Spring Framework - Security
SPRING FRAMEWORK
Dmitry Noskov
Spring Security 3.0
Application security
Security is arguably one of the most critical
architectural components of any application written
in the 21st century
Spring Framework - Security
Dmitry Noskov
What is Spring Security
a powerful and highly customizable authentication
and access-control framework
build on top of Spring Framework
de-facto standard for securing Spring-based
applications
Spring Framework - Security
Dmitry Noskov
Fundamentals (1)
principal
authentication
user that performs the action
confirming truth of credentials
authorization
define access policy for principal
Spring Framework - Security
Dmitry Noskov
Fundamentals (2)
Authentication
GrantedAuthority
application-wide permissions granted to a principal
SecurityContext
the principal in a Spring Security-specific manner
hold the Authentication and other security information
SecurityContextHolder
provide access to SecurityContext
Spring Framework - Security
Dmitry Noskov
SecurityContextHolder
provide access to SecurityContext
strategies
ThreadLocal
InreritableThreadLocal
Global
Spring Framework - Security
Dmitry Noskov
Getting started
SecurityContext context = SecurityContextHolder.getContext();
Object principal = context.getAuthentication().getPrincipal();
if (principal instanceof UserDetails) {
String username = ((UserDetails)principal).getUsername();
} else {
String username = principal.toString();
}
Spring Framework - Security
Dmitry Noskov
Use case
Spring Framework - Security
Dmitry Noskov
Namespace
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:sec="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="
http://www.springframework.org/schema
/beans
http://www.springframework.org/schema/
beans/spring-beans-3.0.xsd
http://www.springframework.org/schema
/security
http://www.springframework.org/schema
/security/spring-security-3.0.xsd">
Spring Framework - Security
Dmitry Noskov
Filters
Spring Framework - Security
Dmitry Noskov
Security filter
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>
org.springframework.web.filter.DelegatingFilterProxy
</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
Spring Framework - Security
Dmitry Noskov
Filter chain
Spring Framework - Security
Dmitry Noskov
Filter chain (2)
<bean id="springSecurityFilterChain"
class="org.springframework.security.web.FilterChainProxy">
<sec:filter-chain-map path-type="ant">
<sec:filter-chain pattern="/login.do*" filters="none"/>
<sec:filter-chain pattern="/**.do*"
filters="
securityContextPersistenceFilter,
logoutFilter,
usernamePasswordAuthenticationFilter,
rememberMeAuthenticationFilter,
exceptionTranslationFilter,
filterSecurityInterceptor" />
</sec:filter-chain-map>
</bean>
Spring Framework - Security
Dmitry Noskov
Basic filters
Filter
Description
ChannelProcessingFilter
ensures that a request is being sent over HTTP or HTTPS
SecurityContextPersistentFilter
Populates the security context using information obtained from the
repository (http session)
LogoutFilter
Used to log a user out of the application
UsernamePasswordAuthenticationFilter
Accepts the users principal and credentials and attempts to
authenticate the user
BasicAuthenticationFilter
Attempts to authenticate a user by processing an HTTP Basic
authentication
ExceptionTranslationFilter
Handles any AccessDeniedException or
AuthenticationException
FilterSecurityInterceptor
Decides whether or not to allow access to a secured resource
http://static.springsource.org/spring-security/site/docs/3.0.x/reference/nsconfig.html#ns-custom-filters
Spring Framework - Security
Dmitry Noskov
Authentication
Spring Framework - Security
Dmitry Noskov
Authentication variants
credential-based
two-factor
hardware
other
Spring Framework - Security
Dmitry Noskov
Authentication mechanisms
basic
form
x.509
JAAS
etc.
Spring Framework - Security
Dmitry Noskov
Authentication storage
RDMBS
LDAP
custom storage
etc.
Spring Framework - Security
Dmitry Noskov
Fundamentals
Filter
Manager
Provider
Authentication
UserDetails
Spring Framework - Security
Dmitry Noskov
HTML form
<form action="j_spring_security_check" method="post">
<span>Login:</span><input name="login" type="text"/>
<span>Password:</span><input name="password" type="password"/>
<input type="submit" value="Login">
</form>
Spring Framework - Security
Dmitry Noskov
Username-password filter
<bean id="..." class="...security.web.authentication.UsernamePasswordAuthenticationFilter">
<property name="authenticationManager" ref="authenticationManager"/>
<property name="filterProcessesUrl" value="/j_spring_security_check"/>
<property name="usernameParameter" value="login"/>
<property name="passwordParameter" value="password"/>
<property name="authenticationSuccessHandler">
<bean class="...security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
<property name="defaultTargetUrl" value="/index.do"/>
</bean>
</property>
<property name="authenticationFailureHandler">
<bean class="...security.web.authentication.SimpleUrlAuthenticationFailureHandler">
<property name="defaultFailureUrl" value="/login.do"/>
</bean>
</property>
<property name="rememberMeServices" ref="rememberMeService"/>
</bean>
Spring Framework - Security
Dmitry Noskov
Core authentication services
AuthenticationManager
AuthenticationProvider
performs authentication
UserDetailsService
handles authentication requests
responsible for returning an UserDetails object
UerDetails
provides the core user information
Spring Framework - Security
Dmitry Noskov
AuthenticationManager
public interface AuthenticationManager {
/* Attempts to authenticate the passed Authentication object,
* returning a fully populated Authentication object (including
* granted authorities) if successful.
* @param authentication the authentication request object
* @return a fully authenticated object including credentials
* @throws AuthenticationException if authentication fails */
Authentication authenticate(Authentication authentication)
throws AuthenticationException;
}
Spring Framework - Security
Dmitry Noskov
AuthenticationProvider
public interface AuthenticationProvider {
/* Performs authentication.
* @param authentication the authentication request object.
* @return a fully authenticated object including credentials.
* @throws AuthenticationException if authentication fails.*/
Authentication authenticate(Authentication authentication)
throws AuthenticationException;
/*Returns true if this provider supports the indicated
*Authentication object.*/
boolean supports(Class<? extends Object> authentication);
}
Spring Framework - Security
Dmitry Noskov
UserDetailsService
/*Core interface which loads user-specific data.*/
public interface UserDetailsService {
/* Locates the user based on the username.
* @param username the username identifying the user
* @return a fully populated user record (never null)
* @throws UsernameNotFoundException if the user could not be
found or the user has no GrantedAuthority
* @throws DataAccessException if user could not be found for a
repository-specific reason*/
UserDetails loadUserByUsername(String username)
throws UsernameNotFoundException, DataAccessException;
}
Spring Framework - Security
Dmitry Noskov
UserDetails
/* Provides core user information.*/
public interface UserDetails extends Serializable {
Collection<GrantedAuthority> getAuthorities();
String getPassword();
String getUsername();
boolean isAccountNonExpired();
boolean isAccountNonLocked();
boolean isCredentialsNonExpired();
boolean isEnabled();
}
Spring Framework - Security
Dmitry Noskov
Authentication manager
<bean id="..." class="...security.authentication.ProviderManager">
<property name="providers">
<list>
<ref local="casAuthenticationProvider"/>
<ref local="daoAuthenticationProvider"/>
<ref local="ldapAuthenticationProvider"/>
</list>
</property>
</bean>
Spring Framework - Security
Dmitry Noskov
Authentication provider
<bean id="daoAuthenticationProvider"
class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
<property name="userDetailsService" ref="userDetailsService"/>
<property name="saltSource" ref bean="saltSource"/>
<property name="passwordEncoder" ref="passwordEncoder"/>
</bean>
<bean id="userDetailsService"
class="org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl">
<property name="dataSource" ref="dataSource"/>
</bean>
Spring Framework - Security
Dmitry Noskov
Authentication DB schema
Spring Framework - Security
Dmitry Noskov
Password encoding
PasswordEncoder
MD5
SHA
SaltSource
SystemWide
reflection
Spring Framework - Security
Dmitry Noskov
Session management
<bean id="sessionManagementFilter"
class="org.springframework.security.web.session.SessionManagementFilter">
<property name="invalidSessionUrl" value="/timeout.do"/>
<property name="sessionAuthenticationStrategy" ref="strategy"/>
</bean>
<bean id="strategy"
class="SessionFixationProtectionStrategy">
<property name="alwaysCreateSession" value="true"/>
<property name="migrateSessionAttributes" value="true"/>
</bean>
Spring Framework - Security
Dmitry Noskov
Logout
<bean id="logoutFilter"
class="org.springframework.security.web.authentication.logout.LogoutFilter">
<constructor-arg>
<bean class="SimpleUrlLogoutSuccessHandler">
<property name="defaultTargetUrl" value="/login"/>
</bean>
</constructor-arg>
<constructor-arg>
<bean class="SecurityContextLogoutHandler"/>
</constructor-arg>
<property name="filterProcessesUrl" value="/logout"/>
</bean>
Spring Framework - Security
Dmitry Noskov
Remember Me authentication
RememberMeAuthenticationFilter
RememberMeServices
RememberMeAuthenticationProvider
Spring Framework - Security
Dmitry Noskov
RememberMe service
public interface RememberMeServices {
Authentication autoLogin(HttpServletRequest request,
HttpServletResponse response);
void loginFail(HttpServletRequest request,
HttpServletResponse response);
void loginSuccess(HttpServletRequest request,
HttpServletResponse response,
Authentication successfulAuthentication);
}
Spring Framework - Security
Dmitry Noskov
Remember Me shema
Spring Framework - Security
Dmitry Noskov
Anonymous authentication
<bean id="anonymousAuthenticationFilter"
class="...web.authentication.AnonymousAuthenticationFilter">
<property name="key" value="foobar"/>
<property name="userAttribute" value="anonymous,ROLE_ANONYMOUS"/>
</bean>
<bean id="anonymousAuthenticationProvider"
class="...authentication.AnonymousAuthenticationProvider">
<property name="key" value="foobar"/>
</bean>
Spring Framework - Security
Dmitry Noskov
Authentication with magic tags
<sec:http auto-config="true">
<sec:form-login login-page="" login-processing-url=""/>
<sec:anonymous enabled="true"/>
<sec:logout invalidate-session="true" logout-url=""/>
<sec:remember-me services-ref=""/>
</sec:http>
Spring Framework - Security
Dmitry Noskov
Authorization
Spring Framework - Security
Dmitry Noskov
Use case
Spring Framework - Security
Dmitry Noskov
Authorization
handling
pre-invocation
after invocation
implementations
voting based
expression based
Spring Framework - Security
Dmitry Noskov
Security layers
WEB (URLs)
Servlet Filter
methods
Spring AOP
AspectJ
content
JSP tag
Spring Framework - Security
Dmitry Noskov
Security interceptor (1)
Spring Framework - Security
Dmitry Noskov
Security interceptor (2)
Security
Interceptor
Authentication
Manager
Access Decision
Manager
Run-As
Manager
Spring Framework - Security
After-Invocation
Manager
Dmitry Noskov
Voting based
DecisionManager
DecisionVoter
ConfigAttribute
Spring Framework - Security
Dmitry Noskov
Decision managers
Decision manager
Description
AffirmativeBased
Allows access if at least one voter votes to grant access
ConsensusBased
Allows access if a consensus of voters vote to grant access
UnanimousBased
Allows access if all voters vote to grant access
Spring Framework - Security
Dmitry Noskov
Decision voter
public interface AccessDecisionVoter {
int ACCESS_GRANTED = 1;
int ACCESS_ABSTAIN = 0;
int ACCESS_DENIED = -1;
boolean supports(ConfigAttribute attribute);
boolean supports(Class<?> clazz);
int vote(Authentication authentication,
Object object,
Collection<ConfigAttribute> attributes);
}
Spring Framework - Security
Dmitry Noskov
Basic expressions
Expression
Description
hasRole(ROLE_USER)
Returns true if the current principal has the specified role
hasAnyRole(ROLE_USER, ROLE_ADMIN)
Returns true if the current principal has any of the roles
principal
Allows direct access to the principal object representing
the current user
authentication
Allows direct access to the current Authentication object
obtained from the SecurityContext
permitAll
Always evaluates to true
denyAll
Always evaluates to false
isAnonymous()
Returns true if the current principal is an anonymous user
isRememberMe()
Returns true if the current principal is a remember-me user
Spring Framework - Security
Dmitry Noskov
WEB authorization
Spring Framework - Security
Dmitry Noskov
Web authorization
<bean id="..." class="web.access.intercept.FilterSecurityInterceptor">
<property name="authenticationManager" ref="authManager"/>
<property name="accessDecisionManager" ref="decisionManager"/>
<property name="securityMetadataSource">
<sec:filter-security-metadata-source>
<sec:intercept-url pattern="/index.do*"
access="IS_AUTHENTICATED_FULLY"/>
<sec:intercept-url pattern="/**"
access="ROLE_USER"
filters="none"
method="GET"
requires-channel="https"/>
</sec:filter-security-metadata-source>
</property>
</bean>
Spring Framework - Security
Dmitry Noskov
WEB authorization with magic tags
<sec:http use-expressions="true">
<sec:intercept-url pattern="/index*"
access="isAuthenticated()"/>
<sec:intercept-url pattern="/**"
access="hasRole('ROLE_USER')"
filters="none"
method="GET"
requires-channel="https"/>
</sec:http>
Spring Framework - Security
Dmitry Noskov
WEB authorization
<bean id="webExpressionHandler"
class="DefaultWebSecurityExpressionHandler"/>
<bean id="webExpressionVoter" class="WebExpressionVoter">
<property name="expressionHandler" ref="webExpressionHandler"/>
</bean>
<bean class="org.springframework.security.access.vote.AffirmativeBased">
<property name="decisionVoters">
<list>
<ref bean="webExpressionVoter"/>
</list>
</property>
</bean>
Spring Framework - Security
Dmitry Noskov
Custom expression root
public class CustomWebSecurityExpressionRoot
extends WebSecurityExpressionRoot {
public CustomWebSecurityExpressionRoot(Authentication a,
FilterInvocation fi) {
super(a, fi);
}
public boolean hasAllRoles(String... roles) {
return false;
}
}
Spring Framework - Security
Dmitry Noskov
Custom expression handler
public class CustomWebSecurityExpressionHandler
extends DefaultWebSecurityExpressionHandler {
@Override
public EvaluationContext createEvaluationContext(Authentication a,
FilterInvocation fi) {
StandardEvaluationContext ctx =
(StandardEvaluationContext)super.createEvaluationContext(a, fi);
SecurityExpressionRoot root =
new CustomWebSecurityExpressionRoot(a, fi);
ctx.setRootObject(root);
return ctx;
}
}
Spring Framework - Security
Dmitry Noskov
Method authorization
Spring Framework - Security
Dmitry Noskov
Method authorization
annotation driven
voting based - @Secured
expression based - @Pre/@Post
JSR-250 - @RolesAllowed
xml driven
Spring Framework - Security
Dmitry Noskov
Configuration
<sec:global-method-security>
access-decision-manager-ref="accessDecisionManager"
jsr250-annotations="disabled"
pre-post-annotations="disabled"
secured-annotations="enabled"
</sec:global-method-security>
Spring Framework - Security
Dmitry Noskov
Annotation driven (voting)
voting
@Secured({"ROLE_USER"})
void create(Customer customer);
jsr-250
@RolesAllowed({"ROLE_USER"})
void create(Customer customer);
Spring Framework - Security
Dmitry Noskov
Annotation driven (expression)
1
@PreAuthorize("hasRole('ROLE_USER')")
void create(Customer customer);
2
@PreAuthorize("hasRole('ROLE_USER') and hasRole('ROLE_ADMIN')")
void create(Customer customer);
3
@PreAuthorize("hasAnyRole('ROLE_USER', 'ROLE_ADMIN')")
void create(Customer customer);
Spring Framework - Security
Dmitry Noskov
XML driven authorization (1)
<bean id="methodInterceptor" class="MethodSecurityInterceptor">
<property name="authenticationManager" ref="authManager"/>
<property name="accessDecisionManager" ref="decisionManager"/>
<property name="securityMetadataSource">
<value>
org.training.AccountService.createAccount=ROLE_USER
org.training.AccountService.delete*=ROLE_ADMIN
</value>
</property>
</bean>
Spring Framework - Security
Dmitry Noskov
XML driven authorization (2)
<bean id="accountService"
class="org.training.AccountServiceImpl">
<sec:intercept-methods>
<sec:protect access="ROLE_USER" method="createAccount"/>
<sec:protect access="ROLE_ADMIN" method="delete*"/>
</sec:intercept-methods>
</bean>
Spring Framework - Security
Dmitry Noskov
Domain Object Security
Spring Framework - Security
Dmitry Noskov
ACL DB scheme
Spring Framework - Security
Dmitry Noskov
ACL_CLASS
ACL_SID
ACL_OBJECT_IDENTITY
ACL_ENTRY
Spring Framework - Security
Dmitry Noskov
Basic classes
Acl
AccessControlEntry
Permission
Sid
ObjectIdentity
represents the identity of an individual domain object
Spring Framework - Security
Dmitry Noskov
Basic ACL services
AclService
MutableAclService
LookupStrategy
ObjectIdentityRetrievalStrategy
SidRetrievalStrategy
Spring Framework - Security
Dmitry Noskov
Permissions
base permissions
read (1)
write (2)
create (4)
delete (8)
administration (16)
custom permissions
Spring Framework - Security
Dmitry Noskov
Spring Framework - Security
Dmitry Noskov
Configuration (voting)
<sec:global-method-security
access-decision-manager-ref="accessDecisionManager"
secured-annotations="enabled">
</sec:global-method-security>
<bean id="accessDecisionManager" class="AffirmativeBased">
<property name="decisionVoters">
<list>
<ref bean="voter1"/>
<ref bean="voter2"/>
</list>
</property>
</bean>
Spring Framework - Security
Dmitry Noskov
@Secured
annotation
@Secured("ACL_CUSTOMER_READ")
public Customer getProjectsByCustomer(Customer customer) {}
voter
<bean id="customerReadVoter" class="AclEntryVoter">
<constructor-arg ref="aclService"/>
<constructor-arg value="ACL_CUSTOMER_READ"/>
<constructor-arg>
<array>
<util:constant static-field="BasePermission.READ"/>
</array>
</constructor-arg>
<property name="processDomainObjectClass" value="Customer"/>
</bean>
Spring Framework - Security
Dmitry Noskov
Configuration (expressions)
<sec:global-method-security pre-post-annotations="enabled">
<sec:expression-handler ref="expressionHandler"/>
</sec:global-method-security>
<bean id="expressionHandler"
class="DefaultMethodSecurityExpressionHandler">
<property name="permissionEvaluator" ref="permissionEvaluator"/>
</bean>
<bean id="permissionEvaluator" class="AclPermissionEvaluator">
<constructor-arg ref="aclService"/>
</bean>
Spring Framework - Security
Dmitry Noskov
Permission evaluator
public interface PermissionEvaluator {
boolean hasPermission(Authentication authentication,
Object targetDomainObject,
Object permission);
boolean hasPermission(Authentication authentication,
Serializable targetId,
String targetType,
Object permission);
}
Spring Framework - Security
Dmitry Noskov
@PreAuthorize
by domain object
@PreAuthorize("hasPermission(#customer, 'delete')")
public void delete(Customer customer);
by identifier
@PreAuthorize(
"hasPermission(#id, 'org.training.Customer', 'read') or " +
"hasPermission(#id, 'org.training.Customer', 'admin')")
public Customer getById(Long id);
hardcode
@PreAuthorize("#customer.owner.id == principal.id")
public void create(Customer customer);
Spring Framework - Security
Dmitry Noskov
@PreFilter
single parameter
@PreFilter("hasPermission(filterObject, 'read')")
public List<Customer> filterCustomers(List<Customer> customers) {
return customers;
}
multiple parameters
@PreFilter(filterTarget = "customers",
value = "hasPermission(filterObject, 'update')")
public void updateCustomers(List<Customer> customers, State st) {
}
Spring Framework - Security
Dmitry Noskov
Additional features
Spring Framework - Security
Dmitry Noskov
RunAsManager
/*Creates a new temporary Authentication object.*/
public interface RunAsManager {
/ *Returns a replacement Authentication object for the current
*secure object, or null if replacement not required*/
Authentication buildRunAs(Authentication authentication,
Object object,
Collection<ConfigAttribute> attr);
boolean supports(ConfigAttribute attribute);
boolean supports(Class<?> clazz);
}
Spring Framework - Security
Dmitry Noskov
RunAs configuration (1)
<bean id="runAsManager" class="RunAsManagerImpl">
<property name="rolePrefix" value="ROLE_"/>
<property name="key" value="someKey"/>
</bean>
<bean class="RunAsImplAuthenticationProvider">
<property name="key" value="someKey"/>
</bean>
Spring Framework - Security
Dmitry Noskov
RunAs configuration (2)
magic tag
<sec:global-method-security run-as-manager-ref="runAsManager">
</sec:global-method-security>
interceptor bean
<bean class="MethodSecurityInterceptor">
<property name="runAsManager" ref="runAsManager"/>
</bean>
Spring Framework - Security
Dmitry Noskov
After invocation
Spring Framework - Security
Dmitry Noskov
Basic services
public interface AfterInvocationManager {
Object decide(Authentication authentication, Object object,
Collection<ConfigAttribute> attributes,
Object returnedObject) throws AccessDeniedException;
boolean supports(ConfigAttribute attribute);
boolean supports(Class<?> clazz);
}
public interface AfterInvocationProvider {
Object decide(Authentication authentication, Object object,
Collection<ConfigAttribute> attributes,
Object returnedObject) throws AccessDeniedException;
boolean supports(ConfigAttribute attribute);
boolean supports(Class<?> clazz);
}
Spring Framework - Security
Dmitry Noskov
Configuration
custom provider
<sec:global-method-security>
<sec:after-invocation-provider ref="myProvider"/>
</sec:global-method-security>
custom manager
<bean class="MethodSecurityInterceptor">
<property name="afterInvocationManager" ref="myManager"/>
</bean>
Spring Framework - Security
Dmitry Noskov
@Post
@PostAuthorize
@PreAuthorize("hasRole('ROLE_USER')")
@PostAuthorize("hasPermission(returnObject, 'read')")
public Employee getEmployeeByName(String name) {
}
@PostFilter
@PreAuthorize("hasRole('ROLE_USER')")
@PostFilter("hasPermission(filterObject, 'read')")
public List<Employee> getEmployees() {
}
Spring Framework - Security
Dmitry Noskov
JSP tag library
Spring Framework - Security
Dmitry Noskov
Authentication
<%@ taglib prefix="sec"
uri="http://www.springframework.org/security/tags" %>
<sec:authentication property="principal" var="user"/>
<div class="links"><div>Logged in: ${user.name}</div></div>
<div class="links">
<div><sec:authentication property="principal.name"/></div>
</div>
Spring Framework - Security
Dmitry Noskov
Authorize (1)
<%@ taglib prefix="sec"
uri="http://www.springframework.org/security/tags" %>
<sec:authorize ifAllGranted="ROLE_ADMIN, ROLE_SUPERVISOR">
</sec:authorize>
<security:authorize ifAnyGranted="ROLE_ADMIN, ROLE_SUPERVISOR">
</security:authorize>
<security:authorize ifNotGranted="ROLE_ADMIN, ROLE_SUPERVISOR">
</security:authorize>
Spring Framework - Security
Dmitry Noskov
Authorize (2)
<%@ taglib prefix="sec"
uri="http://www.springframework.org/security/tags" %>
<sec:authorize access="hasRole('supervisor')">
This content will only be visible to users who have
the "supervisor" authority in their list of
<tt>GrantedAuthority</tt>s.
</sec:authorize>
Spring Framework - Security
Dmitry Noskov
Authorize (3)
JSP
<sec:authorize url="/admin" >
This content will only be visible to users who are authorized
to send requests to the "/admin" URL.
</sec:authorize>
security interceptor
<bean id="..." class="web.access.intercept.FilterSecurityInterceptor">
<property name="securityMetadataSource">
<sec:filter-security-metadata-source>
<sec:intercept-url pattern="/admin*" access="ROLE_ADMIN"/>
</sec:filter-security-metadata-source>
</property>
</bean>
Spring Framework - Security
Dmitry Noskov
ACL
<%@ taglib prefix="sec"
uri="http://www.springframework.org/security/tags" %>
<sec:accesscontrollist hasPermission="1,2" domainObject="object">
This will be shown if the user has either of the permissions
represented by the values "1" or "2" on the given object.
</sec:accesscontrollist>
Spring Framework - Security
Dmitry Noskov
Summary
Spring Framework - Security
Dmitry Noskov
Separation of concerns
business logic is decoupled from security concern
authentication and authorization are decoupled
Spring Framework - Security
Dmitry Noskov
Flexibility
authentication mechanisms
user data storage
basic, form, cookies, SSO
RDBMS, LDAP, etc.
based on Spring
Spring Framework - Security
Dmitry Noskov
Portability
portable across containers
can be deployed as-is
runs in standalone environment
Spring Framework - Security
Dmitry Noskov
Books
Spring Framework - Security
Dmitry Noskov
Links
main features
http://static.springsource.org/spring-security/site/features.html
articles
http://static.springsource.org/spring-security/site/articles.html
reference
http://static.springsource.org/springsecurity/site/docs/3.0.x/reference/springsecurity.html
blog
http://blog.springsource.com/category/security/
refcardz
http://refcardz.dzone.com/refcardz/expression-basedauthorization
Spring Framework - Security
Dmitry Noskov
Questions
Spring Framework - Core
Dmitry Noskov
The end
http://www.linkedin.com/in/noskovd
http://www.slideshare.net/analizator/presentations
