Next development version

Release 2.0.8.RELEASE
Update for javadoc execute with package
2026-08-05 09:47:05 +00:00 · 2012-10-08 22:24:06 -05:00 · 2012-10-08 21:18:15 -05:00 · 2012-10-08 21:09:58 -05:00 · 2012-10-08 15:52:40 -05:00 · 2012-10-08 07:41:26 -05:00
82 changed files with 2997 additions and 877 deletions
@@ -0,0 +1,15 @@
 target
 .gradle
 build/
 .idea
 out/
 *.ipr
 *.iml
 *.iws
 *.log
 intellij/
 .settings
 .classpath
 .project
 .DS_Store
 atlassian-ide-plugin.xml
@@ -3,13 +3,13 @@
    <parent>
        <artifactId>spring-security-parent</artifactId>
        <groupId>org.springframework.security</groupId>
-        <version>2.0.5-SNAPSHOT</version>
+        <version>2.0.9.CI-SNAPSHOT</version>
    </parent>
    <modelVersion>4.0.0</modelVersion>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-acl</artifactId>
    <name>Spring Security - ACL module</name>
-    <packaging>bundle</packaging>
+    <packaging>jar</packaging>
    <dependencies>
        <dependency>
@@ -51,29 +51,14 @@
            <scope>test</scope>
        </dependency>
    </dependencies>
-    
+<!--
-    <properties>
+    <build>
-        <spring.osgi.export>
+        <plugins>
-            org.springframework.security.*;version=${pom.version.osgi}
+            <plugin>
-        </spring.osgi.export>
+                <groupId>com.springsource.bundlor</groupId>
-            
+                <artifactId>com.springsource.bundlor.maven</artifactId>
-        <spring.osgi.import>
+            </plugin>
-            net.sf.ehcache.*;version="[1.4.1, 2.0.0)";resolution:=optional,
+        </plugins>
-            org.springframework.security.*;version="[${pom.version.osgi},${pom.version.osgi}]",
+    </build>       
-            org.springframework.context.*;version="${spring.version.osgi}",
+-->
            org.springframework.dao.*;version="${spring.version.osgi}";resolution:=optional,
            org.springframework.jdbc.*;version="${spring.version.osgi}";resolution:=optional,
            org.springframework.transaction.support.*;version="${spring.version.osgi}";resolution:=optional,
            org.springframework.util.*;version="${spring.version.osgi}",
            org.apache.commons.logging.*;version="[1.1.1, 2.0.0)",
            javax.sql.*
        </spring.osgi.import>
        <spring.osgi.private.pkg>
            !org.springframework.security.*
        </spring.osgi.private.pkg>
        <spring.osgi.symbolic.name>org.springframework.security.acls</spring.osgi.symbolic.name>        
    </properties>    
 </project>
@@ -0,0 +1,19 @@
 Bundle-SymbolicName: org.springframework.security.acls
 Bundle-Name: Spring Security Acls
 Bundle-Vendor: SpringSource
 Bundle-Version: ${version}
 Bundle-ManifestVersion: 2
 Ignored-Existing-Headers: 
 Import-Package,
 Export-Package
 Import-Template: 
 org.apache.commons.logging.*;version="[1.0.4, 2.0.0)",
 org.springframework.security.*;version="[${version}, ${version}]",
 org.springframework.context.*;version="[2.0.8, 3.1.0)";resolution:=optional, 
 org.springframework.dao.*;version="[2.0.8, 3.1.0)";resolution:=optional,
 org.springframework.jdbc.core.*;version="[2.0.8, 3.1.0)";resolution:=optional,
 org.springframework.transaction.support.*;version="[2.0.8, 3.1.0)";resolution:=optional,
 org.springframework.util.*;version="[2.0.8, 3.1.0)";resolution:=optional, 
 net.sf.ehcache.*;version="[1.4.1, 2.0.0)";resolution:=optional,
 javax.sql.*;version="0";resolution:=optional 
@@ -3,7 +3,7 @@
  <parent>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-adapters</artifactId>
-    <version>2.0.5-SNAPSHOT</version>
+    <version>2.0.5.CI-SNAPSHOT</version>
  </parent>
  <artifactId>spring-security-catalina</artifactId>
  <name>Spring Security - Catalina adapter</name>
@@ -3,7 +3,7 @@
  <parent>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-adapters</artifactId>
-    <version>2.0.5-SNAPSHOT</version>
+    <version>2.0.5.CI-SNAPSHOT</version>
  </parent>
  <artifactId>spring-security-jboss</artifactId>
  <name>Spring Security - JBoss adapter</name>
@@ -3,7 +3,7 @@
  <parent>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-adapters</artifactId>
-    <version>2.0.5-SNAPSHOT</version>
+    <version>2.0.5.CI-SNAPSHOT</version>
  </parent>
  <artifactId>spring-security-jetty</artifactId>
  <name>Spring Security - Jetty adapter</name>
@@ -3,7 +3,7 @@
  <parent>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-parent</artifactId>
-    <version>2.0.5-SNAPSHOT</version>
+    <version>2.0.5.CI-SNAPSHOT</version>
  </parent>
  <artifactId>spring-security-adapters</artifactId>
  <name>Spring Security - Adapters</name>
@@ -3,7 +3,7 @@
  <parent>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-adapters</artifactId>
-    <version>2.0.5-SNAPSHOT</version>
+    <version>2.0.5.CI-SNAPSHOT</version>
  </parent>
  <artifactId>spring-security-resin</artifactId>
  <name>Spring Security - Resin adapter</name>
@@ -3,11 +3,11 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-parent</artifactId>
-        <version>2.0.5-SNAPSHOT</version>
+        <version>2.0.9.CI-SNAPSHOT</version>
    </parent>
    <artifactId>spring-security-cas-client</artifactId>
    <name>Spring Security - CAS support</name>
-    <packaging>bundle</packaging>
+    <packaging>jar</packaging>
    <dependencies>
        <dependency>
@@ -38,7 +38,7 @@
        <dependency>
            <groupId>org.jasig.cas</groupId>
            <artifactId>cas-client-core</artifactId>
-            <version>3.1.3</version>
+            <version>3.1.5</version>
        </dependency>
        <dependency>
            <groupId>net.sf.ehcache</groupId>
@@ -47,28 +47,12 @@
        </dependency>
    </dependencies>
-    <properties>
+    <build>
-      	<spring.osgi.export>
+        <plugins>
-      	    org.springframework.security.*;version=${pom.version.osgi}
+            <plugin>
-      	</spring.osgi.export>
+                <groupId>com.springsource.bundlor</groupId>
-            
+                <artifactId>com.springsource.bundlor.maven</artifactId>
-    	<spring.osgi.import>
+            </plugin>
-    	    org.springframework.security.*;version="[${pom.version.osgi},${pom.version.osgi}]",
+        </plugins>
-            org.springframework.beans.*;version="${spring.version.osgi}",
+    </build>
            org.springframework.context.*;version="${spring.version.osgi}",
            org.springframework.dao.*;version="${spring.version.osgi}";resolution:=optional,
            org.springframework.util.*;version="${spring.version.osgi}",
            javax.servlet.*;version="[2.4.0, 3.0.0)";resolution:=optional,
            net.sf.ehcache.*;version="[1.4.1, 2.0.0)";resolution:=optional,
            org.apache.commons.logging.*;version="[1.1.1, 2.0.0)",
            org.jasig.cas.client.*;version="[3.1.3, 4.0.0)"
    	</spring.osgi.import>
    	<spring.osgi.private.pkg>
    	    !org.springframework.security.*
    	</spring.osgi.private.pkg>
    	<spring.osgi.symbolic.name>org.springframework.security.cas</spring.osgi.symbolic.name>        
    </properties>    
 </project>
@@ -0,0 +1,19 @@
 Bundle-SymbolicName: org.springframework.security.cas
 Bundle-Name: Spring Security CAS
 Bundle-Vendor: SpringSource
 Bundle-Version: ${version}
 Bundle-ManifestVersion: 2
 Ignored-Existing-Headers: 
 Import-Package,
 Export-Package
 Import-Template: 
 org.apache.commons.logging.*;version="[1.0.4, 2.0.0)",
 org.jasig.cas.client.*;version="[3.1.1,3.2)",
 org.springframework.security.*;version="[${version}, ${version}]",
 org.springframework.beans.factory;version="[2.0.8, 3.1.0)",
 org.springframework.context.*;version="[2.0.8, 3.1.0)",
 org.springframework.dao;version="[2.0.8, 3.1.0)",
 org.springframework.util;version="[2.0.8, 3.1.0)", 
 net.sf.ehcache.*;version="[1.4.1, 2.0.0)";resolution:=optional, 
 javax.servlet.*;version="0"
@@ -3,9 +3,9 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-parent</artifactId>
-        <version>2.0.5-SNAPSHOT</version>
+        <version>2.0.9.CI-SNAPSHOT</version>
    </parent>
-    <packaging>bundle</packaging>    
+    <packaging>jar</packaging>    
    <artifactId>spring-security-core-tiger</artifactId>
    <name>Spring Security - Java 5 (Tiger)</name>
@@ -59,39 +59,10 @@
                    <target>1.5</target>
                </configuration>
            </plugin>
        </plugins>
    </build>
    <reporting>
        <plugins>
            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
+                <groupId>com.springsource.bundlor</groupId>
-                <artifactId>maven-pmd-plugin</artifactId>
+                <artifactId>com.springsource.bundlor.maven</artifactId>
                <configuration>
                    <targetJdk>1.5</targetJdk>
                </configuration>
            </plugin>            
        </plugins>
-    </reporting>
+    </build>
    <properties>
      	<spring.osgi.export>
      	    org.springframework.security.*;version=${pom.version}
      	</spring.osgi.export>
    	<spring.osgi.import>
    	    javax.annotation.*;version="[1.0.0, 2.0.0)",
    	    org.springframework.security.*;version="[${pom.version.osgi},${pom.version.osgi}]",
    	    org.springframework.core.*;version="${spring.version.osgi}"
    	</spring.osgi.import>
    	<spring.osgi.private.pkg>
    	    !org.springframework.security.*
    	</spring.osgi.private.pkg>
    	<spring.osgi.include.res>
    	    src/main/resources
    	</spring.osgi.include.res>
    	<spring.osgi.symbolic.name>org.springframework.security.annotation</spring.osgi.symbolic.name>        
    </properties>    
 </project>
@@ -0,0 +1,12 @@
 Bundle-SymbolicName: org.springframework.security.annotation
 Bundle-Name: Spring Security Annotations
 Bundle-Vendor: SpringSource
 Bundle-Version: ${version}
 Bundle-ManifestVersion: 2
 Ignored-Existing-Headers: 
 Import-Package,
 Export-Package
 Import-Template: 
 javax.annotation.security.*;version="0";resolution:=optional,
 org.springframework.security.*;version="[${version},${version}]",
 org.springframework.core.*;version="[2.0.8, 3.1.0)"
@@ -0,0 +1,11 @@
 #! /bin/sh
 pushd src/main/resources/org/springframework/security/config/
 echo "Converting rnc file to xsd ..."
 java -jar ~/bin/trang.jar spring-security-2.0.6.rnc spring-security-2.0.6.xsd
 echo "Applying XSL transformation to xsd ..."
 xsltproc --output spring-security-2.0.6.xsd spring-security.xsl spring-security-2.0.6.xsd
 popd
@@ -3,9 +3,9 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-parent</artifactId>
-        <version>2.0.5-SNAPSHOT</version>
+        <version>2.0.9.CI-SNAPSHOT</version>
    </parent>
-    <packaging>bundle</packaging>
+    <packaging>jar</packaging>
    <artifactId>spring-security-core</artifactId>
    <name>Spring Security - Core</name>
@@ -135,6 +135,12 @@
            <version>1.0.1</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.mockito</groupId>
            <artifactId>mockito-all</artifactId>
            <version>1.8.5</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>log4j</groupId>
            <artifactId>log4j</artifactId>
@@ -142,57 +148,12 @@
        </dependency>
    </dependencies>
-    <properties>
+    <build>
-      	<spring.osgi.export>
+        <plugins>
-      	    org.springframework.security.*;version=${pom.version}
+            <plugin>
-      	</spring.osgi.export>
+                <groupId>com.springsource.bundlor</groupId>
-
+                <artifactId>com.springsource.bundlor.maven</artifactId>
-    	<spring.osgi.import>
+            </plugin>
-    	    !com.ibm.websphere.security,
+        </plugins>
-            javax.servlet.*;version="[2.4.0, 3.0.0)";resolution:=optional,
+    </build>
            net.sf.ehcache.*;version="[1.4.1, 2.0.0)";resolution:=optional,
            org.aopalliance.*;version="[1.0.0, 2.0.0)",
            org.apache.commons.codec.*;version="[1.3.0, 2.0.0)",
            org.apache.commons.collections.*;version="[3.2.0, 4.0.0)",
            org.apache.commons.lang.*;version="[2.1.0, 3.0.0)",
            org.apache.commons.logging.*;version="[1.1.1, 2.0.0)",
            org.apache.directory.server.configuration.*;version="[1.0.2, 2.0.0)";resolution:=optional,
            org.apache.directory.server.core.*;version="[1.0.2, 2.0.0)";resolution:=optional,
            org.apache.directory.server.protocol.*;version="[1.0.2, 2.0.0)";resolution:=optional,
            org.aspectj.*;version="[1.5.4, 2.0.0)";resolution:=optional,
            org.jaxen.*;version="[1.1.1, 2.0.0)";resolution:=optional,
            org.springframework.aop.*;version="${spring.version.osgi}",
            org.springframework.beans.*;version="${spring.version.osgi}",
            org.springframework.context.*;version="${spring.version.osgi}",
            org.springframework.core.*;version="${spring.version.osgi}",
            org.springframework.dao.*;version="${spring.version.osgi}";resolution:=optional,
            org.springframework.jdbc.*;version="${spring.version.osgi}";resolution:=optional,
            org.springframework.ldap.*;version="[1.2.1.A, 2.0.0)";resolution:=optional,
            org.springframework.metadata.*;version="${spring.version.osgi}",
            org.springframework.mock.*;version="${spring.version.osgi}";resolution:=optional,
            org.springframework.remoting.*;version="${spring.version.osgi}";resolution:=optional,
            org.springframework.util.*;version="${spring.version.osgi}",
            org.springframework.web.*;version="${spring.version.osgi}";resolution:=optional,
            javax.crypto.*,
            javax.naming.*,
            javax.rmi.*,
            javax.security.*,
            javax.sql.*,
            javax.xml.parsers.*,
            org.w3c.dom.*,
            org.xml.sax.*,            
        	*;resolution:=optional    	    
    	</spring.osgi.import>
    	<spring.osgi.private.pkg>
    	    !org.springframework.security.*
    	</spring.osgi.private.pkg>
 <!--    	
    	<spring.osgi.include.res>
    	    src/main/resources
    	</spring.osgi.include.res>
 -->
    	<spring.osgi.symbolic.name>org.springframework.security.core</spring.osgi.symbolic.name>        
    </properties>
 </project>
@@ -26,7 +26,7 @@ public abstract class AuthenticationException extends SpringSecurityException {
    //~ Instance fields ================================================================================================
    private Authentication authentication;
-    private Object extraInformation;
+    private transient Object extraInformation;
    //~ Constructors ===================================================================================================
@@ -40,4 +40,5 @@ abstract class Elements {
    public static final String X509 = "x509";
    public static final String FILTER_INVOCATION_DEFINITION_SOURCE = "filter-invocation-definition-source";
    public static final String LDAP_PASSWORD_COMPARE = "password-compare";
    public static final String HTTP_FIREWALL = "http-firewall";
 }
@@ -0,0 +1,31 @@
 package org.springframework.security.config;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.xml.BeanDefinitionParser;
 import org.springframework.beans.factory.xml.ParserContext;
 import org.springframework.util.StringUtils;
 import org.w3c.dom.Element;
 /**
 * Injects the supplied {@code HttpFirewall} bean reference into the {@code FilterChainProxy}.
 *
 * @author Luke Taylor
 */
 public class HttpFirewallBeanDefinitionParser implements BeanDefinitionParser {
    public BeanDefinition parse(Element element, ParserContext pc) {
        String ref = element.getAttribute("ref");
        if (!StringUtils.hasText(ref)) {
            pc.getReaderContext().error("ref attribute is required", pc.extractSource(element));
        }
        BeanDefinitionBuilder injector = BeanDefinitionBuilder.rootBeanDefinition(HttpFirewallInjectionBeanPostProcessor.class);
        injector.addConstructorArg(ref);
        pc.getReaderContext().registerWithGeneratedName(injector.getBeanDefinition());
        return null;
    }
 }
@@ -0,0 +1,40 @@
 package org.springframework.security.config;
 import org.springframework.beans.BeansException;
 import org.springframework.beans.factory.BeanFactory;
 import org.springframework.beans.factory.BeanFactoryAware;
 import org.springframework.beans.factory.config.BeanPostProcessor;
 import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
 import org.springframework.security.config.BeanIds;
 import org.springframework.security.util.FilterChainProxy;
 import org.springframework.security.firewall.HttpFirewall;
 /**
 * @author Luke Taylor
 */
 public class HttpFirewallInjectionBeanPostProcessor implements BeanPostProcessor, BeanFactoryAware {
    private ConfigurableListableBeanFactory beanFactory;
    private String ref;
    public HttpFirewallInjectionBeanPostProcessor(String ref) {
        this.ref = ref;
    }
    public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException {
        if (BeanIds.FILTER_CHAIN_PROXY.equals(beanName)) {
            HttpFirewall fw = (HttpFirewall) beanFactory.getBean(ref);
            ((FilterChainProxy)bean).setFirewall(fw);
        }
        return bean;
    }
    public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
        return bean;
    }
    public void setBeanFactory(BeanFactory beanFactory) throws BeansException {
        this.beanFactory = (ConfigurableListableBeanFactory) beanFactory;
    }
 }
@@ -24,6 +24,7 @@ public class SecurityNamespaceHandler extends NamespaceHandlerSupport {
        registerBeanDefinitionParser(Elements.GLOBAL_METHOD_SECURITY, new GlobalMethodSecurityBeanDefinitionParser());
        registerBeanDefinitionParser(Elements.AUTHENTICATION_MANAGER, new AuthenticationManagerBeanDefinitionParser());
        registerBeanDefinitionParser(Elements.FILTER_INVOCATION_DEFINITION_SOURCE, new FilterInvocationDefinitionSourceBeanDefinitionParser());
        registerBeanDefinitionParser(Elements.HTTP_FIREWALL, new HttpFirewallBeanDefinitionParser());
        // Decorators
        registerBeanDefinitionDecorator(Elements.INTERCEPT_METHODS, new InterceptMethodsBeanDefinitionDecorator());
@@ -15,33 +15,30 @@
 package org.springframework.security.context.rmi;
 import org.springframework.security.context.SecurityContext;
 import org.springframework.security.context.SecurityContextHolder;
 import org.aopalliance.intercept.MethodInvocation;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.remoting.support.RemoteInvocation;
 import org.springframework.security.Authentication;
 import org.springframework.security.context.SecurityContextHolder;
 import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
 import java.lang.reflect.InvocationTargetException;
 /**
- * The actual <code>RemoteInvocation</code> that is passed from the client to the server, which contains the
+ * The actual {@code RemoteInvocation} that is passed from the client to the server.
- * contents of {@link SecurityContextHolder}, being a {@link SecurityContext} object.<p>When constructed on the
+ * <p>
- * client via {@link org.springframework.security.context.rmi.ContextPropagatingRemoteInvocationFactory}, the contents of the
+ * The principal and credentials information will be extracted from the current
- * <code>SecurityContext</code> are stored inside the object. The object is then passed to the server that is
+ * security context and passed to the server as part of the invocation object.
- * processing the remote invocation. Upon the server invoking the remote invocation, it will retrieve the passed
+ * <p>
- * contents of the <code>SecurityContextHolder</code> and set them to the server-side
+ * To avoid potential serialization-based attacks, this implementation interprets the values as {@code String}s
- * <code>SecurityContextHolder</code> whilst the target object is invoked. When the target invocation has been
+ * and creates a {@code UsernamePasswordAuthenticationToken} on the server side to hold them. If a different
- * completed, the server-side <code>SecurityContextHolder</code> will be reset to a new instance of
+ * token type is required you can override the {@code createAuthenticationRequest} method.
 * <code>SecurityContextImpl</code>.</p>
 *
 * @author James Monaghan
 * @author Ben Alex
- * @version $Id$
+ * @author Luke Taylor
 */
 public class ContextPropagatingRemoteInvocation extends RemoteInvocation {
    //~ Static fields/initializers =====================================================================================
@@ -50,33 +47,40 @@ public class ContextPropagatingRemoteInvocation extends RemoteInvocation {
    //~ Instance fields ================================================================================================
-    private SecurityContext securityContext;
+    private final String principal;
    private final String credentials;
    //~ Constructors ===================================================================================================
    /**
-     * Constructs the object, storing the value of the client-side
+     * Constructs the object, storing the principal and credentials extracted from the client-side
-     * <code>SecurityContextHolder</code> inside the object.
+     * security context.
     *
     * @param methodInvocation the method to invoke
     */
    public ContextPropagatingRemoteInvocation(MethodInvocation methodInvocation) {
        super(methodInvocation);
-        securityContext = SecurityContextHolder.getContext();
+        Authentication currentUser = SecurityContextHolder.getContext().getAuthentication();
        if (currentUser != null) {
            principal = currentUser.getPrincipal().toString();
            credentials = currentUser.getCredentials().toString();
        } else {
            principal = credentials = null;
        }
        if (logger.isDebugEnabled()) {
-            logger.debug("RemoteInvocation now has SecurityContext: " + securityContext);
+            logger.debug("RemoteInvocation now has principal: " + principal);
        }
    }
    //~ Methods ========================================================================================================
    /**
-     * Invoked on the server-side as described in the class JavaDocs.<p>Invocations will always have their
+     * Invoked on the server-side.
-     * {@link org.springframework.security.Authentication#setAuthenticated(boolean)} set to <code>false</code>, which is
+     * <p>
-     * guaranteed to always be accepted by <code>Authentication</code> implementations. This ensures that even
+     * The transmitted principal and credentials will be used to create an unauthenticated {@code Authentication}
-     * remotely authenticated <code>Authentication</code>s will be untrusted by the server-side, which is an
+     * instance for processing by the {@code AuthenticationManager}.
     * appropriate security measure.</p>
     *
     * @param targetObject the target object to apply the invocation to
     *
@@ -88,15 +92,15 @@ public class ContextPropagatingRemoteInvocation extends RemoteInvocation {
     */
    public Object invoke(Object targetObject)
            throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
        SecurityContextHolder.setContext(securityContext);
-        if ((SecurityContextHolder.getContext() != null)
+        if (principal != null) {
-            && (SecurityContextHolder.getContext().getAuthentication() != null)) {
+            Authentication request = createAuthenticationRequest(principal, credentials);
-            SecurityContextHolder.getContext().getAuthentication().setAuthenticated(false);
+            request.setAuthenticated(false);
-        }
+            SecurityContextHolder.getContext().setAuthentication(request);
            if (logger.isDebugEnabled()) {
-            logger.debug("Set SecurityContextHolder to contain: " + securityContext);
+                logger.debug("Set SecurityContextHolder to contain: " + request);
            }
        }
        try {
@@ -105,8 +109,15 @@ public class ContextPropagatingRemoteInvocation extends RemoteInvocation {
            SecurityContextHolder.clearContext();
            if (logger.isDebugEnabled()) {
-                logger.debug("Set SecurityContext to new instance of SecurityContextImpl");
+                logger.debug("Cleared SecurityContextHolder.");
            }
        }
    }
    /**
     * Creates the server-side authentication request object.
     */
    protected Authentication createAuthenticationRequest(String principal, String credentials) {
        return new UsernamePasswordAuthenticationToken(principal, credentials);
    }
 }
@@ -0,0 +1,67 @@
 package org.springframework.security.firewall;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 /**
 * Default implementation which wraps requests in order to provide consistent values of the {@code servletPath} and
 * {@code pathInfo}, which do not contain path parameters (as defined in
 * <a href="http://www.ietf.org/rfc/rfc2396.txt">RFC 2396</a>). Different servlet containers
 * interpret the servlet spec differently as to how path parameters are treated and it is possible they might be added
 * in order to bypass particular security constraints. When using this implementation, they will be removed for all
 * requests as the request passes through the security filter chain. Note that this means that any segments in the
 * decoded path which contain a semi-colon, will have the part following the semi-colon removed for
 * request matching. Your application should not contain any valid paths which contain semi-colons.
 * <p>
 * If any un-normalized paths are found (containing directory-traversal character sequences), the request will be
 * rejected immediately. Most containers normalize the paths before performing the servlet-mapping, but again this is
 * not guaranteed by the servlet spec.
 *
 * @author Luke Taylor
 */
 public class DefaultHttpFirewall implements HttpFirewall {
    public FirewalledRequest getFirewalledRequest(HttpServletRequest request) throws RequestRejectedException {
        FirewalledRequest fwr = new RequestWrapper(request);
        if (!isNormalized(fwr.getServletPath()) || !isNormalized(fwr.getPathInfo())) {
            throw new RequestRejectedException("Un-normalized paths are not supported: " + fwr.getServletPath() +
                (fwr.getPathInfo() != null ? fwr.getPathInfo() : ""));
        }
        return fwr;
    }
    public HttpServletResponse getFirewalledResponse(HttpServletResponse response) {
        return new FirewalledResponse(response);
    }
    /**
     * Checks whether a path is normalized (doesn't contain path traversal sequences like "./", "/../" or "/.")
     *
     * @param path the path to test
     * @return true if the path doesn't contain any path-traversal character sequences.
     */
    private boolean isNormalized(String path) {
        if (path == null) {
            return true;
        }
        for (int j = path.length(); j > 0;) {
            int i = path.lastIndexOf('/', j - 1);
            int gap = j - i;
            if (gap == 2 && path.charAt(i+1) == '.') {
                // ".", "/./" or "/."
                return false;
            } else if (gap == 3 && path.charAt(i+1) == '.'&& path.charAt(i+2) == '.') {
                return false;
            }
            j = i;
        }
        return true;
    }
 }
@@ -0,0 +1,34 @@
 package org.springframework.security.firewall;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletRequestWrapper;
 /**
 * Request wrapper which is returned by the {@code HttpFirewall} interface.
 * <p>
 * The only difference is the {@code reset} method which allows some
 * or all of the state to be reset by the {@code FilterChainProxy} when the
 * request leaves the security filter chain.
 *
 * @author Luke Taylor
 */
 public abstract class FirewalledRequest extends HttpServletRequestWrapper {
    /**
     * Constructs a request object wrapping the given request.
     *
     * @throws IllegalArgumentException if the request is null
     */
    public FirewalledRequest(HttpServletRequest request) {
        super(request);
    }
    /**
     * This method will be called once the request has passed through the
     * security filter chain, when it is about to proceed to the application
     * proper.
     * <p>
     * An implementation can thus choose to modify the state of the request
     * for the security infrastructure, while still maintaining the
     */
    public abstract void reset();
 }
@@ -0,0 +1,26 @@
 package org.springframework.security.firewall;
 import javax.servlet.http.HttpServletResponseWrapper;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.util.regex.Pattern;
 /**
 * @author Luke Taylor
 */
 class FirewalledResponse extends HttpServletResponseWrapper {
    Pattern CR_OR_LF = Pattern.compile("\\r|\\n");
    public FirewalledResponse(HttpServletResponse response) {
        super(response);
    }
    public void sendRedirect(String location) throws IOException {
        // TODO: implement pluggable validation, instead of simple blacklisting.
        // SEC-1790. Prevent redirects containing CRLF
        if (CR_OR_LF.matcher(location).find()) {
            throw new IllegalArgumentException("Invalid characters (CR/LF) in redirect location");
        }
        super.sendRedirect(location);
    }
 }
@@ -0,0 +1,32 @@
 package org.springframework.security.firewall;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 /**
 * Interface which can be used to reject potentially dangerous requests and/or wrap them to
 * control their behaviour.
 * <p>
 * The implementation is injected into the {@code FilterChainProxy} and will be invoked before
 * sending any request through the filter chain. It can also provide a response wrapper if the response
 * behaviour should also be restricted.
 *
 * @author Luke Taylor
 */
 public interface HttpFirewall {
    /**
     * Provides the request object which will be passed through the filter chain.
     *
     * @throws RequestRejectedException if the request should be rejected immediately
     */
    FirewalledRequest getFirewalledRequest(HttpServletRequest request) throws RequestRejectedException;
    /**
     * Provides the response which will be passed through the filter chain.
     *
     * @param response the original response
     * @return either the original response or a replacement/wrapper.
     */
    HttpServletResponse getFirewalledResponse(HttpServletResponse response);
 }
@@ -0,0 +1,10 @@
 package org.springframework.security.firewall;
 /**
 * @author Luke Taylor
 */
 public class RequestRejectedException extends RuntimeException {
    public RequestRejectedException(String message) {
        super(message);
    }
 }
@@ -0,0 +1,140 @@
 package org.springframework.security.firewall;
 import javax.servlet.RequestDispatcher;
 import javax.servlet.ServletException;
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletRequest;
 import java.io.IOException;
 import java.util.*;
 /**
 * Request wrapper which ensures values of {@code servletPath} and {@code pathInfo} are returned which are suitable for
 * pattern matching against. It strips out path parameters and extra consecutive '/' characters.
 *
 * <h3>Path Parameters</h3>
 * Parameters (as defined in <a href="http://www.ietf.org/rfc/rfc2396.txt">RFC 2396</a>) are stripped from the path
 * segments of the {@code servletPath} and {@code pathInfo} values of the request.
 * <p>
 * The parameter sequence is demarcated by a semi-colon, so each segment is checked for the occurrence of a ";"
 * character and truncated at that point if it is present.
 * <p>
 * The behaviour differs between servlet containers in how they interpret the servlet spec, which
 * does not clearly state what the behaviour should be. For consistency, we make sure they are always removed, to
 * avoid the risk of URL matching rules being bypassed by the malicious addition of parameters to the path component.
 *
 * @author Luke Taylor
 */
 final class RequestWrapper extends FirewalledRequest {
    private final String strippedServletPath;
    private final String strippedPathInfo;
    private boolean stripPaths = true;
    public RequestWrapper(HttpServletRequest request) {
        super(request);
        strippedServletPath = strip(request.getServletPath());
        String pathInfo = strip(request.getPathInfo());
        if (pathInfo != null && pathInfo.length() == 0) {
            pathInfo = null;
        }
        strippedPathInfo = pathInfo;
    }
    /**
     * Removes path parameters from each path segment in the supplied path and truncates sequences of multiple '/'
     * characters to a single '/'.
     *
     * @param path either the {@code servletPath} and {@code pathInfo} from the original request
     *
     * @return the supplied value, with path parameters removed and sequences of multiple '/' characters truncated,
     *  or null if the supplied path was null.
     */
    private String strip(String path) {
        if (path == null) {
            return null;
        }
        int scIndex = path.indexOf(';');
        if (scIndex < 0) {
            int doubleSlashIndex = path.indexOf("//");
            if (doubleSlashIndex < 0) {
                // Most likely case, no parameters in any segment and no '//', so no stripping required
                return path;
            }
        }
        StringTokenizer st = new StringTokenizer(path, "/");
        StringBuilder stripped = new StringBuilder(path.length());
        if (path.charAt(0) == '/') {
            stripped.append('/');
        }
        while(st.hasMoreTokens()) {
            String segment = st.nextToken();
            scIndex = segment.indexOf(';');
            if (scIndex >= 0) {
                segment = segment.substring(0, scIndex);
            }
            stripped.append(segment).append('/');
        }
        // Remove the trailing slash if the original path didn't have one
        if (path.charAt(path.length() - 1) != '/') {
            stripped.deleteCharAt(stripped.length() - 1);
        }
        return stripped.toString();
    }
    public String getPathInfo() {
        return stripPaths ? strippedPathInfo : super.getPathInfo();
    }
    public String getServletPath() {
        return stripPaths ? strippedServletPath : super.getServletPath();
    }
    public RequestDispatcher getRequestDispatcher(String path) {
        return this.stripPaths ? new FirewalledRequestAwareRequestDispatcher(path) : super.getRequestDispatcher(path);
    }
    public void reset() {
        this.stripPaths = false;
    }
    /**
     * Ensures {@link FirewalledRequest#reset()} is called prior to performing a forward. It then delegates work to the
     * {@link RequestDispatcher} from the original {@link HttpServletRequest}.
     *
     * @author Rob Winch
     */
    private class FirewalledRequestAwareRequestDispatcher implements RequestDispatcher {
        private final String path;
        /**
         *
         * @param path the {@code path} that will be used to obtain the delegate {@link RequestDispatcher} from the
         * original {@link HttpServletRequest}.
         */
        public FirewalledRequestAwareRequestDispatcher(String path) {
            this.path = path;
        }
        public void forward(ServletRequest request, ServletResponse response) throws ServletException, IOException {
            reset();
            getDelegateDispatcher().forward(request, response);
        }
        public void include(ServletRequest request, ServletResponse response) throws ServletException, IOException {
            getDelegateDispatcher().include(request, response);
        }
        private RequestDispatcher getDelegateDispatcher() {
            return RequestWrapper.super.getRequestDispatcher(path);
        }
    }
 }
@@ -26,8 +26,10 @@ import org.springframework.security.ConfigAttribute;
 import org.springframework.security.ConfigAttributeDefinition;
 import org.springframework.security.RunAsManager;
 import org.springframework.security.context.SecurityContext;
 import org.springframework.security.context.SecurityContextHolder;
 import org.springframework.security.context.SecurityContextImpl;
 import org.springframework.security.event.authorization.AuthenticationCredentialsNotFoundEvent;
 import org.springframework.security.event.authorization.AuthorizationFailureEvent;
 import org.springframework.security.event.authorization.AuthorizedEvent;
@@ -140,21 +142,22 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean, A
        if (token.isContextHolderRefreshRequired()) {
            if (logger.isDebugEnabled()) {
-                logger.debug("Reverting to original Authentication: " + token.getAuthentication().toString());
+                logger.debug("Reverting to original Authentication: " + token.getSecurityContext().getAuthentication());
            }
-            SecurityContextHolder.getContext().setAuthentication(token.getAuthentication());
+            SecurityContextHolder.setContext(token.getSecurityContext());
        }
        if (afterInvocationManager != null) {
            // Attempt after invocation handling
            try {
-                returnedObject = afterInvocationManager.decide(token.getAuthentication(), token.getSecureObject(),
+                returnedObject = afterInvocationManager.decide(token.getSecurityContext().getAuthentication(),
                        token.getSecureObject(),
                        token.getAttr(), returnedObject);
            }
            catch (AccessDeniedException accessDeniedException) {
                AuthorizationFailureEvent event = new AuthorizationFailureEvent(token.getSecureObject(), token
-                        .getAttr(), token.getAuthentication(), accessDeniedException);
+                        .getAttr(), token.getSecurityContext().getAuthentication(), accessDeniedException);
                publishEvent(event);
                throw accessDeniedException;
@@ -285,16 +288,20 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean, A
            }
            // no further work post-invocation
-            return new InterceptorStatusToken(authenticated, false, attr, object);
+            return new InterceptorStatusToken(SecurityContextHolder.getContext(), false, attr, object);
        } else {
            if (logger.isDebugEnabled()) {
                logger.debug("Switching to RunAs Authentication: " + runAs);
            }
-            SecurityContextHolder.getContext().setAuthentication(runAs);
+            SecurityContext originalContext = SecurityContextHolder.getContext();
            SecurityContext runAsContext = new SecurityContextImpl();
            runAsContext.setAuthentication(runAs);
-            // revert to token.Authenticated post-invocation
+            SecurityContextHolder.setContext(runAsContext);
-            return new InterceptorStatusToken(authenticated, true, attr, object);
+
            // revert to original context post-invocation
            return new InterceptorStatusToken(originalContext, true, attr, object);
        }
    }
@@ -17,6 +17,7 @@ package org.springframework.security.intercept;
 import org.springframework.security.Authentication;
 import org.springframework.security.ConfigAttributeDefinition;
 import org.springframework.security.context.SecurityContext;
 /**
@@ -32,16 +33,16 @@ import org.springframework.security.ConfigAttributeDefinition;
 public class InterceptorStatusToken {
    //~ Instance fields ================================================================================================
-    private Authentication authentication;
+    private SecurityContext context;
    private ConfigAttributeDefinition attr;
    private Object secureObject;
    private boolean contextHolderRefreshRequired;
    //~ Constructors ===================================================================================================
-    public InterceptorStatusToken(Authentication authentication, boolean contextHolderRefreshRequired,
+    public InterceptorStatusToken(SecurityContext context, boolean contextHolderRefreshRequired,
        ConfigAttributeDefinition attr, Object secureObject) {
-        this.authentication = authentication;
+        this.context = context;
        this.contextHolderRefreshRequired = contextHolderRefreshRequired;
        this.attr = attr;
        this.secureObject = secureObject;
@@ -53,8 +54,8 @@ public class InterceptorStatusToken {
        return attr;
    }
-    public Authentication getAuthentication() {
+    public SecurityContext getSecurityContext() {
-        return authentication;
+        return context;
    }
    public Object getSecureObject() {
@@ -60,6 +60,7 @@ public final class ProtectPointcutPostProcessor implements BeanPostProcessor {
    private Map pointcutMap = new LinkedHashMap(); /** Key: string-based pointcut, value: ConfigAttributeDefinition */
    private MapBasedMethodDefinitionSource mapBasedMethodDefinitionSource;
    private PointcutParser parser;
    private final Set processedBeans = new HashSet();
    public ProtectPointcutPostProcessor(MapBasedMethodDefinitionSource mapBasedMethodDefinitionSource) {
        Assert.notNull(mapBasedMethodDefinitionSource, "MapBasedMethodDefinitionSource to populate is required");
@@ -85,6 +86,11 @@ public final class ProtectPointcutPostProcessor implements BeanPostProcessor {
    }
    public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException {
        if (processedBeans.contains(beanName)) {
            // We already have the metadata for this bean
            return bean;
        }
        // Obtain methods for the present bean
        Method[] methods;
        try {
@@ -110,6 +116,8 @@ public final class ProtectPointcutPostProcessor implements BeanPostProcessor {
            }
        }
        processedBeans.add(beanName);
        return bean;
    }
@@ -71,6 +71,7 @@ public class DefaultSpringSecurityContextSource extends LdapContextSource implem
        env.put(Context.SECURITY_PRINCIPAL, userDn);
        env.put(Context.SECURITY_CREDENTIALS, credentials);
        env.remove(SUN_LDAP_POOLING_FLAG);
        if (logger.isDebugEnabled()) {
            logger.debug("Creating context with principal: '" + userDn + "'");
@@ -193,22 +193,27 @@ public class SpringSecurityLdapTemplate extends LdapTemplate {
        return (DirContextOperations) executeReadOnly(new ContextExecutor() {
                public Object executeWithContext(DirContext ctx) throws NamingException {
                    DistinguishedName ctxBaseDn = new DistinguishedName(ctx.getNameInNamespace());
                    if (logger.isDebugEnabled()) {
                    logger.debug("Searching for entry in under DN '" + ctxBaseDn
                	    + "', base = '" + base + "', filter = '" + filter + "'");
                    }
                    NamingEnumeration resultsEnum = ctx.search(base, filter, params, searchControls);
                    Set results = new HashSet();
                    try {
                        while (resultsEnum.hasMore()) {
                            SearchResult searchResult = (SearchResult) resultsEnum.next();
                            // Work out the DN of the matched entry
-                            StringBuffer dn = new StringBuffer(searchResult.getName());
+                            DistinguishedName  dn = new  DistinguishedName(searchResult.getName());
                            if (base.length() > 0) {
-                                dn.append(",");
+                                dn.prepend(new DistinguishedName(base));
                                dn.append(base);
                            }
-                            results.add(new DirContextAdapter(searchResult.getAttributes(),
+                            if (logger.isDebugEnabled()) {
-                                    new DistinguishedName(dn.toString()), ctxBaseDn));
+                         	logger.debug("Found DN: " + dn);
                            }
                            results.add(new DirContextAdapter(searchResult.getAttributes(), dn, ctxBaseDn));
                        }
                    } catch (PartialResultException e) {
                        logger.info("Ignoring PartialResultException");
@@ -24,6 +24,7 @@ import org.springframework.security.providers.encoding.PasswordEncoder;
 import org.springframework.security.providers.encoding.PlaintextPasswordEncoder;
 import org.springframework.security.userdetails.UserDetails;
 import org.springframework.security.userdetails.UserDetailsService;
 import org.springframework.security.userdetails.UsernameNotFoundException;
 import org.springframework.dao.DataAccessException;
 import org.springframework.util.Assert;
@@ -35,10 +36,24 @@ import org.springframework.util.Assert;
 * @version $Id$
 */
 public class DaoAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {
    //~ Static fields/initializers =====================================================================================
    /**
     * The plaintext password used to perform {@link PasswordEncoder#isPasswordValid(String, String, Object)} on when the user is
     * not found to avoid SEC-2056.
     */
    private static final String USER_NOT_FOUND_PASSWORD = "userNotFoundPassword";
    //~ Instance fields ================================================================================================
-    private PasswordEncoder passwordEncoder = new PlaintextPasswordEncoder();
+    private PasswordEncoder passwordEncoder;
    /**
     * The password used to perform {@link PasswordEncoder#isPasswordValid(String, String, Object)} on when the user is
     * not found to avoid SEC-2056. This is necessary, because some {@link PasswordEncoder} implementations will short circuit if the
     * password is not in a valid format.
     */
    private String userNotFoundEncodedPassword;
    private SaltSource saltSource;
@@ -46,6 +61,10 @@ public class DaoAuthenticationProvider extends AbstractUserDetailsAuthentication
    private boolean includeDetailsObject = true;
    public DaoAuthenticationProvider() {
        setPasswordEncoder(new PlaintextPasswordEncoder());
    }
    //~ Methods ========================================================================================================
    protected void additionalAuthenticationChecks(UserDetails userDetails,
@@ -85,6 +104,13 @@ public class DaoAuthenticationProvider extends AbstractUserDetailsAuthentication
        catch (DataAccessException repositoryProblem) {
            throw new AuthenticationServiceException(repositoryProblem.getMessage(), repositoryProblem);
        }
        catch (UsernameNotFoundException notFound) {
            if(authentication.getCredentials() != null) {
                String presentedPassword = authentication.getCredentials().toString();
                passwordEncoder.isPasswordValid(userNotFoundEncodedPassword, presentedPassword, null);
            }
            throw notFound;
        }
        if (loadedUser == null) {
            throw new AuthenticationServiceException(
@@ -100,6 +126,7 @@ public class DaoAuthenticationProvider extends AbstractUserDetailsAuthentication
     * @param passwordEncoder The passwordEncoder to use
     */
    public void setPasswordEncoder(PasswordEncoder passwordEncoder) {
        this.userNotFoundEncodedPassword = passwordEncoder.encodePassword(USER_NOT_FOUND_PASSWORD, null);
        this.passwordEncoder = passwordEncoder;
    }
@@ -189,13 +189,9 @@ public class JaasAuthenticationProvider implements AuthenticationProvider, Appli
                //Attempt to login the user, the LoginContext will call our InternalCallbackHandler at this point.
                loginContext.login();
-                //create a set to hold the authorities, and add any that have already been applied.
+                //create a set to hold the authorities
                Set authorities = new HashSet();
                if (request.getAuthorities() != null) {
                    authorities.addAll(Arrays.asList(request.getAuthorities()));
                }
                //get the subject principals and pass them to each of the AuthorityGranters
                Set principals = loginContext.getSubject().getPrincipals();
@@ -15,22 +15,26 @@
 package org.springframework.security.providers.ldap.authenticator;
-import org.springframework.security.Authentication;
+import java.util.Iterator;
-import org.springframework.security.BadCredentialsException;
+
-import org.springframework.security.ldap.SpringSecurityContextSource;
+import javax.naming.directory.Attributes;
-import org.springframework.security.ldap.SpringSecurityLdapTemplate;
+import javax.naming.directory.DirContext;
 import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
 import org.springframework.dao.DataAccessException;
 import org.springframework.ldap.core.ContextSource;
 import org.springframework.ldap.core.DirContextOperations;
 import org.springframework.ldap.core.DistinguishedName;
 import org.springframework.util.Assert;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
-
+import org.springframework.dao.DataAccessException;
-import javax.naming.directory.DirContext;
+import org.springframework.ldap.NamingException;
-import java.util.Iterator;
+import org.springframework.ldap.core.ContextSource;
 import org.springframework.ldap.core.DirContextAdapter;
 import org.springframework.ldap.core.DirContextOperations;
 import org.springframework.ldap.core.DistinguishedName;
 import org.springframework.ldap.core.support.BaseLdapPathContextSource;
 import org.springframework.ldap.support.LdapUtils;
 import org.springframework.security.Authentication;
 import org.springframework.security.BadCredentialsException;
 import org.springframework.security.ldap.SpringSecurityContextSource;
 import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
 import org.springframework.util.Assert;
 /**
@@ -91,21 +95,42 @@ public class BindAuthenticator extends AbstractLdapAuthenticator {
        return user;
    }
-    private DirContextOperations bindWithDn(String userDn, String username, String password) {
+    private DirContextOperations bindWithDn(String userDnStr, String username, String password) {
-        SpringSecurityLdapTemplate template = new SpringSecurityLdapTemplate(
+	BaseLdapPathContextSource ctxSource = (BaseLdapPathContextSource) getContextSource();
-                new BindWithSpecificDnContextSource((SpringSecurityContextSource) getContextSource(), userDn, password));
+	DistinguishedName userDn = new DistinguishedName(userDnStr);
-
+	DistinguishedName fullDn = new DistinguishedName(userDn);
 	fullDn.prepend(ctxSource.getBaseLdapPath());
 	BindWithSpecificDnContextSource specificDnContextSource = new BindWithSpecificDnContextSource(
 		(SpringSecurityContextSource) getContextSource(), fullDn,
 		password);
 	logger.debug("Attemptimg to bind as " + fullDn);
 	DirContext ctx = null;
 	try {
-            return template.retrieveEntry(userDn, getUserAttributes());
+	    ctx = specificDnContextSource.getReadOnlyContext();
-        } catch (BadCredentialsException e) {
+	    Attributes attrs = ctx.getAttributes(userDn, getUserAttributes());
 	    DirContextAdapter result = new DirContextAdapter(attrs, userDn, ctxSource.getBaseLdapPath());
 	    return result;
 	} catch (NamingException e) {
 	    // This will be thrown if an invalid user name is used and the method may
 	    // be called multiple times to try different names, so we trap the exception
 	    // unless a subclass wishes to implement more specialized behaviour.
-            handleBindException(userDn, username, e.getCause());
+	    if ((e  instanceof org.springframework.ldap.AuthenticationException)
 		    || (e instanceof org.springframework.ldap.OperationNotSupportedException)) {
 		handleBindException(userDnStr, username, e);
 	    } else {
 		throw e;
 	    }
 	} catch (javax.naming.NamingException e) {
 	    throw LdapUtils.convertLdapException(e);
 	} finally {
 	    LdapUtils.closeContext(ctx);
 	}
 	return null;
    }
    /**
@@ -120,13 +145,12 @@ public class BindAuthenticator extends AbstractLdapAuthenticator {
    private class BindWithSpecificDnContextSource implements ContextSource {
        private SpringSecurityContextSource ctxFactory;
-        DistinguishedName userDn;
+        private DistinguishedName userDn;
        private String password;
-        public BindWithSpecificDnContextSource(SpringSecurityContextSource ctxFactory, String userDn, String password) {
+        public BindWithSpecificDnContextSource(SpringSecurityContextSource ctxFactory, DistinguishedName userDn, String password) {
            this.ctxFactory = ctxFactory;
-            this.userDn = new DistinguishedName(userDn);
+            this.userDn = userDn;
            this.userDn.prepend(ctxFactory.getBaseLdapPath());
            this.password = password;
        }
@@ -145,7 +145,7 @@ public class LdapShaPasswordEncoder implements PasswordEncoder {
            salt = null;
        }
-        int startOfHash = prefix.length() + 1;
+        int startOfHash = prefix.length();
        String encodedRawPass = encodePassword(rawPass, salt).substring(startOfHash);
@@ -48,7 +48,7 @@ public class SessionFixationProtectionFilter extends SpringSecurityFilter {
    protected void doFilterHttp(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        // Session fixation isn't a problem if there's no session
-        if(request.getSession(false) == null || request.getAttribute(FILTER_APPLIED) != null) {
+        if(request.getSession(false) == null || request.getAttribute(FILTER_APPLIED) != null || !request.isRequestedSessionIdValid()) {
            chain.doFilter(request, response);
            return;
        }
@@ -28,7 +28,7 @@ import org.springframework.util.StringUtils;
 /**
 * Default implementation for {@link TargetUrlResolver}
- * <p>
+ * <p/>
 * Returns a target URL based from the contents of the configured <tt>targetUrlParameter</tt> if present on
 * the current request. Failing that, the SavedRequest in the session will be used.
 *
@@ -36,7 +36,6 @@ import org.springframework.util.StringUtils;
 * @author Luke Taylor
 * @version $Id$
 * @since 2.0
 *
 */
 public class TargetUrlResolverImpl implements TargetUrlResolver {
    public static String DEFAULT_TARGET_PARAMETER = "spring-security-redirect";
@@ -94,7 +93,6 @@ public class TargetUrlResolverImpl implements TargetUrlResolver {
        this.justUseSavedRequestOnGet = justUseSavedRequestOnGet;
    }
    /**
     * Before checking the SavedRequest, the current request will be checked for this parameter
     * and the value used as the target URL if resent.
@@ -103,7 +101,7 @@ public class TargetUrlResolverImpl implements TargetUrlResolver {
     *                           to "redirect".
     */
    public void setTargetUrlParameter(String targetUrlParameter) {
-	    Assert.hasText("targetUrlParamete canot be null or empty");
+        Assert.hasText("targetUrlParameter cannot be null or empty");
        this.targetUrlParameter = targetUrlParameter;
    }
 }
@@ -21,11 +21,17 @@ import org.springframework.beans.BeansException;
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.context.ApplicationContext;
 import org.springframework.context.ApplicationContextAware;
 import org.springframework.security.firewall.DefaultHttpFirewall;
 import org.springframework.security.firewall.FirewalledRequest;
 import org.springframework.security.firewall.HttpFirewall;
 import org.springframework.security.intercept.web.*;
 import org.springframework.util.Assert;
 import org.springframework.web.filter.DelegatingFilterProxy;
 import javax.servlet.*;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.util.*;
@@ -34,7 +40,7 @@ import java.util.*;
 * Delegates <code>Filter</code> requests to a list of Spring-managed beans.
 * As of version 2.0, you shouldn't need to explicitly configure a <tt>FilterChainProxy</tt> bean in your application
 * context unless you need very fine control over the filter chain contents. Most cases should be adequately covered
- * by the default <tt>&lt;security:http /&gt</tt> namespace configuration options.
+ * by the default <tt>&lt;security:http /&gt;</tt> namespace configuration options.
 *
 * <p>The <code>FilterChainProxy</code> is loaded via a standard Spring {@link DelegatingFilterProxy} declaration in
 * <code>web.xml</code>. <code>FilterChainProxy</code> will then pass {@link #init(FilterConfig)}, {@link #destroy()}
@@ -90,6 +96,7 @@ import java.util.*;
 * @author Carlos Sanchez
 * @author Ben Alex
 * @author Luke Taylor
 * @author Rob Winch
 *
 * @version $Id$
 */
@@ -109,6 +116,7 @@ public class FilterChainProxy implements Filter, InitializingBean, ApplicationCo
    private UrlMatcher matcher = new AntUrlPathMatcher();
    private boolean stripQueryStringFromUrls = true;
    private DefaultFilterInvocationDefinitionSource fids;
    private HttpFirewall firewall = new DefaultHttpFirewall();
    //~ Methods ========================================================================================================
@@ -154,10 +162,13 @@ public class FilterChainProxy implements Filter, InitializingBean, ApplicationCo
        }
    }
-    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+    public void doFilter(ServletRequest servletRequest, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
-        FilterInvocation fi = new FilterInvocation(request, response, chain);
+        FirewalledRequest fwRequest = firewall.getFirewalledRequest((HttpServletRequest) servletRequest);
        HttpServletResponse fwResponse = firewall.getFirewalledResponse((HttpServletResponse) response);
        FilterInvocation fi = new FilterInvocation(fwRequest, fwResponse, chain);
        List filters = getFilters(fi.getRequestUrl());
        if (filters == null || filters.size() == 0) {
@@ -166,12 +177,14 @@ public class FilterChainProxy implements Filter, InitializingBean, ApplicationCo
                        filters == null ? " has no matching filters" : " has an empty filter list");
            }
-            chain.doFilter(request, response);
+            fwRequest.reset();
            chain.doFilter(fwRequest, response);
            return;
        }
-        VirtualFilterChain virtualFilterChain = new VirtualFilterChain(fi, filters);
+        VirtualFilterChain virtualFilterChain = new VirtualFilterChain(fi, filters, fwRequest);
        virtualFilterChain.doFilter(fi.getRequest(), fi.getResponse());
    }
@@ -330,6 +343,10 @@ public class FilterChainProxy implements Filter, InitializingBean, ApplicationCo
        return matcher;
    }
    public void setFirewall(HttpFirewall firewall) {
        this.firewall = firewall;
    }
    /**
     * If set to 'true', the query string will be stripped from the request URL before
     * attempting to find a matching filter chain. This is the default value.
@@ -360,11 +377,13 @@ public class FilterChainProxy implements Filter, InitializingBean, ApplicationCo
    private static class VirtualFilterChain implements FilterChain {
        private FilterInvocation fi;
        private List additionalFilters;
        private FirewalledRequest firewalledRequest;
        private int currentPosition = 0;
-        private VirtualFilterChain(FilterInvocation filterInvocation, List additionalFilters) {
+        private VirtualFilterChain(FilterInvocation filterInvocation, List additionalFilters, FirewalledRequest firewalledRequest) {
            this.fi = filterInvocation;
            this.additionalFilters = additionalFilters;
            this.firewalledRequest = firewalledRequest;
        }
        public void doFilter(ServletRequest request, ServletResponse response)
@@ -374,6 +393,8 @@ public class FilterChainProxy implements Filter, InitializingBean, ApplicationCo
                    logger.debug(fi.getRequestUrl()
                        + " reached end of additional filter chain; proceeding with original chain");
                }
                // Deactivate path stripping as we exit the security filter chain
                this.firewalledRequest.reset();
                fi.getChain().doFilter(request, response);
            } else {
@@ -15,7 +15,7 @@ public class InMemoryXmlApplicationContext extends AbstractXmlApplicationContext
                    "    xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'\n" +
                    "    xsi:schemaLocation='http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd\n" +
                    "http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-2.0.xsd\n" +
-                    "http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.2.xsd'>\n";
+                    "http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.6.xsd'>\n";
    private static final String BEANS_CLOSE = "</b:beans>\n";
    Resource inMemoryXml;
@@ -1,5 +1,6 @@
-http\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-2.0.4.xsd
+http\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-2.0.6.xsd
 http\://www.springframework.org/schema/security/spring-security-2.0.xsd=org/springframework/security/config/spring-security-2.0.xsd
 http\://www.springframework.org/schema/security/spring-security-2.0.1.xsd=org/springframework/security/config/spring-security-2.0.1.xsd
 http\://www.springframework.org/schema/security/spring-security-2.0.2.xsd=org/springframework/security/config/spring-security-2.0.2.xsd
 http\://www.springframework.org/schema/security/spring-security-2.0.4.xsd=org/springframework/security/config/spring-security-2.0.4.xsd
 http\://www.springframework.org/schema/security/spring-security-2.0.6.xsd=org/springframework/security/config/spring-security-2.0.6.xsd
@@ -206,6 +206,9 @@ protect-pointcut.attlist &=
    ## Access configuration attributes list that applies to all methods matching the pointcut, e.g. "ROLE_A,ROLE_B"
    attribute access {xsd:string}
 http-firewall =
    ## Allows a custom instance of HttpFirewall to be injected into the FilterChainProxy created by the namespace.
    element http-firewall {ref}
 http =
    ## Container element for HTTP security configuration
@@ -502,5 +505,3 @@ position =
 named-security-filter = "FIRST" | "CHANNEL_FILTER" | "CONCURRENT_SESSION_FILTER" | "SESSION_CONTEXT_INTEGRATION_FILTER" | "LOGOUT_FILTER" | "X509_FILTER" | "PRE_AUTH_FILTER" | "CAS_PROCESSING_FILTER" | "AUTHENTICATION_PROCESSING_FILTER" | "OPENID_PROCESSING_FILTER" |"BASIC_PROCESSING_FILTER" | "SERVLET_API_SUPPORT_FILTER" | "REMEMBER_ME_FILTER" | "ANONYMOUS_FILTER" | "EXCEPTION_TRANSLATION_FILTER" | "NTLM_FILTER" | "FILTER_SECURITY_INTERCEPTOR" | "SWITCH_USER_FILTER" | "LAST"
@@ -24,6 +24,7 @@ import org.springframework.security.concurrent.ConcurrentLoginException;
 import org.springframework.security.concurrent.ConcurrentSessionControllerImpl;
 import org.springframework.security.concurrent.ConcurrentSessionFilter;
 import org.springframework.security.context.HttpSessionContextIntegrationFilter;
 import org.springframework.security.firewall.DefaultHttpFirewall;
 import org.springframework.security.intercept.web.FilterInvocation;
 import org.springframework.security.intercept.web.FilterInvocationDefinitionSource;
 import org.springframework.security.intercept.web.FilterSecurityInterceptor;
@@ -661,6 +662,19 @@ public class HttpSecurityBeanDefinitionParserTests {
        assertTrue(attrDef.contains(new SecurityConfig("ROLE_B")));
    }
    @Test
    public void httpFirewallInjectionIsSupported() throws Exception {
        setContext(
                "<http-firewall ref='fw'/>" +
                "<http>" +
                "   <form-login />" +
                "</http>" +
                "<b:bean id='fw' class='" + DefaultHttpFirewall.class.getName() +"'/>" +
                AUTH_PROVIDER_XML);
        FilterChainProxy fcp = (FilterChainProxy) appContext.getBean(BeanIds.FILTER_CHAIN_PROXY);
        assertSame(appContext.getBean("fw"), FieldUtils.getFieldValue(fcp, "firewall"));
    }
    private void setContext(String context) {
        appContext = new InMemoryXmlApplicationContext(context);
    }
@@ -0,0 +1,44 @@
 package org.springframework.security.firewall;
 import static org.junit.Assert.fail;
 import org.junit.Test;
 import org.springframework.mock.web.MockHttpServletRequest;
 /**
 * @author Luke Taylor
 */
 public class DefaultHttpFirewallTests {
    public String[] unnormalizedPaths = {
            "/..",
            "/./path/",
            "/path/path/.",
            "/path/path//.",
            "./path/../path//.",
            "./path",
            ".//path",
            "."
    };
    @Test
    public void unnormalizedPathsAreRejected() throws Exception {
        DefaultHttpFirewall fw = new DefaultHttpFirewall();
        MockHttpServletRequest request;
        for (String path : unnormalizedPaths) {
            request = new MockHttpServletRequest();
            request.setServletPath(path);
            try {
                fw.getFirewalledRequest(request);
                fail(path + " is un-normalized");
            } catch (RequestRejectedException expected) {
            }
            request.setPathInfo(path);
            try {
                fw.getFirewalledRequest(request);
                fail(path + " is un-normalized");
            } catch (RequestRejectedException expected) {
            }
        }
    }
 }
@@ -0,0 +1,104 @@
 package org.springframework.security.firewall;
 import static org.junit.Assert.*;
 import static org.mockito.Mockito.*;
 import java.util.LinkedHashMap;
 import java.util.Map;
 import javax.servlet.RequestDispatcher;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import org.junit.BeforeClass;
 import org.junit.Test;
 import org.springframework.mock.web.MockHttpServletRequest;
 /**
 * @author Luke Taylor
 */
 public class RequestWrapperTests {
    private static Map<String, String> testPaths = new LinkedHashMap<String,String>();
    @BeforeClass
    // Some of these may be unrealistic values, but we can't be sure because of the
    // inconsistency in the spec.
    public static void createTestMap() {
        testPaths.put("/path1;x=y;z=w/path2;x=y/path3;x=y", "/path1/path2/path3");
        testPaths.put("/path1;x=y/path2;x=y/", "/path1/path2/");
        testPaths.put("/path1//path2/", "/path1/path2/");
        testPaths.put("//path1/path2//", "/path1/path2/");
        testPaths.put(";x=y;z=w", "");
    }
    @Test
    public void pathParametersAreRemovedFromServletPath() {
        MockHttpServletRequest request = new MockHttpServletRequest();
        for (Map.Entry<String,String> entry : testPaths.entrySet()) {
            String path = entry.getKey();
            String expectedResult = entry.getValue();
            request.setServletPath(path);
            RequestWrapper wrapper = new RequestWrapper(request);
            assertEquals(expectedResult, wrapper.getServletPath());
            wrapper.reset();
            assertEquals(path, wrapper.getServletPath());
        }
    }
    @Test
    public void pathParametersAreRemovedFromPathInfo() {
        MockHttpServletRequest request = new MockHttpServletRequest();
        for (Map.Entry<String,String> entry : testPaths.entrySet()) {
            String path = entry.getKey();
            String expectedResult = entry.getValue();
            // Should be null when stripped value is empty
            if (expectedResult.length() == 0) {
                expectedResult = null;
            }
            request.setPathInfo(path);
            RequestWrapper wrapper = new RequestWrapper(request);
            assertEquals(expectedResult, wrapper.getPathInfo());
            wrapper.reset();
            assertEquals(path, wrapper.getPathInfo());
        }
    }
    @Test
    public void resetWhenForward() throws Exception {
        String denormalizedPath = testPaths.keySet().iterator().next();
        String forwardPath = "/forward/path";
        HttpServletRequest mockRequest = mock(HttpServletRequest.class);
        HttpServletResponse mockResponse = mock(HttpServletResponse.class);
        RequestDispatcher mockDispatcher = mock(RequestDispatcher.class);
        when(mockRequest.getServletPath()).thenReturn("");
        when(mockRequest.getPathInfo()).thenReturn(denormalizedPath);
        when(mockRequest.getRequestDispatcher(forwardPath)).thenReturn(mockDispatcher);
        RequestWrapper wrapper = new RequestWrapper(mockRequest);
        RequestDispatcher dispatcher = wrapper.getRequestDispatcher(forwardPath);
        dispatcher.forward(mockRequest, mockResponse);
        verify(mockRequest).getRequestDispatcher(forwardPath);
        verify(mockDispatcher).forward(mockRequest, mockResponse);
        assertEquals(denormalizedPath,wrapper.getPathInfo());
        verify(mockRequest,times(2)).getPathInfo();
        // validate wrapper.getServletPath() delegates to the mock
        wrapper.getServletPath();
        verify(mockRequest,times(2)).getServletPath();
        verifyNoMoreInteractions(mockRequest,mockResponse,mockDispatcher);
    }
    @Test
    public void requestDispatcherNotWrappedAfterReset() {
        String path = "/forward/path";
        HttpServletRequest request = mock(HttpServletRequest.class);
        RequestDispatcher dispatcher = mock(RequestDispatcher.class);
        when(request.getRequestDispatcher(path)).thenReturn(dispatcher);
        RequestWrapper wrapper = new RequestWrapper(request);
        wrapper.reset();
        assertSame(dispatcher, wrapper.getRequestDispatcher(path));
    }
 }
@@ -18,6 +18,8 @@ package org.springframework.security.intercept;
 import junit.framework.TestCase;
 import org.springframework.security.ConfigAttributeDefinition;
 import org.springframework.security.context.SecurityContext;
 import org.springframework.security.context.SecurityContextImpl;
 import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
 import org.springframework.security.util.SimpleMethodInvocation;
@@ -58,12 +60,13 @@ public class InterceptorStatusTokenTests extends TestCase {
        ConfigAttributeDefinition attr = new ConfigAttributeDefinition("FOO");
        MethodInvocation mi = new SimpleMethodInvocation();
-        InterceptorStatusToken token = new InterceptorStatusToken(new UsernamePasswordAuthenticationToken("rod",
+        SecurityContext ctx = new SecurityContextImpl();
-                    "koala"), true, attr, mi);
+
        InterceptorStatusToken token = new InterceptorStatusToken(ctx, true, attr, mi);
        assertTrue(token.isContextHolderRefreshRequired());
        assertEquals(attr, token.getAttr());
        assertEquals(mi, token.getSecureObject());
-        assertEquals("rod", token.getAuthentication().getPrincipal());
+        assertSame(ctx, token.getSecurityContext());
    }
 }
@@ -34,6 +34,7 @@ import org.springframework.security.MockAuthenticationManager;
 import org.springframework.security.MockRunAsManager;
 import org.springframework.security.RunAsManager;
 import org.springframework.security.context.SecurityContext;
 import org.springframework.security.context.SecurityContextHolder;
 import org.springframework.security.intercept.method.MethodDefinitionSource;
@@ -166,11 +167,15 @@ public class MethodSecurityInterceptorTests extends TestCase {
    public void testMethodCallWithRunAsReplacement() throws Exception {
        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test", "Password",
                new GrantedAuthority[] {new GrantedAuthorityImpl("MOCK_UPPER")});
-        SecurityContextHolder.getContext().setAuthentication(token);
+        SecurityContext ctx = SecurityContextHolder.getContext();
        ctx.setAuthentication(token);
        ITargetObject target = makeInterceptedTarget();
        String result = target.makeUpperCase("hello");
        assertEquals("HELLO org.springframework.security.MockRunAsAuthenticationToken true", result);
        // Check reset afterwards
        assertSame(ctx, SecurityContextHolder.getContext());
        assertSame(token, SecurityContextHolder.getContext().getAuthentication());
    }
    public void testMethodCallWithoutRunAsReplacement()
@@ -1,12 +1,17 @@
 package org.springframework.security.ldap;
 import static org.junit.Assert.assertNull;
 import javax.naming.directory.DirContext;
 import org.junit.Test;
 import org.springframework.security.BadCredentialsException;
 /**
 * @author Luke Taylor
 * @version $Id$
 */
-public class DefaultSpringSecurityContextSourceTests {
+public class DefaultSpringSecurityContextSourceTests extends AbstractLdapIntegrationTests {
    @Test
    public void instantiationSucceeds() {
@@ -18,4 +23,24 @@ public class DefaultSpringSecurityContextSourceTests {
        new DefaultSpringSecurityContextSource("ldap://myhost:10389/dc=spring%20framework,dc=org");
    }
    @Test
    public void poolingIsntUsedForSingleUser() throws Exception {
        DirContext ctx = getContextSource().getReadWriteContext("uid=Bob,ou=people,dc=springframework,dc=org", "bobspassword");
        //com.sun.jndi.ldap.LdapPoolManager.showStats(System.out);
        assertNull(ctx.getEnvironment().get("com.sun.jndi.ldap.connect.pool"));
        ctx.close();
    }
    @Test(expected=BadCredentialsException.class)
    public void poolingIsntUsedForSingleUser2() throws Exception {
        DirContext ctx = getContextSource().getReadWriteContext("uid=Bob,ou=people,dc=springframework,dc=org", "bobspassword");
        com.sun.jndi.ldap.LdapPoolManager.showStats(System.out);
        ctx.close();
        com.sun.jndi.ldap.LdapPoolManager.showStats(System.out);
        // Now get it gain, with wrong password
        ctx = getContextSource().getReadWriteContext("uid=Bob,ou=people,dc=springframework,dc=org", "wrongpassword");
        com.sun.jndi.ldap.LdapPoolManager.showStats(System.out);
    }
 }
@@ -71,13 +71,11 @@ public class FilterBasedLdapUserSearchTests extends AbstractLdapIntegrationTests
    @Test
    public void extraFilterPartToExcludeBob() throws Exception {
        FilterBasedLdapUserSearch locator = new FilterBasedLdapUserSearch("ou=people",
-                "(&(cn=*)(!(|(uid={0})(uid=rod)(uid=jerry))))", dirCtxFactory);
+                "(&(cn=*)(!(|(uid={0})(uid=rod)(uid=jerry)(uid=slashguy))))", dirCtxFactory);
        // Search for bob, get back ben...
        DirContextOperations ben = locator.searchForUser("bob");
        assertEquals("Ben Alex", ben.getStringAttribute("cn"));
 //        assertEquals("uid=ben,ou=people,"+ROOT_DN, ben.getDn());
    }
    @Test(expected=IncorrectResultSizeDataAccessException.class)
@@ -15,6 +15,13 @@
 package org.springframework.security.providers.dao;
 import static org.mockito.Matchers.anyObject;
 import static org.mockito.Matchers.anyString;
 import static org.mockito.Matchers.isA;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 import junit.framework.TestCase;
 import org.springframework.security.AccountExpiredException;
@@ -32,6 +39,7 @@ import org.springframework.security.providers.UsernamePasswordAuthenticationToke
 import org.springframework.security.providers.dao.cache.EhCacheBasedUserCache;
 import org.springframework.security.providers.dao.cache.NullUserCache;
 import org.springframework.security.providers.dao.salt.SystemWideSaltSource;
 import org.springframework.security.providers.encoding.PasswordEncoder;
 import org.springframework.security.providers.encoding.ShaPasswordEncoder;
 import org.springframework.security.userdetails.User;
@@ -436,6 +444,40 @@ public class DaoAuthenticationProviderTests extends TestCase {
        assertTrue(!provider.supports(TestingAuthenticationToken.class));
    }
    // SEC-2056
    public void testUserNotFoundEncodesPassword() {
        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("missing", "koala");
        PasswordEncoder encoder = mock(PasswordEncoder.class);
        when(encoder.encodePassword(anyString(), anyObject())).thenReturn("koala");
        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
        provider.setHideUserNotFoundExceptions(false);
        provider.setPasswordEncoder(encoder);
        provider.setUserDetailsService(new MockAuthenticationDaoUserrod());
        try {
            provider.authenticate(token);
            fail("Expected Exception");
        } catch(UsernameNotFoundException success) {}
        // ensure encoder invoked w/ non-null strings since PasswordEncoder impls may fail if encoded password is null
        verify(encoder).isPasswordValid(isA(String.class),  isA(String.class), anyObject());
    }
    public void testUserNotFoundNullCredentials() {
        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("missing", null);
        PasswordEncoder encoder = mock(PasswordEncoder.class);
        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
        provider.setHideUserNotFoundExceptions(false);
        provider.setPasswordEncoder(encoder);
        provider.setUserDetailsService(new MockAuthenticationDaoUserrod());
        try {
            provider.authenticate(token);
            fail("Expected Exception");
        } catch(UsernameNotFoundException success) {}
        verify(encoder,times(0)).isPasswordValid(anyString(), anyString(), anyObject());
    }
    //~ Inner Classes ==================================================================================================
    private class MockAuthenticationDaoReturnsNull implements UserDetailsService {
@@ -138,13 +138,7 @@ public class JaasAuthenticationProviderTests extends TestCase {
    }
    public void testFull() throws Exception {
-        GrantedAuthorityImpl role1 = new GrantedAuthorityImpl("ROLE_1");
+        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("user", "password");
        GrantedAuthorityImpl role2 = new GrantedAuthorityImpl("ROLE_2");
        GrantedAuthority[] defaultAuths = new GrantedAuthority[] {role1, role2,};
        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("user", "password",
                defaultAuths);
        assertTrue(jaasProvider.supports(UsernamePasswordAuthenticationToken.class));
@@ -161,10 +155,6 @@ public class JaasAuthenticationProviderTests extends TestCase {
        assertTrue("GrantedAuthorities should contain ROLE_TEST2", list.contains(new GrantedAuthorityImpl("ROLE_TEST2")));
        assertTrue("GrantedAuthorities should contain ROLE_1", list.contains(role1));
        assertTrue("GrantedAuthorities should contain ROLE_2", list.contains(role2));
        boolean foundit = false;
        for (int i = 0; i < list.size(); i++) {
@@ -15,18 +15,17 @@
 package org.springframework.security.providers.ldap.authenticator;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.fail;
 import org.junit.Test;
 import org.springframework.ldap.core.DirContextOperations;
 import org.springframework.security.Authentication;
 import org.springframework.security.BadCredentialsException;
 import org.springframework.security.SpringSecurityMessageSource;
 import org.springframework.security.ldap.AbstractLdapIntegrationTests;
 import org.springframework.security.ldap.search.FilterBasedLdapUserSearch;
 import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
 import org.springframework.ldap.core.DirContextAdapter;
 import org.springframework.ldap.core.DirContextOperations;
 import org.springframework.ldap.core.DistinguishedName;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.fail;
 import org.junit.Test;
 /**
 * Tests for {@link BindAuthenticator}.
@@ -39,7 +38,6 @@ public class BindAuthenticatorTests extends AbstractLdapIntegrationTests {
    private BindAuthenticator authenticator;
    private Authentication bob;
 //    private Authentication ben;
    //~ Methods ========================================================================================================
@@ -48,7 +46,6 @@ public class BindAuthenticatorTests extends AbstractLdapIntegrationTests {
        authenticator = new BindAuthenticator(getContextSource());
        authenticator.setMessageSource(new SpringSecurityMessageSource());
        bob = new UsernamePasswordAuthenticationToken("bob", "bobspassword");
 //        ben = new UsernamePasswordAuthenticationToken("ben", "benspassword");
    }
@@ -72,11 +69,14 @@ public class BindAuthenticatorTests extends AbstractLdapIntegrationTests {
    @Test
    public void testAuthenticationWithUserSearch() throws Exception {
-        DirContextAdapter ctx = new DirContextAdapter(new DistinguishedName("uid=bob,ou=people"));
+//        DirContextAdapter ctx = new DirContextAdapter(new DistinguishedName("uid=bob,ou=people"));
-
+	authenticator.setUserSearch(new FilterBasedLdapUserSearch("ou=people", "(uid={0})", getContextSource()));
        authenticator.setUserSearch(new MockUserSearch(ctx));
    authenticator.afterPropertiesSet();
    authenticator.authenticate(bob);
    // SEC-1444
 	authenticator.setUserSearch(new FilterBasedLdapUserSearch("ou=people", "(cn={0})", getContextSource()));
 	authenticator.authenticate(new UsernamePasswordAuthenticationToken("mouse, jerry", "jerryspassword"));
 	authenticator.authenticate(new UsernamePasswordAuthenticationToken("slash/guy", "slashguyspassword"));
    }
    @Test
@@ -0,0 +1,237 @@
 /* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
 package org.springframework.security.util;
 import org.springframework.security.ConfigAttribute;
 import org.springframework.security.ConfigAttributeDefinition;
 import org.springframework.security.MockFilterConfig;
 import org.springframework.security.context.HttpSessionContextIntegrationFilter;
 import org.springframework.security.intercept.web.MockFilterInvocationDefinitionSource;
 import org.springframework.security.intercept.web.DefaultFilterInvocationDefinitionSource;
 import org.springframework.security.intercept.web.RequestKey;
 import org.springframework.security.ui.webapp.AuthenticationProcessingFilter;
 import org.springframework.beans.factory.BeanCreationException;
 import org.springframework.context.support.ClassPathXmlApplicationContext;
 import org.springframework.context.support.StaticApplicationContext;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
 import org.junit.After;
 import static org.junit.Assert.*;
 import org.junit.Before;
 import org.junit.Test;
 import java.util.LinkedHashMap;
 import java.util.List;
 /**
 * Tests {@link FilterChainProxy}.
 *
 * @author Carlos Sanchez
 * @author Ben Alex
 * @version $Id$
 */
 public class FilterChainProxyConfigTests {
    private ClassPathXmlApplicationContext appCtx;
    //~ Methods ========================================================================================================
    @Before
    public void loadContext() {
        appCtx = new ClassPathXmlApplicationContext("org/springframework/security/util/filtertest-valid.xml");
    }
    @After
    public void closeContext() {
        if (appCtx != null) {
            appCtx.close();
        }
    }
    @Test(expected=IllegalArgumentException.class)
    public void testDetectsFilterInvocationDefinitionSourceThatDoesNotReturnAllConfigAttributes() throws Exception {
        FilterChainProxy filterChainProxy = new FilterChainProxy();
        filterChainProxy.setApplicationContext(new StaticApplicationContext());
        filterChainProxy.setFilterInvocationDefinitionSource(new MockFilterInvocationDefinitionSource(false, false));
        filterChainProxy.afterPropertiesSet();
    }
    @Test(expected=IllegalArgumentException.class)
    public void testDetectsIfConfigAttributeDoesNotReturnValueForGetAttributeMethod() throws Exception {
        FilterChainProxy filterChainProxy = new FilterChainProxy();
        filterChainProxy.setApplicationContext(new StaticApplicationContext());
        ConfigAttributeDefinition cad = new ConfigAttributeDefinition(new MockConfigAttribute());
        LinkedHashMap map = new LinkedHashMap();
        map.put(new RequestKey("/**"), cad);
        DefaultFilterInvocationDefinitionSource fids =
                new DefaultFilterInvocationDefinitionSource(new AntUrlPathMatcher(), map);
        filterChainProxy.setFilterInvocationDefinitionSource(fids);
        filterChainProxy.afterPropertiesSet();
        filterChainProxy.init(new MockFilterConfig());
    }
    @Test(expected = IllegalArgumentException.class)
    public void testDetectsMissingFilterInvocationDefinitionSource() throws Exception {
        FilterChainProxy filterChainProxy = new FilterChainProxy();
        filterChainProxy.setApplicationContext(new StaticApplicationContext());
        filterChainProxy.afterPropertiesSet();
    }
    @Test
    public void testDoNotFilter() throws Exception {
        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("filterChain", FilterChainProxy.class);
        MockFilter filter = (MockFilter) appCtx.getBean("mockFilter", MockFilter.class);
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setServletPath("/do/not/filter/somefile.html");
        MockHttpServletResponse response = new MockHttpServletResponse();
        MockFilterChain chain = new MockFilterChain(true);
        filterChainProxy.doFilter(request, response, chain);
        assertFalse(filter.isWasInitialized());
        assertFalse(filter.isWasDoFiltered());
        assertFalse(filter.isWasDestroyed());
    }
    @Test
    public void misplacedUniversalPathShouldBeDetected() throws Exception {
        try {
            appCtx.getBean("newFilterChainProxyWrongPathOrder", FilterChainProxy.class);
            fail("Expected BeanCreationException");
        } catch (BeanCreationException expected) {
        }
    }
    @Test
    public void normalOperation() throws Exception {
        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("filterChain", FilterChainProxy.class);
        doNormalOperation(filterChainProxy);
    }
    @Test
    public void proxyPathWithoutLowerCaseConversionShouldntMatchDifferentCasePath() throws Exception {
        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("filterChainNonLowerCase", FilterChainProxy.class);
        assertNull(filterChainProxy.getFilters("/some/other/path/blah"));
    }
    @Test
    public void normalOperationWithNewConfig() throws Exception {
        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("newFilterChainProxy", FilterChainProxy.class);
        checkPathAndFilterOrder(filterChainProxy);
        doNormalOperation(filterChainProxy);
    }
    @Test
    public void normalOperationWithNewConfigRegex() throws Exception {
        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("newFilterChainProxyRegex", FilterChainProxy.class);
        checkPathAndFilterOrder(filterChainProxy);
        doNormalOperation(filterChainProxy);
    }
    @Test
    public void normalOperationWithNewConfigNonNamespace() throws Exception {
        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("newFilterChainProxyNonNamespace", FilterChainProxy.class);
        checkPathAndFilterOrder(filterChainProxy);
        doNormalOperation(filterChainProxy);
    }
    @Test
    public void pathWithNoMatchHasNoFilters() throws Exception {
        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("newFilterChainProxyNoDefaultPath", FilterChainProxy.class);
        assertEquals(null, filterChainProxy.getFilters("/nomatch"));
    }
    @Test
    public void urlStrippingPropertyIsRespected() throws Exception {
        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("newFilterChainProxyNoDefaultPath", FilterChainProxy.class);
        // Should only match if we are stripping the query string
        String url = "/blah.bar?x=something";
        assertNotNull(filterChainProxy.getFilters(url));
        assertEquals(2, filterChainProxy.getFilters(url).size());
        filterChainProxy.setStripQueryStringFromUrls(false);
        assertNull(filterChainProxy.getFilters(url));
    }
    private void checkPathAndFilterOrder(FilterChainProxy filterChainProxy) throws Exception {
        List filters = filterChainProxy.getFilters("/foo/blah");
        assertEquals(1, filters.size());
        assertTrue(filters.get(0) instanceof MockFilter);
        filters = filterChainProxy.getFilters("/some/other/path/blah");
        assertNotNull(filters);
        assertEquals(3, filters.size());
        assertTrue(filters.get(0) instanceof HttpSessionContextIntegrationFilter);
        assertTrue(filters.get(1) instanceof MockFilter);
        assertTrue(filters.get(2) instanceof MockFilter);
        filters = filterChainProxy.getFilters("/do/not/filter");
        assertEquals(0, filters.size());
        filters = filterChainProxy.getFilters("/another/nonspecificmatch");
        assertEquals(3, filters.size());
        assertTrue(filters.get(0) instanceof HttpSessionContextIntegrationFilter);
        assertTrue(filters.get(1) instanceof AuthenticationProcessingFilter);
        assertTrue(filters.get(2) instanceof MockFilter);
    }
    private void doNormalOperation(FilterChainProxy filterChainProxy) throws Exception {
        MockFilter filter = (MockFilter) appCtx.getBean("mockFilter", MockFilter.class);
        assertFalse(filter.isWasInitialized());
        assertFalse(filter.isWasDoFiltered());
        assertFalse(filter.isWasDestroyed());
        filterChainProxy.init(new MockFilterConfig());
        assertTrue(filter.isWasInitialized());
        assertFalse(filter.isWasDoFiltered());
        assertFalse(filter.isWasDestroyed());
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setServletPath("/foo/secure/super/somefile.html");
        MockHttpServletResponse response = new MockHttpServletResponse();
        MockFilterChain chain = new MockFilterChain(true);
        filterChainProxy.doFilter(request, response, chain);
        assertTrue(filter.isWasInitialized());
        assertTrue(filter.isWasDoFiltered());
        assertFalse(filter.isWasDestroyed());
        request.setServletPath("/a/path/which/doesnt/match/any/filter.html");
        filterChainProxy.doFilter(request, response, chain);
        filterChainProxy.destroy();
        assertTrue(filter.isWasInitialized());
        assertTrue(filter.isWasDoFiltered());
        assertTrue(filter.isWasDestroyed());
    }
    //~ Inner Classes ==================================================================================================
    private class MockConfigAttribute implements ConfigAttribute {
        public String getAttribute() {
            return null;
        }
    }
 }
@@ -1,237 +1,130 @@
 /* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
 package org.springframework.security.util;
-import org.springframework.security.ConfigAttribute;
+import static org.junit.Assert.assertEquals;
-import org.springframework.security.ConfigAttributeDefinition;
+import static org.mockito.Mockito.*;
 import org.springframework.security.MockFilterConfig;
 import org.springframework.security.context.HttpSessionContextIntegrationFilter;
 import org.springframework.security.intercept.web.MockFilterInvocationDefinitionSource;
 import org.springframework.security.intercept.web.DefaultFilterInvocationDefinitionSource;
 import org.springframework.security.intercept.web.RequestKey;
 import org.springframework.security.ui.webapp.AuthenticationProcessingFilter;
 import org.springframework.beans.factory.BeanCreationException;
 import org.springframework.context.support.ClassPathXmlApplicationContext;
 import org.springframework.context.support.StaticApplicationContext;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
 import org.junit.After;
 import static org.junit.Assert.*;
 import org.junit.Before;
 import org.junit.Test;
 import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.security.firewall.FirewalledRequest;
 import org.springframework.security.firewall.HttpFirewall;
-import java.util.LinkedHashMap;
+import javax.servlet.Filter;
-import java.util.List;
+import javax.servlet.FilterChain;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.util.*;
 /**
- * Tests {@link FilterChainProxy}.
+ * @author Luke Taylor
- *
+ * @author Rob Winch
 * @author Carlos Sanchez
 * @author Ben Alex
 * @version $Id$
 */
@SuppressWarnings({"unchecked"})
 public class FilterChainProxyTests {
-    private ClassPathXmlApplicationContext appCtx;
+    private FilterChainProxy fcp;
-
+    private MockHttpServletRequest request;
-    //~ Methods ========================================================================================================
+    private MockHttpServletResponse response;
    private FilterChain chain;
    private Filter filter;
    @Before
-    public void loadContext() {
+    public void setup() throws Exception {
-        appCtx = new ClassPathXmlApplicationContext("org/springframework/security/util/filtertest-valid.xml");
+        fcp = new FilterChainProxy();
-    }
+        filter = mock(Filter.class);
-
+        doAnswer(new Answer() {
-    @After
+                    public Object answer(InvocationOnMock inv) throws Throwable {
-    public void closeContext() {
+                        Object[] args = inv.getArguments();
-        if (appCtx != null) {
+                        FilterChain fc = (FilterChain) args[2];
-            appCtx.close();
+                        fc.doFilter((HttpServletRequest) args[0], (HttpServletResponse) args[1]);
        }
    }
    @Test(expected=IllegalArgumentException.class)
    public void testDetectsFilterInvocationDefinitionSourceThatDoesNotReturnAllConfigAttributes() throws Exception {
        FilterChainProxy filterChainProxy = new FilterChainProxy();
        filterChainProxy.setApplicationContext(new StaticApplicationContext());
        filterChainProxy.setFilterInvocationDefinitionSource(new MockFilterInvocationDefinitionSource(false, false));
        filterChainProxy.afterPropertiesSet();
    }
    @Test(expected=IllegalArgumentException.class)
    public void testDetectsIfConfigAttributeDoesNotReturnValueForGetAttributeMethod() throws Exception {
        FilterChainProxy filterChainProxy = new FilterChainProxy();
        filterChainProxy.setApplicationContext(new StaticApplicationContext());
        ConfigAttributeDefinition cad = new ConfigAttributeDefinition(new MockConfigAttribute());
        LinkedHashMap map = new LinkedHashMap();
        map.put(new RequestKey("/**"), cad);
        DefaultFilterInvocationDefinitionSource fids =
                new DefaultFilterInvocationDefinitionSource(new AntUrlPathMatcher(), map);
        filterChainProxy.setFilterInvocationDefinitionSource(fids);
        filterChainProxy.afterPropertiesSet();
        filterChainProxy.init(new MockFilterConfig());
    }
    @Test(expected = IllegalArgumentException.class)
    public void testDetectsMissingFilterInvocationDefinitionSource() throws Exception {
        FilterChainProxy filterChainProxy = new FilterChainProxy();
        filterChainProxy.setApplicationContext(new StaticApplicationContext());
        filterChainProxy.afterPropertiesSet();
    }
    @Test
    public void testDoNotFilter() throws Exception {
        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("filterChain", FilterChainProxy.class);
        MockFilter filter = (MockFilter) appCtx.getBean("mockFilter", MockFilter.class);
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setServletPath("/do/not/filter/somefile.html");
        MockHttpServletResponse response = new MockHttpServletResponse();
        MockFilterChain chain = new MockFilterChain(true);
        filterChainProxy.doFilter(request, response, chain);
        assertFalse(filter.isWasInitialized());
        assertFalse(filter.isWasDoFiltered());
        assertFalse(filter.isWasDestroyed());
    }
    @Test
    public void misplacedUniversalPathShouldBeDetected() throws Exception {
        try {
            appCtx.getBean("newFilterChainProxyWrongPathOrder", FilterChainProxy.class);
            fail("Expected BeanCreationException");
        } catch (BeanCreationException expected) {
        }
    }
    @Test
    public void normalOperation() throws Exception {
        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("filterChain", FilterChainProxy.class);
        doNormalOperation(filterChainProxy);
    }
    @Test
    public void proxyPathWithoutLowerCaseConversionShouldntMatchDifferentCasePath() throws Exception {
        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("filterChainNonLowerCase", FilterChainProxy.class);
        assertNull(filterChainProxy.getFilters("/some/other/path/blah"));
    }
    @Test
    public void normalOperationWithNewConfig() throws Exception {
        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("newFilterChainProxy", FilterChainProxy.class);
        checkPathAndFilterOrder(filterChainProxy);
        doNormalOperation(filterChainProxy);
    }
    @Test
    public void normalOperationWithNewConfigRegex() throws Exception {
        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("newFilterChainProxyRegex", FilterChainProxy.class);
        checkPathAndFilterOrder(filterChainProxy);
        doNormalOperation(filterChainProxy);
    }
    @Test
    public void normalOperationWithNewConfigNonNamespace() throws Exception {
        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("newFilterChainProxyNonNamespace", FilterChainProxy.class);
        checkPathAndFilterOrder(filterChainProxy);
        doNormalOperation(filterChainProxy);
    }
    @Test
    public void pathWithNoMatchHasNoFilters() throws Exception {
        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("newFilterChainProxyNoDefaultPath", FilterChainProxy.class);
        assertEquals(null, filterChainProxy.getFilters("/nomatch"));
    }
    @Test
    public void urlStrippingPropertyIsRespected() throws Exception {
        FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("newFilterChainProxyNoDefaultPath", FilterChainProxy.class);
        // Should only match if we are stripping the query string
        String url = "/blah.bar?x=something";
        assertNotNull(filterChainProxy.getFilters(url));
        assertEquals(2, filterChainProxy.getFilters(url).size());
        filterChainProxy.setStripQueryStringFromUrls(false);
        assertNull(filterChainProxy.getFilters(url));
    }
    private void checkPathAndFilterOrder(FilterChainProxy filterChainProxy) throws Exception {
        List filters = filterChainProxy.getFilters("/foo/blah");
        assertEquals(1, filters.size());
        assertTrue(filters.get(0) instanceof MockFilter);
        filters = filterChainProxy.getFilters("/some/other/path/blah");
        assertNotNull(filters);
        assertEquals(3, filters.size());
        assertTrue(filters.get(0) instanceof HttpSessionContextIntegrationFilter);
        assertTrue(filters.get(1) instanceof MockFilter);
        assertTrue(filters.get(2) instanceof MockFilter);
        filters = filterChainProxy.getFilters("/do/not/filter");
        assertEquals(0, filters.size());
        filters = filterChainProxy.getFilters("/another/nonspecificmatch");
        assertEquals(3, filters.size());
        assertTrue(filters.get(0) instanceof HttpSessionContextIntegrationFilter);
        assertTrue(filters.get(1) instanceof AuthenticationProcessingFilter);
        assertTrue(filters.get(2) instanceof MockFilter);
    }
    private void doNormalOperation(FilterChainProxy filterChainProxy) throws Exception {
        MockFilter filter = (MockFilter) appCtx.getBean("mockFilter", MockFilter.class);
        assertFalse(filter.isWasInitialized());
        assertFalse(filter.isWasDoFiltered());
        assertFalse(filter.isWasDestroyed());
        filterChainProxy.init(new MockFilterConfig());
        assertTrue(filter.isWasInitialized());
        assertFalse(filter.isWasDoFiltered());
        assertFalse(filter.isWasDestroyed());
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setServletPath("/foo/secure/super/somefile.html");
        MockHttpServletResponse response = new MockHttpServletResponse();
        MockFilterChain chain = new MockFilterChain(true);
        filterChainProxy.doFilter(request, response, chain);
        assertTrue(filter.isWasInitialized());
        assertTrue(filter.isWasDoFiltered());
        assertFalse(filter.isWasDestroyed());
        request.setServletPath("/a/path/which/doesnt/match/any/filter.html");
        filterChainProxy.doFilter(request, response, chain);
        filterChainProxy.destroy();
        assertTrue(filter.isWasInitialized());
        assertTrue(filter.isWasDoFiltered());
        assertTrue(filter.isWasDestroyed());
    }
    //~ Inner Classes ==================================================================================================
    private class MockConfigAttribute implements ConfigAttribute {
        public String getAttribute() {
                        return null;
                    }
                }).when(filter).doFilter(any(HttpServletRequest.class), any(HttpServletResponse.class), any(FilterChain.class));
        LinkedHashMap map = new LinkedHashMap();
        map.put("/match", Arrays.asList(filter));
        fcp.setFilterChainMap(map);
        request = new MockHttpServletRequest();
        request.setServletPath("/match");
        response = new MockHttpServletResponse();
        chain = mock(FilterChain.class);
    }
    @Test
    public void toStringCallSucceeds() throws Exception {
        fcp.afterPropertiesSet();
        fcp.toString();
    }
    @Test
    public void securityFilterChainIsNotInvokedIfMatchFails() throws Exception {
        request.setServletPath("/nomatch");
        fcp.doFilter(request, response, chain);
        assertEquals(1, fcp.getFilterChainMap().size());
        verifyZeroInteractions(filter);
        // The actual filter chain should be invoked though
        verify(chain).doFilter(any(HttpServletRequest.class), any(HttpServletResponse.class));
    }
    @Test
    public void originalChainIsInvokedAfterSecurityChainIfMatchSucceeds() throws Exception {
        fcp.doFilter(request, response, chain);
        verify(filter).doFilter(any(HttpServletRequest.class), any(HttpServletResponse.class), any(FilterChain.class));
        verify(chain).doFilter(any(HttpServletRequest.class), any(HttpServletResponse.class));
    }
    @Test
    public void originalFilterChainIsInvokedIfMatchingSecurityChainIsEmpty() throws Exception {
        LinkedHashMap map = new LinkedHashMap();
        map.put("/match", Collections.emptyList());
        fcp.setFilterChainMap(map);
        fcp.doFilter(request, response, chain);
        verify(chain).doFilter(any(HttpServletRequest.class), any(HttpServletResponse.class));
    }
    @Test
    public void requestIsWrappedForFilteringWhenMatchIsFound() throws Exception {
        fcp.doFilter(request, response, chain);
        verify(filter).doFilter(any(FirewalledRequest.class), any(HttpServletResponse.class), any(FilterChain.class));
        verify(chain).doFilter(any(FirewalledRequest.class), any(HttpServletResponse.class));
    }
    @Test
    public void requestIsWrappedForFilteringWhenMatchIsNotFound() throws Exception {
        request.setServletPath("/nomatch");
        fcp.doFilter(request, response, chain);
        verifyZeroInteractions(filter);
        verify(chain).doFilter(any(FirewalledRequest.class), any(HttpServletResponse.class));
    }
    // SEC-1639
    @Test
    public void bothWrappersAreResetWithNestedFcps() throws Exception {
        HttpFirewall fw = mock(HttpFirewall.class);
        FilterChainProxy firstFcp = new FilterChainProxy();
        LinkedHashMap fcm = new LinkedHashMap();
        fcm.put("/match", Arrays.asList(fcp));
        firstFcp.setFilterChainMap(fcm);
        firstFcp.setFirewall(fw);
        fcp.setFirewall(fw);
        FirewalledRequest firstFwr = mock(FirewalledRequest.class, "firstFwr");
        when(firstFwr.getRequestURI()).thenReturn("/match");
        when(firstFwr.getContextPath()).thenReturn("");
        FirewalledRequest fwr = mock(FirewalledRequest.class, "fwr");
        when(fwr.getRequestURI()).thenReturn("/match");
        when(fwr.getContextPath()).thenReturn("");
        when(fw.getFirewalledResponse(any(HttpServletResponse.class))).thenReturn(response);
        when(fw.getFirewalledRequest(request)).thenReturn(firstFwr);
        when(fw.getFirewalledRequest(firstFwr)).thenReturn(fwr);
        when(fwr.getRequest()).thenReturn(firstFwr);
        when(firstFwr.getRequest()).thenReturn(request);
        firstFcp.doFilter(request, response, chain);
        verify(firstFwr).reset();
        verify(fwr).reset();
    }
 }
@@ -35,15 +35,6 @@ import java.util.Vector;
 * @version $Id$
 */
 public class AffirmativeBasedTests extends TestCase {
    //~ Constructors ===================================================================================================
    public AffirmativeBasedTests() {
        super();
    }
    public AffirmativeBasedTests(String arg0) {
        super(arg0);
    }
    //~ Methods ========================================================================================================
@@ -53,25 +44,24 @@ public class AffirmativeBasedTests extends TestCase {
    private AffirmativeBased makeDecisionManager() {
        AffirmativeBased decisionManager = new AffirmativeBased();
        RoleVoter roleVoter = new RoleVoter();
        DenyVoter denyForSureVoter = new DenyVoter();
        DenyAgainVoter denyAgainForSureVoter = new DenyAgainVoter();
        List voters = new Vector();
-        voters.add(roleVoter);
+        voters.add(new RoleVoter());
-        voters.add(denyForSureVoter);
+        voters.add(new DenyVoter());
-        voters.add(denyAgainForSureVoter);
+        voters.add(new DenyAgainVoter());
        decisionManager.setDecisionVoters(voters);
        return decisionManager;
    }
    private TestingAuthenticationToken makeTestToken() {
-        return new TestingAuthenticationToken("somebody", "password",
+        return new TestingAuthenticationToken("somebody", "password", "ROLE_1","ROLE_2");
            new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_1"), new GrantedAuthorityImpl("ROLE_2")});
    }
-    public final void setUp() throws Exception {
+    public void testOneAffirmativeGrantsAccess(){
-        super.setUp();
+        AffirmativeBased mgr = makeDecisionManager();
        ConfigAttributeDefinition config = new ConfigAttributeDefinition(new String[]{"ROLE_1", "ROLE_2"});
        mgr.decide(new TestingAuthenticationToken("somebody", "password", "ROLE_1"), new Object(), config);
    }
    public void testOneAffirmativeVoteOneDenyVoteOneAbstainVoteGrantsAccess()
@@ -82,7 +72,6 @@ public class AffirmativeBasedTests extends TestCase {
        ConfigAttributeDefinition config = new ConfigAttributeDefinition(new String[]{"ROLE_1", "DENY_FOR_SURE"});
        mgr.decide(auth, new Object(), config);
        assertTrue(true);
    }
    public void testOneAffirmativeVoteTwoAbstainVotesGrantsAccess()
@@ -93,7 +82,6 @@ public class AffirmativeBasedTests extends TestCase {
        ConfigAttributeDefinition config = new ConfigAttributeDefinition("ROLE_2");
        mgr.decide(auth, new Object(), config);
        assertTrue(true);
    }
    public void testOneDenyVoteTwoAbstainVotesDeniesAccess()
@@ -107,7 +95,6 @@ public class AffirmativeBasedTests extends TestCase {
            mgr.decide(auth, new Object(), config);
            fail("Should have thrown AccessDeniedException");
        } catch (AccessDeniedException expected) {
            assertTrue(true);
        }
    }
@@ -124,7 +111,6 @@ public class AffirmativeBasedTests extends TestCase {
            mgr.decide(auth, new Object(), config);
            fail("Should have thrown AccessDeniedException");
        } catch (AccessDeniedException expected) {
            assertTrue(true);
        }
    }
@@ -138,10 +124,9 @@ public class AffirmativeBasedTests extends TestCase {
        ConfigAttributeDefinition config = new ConfigAttributeDefinition("IGNORED_BY_ALL");
        mgr.decide(auth, new Object(), config);
        assertTrue(true);
    }
-    public void testTwoAffirmativeVotesTwoAbstainVotesGrantsAccess()
+    public void testOneAffirmativeVotesTwoAbstainVotesGrantsAccess()
        throws Exception {
        TestingAuthenticationToken auth = makeTestToken();
        AffirmativeBased mgr = makeDecisionManager();
@@ -149,6 +134,5 @@ public class AffirmativeBasedTests extends TestCase {
        ConfigAttributeDefinition config = new ConfigAttributeDefinition(new String[]{"ROLE_1", "ROLE_2"});
        mgr.decide(auth, new Object(), config);
        assertTrue(true);
    }
 }
@@ -58,6 +58,16 @@ sn: Mouse
 uid: jerry
 userPassword: jerryspassword
 dn: cn=slash/guy,ou=people,dc=springframework,dc=org
 objectclass: top
 objectclass: person
 objectclass: organizationalPerson
 objectclass: inetOrgPerson
 cn: slash/guy
 sn: Slash
 uid: slashguy
 userPassword: slashguyspassword
 dn: cn=developers,ou=groups,dc=springframework,dc=org
 objectclass: top
 objectclass: groupOfNames
@@ -0,0 +1,41 @@
 Bundle-SymbolicName: org.springframework.security.core
 Bundle-Name: Spring Security Core
 Bundle-Vendor: SpringSource
 Bundle-Version: ${version}
 Bundle-ManifestVersion: 2
 Ignored-Existing-Headers: 
 Import-Package,
 Export-Package
 Import-Template: 
 org.aopalliance.*;version="[1.0.0, 2.0.0)",
 org.aspectj.*;version="[1.5.2, 1.7.0)";resolution:=optional,
 org.apache.commons.codec.*;version="[1.3, 2.0)";resolution:=optional,
 org.apache.commons.logging.*;version="[1.0.4, 2.0.0)",
 org.apache.commons.collections.*;version="[3.2.0, 4.0.0)",
 org.jaxen.*;version="[1.1.1, 1.2.0)";resolution:=optional,
 org.springframework.aop.*;version="[2.0.8, 3.1.0)";resolution:=optional,
 org.springframework.beans.*;version="[2.0.8, 3.1.0)",
 org.springframework.context.*;version="[2.0.8, 3.1.0)",
 org.springframework.core.*;version="[2.0.8, 3.1.0)",
 org.springframework.metadata.*;version="[2.0.8, 3.1.0)";resolution:=optional, 
 org.springframework.expression.*;version="[2.0.8, 3.1.0)";resolution:=optional,
 org.springframework.remoting.*;version="[2.0.8, 3.1.0)";resolution:=optional,
 org.springframework.dao.*;version="[2.0.8, 3.1.0)";resolution:=optional,
 org.springframework.jdbc.*;version="[2.0.8, 3.1.0)";resolution:=optional,
 org.springframework.transaction.*;version="[2.0.8, 3.1.0)";resolution:=optional,
 org.springframework.web.context.*;version="[2.0.8, 3.1.0)";resolution:=optional, 
 org.springframework.util;version="[2.0.8, 3.1.0)",
 org.springframework.mock.web;version="[2.0.8, 3.1.0)";resolution:=optional,
 org.springframework.util.xml;version="[2.0.8, 3.1.0)";resolution:=optional,
 org.springframework.ldap.*;version="[1.2.1.A, 1.3.0)";resolution:=optional,
 org.apache.directory.server.*;version="[1.0.2, 1.5)";resolution:=optional,
 net.sf.ehcache.*;version="[1.4.1, 2.0.0)";resolution:=optional,
 javax.crypto.*;version="0";resolution:=optional,
 javax.security.auth.*;version="0";resolution:=optional,
 javax.servlet.*;version="[2.4.0, 3.0.0)";resolution:=optional,
 javax.naming.*;version="0";resolution:=optional,
 javax.rmi.*;version="0";resolution:=optional,
 javax.sql.*;version="0";resolution:=optional,
 javax.xml.parsers;version="0";resolution:=optional,
 org.w3c.dom.*;version="0";resolution:=optional,
 org.xml.sax.*;version="0";resolution:=optional
@@ -5,13 +5,18 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-itest</artifactId>
-        <version>2.0.4-SNAPSHOT</version>
+        <version>2.0.9.CI-SNAPSHOT</version>
    </parent>
    <artifactId>spring-security-itest-context</artifactId>
    <name>Spring Security - Miscellaneous Application Context Integration Tests</name>
    <packaging>jar</packaging>
    <dependencies>
        <dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>servlet-api</artifactId>
            <version>2.5</version>
        </dependency>
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
@@ -0,0 +1,67 @@
 package org.springframework.security.integration;
 import static org.junit.Assert.assertEquals;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.mock.web.MockFilterChain;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.mock.web.MockHttpSession;
 import org.springframework.security.context.HttpSessionContextIntegrationFilter;
 import org.springframework.security.context.SecurityContextHolder;
 import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
 import org.springframework.security.util.AuthorityUtils;
 import org.springframework.security.util.FilterChainProxy;
 import org.springframework.test.context.ContextConfiguration;
 import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
 import javax.servlet.http.HttpSession;
@ContextConfiguration(locations={"/http-path-param-stripping-app-context.xml"})
@RunWith(SpringJUnit4ClassRunner.class)
 public class HttpPathParameterStrippingTests {
    @Autowired
    private FilterChainProxy fcp;
    @Test
    public void securedFilterChainCannotBeBypassedByAddingPathParameters() throws Exception {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setPathInfo("/secured;x=y/admin.html");
        request.setSession(createAuthenticatedSession("ROLE_USER"));
        MockHttpServletResponse response = new MockHttpServletResponse();
        fcp.doFilter(request, response, new MockFilterChain());
        assertEquals(403, response.getStatus());
    }
    @Test
    public void adminFilePatternCannotBeBypassedByAddingPathParameters() throws Exception {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setServletPath("/secured/admin.html;x=user.html");
        request.setSession(createAuthenticatedSession("ROLE_USER"));
        MockHttpServletResponse response = new MockHttpServletResponse();
        fcp.doFilter(request, response, new MockFilterChain());
        assertEquals(403, response.getStatus());
        // Try with pathInfo
        request = new MockHttpServletRequest();
        request.setServletPath("/secured");
        request.setPathInfo("/admin.html;x=user.html");
        request.setSession(createAuthenticatedSession("ROLE_USER"));
        response = new MockHttpServletResponse();
        fcp.doFilter(request, response, new MockFilterChain());
        assertEquals(403, response.getStatus());
    }
    public HttpSession createAuthenticatedSession(String... roles) {
        MockHttpSession session = new MockHttpSession();
        SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken("bob", "bobspassword",
                AuthorityUtils.stringArrayToAuthorityArray(roles)));
        session.setAttribute(HttpSessionContextIntegrationFilter.SPRING_SECURITY_CONTEXT_KEY, SecurityContextHolder.getContext());
        SecurityContextHolder.clearContext();
        return session;
    }
 }
@@ -0,0 +1,28 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
  -
  -->
 <b:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:b="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">
    <http>
        <intercept-url pattern="/secured/*user.html" access="ROLE_USER" />
        <intercept-url pattern="/secured/admin.html" access="ROLE_ADMIN" />
        <intercept-url pattern="/secured/user/**" access="ROLE_USER" />
        <intercept-url pattern="/secured/admin/*" access="ROLE_ADMIN" />
        <intercept-url pattern="/**" filters="none" />
        <form-login />
    </http>
    <authentication-provider>
        <user-service id="userService">
            <user name="notused" password="notused" authorities="ROLE_0,ROLE_1"/>
        </user-service>
    </authentication-provider>
 </b:beans>
@@ -4,7 +4,7 @@
    <artifactId>spring-security-itest</artifactId>
    <name>Spring Security - Integration Tests</name>
    <packaging>pom</packaging>
-    <version>2.0.4-SNAPSHOT</version>
+    <version>2.0.9.CI-SNAPSHOT</version>
    <modules>
        <module>web</module>
        <!-- module>webflow</module-->
@@ -14,7 +14,7 @@
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring</artifactId>
-            <version>2.5.5</version>
+            <version>2.5.6.SEC02</version>
            <exclusions>
                <exclusion>
                    <groupId>commons-logging</groupId>
@@ -25,7 +25,7 @@
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-test</artifactId>
-            <version>2.5.5</version>
+            <version>2.5.6.SEC02</version>
            <exclusions>
                <exclusion>
                    <groupId>commons-logging</groupId>
@@ -5,7 +5,7 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-itest</artifactId>
-        <version>2.0.4-SNAPSHOT</version>
+        <version>2.0.9.CI-SNAPSHOT</version>
    </parent>
    <artifactId>spring-security-itest-web</artifactId>
    <name>Spring Security - Web Integration Tests</name>
@@ -3,7 +3,7 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-parent</artifactId>
-        <version>2.0.5-SNAPSHOT</version>
+        <version>2.0.9.CI-SNAPSHOT</version>
    </parent>
    <packaging>jar</packaging>
    <artifactId>spring-security-ntlm</artifactId>
@@ -3,13 +3,13 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-parent</artifactId>
-        <version>2.0.5-SNAPSHOT</version>
+        <version>2.0.9.CI-SNAPSHOT</version>
    </parent>
    <artifactId>spring-security-openid</artifactId>
    <name>Spring Security - OpenID support</name>
    <description>Spring Security - Support for OpenID</description>
-    <version>2.0.5-SNAPSHOT</version>
+    <version>2.0.9.CI-SNAPSHOT</version>
-    <packaging>bundle</packaging>
+    <packaging>jar</packaging>
    <dependencies>
        <dependency>
@@ -46,25 +46,13 @@
        </dependency>
    </dependencies>
-    <properties>
+    <build>
-        <spring.osgi.export>
+        <plugins>
-            org.springframework.security.*;version=${pom.version.osgi}
+            <plugin>
-        </spring.osgi.export>
+                <groupId>com.springsource.bundlor</groupId>
-
+                <artifactId>com.springsource.bundlor.maven</artifactId>
-        <spring.osgi.import>
+            </plugin>
-            javax.servlet.*;version="[2.4.0, 3.0.0)",
+        </plugins>
-            org.apache.commons.logging.*;version="[1.1.1, 2.0.0)",
+    </build>    
            org.openid4java.*;version="[0.9.3, 1.0.0)",
            org.springframework.security.*;version="[${pom.version.osgi},${pom.version.osgi}]",
            org.springframework.beans.*;version="${spring.version.osgi}",
            org.springframework.util.*;version="${spring.version.osgi}"
        </spring.osgi.import>
        <spring.osgi.private.pkg>
            !org.springframework.security.*
        </spring.osgi.private.pkg>
        <spring.osgi.symbolic.name>org.springframework.security.openid</spring.osgi.symbolic.name>
    </properties>
 </project>
@@ -0,0 +1,15 @@
 Bundle-SymbolicName: org.springframework.security.openid
 Bundle-Name: Spring Security OpenID Support
 Bundle-Vendor: SpringSource
 Bundle-Version: ${version}
 Bundle-ManifestVersion: 2
 Ignored-Existing-Headers: 
 Import-Package,
 Export-Package
 Import-Template:
 javax.servlet.*;version="[2.4.0, 3.0.0)",
 org.apache.commons.logging.*;version="[1.0.4, 2.0.0)",
 org.openid4java.*;version="[0.9.3, 1.0.0)", 
 org.springframework.security.*;version="[${version},${version}]",
 org.springframework.beans.*;version="[2.0.8, 3.1.0)",
 org.springframework.util.*;version="[2.0.8, 3.1.0)" 
@@ -3,18 +3,17 @@
    <modelVersion>4.0.0</modelVersion>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-parent</artifactId>
-    <version>2.0.5-SNAPSHOT</version>
+    <version>2.0.9.CI-SNAPSHOT</version>
    <name>Spring Security</name>
    <packaging>pom</packaging>
    <modules>
        <module>core</module>
        <module>core-tiger</module>
        <module>adapters</module>
        <module>portlet</module>
        <module>ntlm</module>
        <module>openid</module>
-        <module>samples</module>
+        <!--module>samples</module-->
        <module>cas</module>
        <module>acl</module>
        <module>taglibs</module>
@@ -36,11 +35,10 @@
        </license>
    </licenses>
    <!-- Note when doing releases: tagBase is set in release plugin configuration below -->
    <scm>
-        <connection>scm:svn:https://acegisecurity.svn.sourceforge.net/svnroot/acegisecurity/spring-security/trunk</connection>
+        <url>https://github.com/SpringSource/spring-security</url>
-        <developerConnection>scm:svn:https://acegisecurity.svn.sourceforge.net/svnroot/acegisecurity/spring-security/trunk</developerConnection>
+        <connection>scm:git:git://github.com/SpringSource/spring-security</connection>
-        <url>http://acegisecurity.svn.sourceforge.net/viewcvs.cgi/acegisecurity/spring-security/trunk/</url>
+        <developerConnection>scm:git:git://github.com/SpringSource/spring-security</developerConnection>
    </scm>
    <issueManagement>
@@ -54,9 +52,9 @@
    <distributionManagement>
        <repository>
-            <id>spring-milestone</id>
+            <id>spring-release</id>
-            <name>Spring Milestone Repository</name>
+            <name>Spring Release Repository</name>
-            <url>s3://maven.springframework.org/milestone</url>
+            <url>s3://maven.springframework.org/release</url>
        </repository>
        <snapshotRepository>
@@ -64,49 +62,15 @@
            <name>Spring Snapshot Repository</name>
            <url>s3://maven.springframework.org/snapshot</url>
        </snapshotRepository>
        <site>
            <id>local</id>
            <name>Local Site Directory</name>
            <!--
            This variable is set by the build release script. You can also set it on the command line if
            you are running maven directly. e.g. mvn site -DsiteDirectory=file:///home/joe/mysite
            -->
            <url>${siteDirectory}</url>
        </site>
    </distributionManagement>
-    <repositories>
+    <pluginRepositories>
-		<repository>
+        <pluginRepository>
-			<id>spring-external</id>
+            <id>com.springsource.repository.maven.milestone</id>
-			<name>Spring Portfolio Release Repository</name>
+            <name>SpringSource Enterprise Bundle Repository - SpringSource Milestone Releases</name>
-			<url>http://s3.amazonaws.com/maven.springframework.org/external</url>
+            <url>http://repository.springsource.com/maven/bundles/milestone</url>
-		</repository>
+        </pluginRepository>
-    </repositories>
+    </pluginRepositories>
    <mailingLists>
        <mailingList>
            <name>Acegi Developer List</name>
            <subscribe>
                https://lists.sourceforge.net/lists/listinfo/acegisecurity-developer
            </subscribe>
            <!--
                   <unsubscribe>https://lists.sourceforge.net/lists/listinfo/acegisecurity-developer</unsubscribe>
                   <post>acegisecurity-developer@lists.sourceforge.net</post>
               -->
            <archive>
                http://sourceforge.net/mailarchive/forum.php?forum_id=40659
            </archive>
            <otherArchives>
                <otherArchive>
                    http://news.gmane.org/gmane.comp.java.springframework.acegisecurity.devel/
                </otherArchive>
                <otherArchive>
                    http://www.mail-archive.com/acegisecurity-developer@lists.sourceforge.net/
                </otherArchive>
            </otherArchives>
        </mailingList>
    </mailingLists>
    <developers>
        <developer>
@@ -236,11 +200,29 @@
    <build>
        <extensions>
            <extension>
-                <groupId>org.springframework.aws</groupId>
+                <groupId>org.springframework.build.aws</groupId>
-                <artifactId>spring-aws-maven</artifactId>
+                <artifactId>org.springframework.build.aws.maven</artifactId>
-                <version>1.2.2</version>
+                <version>2.0.0.RELEASE</version>
            </extension>
        </extensions>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>com.springsource.bundlor</groupId>
                    <artifactId>com.springsource.bundlor.maven</artifactId>
                    <version>1.0.0.M6</version>
                    <executions>
                        <execution>
                            <id>bundlor</id>
                            <phase>package</phase>
                            <goals>
                                <goal>transform</goal>
                            </goals>
                        </execution>
                    </executions>
                </plugin>
            </plugins>
        </pluginManagement>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
@@ -255,7 +237,7 @@
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-resources-plugin</artifactId>
-                <version>2.2</version>
+                <version>2.6</version>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
@@ -361,10 +343,10 @@
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-release-plugin</artifactId>
-                <version>2.0-beta-7</version>
+                <version>2.0-beta-9</version>
                <configuration>
                    <tagBase>
-                        https://acegisecurity.svn.sourceforge.net/svnroot/acegisecurity/spring-security/tags
+                        https://src.springframework.org/svn/spring-security/tags
                    </tagBase>
                </configuration>
            </plugin>
@@ -390,6 +372,59 @@
                    </dependenciesAsLibraries>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-javadoc-plugin</artifactId>
                <version>2.4</version>
                <executions>
                    <execution>
                        <goals>
                            <goal>jar</goal>
                        </goals>
                        <phase>package</phase>
                    </execution>
                </executions>
                <configuration>                    
                    <header>Spring Security Framework</header>
                    <quiet>true</quiet>
                    <excludePackageNames>sample,bigbank,zzz</excludePackageNames>
                    <links>
                        <link>
                            http://java.sun.com/j2se/1.5.0/docs/api
                        </link>
                        <link>
                            http://static.springframework.org/spring/docs/2.5.x/api/
                        </link>
                        <link>
                            http://commons.apache.org/dbcp/apidocs/
                        </link>
                        <link>
                            http://commons.apache.org/httpclient/apidocs/
                        </link>
                        <link>
                            http://commons.apache.org/pool/apidocs/
                        </link>
                        <link>
                            http://commons.apache.org/lang/api/
                        </link>
                        <link>
                            http://commons.apache.org/codec/apidocs/
                        </link>
                        <link>
                            http://commons.apache.org/collections/apidocs/
                        </link>
                        <link>
                            http://velocity.apache.org/engine/releases/velocity-1.5/apidocs/
                        </link>
                        <link>
                            http://developer.ja-sig.org/projects/cas/cas-server-core/cas-server/cas-server-core/apidocs/
                        </link>
                        <link>
                            http://tomcat.apache.org/tomcat-5.5-doc/servletapi/
                        </link>
                    </links>
                </configuration>
            </plugin>
            <!-- Site -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
@@ -449,35 +484,6 @@
                    </postProcess>
                </configuration>
            </plugin>
             <!-- OSGi Felix bundle plugin -->
             <plugin>
                 <groupId>org.apache.felix</groupId>
                 <artifactId>maven-bundle-plugin</artifactId>
                 <version>1.4.0</version>
                 <extensions>true</extensions>
                 <configuration>
                     <obrRepository>NONE</obrRepository>        
                     <instructions>
                         <!-- bundle specific conf -->      
                         <Bundle-Name>${artifactId}</Bundle-Name>
                         <Bundle-SymbolicName>${spring.osgi.symbolic.name}</Bundle-SymbolicName>
                         <Bundle-Vendor>SpringSource</Bundle-Vendor>
                         <Export-Package>${spring.osgi.export}</Export-Package>
                         <Import-Package>${spring.osgi.import}</Import-Package>
                         <Private-Package>${spring.osgi.private.pkg}</Private-Package>
                         <!--Include-Resource>${spring.osgi.include.res}</Include-Resource-->
                         <!-- jar entries -->
                         <Implementation-Title>Spring Security</Implementation-Title>
                         <Implementation-Version>${pom.version}</Implementation-Version>
                         <Implementation-Vendor>SpringSource</Implementation-Vendor>
                         <Implementation-Vendor-Id>org.springframework.security</Implementation-Vendor-Id>
                         <!-- Spring specific entries -->                         
                         <!--Spring-Version>${spring.maven.artifact.version}</Spring-Version-->
                     </instructions>
                     <excludeDependencies>true</excludeDependencies> 
                 </configuration>
             </plugin>             
        </plugins>
    </build>
@@ -727,9 +733,7 @@
        </dependencies>
    </dependencyManagement>
    <properties>
        <pom.version.osgi>2.0.3.RELEASE</pom.version.osgi>
        <spring.version>2.0.8</spring.version>
        <spring.version.osgi>[2.0.8, 3.0.0)</spring.version.osgi>
        <jstl.version>1.1.2</jstl.version>
        <docbook.source>${basedir}/src/docbkx</docbook.source>
@@ -3,7 +3,7 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-parent</artifactId>
-        <version>2.0.5-SNAPSHOT</version>
+        <version>2.0.9.CI-SNAPSHOT</version>
    </parent>
    <artifactId>spring-security-portlet</artifactId>
    <name>Spring Security - Portlet support</name>
@@ -44,7 +44,7 @@ Release jars for the project are available from the central maven repository
 http://repo1.maven.org/maven2/org/springframework/security/
 Note that milestone releases and snapshots are not uploaded to the central
-repository, but can be obtained from te Spring milestone repository.
+repository, but can be obtained from the Spring milestone repository.
 This blog article has full details on how to download milestone or snapshot
 jars or use them in a Maven-based project build:
@@ -64,14 +64,7 @@ people who wrote Spring Security, and lead the development of the project:
 For peer help and assistance, please use the Spring Security forum
 located at the Spring Community's forum site: 
-  http://forum.springframework.org
+  http://forum.springsource.org
 If you start using Spring Security in your project, please consider joining
 the acegisecurity-developer mailing list. This is currently the best way to
 keep informed about the project's status and provide feedback in design 
 discussions. You can join at:
  https://lists.sourceforge.net/lists/listinfo/acegisecurity-developer.
 Links to mailing list archives, the forums, and other useful resources are
 available from the web site.
@@ -3,7 +3,7 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-samples-cas</artifactId>
-        <version>2.0.5-SNAPSHOT</version>
+        <version>2.0.9.CI-SNAPSHOT</version>
    </parent>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-samples-cas-client</artifactId>
@@ -3,7 +3,7 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-samples</artifactId>
-        <version>2.0.5-SNAPSHOT</version>
+        <version>2.0.9.CI-SNAPSHOT</version>
    </parent>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-samples-cas</artifactId>
@@ -3,7 +3,7 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-samples-cas</artifactId>
-        <version>2.0.5-SNAPSHOT</version>
+        <version>2.0.9.CI-SNAPSHOT</version>
    </parent>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-samples-cas-server</artifactId>
@@ -3,7 +3,7 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-samples</artifactId>
-        <version>2.0.5-SNAPSHOT</version>
+        <version>2.0.9.CI-SNAPSHOT</version>
    </parent>
    <artifactId>spring-security-samples-contacts</artifactId>
    <name>Spring Security - Contacts sample</name>
@@ -3,7 +3,7 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-samples</artifactId>
-        <version>2.0.5-SNAPSHOT</version>
+        <version>2.0.9.CI-SNAPSHOT</version>
    </parent>
    <artifactId>spring-security-samples-dms</artifactId>
    <name>Spring Security - DMS sample</name>
@@ -3,7 +3,7 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-samples</artifactId>
-        <version>2.0.5-SNAPSHOT</version>
+        <version>2.0.9.CI-SNAPSHOT</version>
    </parent>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-samples-ldap</artifactId>
@@ -3,7 +3,7 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-samples</artifactId>
-        <version>2.0.5-SNAPSHOT</version>
+        <version>2.0.9.CI-SNAPSHOT</version>
    </parent>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-samples-openid</artifactId>
@@ -3,7 +3,7 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-parent</artifactId>
-        <version>2.0.5-SNAPSHOT</version>
+        <version>2.0.9.CI-SNAPSHOT</version>
    </parent>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-samples</artifactId>
@@ -3,7 +3,7 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-samples</artifactId>
-        <version>2.0.5-SNAPSHOT</version>
+        <version>2.0.9.CI-SNAPSHOT</version>
    </parent>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-samples-portlet</artifactId>
@@ -3,7 +3,7 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-samples</artifactId>
-        <version>2.0.5-SNAPSHOT</version>
+        <version>2.0.9.CI-SNAPSHOT</version>
    </parent>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-samples-preauth</artifactId>
@@ -3,7 +3,7 @@
    <parent>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-samples</artifactId>
-        <version>2.0.5-SNAPSHOT</version>
+        <version>2.0.9.CI-SNAPSHOT</version>
    </parent>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-samples-tutorial</artifactId>
@@ -10,23 +10,23 @@
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-samples-webflow</artifactId>
    <name>Spring Security - Webflow sample</name>
-    <version>2.0.5-SNAPSHOT</version>
+    <version>2.0.5.CI-SNAPSHOT</version>
    <packaging>war</packaging>
    <dependencies>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-core</artifactId>
-            <version>2.0.4</version>
+            <version>2.0.5.CI-SNAPSHOT</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-core-tiger</artifactId>
-            <version>2.0.4</version>
+            <version>2.0.5.CI-SNAPSHOT</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-taglibs</artifactId>
-            <version>2.0.4</version>
+            <version>2.0.5.CI-SNAPSHOT</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.webflow</groupId>
@@ -3,13 +3,13 @@
    <parent>
        <artifactId>spring-security-parent</artifactId>
        <groupId>org.springframework.security</groupId>
-        <version>2.0.5-SNAPSHOT</version>
+        <version>2.0.9.CI-SNAPSHOT</version>
    </parent>
    <modelVersion>4.0.0</modelVersion>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-taglibs</artifactId>
    <name>Spring Security - JSP taglibs</name>
-    <version>2.0.5-SNAPSHOT</version>
+    <version>2.0.9.CI-SNAPSHOT</version>
    <packaging>jar</packaging>
    <dependencies>
@@ -57,12 +57,17 @@
                <directory>
                    ${basedir}/src/main/resources
                </directory>
                <targetPath>/</targetPath>
                <includes>
                    <include>**/*</include>
                </includes>
                <filtering>false</filtering>
            </resource>            
        </resources>
        <plugins>
            <plugin>
                <groupId>com.springsource.bundlor</groupId>
                <artifactId>com.springsource.bundlor.maven</artifactId>
            </plugin>
        </plugins>        
    </build>
 </project>
@@ -0,0 +1,18 @@
 Bundle-SymbolicName: org.springframework.security.taglibs
 Bundle-Name: Spring Security Taglibs
 Bundle-Vendor: SpringSource
 Bundle-Version: ${version}
 Bundle-ManifestVersion: 2
 Ignored-Existing-Headers: 
 Import-Package,
 Export-Package
 Import-Template: 
 org.apache.commons.logging.*;version="[1.0.4, 2.0.0)",
 org.springframework.security.*;version="[${version}, ${version}]",
 org.springframework.beans.*;version="[2.0.8, 3.1.0)",
 org.springframework.context.*;version="[2.0.8, 3.1.0)",
 org.springframework.web.*;version="[2.0.8, 3.1.0)",
 org.springframework.util;version="[2.0.8, 3.1.0)", 
 net.sf.ehcache.*;version="[1.4.1, 2.0.0)";resolution:=optional, 
 javax.servlet.*;version="0"
Author	SHA1	Message	Date
Rob Winch	c4bcce1ac3	Next development version	2012-10-08 22:24:06 -05:00
Rob Winch	23bdc7d766	Release 2.0.8.RELEASE	2012-10-08 21:18:15 -05:00
Rob Winch	d07d97838a	Update for javadoc execute with package	2012-10-08 21:09:58 -05:00
Rob Winch	f5fc94e1be	SEC-2056: DaoAuthenticationProvider performs isPasswordValid when user not found Previously authenticating a user could take significantly longer than determining that a user does not exist. This was due to the fact that only users that were found would use the password encoder and comparing a password can take a significant amount of time. The difference in the time required could allow a side channel attack that reveals if a user exists. The code has been updated to do comparison against a dummy password even when the the user was not found.	2012-10-08 15:52:40 -05:00
Rob Winch	a4f13a9ae0	Added SCM information to pom for OSS requirements	2012-10-08 07:41:26 -05:00
Rob Winch	5c308c0215	Further maven 3 cleanup	2012-10-07 18:56:51 -05:00
Rob Winch	a0f91b2dd2	Update maven-resources-plugin to 2.6 to work with m2e	2012-10-07 18:21:16 -05:00
Rob Winch	6cf44b9de0	Update maven-dependency-plugin to 2.5.1 to support m2e	2012-10-07 18:09:46 -05:00
Luke Taylor	55e501711d	Set version to 2.0.8.CI-SNAPSHOT	2011-08-19 13:23:04 -07:00
Luke Taylor	d5e6f0b575	Set release version to 2.0.7.RELEASE	2011-08-19 13:18:45 -07:00
Luke Taylor	76dc21469e	SEC-1750: Make sure RunAs replacement is constrained to the SecurityContext of the current thread.	2011-08-19 13:18:45 -07:00
Luke Taylor	22b7c9b905	SEC-1742: Make extraInformation in AuthenticationException transient.	2011-08-19 13:18:45 -07:00
Luke Taylor	0cdf202b10	SEC-1744: Do not trust authorities contained in the authentication request in JaasAuthenticationProvider.	2011-08-19 13:18:45 -07:00
Luke Taylor	a507e3612a	SEC-1741: Modify ContextPropagatingRemoteInvocation to pass a simple combination of principal/credentials as Strings, rather than serializing the whole SecurityContext object from the client.	2011-08-19 13:18:45 -07:00
Luke Taylor	f5fbda42e5	SEC-1790: Reject redirect locations containing CR or LF.	2011-08-19 13:18:35 -07:00
Rob Winch	d5b72275e5	SEC-1639: FirewalledRequest is now called on the specific FirewalledRequest instance rather that looping through ServletRequestWrappers. VirtualFilterChain now accepts the FirewalledRequest in the constructor. The reset method is called directly on the instance passed in instead of looping through the ServletRequestWrappers.	2010-12-17 09:42:25 -06:00
Luke Taylor	08a933f930	SEC-1608: Ensure request wrapper is reset for empty filter chains.	2010-12-08 13:56:08 +00:00
Rob Winch	54ffc98bb4	SEC-1606: Added a FirewalledRequestAwareRequestDispatcher that will call FirewalledRequest.reset() before a forward	2010-11-03 15:01:39 -05:00
Luke Taylor	1c3d530b60	Switch versions to 2.0.7.CI-SNAPSHOT	2010-10-25 17:20:25 +01:00
Luke Taylor	beb0ec4ba9	Version 2.0.6.RELEASE	2010-10-25 17:18:16 +01:00
Luke Taylor	dec2e59fba	SEC-1584: Backport of namespace support for injecting custom HttpFirewall instance into FilterChainProxy.	2010-10-14 20:32:01 +01:00
Luke Taylor	ed7f589998	SEC-1584: Additional integration tests.	2010-10-13 00:05:38 +01:00
Luke Taylor	8f6ddb0f17	SEC-1584: Backport to 2.0.x branch of request firewalling (normalization checks and path-parameter stripping from servletPath and pathInfo).	2010-10-13 00:04:44 +01:00
Luke Taylor	62a8aca853	.gitignore updates	2010-10-03 23:39:33 +01:00
Luke Taylor	9c6a5135a3	SEC-1532: Patch applied to 2.0.x branch	2010-08-26 14:13:01 +01:00
Luke Taylor	0acf262546	SEC-1462: Added suggested patch (effectively the same as changes in 3.0.x and master branches).	2010-04-20 18:16:45 +01:00
Luke Taylor	6ad652ae97	Update 2.0 branch pom versions.	2010-04-20 18:15:51 +01:00
Luke Taylor	068b3d48ec	Add .gitignore to 2.0.x branch	2010-04-16 15:15:54 +01:00
Luke Taylor	d6f6a54455	SEC-1444: Backport of changes to 2.0.x	2010-04-16 15:14:01 +01:00
Luke Taylor	4361211c21	Change release from milestone to release	2009-07-14 12:29:51 +00:00
Luke Taylor	71adc26b0f	[maven-release-plugin] prepare release spring-security-2.0.5.RELEASE	2009-07-14 00:29:53 +00:00
Luke Taylor	eb3288ca34	Removing unnecessary repository declarations	2009-07-13 23:53:12 +00:00
Luke Taylor	f3f4cfe804	Minor changes to readme	2009-07-13 23:48:55 +00:00
Luke Taylor	40fa884860	Updated release plugin version	2009-07-13 23:47:53 +00:00
Luke Taylor	3e393c9df6	Tidying test class	2009-07-13 23:47:33 +00:00
Luke Taylor	a61aca1abf	Update to bundlor M5	2009-07-13 13:07:44 +00:00
Luke Taylor	52d2c904f9	Disable adapters build	2009-07-09 12:38:59 +00:00
Luke Taylor	149fd5d8de	Add bundlor templates	2009-07-09 12:26:11 +00:00
Luke Taylor	f3f02d8aed	Update sec-2.0.x branch to use bundlor	2009-07-09 11:51:26 +00:00
Luke Taylor	781c99f257	SEC-1145: Updated LDAP code to make sure pooling flag is removed when binding as a specific user (for real this time)	2009-06-03 16:57:33 +00:00
Luke Taylor	b77f780993	SEC-1145: Updated LDAP code to make sure pooling flag is removed when binding as a specific user	2009-06-03 16:12:54 +00:00
Scott Battaglia	22964837e9	SEC-1066 upgraded to CAS Client for Java 3.1.5	2008-12-22 19:37:50 +00:00
Scott Battaglia	7566802a08	SEC-1046 upgrade to CAS Client for Java 3.1.4	2008-12-16 14:50:04 +00:00
Luke Taylor	4c3867718e	SEC-1031: Ported change from trunk.	2008-11-11 23:36:47 +00:00