slf4j:jul-to-slf4j:$slf4jVersion",
            "org.slf4j:jcl-over-slf4j:$slf4jVersion",
-            "javax.servlet:jstl:1.2",
+            "javax.servlet.jsp.jstl:javax.servlet.jsp.jstl-api:$jstlVersion",
            "javax.validation:validation-api:1.0.0.GA",
            "org.hibernate:hibernate-validator:4.2.0.Final"

@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-samples-hellomvc-jc</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <packaging>war</packaging>
  <name>spring-security-samples-hellomvc-jc</name>
  <description>spring-security-samples-hellomvc-jc</description>
@@ -50,17 +50,11 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
-      <groupId>javax.servlet</groupId>
-      <artifactId>jstl</artifactId>
-      <version>1.2</version>
+      <groupId>javax.servlet.jsp.jstl</groupId>
+      <artifactId>javax.servlet.jsp.jstl-api</artifactId>
+      <version>1.2.1</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -102,25 +96,25 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-samples-messages-jc</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -193,7 +187,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -7,7 +7,7 @@ dependencies {

    compile project(":spring-security-config"),
            project(":spring-security-web"),
-            "javax.servlet:jstl:1.2",
+            "javax.servlet.jsp.jstl:javax.servlet.jsp.jstl-api:$jstlVersion",
            "org.slf4j:jcl-over-slf4j:$slf4jVersion"

    runtime "ch.qos.logback:logback-classic:$logbackVersion"
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-samples-helloworld-jc</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <packaging>war</packaging>
  <name>spring-security-samples-helloworld-jc</name>
  <description>spring-security-samples-helloworld-jc</description>
@@ -50,17 +50,11 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
-      <groupId>javax.servlet</groupId>
-      <artifactId>jstl</artifactId>
-      <version>1.2</version>
+      <groupId>javax.servlet.jsp.jstl</groupId>
+      <artifactId>javax.servlet.jsp.jstl-api</artifactId>
+      <version>1.2.1</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -72,13 +66,13 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -121,7 +115,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -15,7 +15,7 @@ dependencies {
            "org.slf4j:log4j-over-slf4j:$slf4jVersion",
            "org.slf4j:jul-to-slf4j:$slf4jVersion",
            "org.slf4j:jcl-over-slf4j:$slf4jVersion",
-            "javax.servlet:jstl:1.2",
+            "javax.servlet.jsp.jstl:javax.servlet.jsp.jstl-api:$jstlVersion",
            "javax.validation:validation-api:1.0.0.GA",
            "org.hibernate:hibernate-validator:4.2.0.Final"

@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-samples-inmemory-jc</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <packaging>war</packaging>
  <name>spring-security-samples-inmemory-jc</name>
  <description>spring-security-samples-inmemory-jc</description>
@@ -50,17 +50,11 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
-      <groupId>javax.servlet</groupId>
-      <artifactId>jstl</artifactId>
-      <version>1.2</version>
+      <groupId>javax.servlet.jsp.jstl</groupId>
+      <artifactId>javax.servlet.jsp.jstl-api</artifactId>
+      <version>1.2.1</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -102,25 +96,25 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-samples-messages-jc</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -193,7 +187,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -5,7 +5,7 @@ dependencies {
    providedCompile "javax.servlet:javax.servlet-api:3.0.1",
                    'javax.servlet.jsp:jsp-api:2.1'

-    compile "javax.servlet:jstl:1.2",
+    compile "javax.servlet.jsp.jstl:javax.servlet.jsp.jstl-api:$jstlVersion",
            "org.slf4j:jcl-over-slf4j:$slf4jVersion"

    runtime "ch.qos.logback:logback-classic:$logbackVersion"
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-samples-insecure</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <packaging>war</packaging>
  <name>spring-security-samples-insecure</name>
  <description>spring-security-samples-insecure</description>
@@ -50,17 +50,11 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
-      <groupId>javax.servlet</groupId>
-      <artifactId>jstl</artifactId>
-      <version>1.2</version>
+      <groupId>javax.servlet.jsp.jstl</groupId>
+      <artifactId>javax.servlet.jsp.jstl-api</artifactId>
+      <version>1.2.1</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -109,7 +103,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -12,7 +12,7 @@ dependencies {
            "org.slf4j:log4j-over-slf4j:$slf4jVersion",
            "org.slf4j:jul-to-slf4j:$slf4jVersion",
            "org.slf4j:jcl-over-slf4j:$slf4jVersion",
-            "javax.servlet:jstl:1.2",
+            "javax.servlet.jsp.jstl:javax.servlet.jsp.jstl-api:$jstlVersion",
            "javax.validation:validation-api:1.0.0.GA",
            "org.hibernate:hibernate-validator:4.2.0.Final"

@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-samples-insecuremvc</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <packaging>war</packaging>
  <name>spring-security-samples-insecuremvc</name>
  <description>spring-security-samples-insecuremvc</description>
@@ -50,17 +50,11 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
-      <groupId>javax.servlet</groupId>
-      <artifactId>jstl</artifactId>
-      <version>1.2</version>
+      <groupId>javax.servlet.jsp.jstl</groupId>
+      <artifactId>javax.servlet.jsp.jstl-api</artifactId>
+      <version>1.2.1</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -102,7 +96,7 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-samples-messages-jc</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -175,7 +169,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -12,7 +12,7 @@ configurations {
 }

 dependencies {
-    providedCompile "org.apache.tomcat:tomcat-servlet-api:$servletApiVersion"
+    providedCompile "javax.servlet:javax.servlet-api:$servletApiVersion"

    compile project(':spring-security-core'),
            "org.springframework:spring-beans:$springVersion",
@@ -23,7 +23,7 @@ dependencies {
            project(':spring-security-config'),
            project(':spring-security-taglibs'),
            "org.springframework:spring-context-support:$springVersion",
-            "javax.servlet:jstl:$jstlVersion",
+            "javax.servlet.jsp.jstl:javax.servlet.jsp.jstl-api:$jstlVersion",
            "org.slf4j:jcl-over-slf4j:$slf4jVersion",
            "ch.qos.logback:logback-classic:$logbackVersion"
 }
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-samples-jaas-xml</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <packaging>war</packaging>
  <name>spring-security-samples-jaas-xml</name>
  <description>spring-security-samples-jaas-xml</description>
@@ -50,17 +50,11 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -101,9 +95,9 @@
      <optional>true</optional>
    </dependency>
    <dependency>
-      <groupId>org.apache.tomcat</groupId>
-      <artifactId>tomcat-servlet-api</artifactId>
-      <version>7.0.33</version>
+      <groupId>javax.servlet</groupId>
+      <artifactId>javax.servlet-api</artifactId>
+      <version>3.0.1</version>
      <scope>provided</scope>
    </dependency>
    <dependency>
@@ -113,9 +107,9 @@
      <scope>runtime</scope>
    </dependency>
    <dependency>
-      <groupId>javax.servlet</groupId>
-      <artifactId>jstl</artifactId>
-      <version>1.2</version>
+      <groupId>javax.servlet.jsp.jstl</groupId>
+      <artifactId>javax.servlet.jsp.jstl-api</artifactId>
+      <version>1.2.1</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
@@ -127,19 +121,19 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-taglibs</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
@@ -151,7 +145,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -15,7 +15,7 @@ dependencies {
            "org.slf4j:log4j-over-slf4j:$slf4jVersion",
            "org.slf4j:jul-to-slf4j:$slf4jVersion",
            "org.slf4j:jcl-over-slf4j:$slf4jVersion",
-            "javax.servlet:jstl:1.2",
+            "javax.servlet.jsp.jstl:javax.servlet.jsp.jstl-api:$jstlVersion",
            "javax.validation:validation-api:1.0.0.GA",
            "org.hibernate:hibernate-validator:4.2.0.Final"

@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-samples-jdbc-jc</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <packaging>war</packaging>
  <name>spring-security-samples-jdbc-jc</name>
  <description>spring-security-samples-jdbc-jc</description>
@@ -50,17 +50,11 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
-      <groupId>javax.servlet</groupId>
-      <artifactId>jstl</artifactId>
-      <version>1.2</version>
+      <groupId>javax.servlet.jsp.jstl</groupId>
+      <artifactId>javax.servlet.jsp.jstl-api</artifactId>
+      <version>1.2.1</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -102,25 +96,25 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-samples-messages-jc</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -193,7 +187,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -6,7 +6,7 @@ dependencies {
                    'javax.servlet.jsp:jsp-api:2.1'

    compile project(":spring-security-ldap"),
-            apacheds_libs,
+            apachedsDependencies,
            project(":spring-security-config"),
            project(":spring-security-samples-messages-jc"),
            project(":spring-security-core"),
@@ -17,7 +17,7 @@ dependencies {
            "org.slf4j:log4j-over-slf4j:$slf4jVersion",
            "org.slf4j:jul-to-slf4j:$slf4jVersion",
            "org.slf4j:jcl-over-slf4j:$slf4jVersion",
-            "javax.servlet:jstl:1.2",
+            "javax.servlet.jsp.jstl:javax.servlet.jsp.jstl-api:$jstlVersion",
            "javax.validation:validation-api:1.0.0.GA",
            "org.hibernate:hibernate-validator:4.2.0.Final"

@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-samples-ldap-jc</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <packaging>war</packaging>
  <name>spring-security-samples-ldap-jc</name>
  <description>spring-security-samples-ldap-jc</description>
@@ -50,17 +50,11 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
-      <groupId>javax.servlet</groupId>
-      <artifactId>jstl</artifactId>
-      <version>1.2</version>
+      <groupId>javax.servlet.jsp.jstl</groupId>
+      <artifactId>javax.servlet.jsp.jstl-api</artifactId>
+      <version>1.2.1</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -138,31 +132,31 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-ldap</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-samples-messages-jc</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -235,7 +229,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -17,5 +17,6 @@ dependencies {
            project(':spring-security-config'),
            project(':spring-security-ldap'),
            "org.slf4j:jcl-over-slf4j:$slf4jVersion",
-            "ch.qos.logback:logback-classic:$logbackVersion"
+            "ch.qos.logback:logback-classic:$logbackVersion",
+            apachedsDependencies
 }
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-samples-ldap-xml</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <packaging>war</packaging>
  <name>spring-security-samples-ldap-xml</name>
  <description>spring-security-samples-ldap-xml</description>
@@ -50,12 +50,6 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
      <groupId>org.springframework</groupId>
@@ -82,6 +76,42 @@
      <version>0.9.29</version>
      <scope>runtime</scope>
    </dependency>
+    <dependency>
+      <groupId>org.apache.directory.server</groupId>
+      <artifactId>apacheds-core</artifactId>
+      <version>1.5.5</version>
+      <scope>runtime</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.directory.server</groupId>
+      <artifactId>apacheds-core-entry</artifactId>
+      <version>1.5.5</version>
+      <scope>runtime</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.directory.server</groupId>
+      <artifactId>apacheds-protocol-ldap</artifactId>
+      <version>1.5.5</version>
+      <scope>runtime</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.directory.server</groupId>
+      <artifactId>apacheds-protocol-shared</artifactId>
+      <version>1.5.5</version>
+      <scope>runtime</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.directory.server</groupId>
+      <artifactId>apacheds-server-jndi</artifactId>
+      <version>1.5.5</version>
+      <scope>runtime</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.directory.shared</groupId>
+      <artifactId>shared-ldap</artifactId>
+      <version>0.9.15</version>
+      <scope>runtime</scope>
+    </dependency>
    <dependency>
      <groupId>org.slf4j</groupId>
      <artifactId>jcl-over-slf4j</artifactId>
@@ -91,25 +121,25 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-ldap</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -7,7 +7,6 @@ dependencies {
    compile project(":spring-security-web"),
            project(":spring-security-config"),
            "org.hibernate.javax.persistence:hibernate-jpa-2.0-api:1.0.0.Final",
-            "org.hibernate:hibernate-entitymanager:3.6.10.Final",
            "org.hsqldb:hsqldb:2.2.8",
            "javax.validation:validation-api:1.0.0.GA",
            "org.hibernate:hibernate-validator:4.2.0.Final",
@@ -20,7 +19,12 @@ dependencies {
            "org.springframework:spring-instrument:$springVersion",
            "org.springframework:spring-core:$springVersion",
            "org.springframework:spring-aspects:$springVersion",
-            "org.springframework.data:spring-data-jpa:1.3.4.RELEASE",
            "org.thymeleaf:thymeleaf-spring3:$thymeleafVersion",
            "org.thymeleaf.extras:thymeleaf-extras-tiles2:2.1.0.RELEASE"
+      compile('org.hibernate:hibernate-entitymanager:3.6.10.Final') {
+            exclude group:'javassist', module: 'javassist'
+      }
+      compile('org.springframework.data:spring-data-jpa:1.3.4.RELEASE') {
+            exclude group:'org.aspectj', module:'aspectjrt'
+      }
 }
@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-samples-messages-jc</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <name>spring-security-samples-messages-jc</name>
  <description>spring-security-samples-messages-jc</description>
  <url>http://spring.io/spring-security</url>
@@ -42,12 +42,6 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
      <groupId>javax.validation</groupId>
@@ -66,6 +60,12 @@
      <artifactId>hibernate-entitymanager</artifactId>
      <version>3.6.10.Final</version>
      <scope>compile</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>javassist</artifactId>
+          <groupId>javassist</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.hibernate</groupId>
@@ -84,17 +84,23 @@
      <artifactId>spring-data-jpa</artifactId>
      <version>1.3.4.RELEASE</version>
      <scope>compile</scope>
+      <exclusions>
+        <exclusion>
+          <artifactId>aspectjrt</artifactId>
+          <groupId>org.aspectj</groupId>
+        </exclusion>
+      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -197,7 +203,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
@@ -16,7 +16,7 @@ dependencies {
            "org.slf4j:log4j-over-slf4j:$slf4jVersion",
            "org.slf4j:jul-to-slf4j:$slf4jVersion",
            "org.slf4j:jcl-over-slf4j:$slf4jVersion",
-            "javax.servlet:jstl:1.2",
+            "javax.servlet.jsp.jstl:javax.servlet.jsp.jstl-api:$jstlVersion",
            "javax.validation:validation-api:1.0.0.GA",
            "org.hibernate:hibernate-validator:4.2.0.Final"

@@ -4,7 +4,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-samples-openid-jc</artifactId>
-  <version>3.2.1.CI-SNAPSHOT</version>
+  <version>3.2.4.RELEASE</version>
  <packaging>war</packaging>
  <name>spring-security-samples-openid-jc</name>
  <description>spring-security-samples-openid-jc</description>
@@ -50,17 +50,11 @@
      </plugin>
    </plugins>
  </build>
-  <repositories>
-    <repository>
-      <id>spring-snasphot</id>
-      <url>https://repo.spring.io/snapshot</url>
-    </repository>
-  </repositories>
  <dependencies>
    <dependency>
-      <groupId>javax.servlet</groupId>
-      <artifactId>jstl</artifactId>
-      <version>1.2</version>
+      <groupId>javax.servlet.jsp.jstl</groupId>
+      <artifactId>javax.servlet.jsp.jstl-api</artifactId>
+      <version>1.2.1</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -102,31 +96,31 @@
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-openid</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-samples-messages-jc</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
-      <version>3.2.1.CI-SNAPSHOT</version>
+      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
@@ -205,7 +199,7 @@
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
-      <version>4.10</version>
+      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Spring Buildmaster	59bb10ef81	Release version 3.2.4.RELEASE	2014-05-21 14:27:27 -07:00
Rob Winch	08ec5797db	SEC-2607: CAS Server logouts out synchronously	2014-05-21 15:43:05 -05:00
Rob Winch	b20438562d	SEC-2579: Ignore springio props in release checks	2014-05-21 14:04:18 -05:00
Rob Winch	d4e26864d9	SEC-2606: ApacheDSServerIntegrationTests scan for available port	2014-05-21 06:49:00 -05:00
Rob Winch	519d85877c	SEC-2603: Fix config groovy integration tests	2014-05-20 23:14:11 -05:00
Rob Winch	f31a5c5411	SEC-2472: Support LDAP crypto PasswordEncoder	2014-05-20 23:13:07 -05:00
Rob Winch	77b9209640	SEC-2579: Remove duplicate snapshot repo and dependencies closure	2014-05-19 15:58:04 -05:00
Rob Winch	ae39a4dcdd	SEC-2579: Polish so that platformVersion has a default	2014-05-19 15:33:30 -05:00
Andy Wilkinson	f37e414442	SEC-2579: Update Spring IO plugin configuration - Upgrade to 0.0.3.RELEASE of the plugin - Declare a dependency in the springIoVersions configuration on the Platform’s platform-versions artifact. An external property is used to provide the version of this artifact. This means that the build script does not need to refer to a snapshot artifact (the only version available at the time of writing) and also breaks a circular dependency between Spring Security (a project that’s part of the Platform) and the Platform itself. - The plugin applied and the libs-snapshot repository is added only if the external property is specified. This removes the possibility of a release or milestone being shipped with a snapshot dependency (unless the release build is performed with -PplatformVersion=foo).	2014-05-19 15:25:57 -05:00
Andy Wilkinson	be687d6a84	SEC-2600: Remove unused import	2014-05-19 12:28:05 -05:00
Rob Winch	d6b81abcf2	SEC-2578: HttpSessionSecurityContextRepository traverses HttpServletResponseWrapper	2014-05-02 15:06:28 -05:00
Rob Winch	bf918df7a3	SEC-2543: Logout with CSRF enabled requires POST by default	2014-05-02 11:17:57 -05:00
Rob Winch	dc7a3b30ea	SEC-2581: Update to propdeps-plugin:0.0.6	2014-04-30 16:41:51 -05:00
Rob Winch	3be2f375f6	SEC-2580: Include ApacheDS in samples/ldap-xml	2014-04-30 16:39:23 -05:00
Rob Winch	9146345673	Fix warnings in itest-web.gradle	2014-04-30 08:52:39 -05:00
Rob Winch	fb2cf96fa4	SEC-2579: Fix acl tests to work w/ newer ehcache versions	2014-04-30 08:52:29 -05:00
Rob Winch	9a27f9f778	SEC-2579: Add springio-platform plugin	2014-04-29 16:59:32 -05:00
Alexander Grüneberg	e0b4945fad	SEC-2577: Add missing whitespace in reference	2014-04-28 16:25:38 -05:00
Rob Winch	d6f540fdee	SEC-2532: Add disclaimer about jdbcAuthentication() with persistent data stores	2014-04-28 14:45:51 -05:00
Rob Winch	3f24210a2a	SEC-2537: Add nekohtml to openid module	2014-04-25 13:51:00 -05:00
Rob Winch	13c5750f5d	SEC-2571: Improve wording of UsernamePasswordAuthenticationToken#setAuthenticated() error	2014-04-24 17:03:34 -05:00
Rob Winch	414289d466	SEC-2571: Failure in UserDetailsService->InternalAuthenticationServiceException	2014-04-24 16:35:58 -05:00
Rob Winch	5e88ebef2e	SEC-2549: Remove LazyBean marker interface	2014-04-24 13:55:25 -05:00
Mattias Severson	c074493f24	SEC-2573: RequestHeaderRequestMatcher constructor argument name has typo	2014-04-23 09:41:43 -05:00
Rob Winch	1337f99843	SEC-2560: Remove samples from .gitignore and add missing sample files	2014-04-16 21:16:34 -05:00
Rob Winch	cf721afc29	SEC-2558: Fix failing ApacheDSContainerTests when port is taken	2014-04-15 13:39:03 -05:00
Rob Winch	9133491da9	Revert "SEC-2547: Consistent CAS client version" This reverts commit `d9e87d8222`.	2014-04-15 10:16:51 -05:00
Rob Winch	3632564972	Revert "SEC-2547: Fix sample after updating CAS client version" This reverts commit `7ea0d3d42f`.	2014-04-15 10:16:49 -05:00
Rob Winch	7ea0d3d42f	SEC-2547: Fix sample after updating CAS client version	2014-04-15 07:49:34 -05:00
Hans-Joachim Kliemeck	d9e87d8222	SEC-2547: Consistent CAS client version	2014-04-14 22:45:18 -05:00
Grzegorz Rożniecki	3954e0b2c1	SEC-2556: Fix @Import example in manual	2014-04-14 22:38:41 -05:00
Rob Winch	79fa1c70eb	SEC-2542: Polish dependency exclusions This cleans up exclusions so the pom.xml are not as cluttered.	2014-04-02 08:49:25 -05:00
Rob Winch	fd6f9da184	SEC-2542: Use exclusions to remove duplicate dependencies A number of projects had duplicate dependencies on their classpaths as a result of the same classes being available in more than one artifact, each with different Maven coordinates. Typically this only affected the tests, but meant that the actual classes that were loaded was somewhat unpredictable and had the potential to vary between an IDE and the command line depending on the order in which the aritfacts appeared on the classpath. This commit adds a number of exclusions to remove such duplicates. In addition to the new exclusions, notable other changes are: - Spring Data JPA has been updated to 1.4.1. This brings its transitive dependency upon spring-data-commons into line with Spring LDAP's and prevents both spring-data-commons-core and spring-data-commons from being on the classpath - All Servlet API dependencies have been updated to use the official artifact with all transitive dependencies on unofficial servlet API artifacts being excluded. - In places, groovy has been replaced with groovy-all. This removes some duplicates caused by groovy's transitive dependencies. - JUnit has been updated to 4.11 which brings its transitive Hamcrest dependency into line with other components. There appears to be a bug in Gradle which means that some exclusions applied to an artifact do not work reliably. To work around this problem it has been necessary to apply some exclusions at the configuration level Conflicts: samples/messages-jc/pom.xml	2014-04-02 08:48:55 -05:00
Rob Winch	ea0466d666	Next developmenet version in pom.xml	2014-04-02 08:44:06 -05:00
Spring Buildmaster	2cc0d94481	Next development version	2014-03-25 12:05:00 -07:00
Rob Winch	32c767a30d	SEC-2533: Global AuthenticationManagerBuilder disables clearing child credentials	2014-03-25 13:00:42 -05:00
Rob Winch	a11746a8d1	SEC-2498: RequestCache allows POST when CSRF is disabled	2014-03-25 10:44:34 -05:00
Rob Winch	a18265a163	SEC-2531: AuthenticationConfiguration#lazyBean should use BeanClassLoader	2014-03-24 14:54:02 -05:00
Rob Winch	d7a2c0a98c	SEC-2177: Polish	2014-03-18 15:49:20 -05:00
Maciej Zasada	9057fbe0ed	SEC-2177: Striping off all leading schemes Striping off all leading schemes in the DefaultRedirectStrategy, so it will be less vulnerable to open redirect phishing attacks. More info can be found at SEC-2177 JIRA issue.	2014-03-18 15:49:20 -05:00
Julien Dubois	537d8f974f	SEC-2519: RememberMeAuthenticationException supports root cause Added a constructor which keeps the root cause of the exception, and added some documentation	2014-03-11 16:13:03 -05:00
Alexander Kjäll	783af4012b	SEC-2518: UserDetailsService javadoc repeats "insensitive" Typo in javadoc, "case insensitive" was repeated twice.	2014-03-11 15:38:28 -05:00
Spring Buildmaster	5f5b8052d8	Next development version	2014-03-10 15:24:45 -07:00