renamed modules org.springframework.integration.* -> spring-integration-*

@Ignore'd SimpleTcpNetOutboundGatewayTests#testOutboundClose() to avoid failure; this failure is correlated to the module name change, but hard to understand how it would be caused by it

spring-integration-security/src/main/java/org/springframework/integration/security/channel/ChannelAccessPolicy.java

@@ -0,0 +1,64 @@
+/*
+ * Copyright 2002-2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.integration.security.channel;
+
+import org.springframework.security.ConfigAttributeDefinition;
+import org.springframework.util.Assert;
+import org.springframework.util.StringUtils;
+
+/**
+ * Creates the {@link ConfigAttributeDefinition}s for secured channel
+ * send and receive operations based on simple String values.
+ * 
+ * @author Mark Fisher
+ */
+public class ChannelAccessPolicy {
+
+	private final ConfigAttributeDefinition configAttributeDefinitionForSend;
+
+	private final ConfigAttributeDefinition configAttributeDefinitionForReceive;
+
+
+	/**
+	 * Create an access policy instance. The provided 'sendAccess' and 'receiveAccess'
+	 * values may be a single String or a comma-delimited list of values. All whitespace
+	 * will be trimmed. A <code>null</code> value indicates that the policy does not
+	 * apply for either send or receive access type. At most one of the values may be null. 
+	 */
+	public ChannelAccessPolicy(String sendAccess, String receiveAccess) {
+		Assert.isTrue(sendAccess != null || receiveAccess != null,
+				"At least one of 'sendAccess' and 'receiveAccess' must not be null.");
+		String[] sendValues = StringUtils.trimArrayElements(
+				StringUtils.commaDelimitedListToStringArray(sendAccess));
+		String[] receiveValues = StringUtils.trimArrayElements(
+				StringUtils.commaDelimitedListToStringArray(receiveAccess));
+		this.configAttributeDefinitionForSend = (sendValues.length > 0)
+				? new ConfigAttributeDefinition(sendValues) : null;
+		this.configAttributeDefinitionForReceive = (receiveValues.length > 0)
+				? new ConfigAttributeDefinition(receiveValues) : null;
+	}
+
+
+	public ConfigAttributeDefinition getConfigAttributeDefinitionForSend() {
+		return this.configAttributeDefinitionForSend;
+	}
+
+	public ConfigAttributeDefinition getConfigAttributeDefinitionForReceive() {
+		return this.configAttributeDefinitionForReceive;
+	}
+
+}

spring-integration-security/src/main/java/org/springframework/integration/security/channel/ChannelInvocation.java

@@ -0,0 +1,83 @@
+/*
+ * Copyright 2002-2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.integration.security.channel;
+
+import org.aopalliance.intercept.MethodInvocation;
+
+import org.springframework.integration.core.Message;
+import org.springframework.integration.core.MessageChannel;
+import org.springframework.util.Assert;
+
+/**
+ * Secured object for {@link ChannelSecurityInterceptor}. Maintains a reference
+ * to the original {@link MethodInvocation} instance and provides convenient
+ * access to the secured {@link MessageChannel}. If the intercepted invocation
+ * is a <em>send</em> operation, the {@link Message} is also available.
+ * 
+ * @author Mark Fisher
+ */
+public class ChannelInvocation {
+
+	private final MessageChannel channel;
+
+	private final Message<?> message;
+
+	private final MethodInvocation methodInvocation;
+
+
+	/**
+	 * @param methodInvocation the intercepted MethodInvocation instance
+	 */
+	public ChannelInvocation(MethodInvocation methodInvocation) {
+		Assert.notNull(methodInvocation, "MethodInvocation must not be null");
+		Assert.isAssignable(MessageChannel.class, methodInvocation.getThis().getClass(),
+				"MethodInvocation must be on a MessageChannel");
+		this.channel = (MessageChannel) methodInvocation.getThis();
+		if (methodInvocation.getMethod().getName().equals("send")) {
+			if (methodInvocation.getArguments().length < 1 || !(methodInvocation.getArguments()[0] instanceof Message)) {
+				throw new IllegalStateException("expected a Message as the first parameter of the channel's send method");
+			}
+			this.message = (Message<?>) methodInvocation.getArguments()[0];
+		}
+		else {
+			this.message = null;
+		}
+		this.methodInvocation = methodInvocation;
+	}
+
+
+	public MessageChannel getChannel() {
+		return this.channel;
+	}
+
+	public Message<?> getMessage() {
+		return this.message;
+	}
+
+	public MethodInvocation getMethodInvocation() {
+		return this.methodInvocation;
+	}
+
+	public boolean isSend() {
+		return "send".equals(this.methodInvocation.getMethod().getName());
+	}
+
+	public boolean isReceive() {
+		return "receive".equals(this.methodInvocation.getMethod().getName());
+	}
+
+}

spring-integration-security/src/main/java/org/springframework/integration/security/channel/ChannelInvocationDefinitionSource.java

@@ -0,0 +1,112 @@
+/*
+ * Copyright 2002-2010 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.integration.security.channel;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.regex.Pattern;
+
+import org.springframework.integration.context.NamedComponent;
+import org.springframework.integration.core.MessageChannel;
+import org.springframework.security.ConfigAttribute;
+import org.springframework.security.ConfigAttributeDefinition;
+import org.springframework.security.intercept.ObjectDefinitionSource;
+import org.springframework.util.Assert;
+
+/**
+ * The {@link ObjectDefinitionSource} implementation for secured {@link MessageChannel}s.
+ * 
+ * @author Mark Fisher
+ */
+public class ChannelInvocationDefinitionSource implements ObjectDefinitionSource {
+
+	private final Map<Pattern, ChannelAccessPolicy> patternMappings;
+
+
+	public ChannelInvocationDefinitionSource() {
+		this(null);
+	}
+
+	public ChannelInvocationDefinitionSource(Map<Pattern, ChannelAccessPolicy> patternMappings) {
+		this.patternMappings = (patternMappings != null) ? patternMappings
+				: new LinkedHashMap<Pattern, ChannelAccessPolicy>();
+	}
+
+
+	public void addPatternMapping(Pattern pattern, ChannelAccessPolicy accessPolicy) {
+		this.patternMappings.put(pattern, accessPolicy);
+	}
+
+	public Set<Pattern> getPatterns() {
+		return this.patternMappings.keySet();
+	}
+
+	@SuppressWarnings("unchecked")
+	public boolean supports(Class clazz) {
+		return ChannelInvocation.class.isAssignableFrom(clazz);
+	}
+
+	@SuppressWarnings("unchecked")
+	public ConfigAttributeDefinition getAttributes(Object object) throws IllegalArgumentException {
+		Assert.isAssignable(ChannelInvocation.class, object.getClass());
+		ChannelInvocation invocation = (ChannelInvocation) object;
+		MessageChannel channel = invocation.getChannel();
+		Assert.isAssignable(NamedComponent.class, channel.getClass());
+		String channelName = ((NamedComponent) channel).getComponentName();
+		List<ConfigAttribute> attributes = new ArrayList<ConfigAttribute>();
+		for (Map.Entry<Pattern, ChannelAccessPolicy> mapping : this.patternMappings.entrySet()) {
+			Pattern pattern = mapping.getKey();
+			ChannelAccessPolicy accessPolicy = mapping.getValue();
+			if (pattern.matcher(channelName).matches()) {
+				if (invocation.isSend()) {
+					ConfigAttributeDefinition definition = accessPolicy.getConfigAttributeDefinitionForSend();
+					if (definition != null) {
+						attributes.addAll(definition.getConfigAttributes());
+					}
+				}
+				else if (invocation.isReceive()) {
+					ConfigAttributeDefinition definition = accessPolicy.getConfigAttributeDefinitionForReceive();
+					if (definition != null) {
+						attributes.addAll(definition.getConfigAttributes());
+					}
+				}
+			}
+		}
+		return new ConfigAttributeDefinition(attributes);
+	}
+
+	public Collection<?> getConfigAttributeDefinitions() {
+		Set<ConfigAttributeDefinition> definitions = new HashSet<ConfigAttributeDefinition>();
+		for (ChannelAccessPolicy accessPolicy : this.patternMappings.values()) {
+			ConfigAttributeDefinition sendDefinition = accessPolicy.getConfigAttributeDefinitionForSend();
+			if (sendDefinition != null) {
+				definitions.add(sendDefinition);
+			}
+			ConfigAttributeDefinition receiveDefinition = accessPolicy.getConfigAttributeDefinitionForReceive();
+			if (receiveDefinition != null) {
+				definitions.add(receiveDefinition);
+			}
+		}
+		return definitions;
+	}
+
+}

spring-integration-security/src/main/java/org/springframework/integration/security/channel/ChannelSecurityInterceptor.java

@@ -0,0 +1,75 @@
+/*
+ * Copyright 2002-2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.integration.security.channel;
+
+import java.lang.reflect.Method;
+
+import org.aopalliance.intercept.MethodInterceptor;
+import org.aopalliance.intercept.MethodInvocation;
+
+import org.springframework.security.intercept.AbstractSecurityInterceptor;
+import org.springframework.security.intercept.InterceptorStatusToken;
+import org.springframework.security.intercept.ObjectDefinitionSource;
+import org.springframework.util.Assert;
+
+/**
+ * An AOP interceptor that enforces authorization for MessageChannel send and/or receive calls.
+ * 
+ * @author Mark Fisher
+ */
+public class ChannelSecurityInterceptor extends AbstractSecurityInterceptor implements MethodInterceptor {
+
+	private final ChannelInvocationDefinitionSource objectDefinitionSource;
+
+
+	public ChannelSecurityInterceptor(ChannelInvocationDefinitionSource objectDefinitionSource) {
+		Assert.notNull(objectDefinitionSource, "objectDefinitionSource must not be null");
+		this.objectDefinitionSource = objectDefinitionSource;
+	}
+
+
+	@Override
+	public Class<?> getSecureObjectClass() {
+		return ChannelInvocation.class;
+	}
+
+	@Override
+	public ObjectDefinitionSource obtainObjectDefinitionSource() {
+		return this.objectDefinitionSource;
+	}
+
+	public Object invoke(MethodInvocation invocation) throws Throwable {
+		Method method = invocation.getMethod();
+		if (method.getName().equals("send") || method.getName().equals("receive")) {
+			return this.invokeWithAuthorizationCheck(invocation);
+		}
+		return invocation.proceed();
+	}
+
+	private Object invokeWithAuthorizationCheck(MethodInvocation methodInvocation) throws Throwable {
+		Object returnValue = null;
+		InterceptorStatusToken token = super.beforeInvocation(new ChannelInvocation(methodInvocation));
+		try {
+			returnValue = methodInvocation.proceed();
+		}
+		finally {
+			returnValue = super.afterInvocation(token, returnValue);
+		}
+		return returnValue;
+	}
+
+}

spring-integration-security/src/main/java/org/springframework/integration/security/config/ChannelSecurityInterceptorBeanPostProcessor.java

@@ -0,0 +1,71 @@
+/*
+ * Copyright 2002-2010 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.integration.security.config;
+
+import java.util.Set;
+import java.util.regex.Pattern;
+
+import org.springframework.aop.framework.ProxyFactory;
+import org.springframework.aop.support.DefaultPointcutAdvisor;
+import org.springframework.beans.BeansException;
+import org.springframework.beans.factory.config.BeanPostProcessor;
+import org.springframework.integration.core.MessageChannel;
+import org.springframework.integration.security.channel.ChannelInvocationDefinitionSource;
+import org.springframework.integration.security.channel.ChannelSecurityInterceptor;
+import org.springframework.util.Assert;
+
+/**
+ * A {@link BeanPostProcessor} that proxies {@link MessageChannel}s to apply a {@link ChannelSecurityInterceptor}.
+ * 
+ * @author Mark Fisher
+ */
+public class ChannelSecurityInterceptorBeanPostProcessor implements BeanPostProcessor {
+
+	private final ChannelSecurityInterceptor interceptor;
+
+
+	public ChannelSecurityInterceptorBeanPostProcessor(ChannelSecurityInterceptor interceptor) {
+		Assert.notNull(interceptor, "interceptor must not be null");
+		this.interceptor = interceptor;
+	}
+
+
+	public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException {
+		return bean;
+	}
+
+	public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
+		if (bean instanceof MessageChannel && shouldProxy(beanName, (MessageChannel) bean,
+				(ChannelInvocationDefinitionSource) this.interceptor.obtainObjectDefinitionSource())) {
+			ProxyFactory proxyFactory = new ProxyFactory(bean);
+			proxyFactory.addAdvisor(new DefaultPointcutAdvisor(this.interceptor));
+			return proxyFactory.getProxy();
+		}
+		return bean;
+	}
+
+	private boolean shouldProxy(String beanName, MessageChannel channel, ChannelInvocationDefinitionSource definitionSource) {
+		Set<Pattern> patterns = ((ChannelInvocationDefinitionSource) this.interceptor.obtainObjectDefinitionSource()).getPatterns();
+		for (Pattern pattern : patterns) {
+			if (pattern.matcher(beanName).matches()) {
+				return true;
+			}
+		}
+		return false;
+	}
+
+}

spring-integration-security/src/main/java/org/springframework/integration/security/config/IntegrationSecurityNamespaceHandler.java

@@ -0,0 +1,32 @@
+/*
+ * Copyright 2002-2009 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.integration.security.config;
+
+import org.springframework.integration.config.xml.AbstractIntegrationNamespaceHandler;
+
+/**
+ * Namespace handler for the security namespace.
+ * 
+ * @author Jonas Partner
+ */
+public class IntegrationSecurityNamespaceHandler extends AbstractIntegrationNamespaceHandler {
+
+	public void init() {
+		registerBeanDefinitionParser("secured-channels", new SecuredChannelsParser());
+	}
+
+}

spring-integration-security/src/main/java/org/springframework/integration/security/config/SecuredChannelsParser.java

@@ -0,0 +1,98 @@
+/*
+ * Copyright 2002-2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.integration.security.config;
+
+import java.util.List;
+import java.util.regex.Pattern;
+
+import org.w3c.dom.Element;
+
+import org.springframework.beans.factory.config.BeanDefinition;
+import org.springframework.beans.factory.support.BeanDefinitionBuilder;
+import org.springframework.beans.factory.support.BeanDefinitionReaderUtils;
+import org.springframework.beans.factory.support.ManagedMap;
+import org.springframework.beans.factory.xml.AbstractSingleBeanDefinitionParser;
+import org.springframework.beans.factory.xml.ParserContext;
+import org.springframework.integration.config.xml.IntegrationNamespaceUtils;
+import org.springframework.util.StringUtils;
+import org.springframework.util.xml.DomUtils;
+
+/**
+ * Creates a {@link org.springframework.integration.security.channel.ChannelSecurityInterceptor}
+ * to control send and receive access, and creates a bean post-processor to apply the
+ * interceptor to {@link org.springframework.integration.core.MessageChannel}s
+ * whose names match the specified patterns.
+ * 
+ * @author Jonas Partner
+ * @author Mark Fisher
+ */
+public class SecuredChannelsParser extends AbstractSingleBeanDefinitionParser {
+
+	private final static String BASE_PACKAGE_NAME = "org.springframework.integration.security";
+
+
+	@Override
+	protected String getBeanClassName(Element element) {
+		return BASE_PACKAGE_NAME + ".config.ChannelSecurityInterceptorBeanPostProcessor";
+	}
+
+	@Override
+	protected boolean shouldGenerateId() {
+		return true;
+	}
+
+	@Override
+	protected void doParse(Element element, ParserContext parserContext, BeanDefinitionBuilder builder) {
+		String objectDefinitionSourceBeanName = this.parseObjectDefinitionSource(element, parserContext);
+		BeanDefinitionBuilder interceptorBuilder = BeanDefinitionBuilder.genericBeanDefinition(
+				BASE_PACKAGE_NAME + ".channel.ChannelSecurityInterceptor");
+		interceptorBuilder.addConstructorArgReference(objectDefinitionSourceBeanName);
+		IntegrationNamespaceUtils.setReferenceIfAttributeDefined(interceptorBuilder, element, "authentication-manager");
+		IntegrationNamespaceUtils.setReferenceIfAttributeDefined(interceptorBuilder, element, "access-decision-manager");
+		String interceptorBeanName = BeanDefinitionReaderUtils.registerWithGeneratedName(
+				interceptorBuilder.getBeanDefinition(), parserContext.getRegistry());
+		builder.addConstructorArgReference(interceptorBeanName);
+	}
+
+	@SuppressWarnings("unchecked")
+	private String parseObjectDefinitionSource(Element element, ParserContext parserContext) {
+		BeanDefinitionBuilder builder = BeanDefinitionBuilder.genericBeanDefinition(
+				BASE_PACKAGE_NAME + ".channel.ChannelInvocationDefinitionSource");
+		List<Element> accessPolicyElements = (List<Element>) DomUtils.getChildElementsByTagName(element, "access-policy");
+		ManagedMap patternMappings = new ManagedMap();
+		for (Element accessPolicyElement : accessPolicyElements) {
+			Pattern pattern = Pattern.compile(accessPolicyElement.getAttribute("pattern"));
+			String sendAccess = accessPolicyElement.getAttribute("send-access");
+			String receiveAccess = accessPolicyElement.getAttribute("receive-access");
+			if (!StringUtils.hasText(sendAccess) && !StringUtils.hasText(receiveAccess)) {
+				parserContext.getReaderContext().error(
+						"At least one of 'send-access' or 'receive-access' must be provided.", accessPolicyElement);
+			}
+			BeanDefinitionBuilder accessPolicyBuilder = BeanDefinitionBuilder.genericBeanDefinition(
+					BASE_PACKAGE_NAME + ".channel.ChannelAccessPolicy");
+			accessPolicyBuilder.addConstructorArgValue(sendAccess);
+			accessPolicyBuilder.addConstructorArgValue(receiveAccess);
+			accessPolicyBuilder.getBeanDefinition().setRole(BeanDefinition.ROLE_SUPPORT);
+			patternMappings.put(pattern, accessPolicyBuilder.getBeanDefinition());
+		}
+		builder.addConstructorArgValue(patternMappings);
+		builder.setRole(BeanDefinition.ROLE_SUPPORT);
+		return BeanDefinitionReaderUtils.registerWithGeneratedName(
+				builder.getBeanDefinition(), parserContext.getRegistry());
+	}
+
+}

spring-integration-security/src/main/resources/META-INF/spring.handlers

@@ -0,0 +1 @@
+http\://www.springframework.org/schema/integration/security=org.springframework.integration.security.config.IntegrationSecurityNamespaceHandler

spring-integration-security/src/main/resources/META-INF/spring.schemas

@@ -0,0 +1,3 @@
+http\://www.springframework.org/schema/integration/security/spring-integration-security-1.0.xsd=org/springframework/integration/security/config/spring-integration-security-1.0.xsd
+http\://www.springframework.org/schema/integration/security/spring-integration-security-2.0.xsd=org/springframework/integration/security/config/spring-integration-security-2.0.xsd
+http\://www.springframework.org/schema/integration/security/spring-integration-security.xsd=org/springframework/integration/security/config/spring-integration-security-2.0.xsd

spring-integration-security/src/main/resources/META-INF/spring.tooling

@@ -0,0 +1,4 @@
+# Tooling related information for the integration security namespace
+http\://www.springframework.org/schema/integration/security@name=integration security Namespace
+http\://www.springframework.org/schema/integration/security@prefix=int-security
+http\://www.springframework.org/schema/integration/security@icon=org/springframework/integration/security/config/spring-integration-security.gif

spring-integration-security/src/main/resources/org/springframework/integration/security/config/spring-integration-security-1.0.xsd

@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xsd:schema xmlns="http://www.springframework.org/schema/integration/security"
+	xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+	xmlns:beans="http://www.springframework.org/schema/beans"
+	xmlns:tool="http://www.springframework.org/schema/tool"
+	targetNamespace="http://www.springframework.org/schema/integration/security"
+	elementFormDefault="qualified" attributeFormDefault="unqualified">
+
+	<xsd:import namespace="http://www.springframework.org/schema/beans" />
+	<xsd:import namespace="http://www.springframework.org/schema/tool" />
+
+	<xsd:element name="secured-channels">
+		<xsd:complexType>
+			<xsd:annotation>
+				<xsd:documentation>
+	Defines security requirements for one or more Message Channels.
+				</xsd:documentation>
+			</xsd:annotation>
+			<xsd:sequence>
+				<xsd:element name="access-policy" type="accessPolicyType" minOccurs="1" maxOccurs="unbounded"/>
+			</xsd:sequence>
+			<xsd:attribute name="authentication-manager" type="xsd:string" default="authenticationManager">
+				<xsd:annotation>
+					<xsd:appinfo>
+						<tool:annotation kind="ref">
+							<tool:expected-type type="org.springframework.security.AuthenticationManager"/>
+						</tool:annotation>
+					</xsd:appinfo>
+				</xsd:annotation>
+			</xsd:attribute>
+			<xsd:attribute name="access-decision-manager" type="xsd:string" default="accessDecisionManager">
+				<xsd:annotation>
+					<xsd:appinfo>
+						<tool:annotation kind="ref">
+							<tool:expected-type type="org.springframework.security.AccessDecisionManager"/>
+						</tool:annotation>
+					</xsd:appinfo>
+				</xsd:annotation>
+			</xsd:attribute>
+		</xsd:complexType>
+	</xsd:element>
+
+	<xsd:complexType name="accessPolicyType">
+		<xsd:annotation>
+			<xsd:documentation>
+	Defines the security access policy for send and/or receive invocations based on a Message Channel name pattern.
+			</xsd:documentation>
+		</xsd:annotation>
+		<xsd:attribute name="pattern" type="xsd:string" use="required"/>
+		<xsd:attribute name="send-access" type="xsd:string"/>
+		<xsd:attribute name="receive-access" type="xsd:string"/>
+	</xsd:complexType>
+
+</xsd:schema>

spring-integration-security/src/main/resources/org/springframework/integration/security/config/spring-integration-security-2.0.xsd

@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xsd:schema xmlns="http://www.springframework.org/schema/integration/security"
+	xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+	xmlns:beans="http://www.springframework.org/schema/beans"
+	xmlns:tool="http://www.springframework.org/schema/tool"
+	targetNamespace="http://www.springframework.org/schema/integration/security"
+	elementFormDefault="qualified" attributeFormDefault="unqualified">
+
+	<xsd:import namespace="http://www.springframework.org/schema/beans" />
+	<xsd:import namespace="http://www.springframework.org/schema/tool" />
+
+	<xsd:element name="secured-channels">
+		<xsd:complexType>
+			<xsd:annotation>
+				<xsd:documentation>
+	Defines security requirements for one or more Message Channels.
+				</xsd:documentation>
+			</xsd:annotation>
+			<xsd:sequence>
+				<xsd:element name="access-policy" type="accessPolicyType" minOccurs="1" maxOccurs="unbounded"/>
+			</xsd:sequence>
+			<xsd:attribute name="authentication-manager" type="xsd:string" default="authenticationManager">
+				<xsd:annotation>
+					<xsd:appinfo>
+						<tool:annotation kind="ref">
+							<tool:expected-type type="org.springframework.security.AuthenticationManager"/>
+						</tool:annotation>
+					</xsd:appinfo>
+				</xsd:annotation>
+			</xsd:attribute>
+			<xsd:attribute name="access-decision-manager" type="xsd:string" default="accessDecisionManager">
+				<xsd:annotation>
+					<xsd:appinfo>
+						<tool:annotation kind="ref">
+							<tool:expected-type type="org.springframework.security.AccessDecisionManager"/>
+						</tool:annotation>
+					</xsd:appinfo>
+				</xsd:annotation>
+			</xsd:attribute>
+		</xsd:complexType>
+	</xsd:element>
+
+	<xsd:complexType name="accessPolicyType">
+		<xsd:annotation>
+			<xsd:documentation>
+	Defines the security access policy for send and/or receive invocations based on a Message Channel name pattern.
+			</xsd:documentation>
+		</xsd:annotation>
+		<xsd:attribute name="pattern" type="xsd:string" use="required"/>
+		<xsd:attribute name="send-access" type="xsd:string"/>
+		<xsd:attribute name="receive-access" type="xsd:string"/>
+	</xsd:complexType>
+
+</xsd:schema>

spring-integration-security/src/test/java/org/springframework/integration/security/SecurityTestUtils.java

@@ -0,0 +1,47 @@
+/*
+ * Copyright 2002-2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.integration.security;
+
+import org.springframework.security.GrantedAuthority;
+import org.springframework.security.GrantedAuthorityImpl;
+import org.springframework.security.context.SecurityContext;
+import org.springframework.security.context.SecurityContextImpl;
+import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
+
+/**
+ * @author Jonas Partner
+ */
+public class SecurityTestUtils {
+
+	public static SecurityContext createContext(String username, String password, String... roles) {
+		SecurityContextImpl ctxImpl = new SecurityContextImpl();
+		UsernamePasswordAuthenticationToken authToken;
+		if (roles != null && roles.length > 0) {
+			GrantedAuthority[] authorities = new GrantedAuthority[roles.length];
+			for (int i = 0; i < roles.length; i++) {
+				authorities[i] = new GrantedAuthorityImpl(roles[i]);
+			}
+			authToken = new UsernamePasswordAuthenticationToken(username, password, authorities);
+		}
+		else {
+			authToken = new UsernamePasswordAuthenticationToken(username, password);
+		}
+		ctxImpl.setAuthentication(authToken);
+		return ctxImpl;
+	}
+
+}

spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelAdapterSecurityIntegrationTests-context.xml

@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans:beans xmlns="http://www.springframework.org/schema/integration"
+ 	xmlns:si-security="http://www.springframework.org/schema/integration/security"
+	xmlns:beans="http://www.springframework.org/schema/beans"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:security="http://www.springframework.org/schema/security"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xsi:schemaLocation="http://www.springframework.org/schema/beans
+			http://www.springframework.org/schema/beans/spring-beans.xsd
+			http://www.springframework.org/schema/security
+			http://www.springframework.org/schema/security/spring-security.xsd
+			http://www.springframework.org/schema/integration
+			http://www.springframework.org/schema/integration/spring-integration.xsd
+			http://www.springframework.org/schema/integration/security
+			http://www.springframework.org/schema/integration/security/spring-integration-security.xsd
+			http://www.springframework.org/schema/context
+			http://www.springframework.org/schema/context/spring-context.xsd">
+
+	<beans:import resource="classpath:org/springframework/integration/security/config/commonSecurityConfiguration.xml"/>
+
+	<si-security:secured-channels>
+		<si-security:access-policy pattern="secured.*" send-access="ROLE_ADMIN"/>
+	</si-security:secured-channels>
+
+	<beans:bean id="testHandler" class="org.springframework.integration.security.channel.TestHandler"/>
+
+	<outbound-channel-adapter id="securedChannelAdapter" ref="testHandler"/>
+
+	<outbound-channel-adapter id="unsecuredChannelAdapter" ref="testHandler"/>
+
+</beans:beans>

spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelAdapterSecurityIntegrationTests.java

@@ -0,0 +1,111 @@
+/*
+ * Copyright 2002-2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.integration.security.channel;
+
+import static org.junit.Assert.assertEquals;
+
+import org.junit.After;
+import org.junit.Test;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.integration.core.MessageChannel;
+import org.springframework.integration.message.StringMessage;
+import org.springframework.integration.security.SecurityTestUtils;
+import org.springframework.security.AccessDeniedException;
+import org.springframework.security.AuthenticationException;
+import org.springframework.security.context.SecurityContext;
+import org.springframework.security.context.SecurityContextHolder;
+import org.springframework.test.annotation.DirtiesContext;
+import org.springframework.test.context.ContextConfiguration;
+import org.springframework.test.context.junit4.AbstractJUnit4SpringContextTests;
+
+/**
+ * @author Mark Fisher
+ */
+@ContextConfiguration
+public class ChannelAdapterSecurityIntegrationTests extends AbstractJUnit4SpringContextTests {
+
+	@Autowired
+	@Qualifier("securedChannelAdapter")
+	MessageChannel securedChannelAdapter;
+
+	@Autowired
+	@Qualifier("unsecuredChannelAdapter")
+	MessageChannel unsecuredChannelAdapter;
+
+	@Autowired
+	TestHandler testConsumer;
+
+
+	@After
+	public void tearDown() {
+		SecurityContextHolder.clearContext();
+	}
+
+
+	@Test
+	@DirtiesContext
+	public void testSecuredWithPermission() {
+		login("bob", "bobspassword", "ROLE_ADMIN");
+		securedChannelAdapter.send(new StringMessage("test"));
+		assertEquals("Wrong size of message list in target", 1, testConsumer.sentMessages.size());
+	}
+
+	@Test(expected = AccessDeniedException.class)
+	@DirtiesContext
+	public void testSecuredWithoutPermision() {
+		login("bob", "bobspassword", "ROLE_USER");
+		securedChannelAdapter.send(new StringMessage("test"));
+	}
+
+	@Test(expected = AuthenticationException.class)
+	@DirtiesContext
+	public void testSecuredWithoutAuthenticating() {
+		securedChannelAdapter.send(new StringMessage("test"));
+	}
+
+	@Test
+	@DirtiesContext
+	public void testUnsecuredAsAdmin() {
+		login("bob", "bobspassword", "ROLE_ADMIN");
+		unsecuredChannelAdapter.send(new StringMessage("test"));
+		assertEquals("Wrong size of message list in target", 1, testConsumer.sentMessages.size());
+	}
+
+	@Test
+	@DirtiesContext
+	public void testUnsecuredAsUser() {
+		login("bob", "bobspassword", "ROLE_USER");
+		unsecuredChannelAdapter.send(new StringMessage("test"));
+		assertEquals("Wrong size of message list in target", 1, testConsumer.sentMessages.size());
+	}
+
+	@Test
+	@DirtiesContext
+	public void testUnsecuredWithoutAuthenticating() {
+		unsecuredChannelAdapter.send(new StringMessage("test"));
+		assertEquals("Wrong size of message list in target", 1, testConsumer.sentMessages.size());
+	}
+
+
+	private void login(String username, String password, String... roles) {
+		SecurityContext context = SecurityTestUtils.createContext(username, password, roles);
+		SecurityContextHolder.setContext(context);
+	}
+
+}

spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelSecurityInterceptorBeanPostProcessorTests.java

@@ -0,0 +1,60 @@
+/*
+ * Copyright 2002-2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.integration.security.channel;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import java.util.regex.Pattern;
+
+import org.junit.Test;
+
+import org.springframework.aop.support.AopUtils;
+import org.springframework.integration.channel.QueueChannel;
+import org.springframework.integration.core.MessageChannel;
+import org.springframework.integration.security.config.ChannelSecurityInterceptorBeanPostProcessor;
+
+/**
+ * @author Mark Fisher
+ */
+public class ChannelSecurityInterceptorBeanPostProcessorTests {
+
+	@Test
+	public void securedChannelIsProxied() {
+		ChannelInvocationDefinitionSource objectDefinitionSource = new ChannelInvocationDefinitionSource();
+		objectDefinitionSource.addPatternMapping(Pattern.compile("secured.*"), new ChannelAccessPolicy("ROLE_ADMIN", null));
+		ChannelSecurityInterceptor interceptor = new ChannelSecurityInterceptor(objectDefinitionSource);
+		ChannelSecurityInterceptorBeanPostProcessor postProcessor = new ChannelSecurityInterceptorBeanPostProcessor(interceptor);
+		QueueChannel securedChannel = new QueueChannel();
+		securedChannel.setBeanName("securedChannel");
+		MessageChannel postProcessedChannel = (MessageChannel) postProcessor.postProcessAfterInitialization(securedChannel, "securedChannel");
+		assertTrue(AopUtils.isAopProxy(postProcessedChannel));
+	}
+
+	@Test
+	public void nonsecuredChannelIsNotProxied() {
+		ChannelInvocationDefinitionSource objectDefinitionSource = new ChannelInvocationDefinitionSource();
+		objectDefinitionSource.addPatternMapping(Pattern.compile("secured.*"), new ChannelAccessPolicy("ROLE_ADMIN", null));
+		ChannelSecurityInterceptor interceptor = new ChannelSecurityInterceptor(objectDefinitionSource);
+		ChannelSecurityInterceptorBeanPostProcessor postProcessor = new ChannelSecurityInterceptorBeanPostProcessor(interceptor);
+		QueueChannel channel = new QueueChannel();
+		channel.setBeanName("testChannel");
+		MessageChannel postProcessedChannel = (MessageChannel) postProcessor.postProcessAfterInitialization(channel, "testChannel");
+		assertFalse(AopUtils.isAopProxy(postProcessedChannel));
+	}
+
+}

spring-integration-security/src/test/java/org/springframework/integration/security/channel/ChannelSecurityInterceptorTests.java

@@ -0,0 +1,92 @@
+/*
+ * Copyright 2002-2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.integration.security.channel;
+
+import java.util.Collections;
+import java.util.regex.Pattern;
+
+import org.junit.After;
+import org.junit.Test;
+
+import org.springframework.aop.framework.ProxyFactory;
+import org.springframework.integration.channel.QueueChannel;
+import org.springframework.integration.core.MessageChannel;
+import org.springframework.integration.message.StringMessage;
+import org.springframework.integration.security.SecurityTestUtils;
+import org.springframework.security.AccessDeniedException;
+import org.springframework.security.AuthenticationException;
+import org.springframework.security.MockAuthenticationManager;
+import org.springframework.security.context.SecurityContext;
+import org.springframework.security.context.SecurityContextHolder;
+import org.springframework.security.vote.AffirmativeBased;
+import org.springframework.security.vote.RoleVoter;
+
+/**
+ * @author Mark Fisher
+ */
+public class ChannelSecurityInterceptorTests {
+
+	@After
+	public void clearSecurityContext() {
+		SecurityContextHolder.clearContext();
+	}
+
+	@Test(expected = AuthenticationException.class)
+	public void securedSendWithoutAuthentication() throws Exception {
+		MessageChannel channel = getSecuredChannel("ROLE_ADMIN");
+		channel.send(new StringMessage("test"));
+	}
+
+	@Test(expected = AccessDeniedException.class)
+	public void securedSendWithoutRole() throws Exception {
+		MessageChannel channel = getSecuredChannel("ROLE_ADMIN");
+		SecurityContext context = SecurityTestUtils.createContext("test", "pwd", "ROLE_USER");
+		SecurityContextHolder.setContext(context);
+		channel.send(new StringMessage("test"));
+	}
+
+	@Test
+	public void securedSendWithRole() throws Exception {
+		MessageChannel channel = getSecuredChannel("ROLE_ADMIN");
+		SecurityContext context = SecurityTestUtils.createContext("test", "pwd", "ROLE_ADMIN");
+		SecurityContextHolder.setContext(context);
+		channel.send(new StringMessage("test"));
+	}
+
+
+	private static MessageChannel getSecuredChannel(String role) throws Exception {
+		QueueChannel channel = new QueueChannel();
+		channel.setBeanName("securedChannel");
+		ProxyFactory proxyFactory = new ProxyFactory(channel);
+		proxyFactory.addAdvice(createInterceptor(role));
+		return (MessageChannel) proxyFactory.getProxy();
+	}
+
+	private static ChannelSecurityInterceptor createInterceptor(String role) throws Exception {
+		ChannelInvocationDefinitionSource objectDefinitionSource = new ChannelInvocationDefinitionSource();
+		objectDefinitionSource.addPatternMapping(Pattern.compile("secured.*"), new ChannelAccessPolicy(role, null));
+		ChannelSecurityInterceptor interceptor = new ChannelSecurityInterceptor(objectDefinitionSource);
+		AffirmativeBased accessDecisionManager = new AffirmativeBased();
+		accessDecisionManager.setDecisionVoters(Collections.singletonList(new RoleVoter()));
+		accessDecisionManager.afterPropertiesSet();
+		interceptor.setAccessDecisionManager(accessDecisionManager);
+		interceptor.setAuthenticationManager(new MockAuthenticationManager(true));
+		interceptor.afterPropertiesSet();
+		return interceptor;
+	}
+
+}

spring-integration-security/src/test/java/org/springframework/integration/security/channel/TestHandler.java

@@ -0,0 +1,36 @@
+/*
+ * Copyright 2002-2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.integration.security.channel;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.springframework.integration.core.Message;
+import org.springframework.integration.message.MessageHandler;
+
+/**
+ * @author Mark Fisher
+ */
+public class TestHandler implements MessageHandler {
+
+	public List<Message<?>> sentMessages = new ArrayList<Message<?>>();
+
+	public void handleMessage(Message<?> message) {
+		sentMessages.add(message);
+	}
+
+}

spring-integration-security/src/test/java/org/springframework/integration/security/config/DefaultConfigurationTests-context.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:security="http://www.springframework.org/schema/integration/security"
+	xsi:schemaLocation="http://www.springframework.org/schema/beans
+			http://www.springframework.org/schema/beans/spring-beans.xsd
+			http://www.springframework.org/schema/integration/security
+			http://www.springframework.org/schema/integration/security/spring-integration-security.xsd">
+
+	<import resource="classpath:org/springframework/integration/security/config/commonSecurityConfiguration.xml"/>
+
+	<security:secured-channels>
+		<security:access-policy pattern="test" send-access="ROLE_ADMIN"/>
+	</security:secured-channels>
+
+</beans>

spring-integration-security/src/test/java/org/springframework/integration/security/config/DefaultConfigurationTests.java

@@ -0,0 +1,72 @@
+/*
+ * Copyright 2002-2009 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.integration.security.config;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import org.springframework.beans.DirectFieldAccessor;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationContext;
+import org.springframework.integration.channel.MessagePublishingErrorHandler;
+import org.springframework.integration.channel.NullChannel;
+import org.springframework.integration.channel.PublishSubscribeChannel;
+import org.springframework.integration.context.IntegrationContextUtils;
+import org.springframework.scheduling.concurrent.ThreadPoolTaskScheduler;
+import org.springframework.test.context.ContextConfiguration;
+import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
+
+/**
+ * @author Mark Fisher
+ * @since 1.0.3
+ */
+@RunWith(SpringJUnit4ClassRunner.class)
+@ContextConfiguration
+public class DefaultConfigurationTests {
+
+	@Autowired
+	private ApplicationContext context;
+
+
+	@Test
+	public void verifyErrorChannel() {
+		Object errorChannel = context.getBean("errorChannel");
+		assertNotNull(errorChannel);
+		assertEquals(PublishSubscribeChannel.class, errorChannel.getClass());
+	}
+
+	@Test
+	public void verifyNullChannel() {
+		Object nullChannel = context.getBean("nullChannel");
+		assertNotNull(nullChannel);
+		assertEquals(NullChannel.class, nullChannel.getClass());
+	}
+
+	@Test
+	public void verifyTaskScheduler() {
+		Object taskScheduler = context.getBean(IntegrationContextUtils.TASK_SCHEDULER_BEAN_NAME);
+		assertEquals(ThreadPoolTaskScheduler.class, taskScheduler.getClass());
+		Object errorHandler = new DirectFieldAccessor(taskScheduler).getPropertyValue("errorHandler");
+		assertEquals(MessagePublishingErrorHandler.class, errorHandler.getClass());
+		Object defaultErrorChannel = new DirectFieldAccessor(errorHandler).getPropertyValue("defaultErrorChannel");
+		assertEquals(context.getBean(IntegrationContextUtils.ERROR_CHANNEL_BEAN_NAME), defaultErrorChannel);
+	}
+
+}

spring-integration-security/src/test/java/org/springframework/integration/security/config/SecuredChannelsParserTests-context.xml

@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans:beans xmlns="http://www.springframework.org/schema/integration"
+ 	xmlns:si-security="http://www.springframework.org/schema/integration/security"
+	xmlns:beans="http://www.springframework.org/schema/beans"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:security="http://www.springframework.org/schema/security"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xsi:schemaLocation="http://www.springframework.org/schema/beans
+			http://www.springframework.org/schema/beans/spring-beans.xsd
+			http://www.springframework.org/schema/security
+			http://www.springframework.org/schema/security/spring-security.xsd
+			http://www.springframework.org/schema/integration
+			http://www.springframework.org/schema/integration/spring-integration.xsd
+			http://www.springframework.org/schema/integration/security
+			http://www.springframework.org/schema/integration/security/spring-integration-security.xsd
+			http://www.springframework.org/schema/context
+			http://www.springframework.org/schema/context/spring-context.xsd">
+
+	<beans:import resource="classpath:org/springframework/integration/security/config/commonSecurityConfiguration.xml"/>
+
+	<si-security:secured-channels>
+		<si-security:access-policy pattern="adminRequiredForSend" send-access="ROLE_ADMIN"/>
+		<si-security:access-policy pattern="adminOrUserRequiredForSend" send-access="ROLE_ADMIN, ROLE_USER"/>
+		<si-security:access-policy pattern="adminRequiredForReceive" receive-access="ROLE_ADMIN"/>
+		<si-security:access-policy pattern="adminOrUserRequiredForReceive" receive-access="ROLE_ADMIN, ROLE_USER"/>
+		<si-security:access-policy pattern="adminRequiredForSendAndReceive" send-access="ROLE_ADMIN" receive-access="ROLE_ADMIN"/>
+	</si-security:secured-channels>
+
+</beans:beans>

spring-integration-security/src/test/java/org/springframework/integration/security/config/SecuredChannelsParserTests.java

@@ -0,0 +1,220 @@
+/*
+ * Copyright 2002-2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.integration.security.config;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.regex.Pattern;
+
+import org.junit.Before;
+import org.junit.Test;
+
+import org.springframework.aop.Advisor;
+import org.springframework.aop.framework.Advised;
+import org.springframework.aop.support.AopUtils;
+import org.springframework.beans.DirectFieldAccessor;
+import org.springframework.integration.channel.AbstractPollableChannel;
+import org.springframework.integration.channel.ChannelInterceptor;
+import org.springframework.integration.core.Message;
+import org.springframework.integration.core.MessageChannel;
+import org.springframework.integration.security.channel.ChannelAccessPolicy;
+import org.springframework.integration.security.channel.ChannelInvocationDefinitionSource;
+import org.springframework.integration.security.channel.ChannelSecurityInterceptor;
+import org.springframework.integration.selector.MessageSelector;
+import org.springframework.security.ConfigAttribute;
+import org.springframework.security.ConfigAttributeDefinition;
+import org.springframework.test.context.ContextConfiguration;
+import org.springframework.test.context.junit4.AbstractJUnit4SpringContextTests;
+
+/**
+ * @author Jonas Partner
+ * @author Mark Fisher
+ */
+@ContextConfiguration
+public class SecuredChannelsParserTests extends AbstractJUnit4SpringContextTests {
+
+	TestMessageChannel messageChannel;
+
+	@Before
+	public void setUp() {
+		messageChannel = new TestMessageChannel();
+	}
+
+	@Test
+	public void testAdminRequiredForSend() {
+		String beanName = "adminRequiredForSend";
+		messageChannel.setBeanName(beanName);
+		MessageChannel proxy = (MessageChannel) applicationContext.getAutowireCapableBeanFactory()
+				.applyBeanPostProcessorsAfterInitialization(messageChannel, beanName);
+		assertTrue("Channel was not proxied", AopUtils.isAopProxy(proxy));
+		Advisor[] advisors = ((Advised) proxy).getAdvisors();
+		assertEquals("Wrong number of interceptors", 1, advisors.length);
+		ChannelSecurityInterceptor interceptor = (ChannelSecurityInterceptor) advisors[0].getAdvice();
+		ChannelAccessPolicy policy = this.retrievePolicyForPatternString(beanName, interceptor);
+		assertNotNull("Pattern '" + beanName + "' is not included in mappings", policy);
+		ConfigAttributeDefinition sendDefinition = policy.getConfigAttributeDefinitionForSend();
+		ConfigAttributeDefinition receiveDefinition = policy.getConfigAttributeDefinitionForReceive();
+		assertTrue("ROLE_ADMIN not found as send attribute", this.getRolesFromDefintion(sendDefinition).contains("ROLE_ADMIN"));
+		assertNull("Policy applies to receive", receiveDefinition);
+	}
+
+	@Test
+	public void testAdminOrUserRequiredForSend() {
+		String beanName = "adminOrUserRequiredForSend";
+		messageChannel.setBeanName(beanName);
+		MessageChannel proxy = (MessageChannel) applicationContext.getAutowireCapableBeanFactory()
+				.applyBeanPostProcessorsAfterInitialization(messageChannel, beanName);
+		assertTrue("Channel was not proxied", AopUtils.isAopProxy(proxy));
+		Advisor[] advisors = ((Advised) proxy).getAdvisors();
+		assertEquals("Wrong number of interceptors", 1, advisors.length);
+		ChannelSecurityInterceptor interceptor = (ChannelSecurityInterceptor) advisors[0].getAdvice();
+		ChannelAccessPolicy policy = this.retrievePolicyForPatternString(beanName, interceptor);
+		assertNotNull("Pattern '" + beanName + "' is not included in mappings", policy);
+		ConfigAttributeDefinition sendDefinition = policy.getConfigAttributeDefinitionForSend();
+		ConfigAttributeDefinition receiveDefinition = policy.getConfigAttributeDefinitionForReceive();
+		Collection<String> sendRoles = this.getRolesFromDefintion(sendDefinition);
+		assertTrue("ROLE_ADMIN not found as send attribute", sendRoles.contains("ROLE_ADMIN"));
+		assertTrue("ROLE_USER not found as send attribute", sendRoles.contains("ROLE_USER"));
+		assertNull("Policy applies to receive", receiveDefinition);
+	}
+
+	@Test
+	public void testAdminRequiredForReceive() {
+		String beanName = "adminRequiredForReceive";
+		messageChannel.setBeanName(beanName);
+		MessageChannel proxy = (MessageChannel) applicationContext.getAutowireCapableBeanFactory()
+				.applyBeanPostProcessorsAfterInitialization(messageChannel, beanName);
+		assertTrue("Channel was not proxied", AopUtils.isAopProxy(proxy));
+		Advisor[] advisors = ((Advised) proxy).getAdvisors();
+		assertEquals("Wrong number of interceptors", 1, advisors.length);
+		ChannelSecurityInterceptor interceptor = (ChannelSecurityInterceptor) advisors[0].getAdvice();
+		ChannelAccessPolicy policy = this.retrievePolicyForPatternString(beanName, interceptor);
+		assertNotNull("Pattern '" + beanName + "' is not included in mappings", policy);
+		ConfigAttributeDefinition sendDefinition = policy.getConfigAttributeDefinitionForSend();
+		ConfigAttributeDefinition receiveDefinition = policy.getConfigAttributeDefinitionForReceive();
+		Collection<String> receiveRoles = this.getRolesFromDefintion(receiveDefinition);
+		assertTrue("ROLE_ADMIN not found as receive attribute", receiveRoles.contains("ROLE_ADMIN"));
+		assertNull("Policy applies to send", sendDefinition);
+	}
+
+	@Test
+	public void testAdminOrUserRequiredForReceive() {
+		String beanName = "adminOrUserRequiredForReceive";
+		messageChannel.setBeanName(beanName);
+		MessageChannel proxy = (MessageChannel) applicationContext.getAutowireCapableBeanFactory()
+				.applyBeanPostProcessorsAfterInitialization(messageChannel, beanName);
+		assertTrue("Channel was not proxied", AopUtils.isAopProxy(proxy));
+		Advisor[] advisors = ((Advised) proxy).getAdvisors();
+		assertEquals("Wrong number of interceptors", 1, advisors.length);
+		ChannelSecurityInterceptor interceptor = (ChannelSecurityInterceptor) advisors[0].getAdvice();
+		ChannelAccessPolicy policy = this.retrievePolicyForPatternString(beanName, interceptor);
+		assertNotNull("Pattern '" + beanName + "' is not included in mappings", policy);
+		ConfigAttributeDefinition sendDefinition = policy.getConfigAttributeDefinitionForSend();
+		ConfigAttributeDefinition receiveDefinition = policy.getConfigAttributeDefinitionForReceive();
+		Collection<String> receiveRoles = this.getRolesFromDefintion(receiveDefinition);
+		assertTrue("ROLE_ADMIN not found as receive attribute", receiveRoles.contains("ROLE_ADMIN"));
+		assertTrue("ROLE_USER not found as receive attribute", receiveRoles.contains("ROLE_USER"));
+		assertNull("Policy applies to send", sendDefinition);
+	}
+
+	@Test
+	public void testAdminRequiredForSendAndReceive() {
+		String beanName = "adminRequiredForSendAndReceive";
+		messageChannel.setBeanName(beanName);
+		MessageChannel proxy = (MessageChannel) applicationContext.getAutowireCapableBeanFactory()
+				.applyBeanPostProcessorsAfterInitialization(messageChannel, beanName);
+		assertTrue("Channel was not proxied", AopUtils.isAopProxy(proxy));
+		Advisor[] advisors = ((Advised) proxy).getAdvisors();
+		assertEquals("Wrong number of interceptors", 1, advisors.length);
+		ChannelSecurityInterceptor interceptor = (ChannelSecurityInterceptor) advisors[0].getAdvice();
+		ChannelAccessPolicy policy = this.retrievePolicyForPatternString(beanName, interceptor);
+		assertNotNull("Pattern '" + beanName + "' is not included in mappings", policy);
+		ConfigAttributeDefinition sendDefinition = policy.getConfigAttributeDefinitionForSend();
+		ConfigAttributeDefinition receiveDefinition = policy.getConfigAttributeDefinitionForReceive();
+		assertNotNull("Pattern does not apply to 'send'", sendDefinition);
+		assertNotNull("Pattern does not apply to 'receive'", receiveDefinition);
+		Collection<String> sendRoles = this.getRolesFromDefintion(sendDefinition);
+		Collection<String> receiveRoles = this.getRolesFromDefintion(receiveDefinition);
+		assertTrue("ROLE_ADMIN not found in send attributes", sendRoles.contains("ROLE_ADMIN"));
+		assertTrue("ROLE_ADMIN not found in receive attributes", receiveRoles.contains("ROLE_ADMIN"));
+	}
+
+
+	@SuppressWarnings("unchecked")
+	private ChannelAccessPolicy retrievePolicyForPatternString(String patternString, ChannelSecurityInterceptor interceptor) {
+		DirectFieldAccessor accessor = new DirectFieldAccessor((ChannelInvocationDefinitionSource) interceptor.obtainObjectDefinitionSource());
+		Map<Pattern, ChannelAccessPolicy> policies = (Map<Pattern, ChannelAccessPolicy>) accessor.getPropertyValue("patternMappings");
+		for (Map.Entry<Pattern, ChannelAccessPolicy> entry : policies.entrySet()) {
+			if (entry.getKey().pattern().equals(patternString)) {
+				return entry.getValue();
+			}
+		}
+		return null;
+	}
+
+	@SuppressWarnings("unchecked")
+	private Collection<String> getRolesFromDefintion(ConfigAttributeDefinition definition) {
+		Set<String> roles = new HashSet<String>();
+		Collection configAttributes = definition.getConfigAttributes();
+		for (Object next : configAttributes) {
+			ConfigAttribute attribute = (ConfigAttribute) next;
+			roles.add(attribute.getAttribute());
+		}
+		return roles;
+	}
+
+
+	static class TestMessageChannel extends AbstractPollableChannel {
+
+		List<ChannelInterceptor> interceptors = new ArrayList<ChannelInterceptor>();
+
+
+		@Override
+		protected Message<?> doReceive(long timeout) {
+			return null;
+		}
+
+		@Override
+		protected boolean doSend(Message<?> message, long timeout) {
+			return false;
+		}
+
+		public List<Message<?>> clear() {
+			return null;
+		}
+
+		public List<Message<?>> purge(MessageSelector selector) {
+			return null;
+		}
+
+		@Override
+		public void addInterceptor(ChannelInterceptor interceptor) {
+			interceptors.add(interceptor);
+		}
+
+	}
+
+}

spring-integration-security/src/test/java/org/springframework/integration/security/config/commonSecurityConfiguration.xml

@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans:beans xmlns="http://www.springframework.org/schema/integration"
+	xmlns:beans="http://www.springframework.org/schema/beans"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:security="http://www.springframework.org/schema/security"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xsi:schemaLocation="http://www.springframework.org/schema/beans
+			http://www.springframework.org/schema/beans/spring-beans.xsd
+			http://www.springframework.org/schema/security
+			http://www.springframework.org/schema/security/spring-security.xsd
+			http://www.springframework.org/schema/context
+			http://www.springframework.org/schema/context/spring-context.xsd">
+
+	<context:annotation-config/>	
+
+	<beans:bean id="authenticationManager" class="org.springframework.security.MockAuthenticationManager"/>
+
+	<beans:bean id="accessDecisionManager" class="org.springframework.security.vote.AffirmativeBased">
+		<beans:property name="allowIfAllAbstainDecisions" value="true"/>
+		<beans:property name="decisionVoters">
+			<beans:list>
+				<beans:bean class="org.springframework.security.vote.RoleVoter"/>
+			</beans:list>
+		</beans:property>
+	</beans:bean>
+
+	<security:authentication-provider user-service-ref="userDetailsService"/>
+
+	<security:user-service id="userDetailsService">
+		<security:user name="jimi" password="jimispassword" authorities="ROLE_USER, ROLE_ADMIN"/>
+		<security:user name="bob" password="bobspassword" authorities="ROLE_USER"/>
+	</security:user-service>
+
+</beans:beans>

spring-integration-security/src/test/resources/log4j.properties

@@ -0,0 +1,8 @@
+log4j.rootCategory=WARN, stdout
+
+log4j.appender.stdout=org.apache.log4j.ConsoleAppender
+log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
+log4j.appender.stdout.layout.ConversionPattern=%c{1}: %m%n
+
+log4j.category.org.springframework.integration.security=WARN
+log4j.category.org.springframework.integration=WARN