From 4761614c9f5390664fcd9f90caf60e63b37aa6ce Mon Sep 17 00:00:00 2001 From: Rob Winch Date: Wed, 28 Aug 2013 00:59:02 -0500 Subject: [PATCH] SEC-2291: Fix internal links within reference Instead of using xlink:href="# use linkend=" --- .../config/doc/XsdDocumentedTests.groovy | 4 +- docs/faq/src/docbook/faq.xml | 8 +- .../manual/src/docbook/anon-auth-provider.xml | 2 +- .../manual/src/docbook/appendix-db-schema.xml | 4 +- .../manual/src/docbook/appendix-namespace.xml | 296 +++++++++--------- .../src/docbook/authorization-common.xml | 6 +- docs/manual/src/docbook/cas-auth-provider.xml | 10 +- docs/manual/src/docbook/channel-security.xml | 2 +- docs/manual/src/docbook/core-filters.xml | 12 +- docs/manual/src/docbook/core-services.xml | 10 +- docs/manual/src/docbook/csrf.xml | 10 +- docs/manual/src/docbook/el-access.xml | 2 +- docs/manual/src/docbook/index.xml | 4 +- .../manual/src/docbook/jaas-auth-provider.xml | 2 +- docs/manual/src/docbook/namespace-config.xml | 46 +-- docs/manual/src/docbook/new-3-1.xml | 56 ++-- docs/manual/src/docbook/preauth.xml | 8 +- .../docbook/remember-me-authentication.xml | 2 +- docs/manual/src/docbook/samples.xml | 12 +- docs/manual/src/docbook/secured-objects.xml | 2 +- .../src/docbook/security-filter-chain.xml | 4 +- docs/manual/src/docbook/session-mgmt.xml | 2 +- docs/manual/src/docbook/taglibs.xml | 2 +- .../manual/src/docbook/technical-overview.xml | 8 +- 24 files changed, 257 insertions(+), 257 deletions(-) diff --git a/config/src/test/groovy/org/springframework/security/config/doc/XsdDocumentedTests.groovy b/config/src/test/groovy/org/springframework/security/config/doc/XsdDocumentedTests.groovy index 51a349d2a8..0826db318b 100644 --- a/config/src/test/groovy/org/springframework/security/config/doc/XsdDocumentedTests.groovy +++ b/config/src/test/groovy/org/springframework/security/config/doc/XsdDocumentedTests.groovy @@ -53,9 +53,9 @@ class XsdDocumentedTests extends Specification { def id = delegate.@id.text().replace('-parents', '').replace('-children', '') result.put(id,[]) delegate.children().breadthFirst().each { sectionChild -> - def href = sectionChild.@href.text() + def href = sectionChild.@linkend.text() if(href) { - result.get(id).add(href[1..-1]) + result.get(id).add(href) } } } diff --git a/docs/faq/src/docbook/faq.xml b/docs/faq/src/docbook/faq.xml index 32be72e9a4..fd1b0edcb0 100644 --- a/docs/faq/src/docbook/faq.xml +++ b/docs/faq/src/docbook/faq.xml @@ -286,7 +286,7 @@ Note that the permissions for an LDAP directory often do not allow you to read the password - for a user. Hence it is often not possible to use the UserDetailsService + for a user. Hence it is often not possible to use the UserDetailsService approach where Spring Security compares the stored password with the one submitted by the user. The most common approach is to use LDAP bind, which is one of the operations supported by the LDAP protocol. @@ -656,7 +656,7 @@ a UserDetailsService to allow it to load the password (and other data) for a user in order to compare it with the submitted value. Note that if you are using LDAP, - this approach may not work. + this approach may not work. If you want to customize the authentication process then you should implement AuthenticationProvider yourself. See this You can't (and shouldn't). You are probably misunderstanding its purpose. - See What is a UserDetailsService? + See What is a UserDetailsService? above. @@ -909,7 +909,7 @@ >Spring Reference Manual. In order to do this, you need to know a bit about which beans are created, so you should also read the blog article in the above question on how the namespace maps to + linkend="faq-namespace-to-bean-mapping">how the namespace maps to Spring beans. Normally, you would add the functionality you require to the postProcessBeforeInitialization method of diff --git a/docs/manual/src/docbook/anon-auth-provider.xml b/docs/manual/src/docbook/anon-auth-provider.xml index 5a664e13fe..4890f5d33f 100644 --- a/docs/manual/src/docbook/anon-auth-provider.xml +++ b/docs/manual/src/docbook/anon-auth-provider.xml @@ -126,7 +126,7 @@ interceptor configuration replaced with IS_AUTHENTICATED_ANONYMOUSLY, which is effectively the same thing when defining access controls. This is an example of the use of the AuthenticatedVoter which we will see in the authorization chapter. It uses an + linkend="authz-authenticated-voter">authorization chapter. It uses an AuthenticationTrustResolver to process this particular configuration attribute and grant access to anonymous users. The AuthenticatedVoter approach is more powerful, since it allows you diff --git a/docs/manual/src/docbook/appendix-db-schema.xml b/docs/manual/src/docbook/appendix-db-schema.xml index b0a4bec76a..2cfe5a94a3 100644 --- a/docs/manual/src/docbook/appendix-db-schema.xml +++ b/docs/manual/src/docbook/appendix-db-schema.xml @@ -58,7 +58,7 @@ create table group_members (
Persistent Login (Remember-Me) Schema This table is used to store data used by the more secure persistent token remember-me + linkend="remember-me-persistent-token">persistent token remember-me implementation. If you are using JdbcTokenRepositoryImpl either directly or through the namespace, then you will need this table. @@ -71,7 +71,7 @@ create table persistent_logins (
ACL Schema - There are four tables used by the Spring Security There are four tables used by the Spring Security ACL implementation. acl_sid stores the security identities recognised by the diff --git a/docs/manual/src/docbook/appendix-namespace.xml b/docs/manual/src/docbook/appendix-namespace.xml index 88c6fd0ced..587db406f2 100644 --- a/docs/manual/src/docbook/appendix-namespace.xml +++ b/docs/manual/src/docbook/appendix-namespace.xml @@ -8,7 +8,7 @@ and information on the underlying beans they create (a knowledge of the individual classes and how they work together is assumed - you can find more information in the project Javadoc and elsewhere in this document). If you haven't used the namespace before, please read the - introductory chapter on namespace configuration, as + introductory chapter on namespace configuration, as this is intended as a supplement to the information there. Using a good quality XML editor while editing a configuration based on the schema is recommended as this will provide contextual information on which elements and attributes are available as well as comments @@ -33,11 +33,11 @@ created and the configuration within the element is used to build a filter chain within FilterChainProxy. As of Spring Security 3.1, additional http elements can be used to add extra filter chains - See the introductory chapter for how to set + See the introductory chapter for how to set up the mapping from your web.xml . Some core filters are always created in a filter chain and others will be added to the stack depending on the attributes and child elements which are present. The - positions of the standard filters are fixed (see the + positions of the standard filters are fixed (see the filter order table in the namespace introduction), removing a common source of errors with previous versions of the framework when users had to configure the filter chain explicitly in the FilterChainProxy bean. You can, of course, @@ -45,7 +45,7 @@ All filters which require a reference to the AuthenticationManager will be automatically injected with the internal instance created by the namespace configuration (see the introductory chapter for more on the + linkend="ns-auth-manager">introductory chapter for more on the AuthenticationManager). Each <http> namespace block always creates an SecurityContextPersistenceFilter, an @@ -67,7 +67,7 @@
<literal>access-denied-page</literal> - Deprecated in favour of the access-denied-handler + Deprecated in favour of the access-denied-handler child element.
@@ -139,15 +139,15 @@
<literal>path-type</literal> - Deprecated in favor of request-matcher. + Deprecated in favor of request-matcher.
<literal>pattern</literal> - Defining a pattern for the http element controls the + Defining a pattern for the http element controls the requests which will be filtered through the list of filters which it defines. The interpretation is dependent on the configured request-matcher. If no pattern is defined, + linkend="nsa-http-request-matcher">request-matcher. If no pattern is defined, all requests will be matched, so the most specific patterns should be declared first.
@@ -165,9 +165,9 @@ currently ant, regex and ciRegex, for ant, regular-expression and case-insensitive regular-expression repsectively. A separate instance is created for each - intercept-url element using its - pattern and - method attributes. Ant paths + intercept-url element using its + pattern and + method attributes. Ant paths are matched using an AntPathRequestMatcher and regular expressions are matched using a RegexRequestMatcher. See the Javadoc for these classes for more details on exactly how the matching is preformed. Ant @@ -177,7 +177,7 @@ <literal>request-matcher-ref</literal> A referenece to a bean that implements RequestMatcher that will determine if this FilterChain should be used. This is a more - powerful alternative to pattern. + powerful alternative to pattern.
<literal>security</literal> @@ -202,30 +202,30 @@
<literal>use-expressions</literal> Enables EL-expressions in the access attribute, as - described in the chapter on expression-based + described in the chapter on expression-based access-control.
Child Elements of <http> - access-denied-handler - anonymous - csrf - custom-filter - expression-handler - form-login - headers - http-basic - intercept-url - jee - logout - openid-login - port-mappings - remember-me - request-cache - session-management - x509 + access-denied-handler + anonymous + csrf + custom-filter + expression-handler + form-login + headers + http-basic + intercept-url + jee + logout + openid-login + port-mappings + remember-me + request-cache + session-management + x509
@@ -234,15 +234,15 @@ This element allows you to set the errorPage property for the default AccessDeniedHandler used by the ExceptionTranslationFilter, using the - error-page attribute, or + error-page attribute, or to supply your own implementation using the - ref attribute. This is discussed - in more detail in the section on the + ref attribute. This is discussed + in more detail in the section on the ExceptionTranslationFilter.
Parent Elements of <literal><access-denied-handler></literal> - http + http
@@ -263,24 +263,24 @@ <literal><headers></literal> This element allows for configuring additional (security) headers to be send with the response. It enables easy configuration for several headers and also allows for setting custom headers through - the header element. + the header element. Cache-Control and Pragma - Can be set using the - cache-control element. This ensures that the + cache-control element. This ensures that the browser does not cache your secured pages. Strict-Transport-Security - Can be set using the - hsts element. This ensures that the + hsts element. This ensures that the browser automatically requests HTTPS for future requests. X-Frame-Options - Can be set using the - frame-options element. The + frame-options element. The X-Frame-Options header can be used to prevent clickjacking attacks. X-XSS-Protection - Can be set using the - xss-protection element. + xss-protection element. The X-XSS-Protection header can be used by browser to do basic control. X-Content-Type-Options - Can be set using the - content-type-options element. The + content-type-options element. The X-Content-Type-Options header prevents Internet Explorer from MIME-sniffing a response away from the declared content-type. This also applies to Google Chrome, when downloading extensions. @@ -289,18 +289,18 @@
Parent Elements of <literal><headers></literal> - http + http
Child Elements of <literal><headers></literal> - cache-control - content-type-options - frame-options - header - hsts - xss-protection + cache-control + content-type-options + frame-options + header + hsts + xss-protection
@@ -311,7 +311,7 @@
Parent Elements of <literal><cache-control></literal> - headers + headers
@@ -343,7 +343,7 @@
Parent Elements of <literal><hsts></literal> - headers + headers
@@ -361,7 +361,7 @@ the site attempting to do so. This is the default when frame-options-policy is specified. SAMEORIGIN The page can only be displayed in a frame on the same origin as the page itself - ALLOW-FROM origin + ALLOW-FROM origin The page can only be displayed in a frame on the specified origin. @@ -377,17 +377,17 @@ Select the AllowFromStrategy to use when using the ALLOW-FROM policy. static Use a single static ALLOW-FROM value. The value can be set - through the value attribute. + through the value attribute. regexp Use a regelur expression to validate incoming requests and - if they are allowed. The regular expression can be set through the value + if they are allowed. The regular expression can be set through the value attribute. The request parameter used to retrieve the value to validate can be specified - using the from-parameter. + using the from-parameter. whitelistA comma-seperated list containing the allowed domains. - The comma-seperated list can be set through the value + The comma-seperated list can be set through the value attribute. The request parameter used to retrieve the value to validate can be specified - using the from-parameter. + using the from-parameter. @@ -401,7 +401,7 @@
<literal>frame-options-value</literal> - The value to use when ALLOW-FROM is used a strategy. + The value to use when ALLOW-FROM is used a strategy.
<literal>frame-options-from-parameter</literal> @@ -414,7 +414,7 @@
Parent Elements of <literal><frame-options></literal> - headers + headers
@@ -439,7 +439,7 @@
Parent Elements of <literal><xss-protection></literal> - headers + headers
@@ -451,7 +451,7 @@
Parent Elements of <literal><content-type-options></literal> - headers + headers
@@ -476,7 +476,7 @@
Parent Elements of <literal><header></literal> - headers + headers
@@ -488,7 +488,7 @@
Parent Elements of <literal><anonymous></literal> - http + http
@@ -527,7 +527,7 @@
Parent Elements of <literal><csrf></literal> - http + http
@@ -550,12 +550,12 @@ additional beans but is used to select a bean of type javax.servlet.Filter which is already defined in the application context and add that at a particular position in the filter chain - maintained by Spring Security. Full details can be found in the + maintained by Spring Security. Full details can be found in the namespace chapter.
Parent Elements of <literal><custom-filter></literal> - http + http
@@ -590,8 +590,8 @@
Parent Elements of <literal><expression-handler></literal> - global-method-security - http + global-method-security + http
@@ -615,12 +615,12 @@ DefaultLoginPageGeneratingFilter is responsible for rendering the login page and will provide login forms for both normal form login and/or OpenID if required. - The behaviour can be customized using the + The behaviour can be customized using the <form-login> Attributes.
Parent Elements of <literal><form-login></literal> - http + http
@@ -628,7 +628,7 @@
<literal>always-use-default-target</literal> If set to true, the user will always start at the value given by - default-target-url, regardless + default-target-url, regardless of how they arrived at the login page. Maps to the alwaysUseDefaultTargetUrl property of UsernamePasswordAuthenticationFilter. Default value is false. @@ -641,7 +641,7 @@
<literal>authentication-failure-handler-ref</literal> Can be used as an alternative to - authentication-failure-url, + authentication-failure-url, giving you full control over the navigation flow after an authentication failure. The value should be he name of an AuthenticationFailureHandler bean in the application context. @@ -657,13 +657,13 @@
<literal>authentication-success-handler-ref</literal> This can be used as an alternative to - default-target-url - and always-use-default-target, + default-target-url + and always-use-default-target, giving you full control over the navigation flow after a successful authentication. The value should be the name of an AuthenticationSuccessHandler bean in the application context. By default, an implementation of SavedRequestAwareAuthenticationSuccessHandler is used and - injected with the default-target-url + injected with the default-target-url .
@@ -707,7 +707,7 @@
Parent Elements of <literal><http-basic></literal> - http + http
@@ -752,9 +752,9 @@
Parent Elements of <literal><intercept-url></literal> - filter-invocation-definition-source - filter-security-metadata-source - http + filter-invocation-definition-source + filter-security-metadata-source + http
@@ -797,7 +797,7 @@ ChannelProcessingFilter will be added to the filter stack and its additional dependencies added to the application context. If a <port-mappings> configuration is added, this will be used to by the SecureChannelProcessor and @@ -813,7 +813,7 @@
Parent Elements of <literal><jee></literal> - http + http
@@ -835,7 +835,7 @@
Parent Elements of <literal><logout></literal> - http + http
@@ -886,7 +886,7 @@
Parent Elements of <literal><openid-login></literal> - http + http
@@ -915,8 +915,8 @@ <literal>authentication-success-handler-ref</literal> Reference to an AuthenticationSuccessHandler bean which should be used to handle a successful authentication request. Should not be used in combination with - default-target-url (or - + default-target-url (or + always-use-default-target) as the implementation should always deal with navigation to the subsequent destination
@@ -952,7 +952,7 @@
Child Elements of <openid-login> - attribute-exchange + attribute-exchange
@@ -960,7 +960,7 @@ <literal><attribute-exchange></literal> The attribute-exchange element defines the list of attributes which should be requested from the identity provider. An example can be found - in the OpenID Support section of the namespace configuration + in the OpenID Support section of the namespace configuration chapter. More than one can be used, in which case each must have an identifier-match attribute, containing a regular expression which is matched against the supplied OpenID identifier. This allows different attribute lists to be fetched from @@ -968,7 +968,7 @@
Parent Elements of <literal><attribute-exchange></literal> - openid-login + openid-login
@@ -982,7 +982,7 @@
Child Elements of <literal><attribute-exchange></literal> - openid-attribute + openid-attribute
@@ -994,7 +994,7 @@
Parent Elements of <literal><openid-attribute></literal> - attribute-exchange + attribute-exchange
@@ -1027,18 +1027,18 @@ can optionally be used to override the default mappings which that class defines. Each child <port-mapping> element defines a pair of HTTP:HTTPS ports. The default mappings are 80:443 and 8080:8443. An example of - overriding these can be found in the namespace introduction.
Parent Elements of <literal><port-mappings></literal> - http + http
Child Elements of <literal><port-mappings></literal> - port-mapping + port-mapping
@@ -1048,7 +1048,7 @@
Parent Elements of <literal><port-mapping></literal> - port-mappings + port-mappings
@@ -1074,7 +1074,7 @@
Parent Elements of <literal><remember-me></literal> - http + http
@@ -1166,7 +1166,7 @@
Parent Elements of <literal><request-cache></literal> - http + http
@@ -1184,7 +1184,7 @@
Parent Elements of <literal><session-management></literal> - http + http
@@ -1228,7 +1228,7 @@
Child elements of <literal><session-management></literal> - concurrency-control + concurrency-control
@@ -1247,7 +1247,7 @@
Parent Elements of <literal><concurrency-control></literal> - session-management + session-management
@@ -1301,7 +1301,7 @@
Parent Elements of <literal><x509></literal> - http + http
@@ -1333,7 +1333,7 @@
<literal>path-type</literal> Superseded by the - request-matcher attribute + request-matcher attribute
<literal>request-matcher</literal> @@ -1345,7 +1345,7 @@
Child Elements of <literal><filter-chain-map></literal> - filter-chain + filter-chain
@@ -1357,7 +1357,7 @@
Parent Elements of <literal><filter-chain></literal> - filter-chain-map + filter-chain-map
@@ -1372,7 +1372,7 @@
<literal>pattern</literal> A-pattern that creates RequestMatcher in combination with the - request-matcher + request-matcher
<literal>request-matcher-ref</literal> @@ -1397,7 +1397,7 @@
<literal>path-type</literal> Superseded by - request-matcher + request-matcher
<literal>request-matcher</literal> @@ -1416,7 +1416,7 @@
Child Elements of <literal><filter-invocation-definition-source></literal> - intercept-url + intercept-url
@@ -1439,7 +1439,7 @@
<literal>path-type</literal> Superseded by - request-matcher + request-matcher
@@ -1459,7 +1459,7 @@
Child Elements of <literal><filter-security-metadata-source></literal> - intercept-url + intercept-url
@@ -1489,7 +1489,7 @@ <literal>alias</literal> This attribute allows you to define an alias name for the internal instance for use in your own configuration. Its use is described in the - namespace introduction. + namespace introduction.
<literal>erase-credentials</literal> @@ -1497,7 +1497,7 @@ returned Authentication object, once the user has been authenticated. Literally it maps to the eraseCredentialsAfterAuthentication property of the ProviderManager. This is discussed in the Core Services chapter. + linkend="core-services-erasing-credentials">Core Services chapter.
<literal>id</literal> @@ -1509,15 +1509,15 @@
Child Elements of <literal><authentication-manager></literal> - authentication-provider - ldap-authentication-provider + authentication-provider + ldap-authentication-provider
<literal><authentication-provider></literal> Unless used with a ref attribute, this element is - shorthand for configuring a DaoAuthenticationProvider. DaoAuthenticationProvider loads user information from a UserDetailsService and compares the @@ -1526,12 +1526,12 @@ by using an available namespace element (jdbc-user-service or by using the user-service-ref attribute to point to a bean defined elsewhere in the application context). You can find examples of these - variations in the namespace + variations in the namespace introduction.
Parent Elements of <literal><authentication-provider></literal> - authentication-manager + authentication-manager
@@ -1560,10 +1560,10 @@
Child Elements of <literal><authentication-provider></literal> - jdbc-user-service - ldap-user-service - password-encoder - user-service + jdbc-user-service + ldap-user-service + password-encoder + user-service
@@ -1617,7 +1617,7 @@ where
<literal><password-encoder></literal> Authentication providers can optionally be configured to use a password - encoder as described in the namespace introduction. This will result in the bean being injected with the appropriate PasswordEncoder instance, potentially with an accompanying @@ -1626,8 +1626,8 @@ where
Parent Elements of <literal><password-encoder></literal> - authentication-provider - password-compare + authentication-provider + password-compare
@@ -1650,7 +1650,7 @@ where
Child Elements of <literal><password-encoder></literal> - salt-source + salt-source
@@ -1661,7 +1661,7 @@ where
Parent Elements of <literal><salt-source></literal> - password-encoder + password-encoder
@@ -1701,7 +1701,7 @@ where
Child Elements of <literal><user-service></literal> - user + user
@@ -1711,7 +1711,7 @@ where
Parent Elements of <literal><user></literal> - user-service + user-service
@@ -1820,10 +1820,10 @@ where
Child Elements of <literal><global-method-security></literal> - after-invocation-provider - expression-handler - pre-post-annotation-handling - protect-pointcut + after-invocation-provider + expression-handler + pre-post-annotation-handling + protect-pointcut
@@ -1840,7 +1840,7 @@ where
Parent Elements of <literal><after-invocation-provider></literal> - global-method-security + global-method-security
@@ -1860,15 +1860,15 @@ where
Parent Elements of <literal><pre-post-annotation-handling></literal> - global-method-security + global-method-security
Child Elements of <literal><pre-post-annotation-handling></literal> - invocation-attribute-factory - post-invocation-advice - pre-invocation-advice + invocation-attribute-factory + post-invocation-advice + pre-invocation-advice
@@ -1879,7 +1879,7 @@ where
Parent Elements of <literal><invocation-attribute-factory></literal> - pre-post-annotation-handling + pre-post-annotation-handling
@@ -1898,7 +1898,7 @@ where
Parent Elements of <literal><post-invocation-advice></literal> - pre-post-annotation-handling + pre-post-annotation-handling
@@ -1917,7 +1917,7 @@ where
Parent Elements of <literal><pre-invocation-advice></literal> - pre-post-annotation-handling + pre-post-annotation-handling
@@ -1935,11 +1935,11 @@ where cross-cutting security constraints across whole sets of methods and interfaces in your service layer using the <protect-pointcut> element. You can find an example in the namespace introduction. + linkend="ns-protect-pointcut">namespace introduction.
Parent Elements of <literal><protect-pointcut></literal> - global-method-security + global-method-security
@@ -1970,7 +1970,7 @@ where
Child Elements of <literal><intercept-methods></literal> - protect + protect
@@ -1994,7 +1994,7 @@ where
Child Elements of <literal><method-security-metadata-source></literal> - protect + protect
@@ -2005,8 +2005,8 @@ where
Parent Elements of <literal><protect></literal> - intercept-methods - method-security-metadata-source + intercept-methods + method-security-metadata-source
@@ -2024,7 +2024,7 @@ where
LDAP Namespace Options - LDAP is covered in some details in its own + LDAP is covered in some details in its own chapter. We will expand on that here with some explanation of how the namespace options map to Spring beans. The LDAP implementation uses Spring LDAP extensively, so some familiarity with that project's API may be useful. @@ -2036,7 +2036,7 @@ where defining the location of the LDAP server and other information (such as a username and password, if it doesn't allow anonymous access) for connecting to it. It can also be used to create an embedded server for testing. Details of the - syntax for both options are covered in the LDAP + syntax for both options are covered in the LDAP chapter. The actual ContextSource implementation is DefaultSpringSecurityContextSource which extends Spring LDAP's LdapContextSource class. The @@ -2097,7 +2097,7 @@ where
Parent Elements of <literal><ldap-authentication-provider></literal> - authentication-manager + authentication-manager
@@ -2185,7 +2185,7 @@ where
Child Elements of <literal><ldap-authentication-provider></literal> - password-compare + password-compare
@@ -2198,7 +2198,7 @@ where
Parent Elements of <literal><password-compare></literal> - ldap-authentication-provider + ldap-authentication-provider
@@ -2217,7 +2217,7 @@ where
Child Elements of <literal><password-compare></literal> - password-encoder + password-encoder
diff --git a/docs/manual/src/docbook/authorization-common.xml b/docs/manual/src/docbook/authorization-common.xml index 514cb8a576..e856ad8a0c 100644 --- a/docs/manual/src/docbook/authorization-common.xml +++ b/docs/manual/src/docbook/authorization-common.xml @@ -7,7 +7,7 @@ Authorities - As we saw in the technical overview, + As we saw in the technical overview, all Authentication implementations store a list of GrantedAuthority objects. These represent the authorities that have been granted to the principal. The @@ -51,7 +51,7 @@ Pre-Invocation Handling - As we've also seen in the Technical + As we've also seen in the Technical Overview chapter, Spring Security provides interceptors which control access to secure objects such as method invocations or web requests. A pre-invocation decision on whether the invocation is allowed to proceed is made by the @@ -307,7 +307,7 @@ boolean supports(Class clazz); The use of a role-hierarchy allows you to configure which roles (or authorities) should include others. - An extended version of Spring Security's RoleVoter, + An extended version of Spring Security's RoleVoter, RoleHierarchyVoter, is configured with a RoleHierarchy, from which it obtains all the reachable authorities which the user is assigned. A typical configuration might look like this: diff --git a/docs/manual/src/docbook/cas-auth-provider.xml b/docs/manual/src/docbook/cas-auth-provider.xml index 0a610dac02..a9d504775d 100644 --- a/docs/manual/src/docbook/cas-auth-provider.xml +++ b/docs/manual/src/docbook/cas-auth-provider.xml @@ -196,7 +196,7 @@ The user's browser is redirected to the original page that caused the AuthenticationException (or a - custom destination depending on + custom destination depending on the configuration). @@ -213,7 +213,7 @@ already know the basics of using Spring Security, so these are not covered again below. We'll assume a namespace based configuration is being used and add in the CAS beans as required. Each section builds upon the previous section. A full - CAS sample application can be found in the Spring + CAS sample application can be found in the Spring Security Samples.
@@ -259,7 +259,7 @@ For CAS to operate, the ExceptionTranslationFilter must have its authenticationEntryPoint property set to the CasAuthenticationEntryPoint bean. This can easily be done using - entry-point-ref as is + entry-point-ref as is done in the example above. The CasAuthenticationEntryPoint must refer to the ServiceProperties bean (discussed above), which provides the URL to the enterprise's CAS login server. This is where the user's browser will be @@ -300,7 +300,7 @@ here. Note that the CasAuthenticationProvider does not actually use the password for authentication, but it does use the authorities. The beans are all reasonably self-explanatory if you refer back to the - How CAS Works section. + How CAS Works section. This completes the most basic configuration for CAS. If you haven't made any mistakes, your web application should happily work within the framework of CAS single sign on. No other parts of Spring Security @@ -448,7 +448,7 @@ Calling a Stateless Service Using a Proxy Ticket Now that Spring Security obtains PGTs, you can use them to create proxy tickets which can be used to authenticate - to a stateless service. The CAS sample application contains a working example in + to a stateless service. The CAS sample application contains a working example in the ProxyTicketSampleServlet. Example code can be found below: Configuration - Channel security is supported by the security + Channel security is supported by the security namespace by means of the requires-channel attribute on the <intercept-url> element and this is the simplest (and recommended approach). diff --git a/docs/manual/src/docbook/core-filters.xml b/docs/manual/src/docbook/core-filters.xml index 2cc346b5cb..b9aa392135 100644 --- a/docs/manual/src/docbook/core-filters.xml +++ b/docs/manual/src/docbook/core-filters.xml @@ -8,7 +8,7 @@
<classname>FilterSecurityInterceptor</classname> We've already seen FilterSecurityInterceptor briefly when - discussing access-control in + discussing access-control in general, and we've already used it with the namespace where the <intercept-url> elements are combined to configure it internally. Now we'll see how to explicitly configure it for use with a @@ -31,7 +31,7 @@ AuthenticationManager and an AccessDecisionManager. It is also supplied with configuration attributes that apply to different HTTP URL requests. Refer back to the original discussion on these in + linkend="tech-intro-config-attributes">the original discussion on these in the technical introduction. The FilterSecurityInterceptor can be configured with configuration attributes in two ways. The first, which is shown above, is using the @@ -165,7 +165,7 @@ can implement the interface yourself and use your own implementation. It's also possible to supply a custom AccessDeniedHandler when you're using the namespace - to configure your application. See the + to configure your application. See the namespace appendix for more details.
@@ -173,10 +173,10 @@ Another of ExceptionTranslationFilter's responsibilities is to save the current request before invoking the AuthenticationEntryPoint. This allows the request to be restored after the use has authenticated (see previous overview - of web authentication). + of web authentication). A typical example would be where the user logs in with a form, and is then redirected to the original URL by the default SavedRequestAwareAuthenticationSuccessHandler - (see below). + (see below). The RequestCache encapsulates the functionality required for storing and retrieving HttpServletRequest instances. By default @@ -196,7 +196,7 @@
<classname>SecurityContextPersistenceFilter</classname> We covered the purpose of this all-important filter in the Technical Overview chapter so + linkend="tech-intro-sec-context-persistence">Technical Overview chapter so you might want to re-read that section at this point. Let's first take a look at how you would configure it for use with a FilterChainProxy. A basic configuration only requires the bean itself SecurityContext. If you are using the namespace, an instance of ProviderManager is created and maintained internally, and you add providers to it by using the namespace - authentication provider elements (see the namespace + authentication provider elements (see the namespace chapter). In this case, you should not declare a ProviderManager bean in your application context. However, if you are not using the namespace then you would declare it like so: PasswordEncoder provides encoding and decoding of passwords presented in the UserDetails object that is returned from the configured UserDetailsService. This - will be discussed in more detail below.
@@ -149,7 +149,7 @@ Security, when you don't really want to spend time configuring databases or writing UserDetailsService implementations. For this sort of situation, a simple option is to use the user-service element - from the security namespace: namespace: @@ -196,7 +196,7 @@ Authority Groups By default, JdbcDaoImpl loads the authorities for a single user with the assumption that the authorities are mapped directly to - users (see the database schema + users (see the database schema appendix). An alternative approach is to partition the authorities into groups and assign groups to the user. Some people prefer this approach as a means of administering user rights. See the JdbcDaoImpl @@ -217,7 +217,7 @@
Password Encoding - Spring Security's + Spring Security's PasswordEncoder interface is used to support the use of passwords which are encoded in some way in persistent storage. You should never store passwords in plain text. Always use a one-way password hashing algorithm such as bcrypt diff --git a/docs/manual/src/docbook/csrf.xml b/docs/manual/src/docbook/csrf.xml index 17acffcd32..1389883939 100644 --- a/docs/manual/src/docbook/csrf.xml +++ b/docs/manual/src/docbook/csrf.xml @@ -71,13 +71,13 @@ amount=100.00&routingNumber=1234&account=9876&_csrf= Security's CSRF protection are outlined below: - Use proper HTTP verbs + Use proper HTTP verbs - Configure CSRF Protection + Configure CSRF Protection - Include the CSRF Token + Include the CSRF Token
@@ -89,7 +89,7 @@ amount=100.00&routingNumber=1234&account=9876&_csrf=
Configure CSRF Protection The next step is to include Spring Security's CSRF protection within your application. If you are using the XML configuration, this can be done - using the <csrf /> element: + using the <csrf /> element: ... @@ -196,7 +196,7 @@ public class WebSecurityConfig extends Spring Security's goal is to provide defaults that protect your users from exploits. This does not mean that you are forced to accept all of its defaults. For example, you can provide a custom CsrfTokenRepository to override the way in which the CsrfToken is stored. You can also specify a custom RequestMatcher to determine which requests are protected by CSRF (i.e. perhaps you don't care if log out is exploited). In short, if - Spring Security's CSRF protection doesn't behave exactly as you want it, you are able to customize the behavior. Refer to the <csrf /> + Spring Security's CSRF protection doesn't behave exactly as you want it, you are able to customize the behavior. Refer to the <csrf /> documentation for details on how to make these customizations with XML and the CsrfConfigurer javadoc for details on how to make these customizations when using Java configuration.
diff --git a/docs/manual/src/docbook/el-access.xml b/docs/manual/src/docbook/el-access.xml index 0f2c75fc1a..ec5eb981e2 100644 --- a/docs/manual/src/docbook/el-access.xml +++ b/docs/manual/src/docbook/el-access.xml @@ -150,7 +150,7 @@ whether the current user has the adminpermission for the given contact. The built-in hasPermission() expression is linked into the Spring Security ACL module through the application context, as we'll - see below. You can access any + see below. You can access any of the method arguments by name as expression variables, provided your code has debug information compiled in. Any Spring-EL functionality is available within the expression, so you can also access properties on the arguments. For example, diff --git a/docs/manual/src/docbook/index.xml b/docs/manual/src/docbook/index.xml index dd7506b256..bb3d56d6c2 100644 --- a/docs/manual/src/docbook/index.xml +++ b/docs/manual/src/docbook/index.xml @@ -70,8 +70,8 @@ ten list of web application vulnerabilities as well as a lot of useful reference information. We hope that you find this reference guide useful, and we welcome your feedback and - suggestions. - Finally, welcome to the Spring Security suggestions. + Finally, welcome to the Spring Security community. diff --git a/docs/manual/src/docbook/jaas-auth-provider.xml b/docs/manual/src/docbook/jaas-auth-provider.xml index 47947ac71d..91d49de2da 100644 --- a/docs/manual/src/docbook/jaas-auth-provider.xml +++ b/docs/manual/src/docbook/jaas-auth-provider.xml @@ -225,7 +225,7 @@ JAASTest { Subject subject = Subject.getSubject(AccessController.getContext()); ]]> This integration can easily be configured using the - jaas-api-provision attribute. This + jaas-api-provision attribute. This feature is useful when integrating with legacy or external API's that rely on the JAAS Subject being populated.
diff --git a/docs/manual/src/docbook/namespace-config.xml b/docs/manual/src/docbook/namespace-config.xml index b837c562a3..90ade594e4 100644 --- a/docs/manual/src/docbook/namespace-config.xml +++ b/docs/manual/src/docbook/namespace-config.xml @@ -23,7 +23,7 @@ attributes on the ldap-server element and the user is isolated from worrying about which beans they need to create and what the bean property names are. You can find out more about the use of the ldap-server element - in the chapter on LDAP. + in the chapter on LDAP. . Use of a good XML editor while editing the application context file should provide information on the attributes and elements that are available. We would recommend that you try out the <intercept-url> element defines a pattern which is matched against the URLs of incoming requests using an ant path style syntax - See the section on Request + See the section on Request Matching in the Web Application Infrastructure chapter for more details on how matches are actually performed. . You can also use regular-expression matching as an alternative (see the @@ -162,9 +162,9 @@ attributes). We'll see later how the interpretation can vary The interpretation of the comma-separated values in the access attribute depends on the implementation of the AccessDecisionManager which is used. In + linkend="ns-access-manager">AccessDecisionManager which is used. In Spring Security 3.0, the attribute can also be populated with an EL expression. + linkend="el-access">EL expression. . You can use multiple <intercept-url> elements to @@ -202,7 +202,7 @@ <authentication-manager> element, which creates a ProviderManager and registers the authentication providers with it. You can find more detailed information on the beans that are - created in the namespace appendix. + created in the namespace appendix. It's worth cross-checking this if you want to start understanding what the important classes in the framework are and how they are used, particularly if you want to customise things later. @@ -211,7 +211,7 @@ the application (which will be used for access control). It is also possible to load user information from a standard properties file using the properties attribute on user-service. See the - section on in-memory + section on in-memory authentication for more details on the file format. Using the <authentication-provider> element means that the user information will be used by the authentication manager to process authentication @@ -241,8 +241,8 @@ Also note that we've added an extra intercept-url element to say that any requests for the login page should be available to anonymous users - See the chapter on anonymous - authentication and also the See the chapter on anonymous + authentication and also the AuthenticatedVoter class for more details on how the value IS_AUTHENTICATED_ANONYMOUSLY is processed. . Otherwise the request would be matched by the pattern @@ -273,7 +273,7 @@ intercept-url element is incompatible with this change and is no longer supported in 3.1. . We'll look at this new syntax in more detail in the chapter on the - Security Filter Chain. + Security Filter Chain. It's important to realise that these unsecured requests will be completely oblivious to any Spring Security web-related configuration or additional attributes such as requires-channel, so you will not be able to access @@ -313,7 +313,7 @@ authentication-success-handler-ref attribute as an alternative to default-target-url. The referenced bean should be an instance of AuthenticationSuccessHandler. - You'll find more on this in the Core Filters chapter and also in the namespace appendix, as well as information on how to customize the flow when authentication fails.
@@ -331,7 +331,7 @@ In practice you will need a more scalable source of user information than a few names added to the application context file. Most likely you will want to store your user information in something like a database or an LDAP server. LDAP namespace - configuration is dealt with in the LDAP chapter, so + configuration is dealt with in the LDAP chapter, so we won't cover it here. If you have a custom implementation of Spring Security's UserDetailsService, called "myUserDetailsService" in your application context, then you can authenticate against this using Where securityDataSource is the name of a DataSource bean in the application context, pointing at a database containing the standard Spring Security user data tables. Alternatively, + linkend="db_schema_users_authorities">user data tables. Alternatively, you could configure a Spring Security JdbcDaoImpl bean and point at that using the user-service-ref attribute: @@ -408,7 +408,7 @@ Advanced Web Features
Remember-Me Authentication - See the separate Remember-Me chapter for + See the separate Remember-Me chapter for information on remember-me namespace configuration.
@@ -515,7 +515,7 @@ session-management element. If you are using a customized authentication filter for form-based login, then you have to configure concurrent session control support explicitly. More - details can be found in the Session Management + details can be found in the Session Management chapter.
@@ -559,7 +559,7 @@ will also result in any javax.servlet.http.HttpSessionIdListeners being notified, so use caution if your code listens for both events. See the - Session Management chapter for additional + Session Management chapter for additional information.
@@ -580,7 +580,7 @@ authenticate. It is also possible to select a specific UserDetailsService bean for use OpenID by setting the user-service-ref attribute on the openid-login - element. See the previous section on authentication providers for more information. Note that we have omitted the password attribute from the above user configuration, since this set of user data is only being used to load the authorities for the user. A random password will be @@ -613,7 +613,7 @@ List<OpenIDAttribute> attributes = token.getAttributes();The retrieved value (or values in the case of multi-valued attributes). We'll see more about how the SecurityContextHolder class is used when we look at core Spring Security components in the technical overview chapter. Multiple + linkend="core-components">technical overview chapter. Multiple attribute exchange configurations are also be supported, if you wish to use multiple identity providers. You can supply multiple attribute-exchange elements, using an @@ -659,7 +659,7 @@ List<OpenIDAttribute> attributes = token.getAttributes();The ]]> - For additional information on how to customize the headers element refer to the headers + For additional information on how to customize the headers element refer to the headers section of the Security Namespace appendix.
@@ -826,7 +826,7 @@ List<OpenIDAttribute> attributes = token.getAttributes();The FilterSecurityInterceptor. Some other filters are added by default, but you can disable them. An AnonymousAuthenticationFilter is added by default and unless you have - session-fixation protection + session-fixation protection disabled, a SessionManagementFilter will also be added to the filter chain. @@ -847,7 +847,7 @@ List<OpenIDAttribute> attributes = token.getAttributes();The The CAS sample application is a good example of the use of custom beans with the namespace, including this syntax. If you aren't familiar with authentication entry points, they are discussed in the technical overview chapter. + linkend="tech-intro-auth-entry-point">technical overview chapter.
@@ -857,7 +857,7 @@ List<OpenIDAttribute> attributes = token.getAttributes();The From version 2.0 onwards Spring Security has improved support substantially for adding security to your service layer methods. It provides support for JSR-250 annotation security as well as the framework's original @Secured annotation. - From 3.0 you can also make use of new expression-based + From 3.0 you can also make use of new expression-based annotations. You can apply security to a single bean, using the intercept-methods element to decorate the bean declaration, or you can secure multiple beans across the entire service layer using the AspectJ style @@ -963,7 +963,7 @@ List<OpenIDAttribute> attributes = token.getAttributes();The The default strategy is to use an AffirmativeBased AccessDecisionManager with a RoleVoter and an AuthenticatedVoter. You - can find out more about these in the chapter on authorization.
Customizing the AccessDecisionManager @@ -992,7 +992,7 @@ List<OpenIDAttribute> attributes = token.getAttributes();The AuthenticationManager. This is usually an instance of Spring Security's ProviderManager class, which you may already be familiar with if you've used the framework before. If not, it will be covered later, in - the technical overview chapter. The + the technical overview chapter. The bean instance is registered using the authentication-manager namespace element. You can't use a custom AuthenticationManager if you are using either HTTP or method security through the namespace, but this should diff --git a/docs/manual/src/docbook/new-3-1.xml b/docs/manual/src/docbook/new-3-1.xml index 36c0bfd9c0..68102e0315 100644 --- a/docs/manual/src/docbook/new-3-1.xml +++ b/docs/manual/src/docbook/new-3-1.xml @@ -32,36 +32,36 @@ Spring Security 3.1 namespace updates Below you can find a summary of updates to the Spring Security 3.1 namespace. - Added support for multiple <http> elements and support for determining which one to use with - http@pattern, http@request-matcher, and - http@security. - Further information can be found in Namespace Configuration section of the reference. - Added stateless option for http@create-session - Added support for http@authentication-manager-ref - and global-method-security@authentication-manager-ref. - Added http@name - Added http@request-matcher-ref and - filter-chain@request-matcher-ref - Added <debug> + Added support for multiple <http> elements and support for determining which one to use with + http@pattern, http@request-matcher, and + http@security. + Further information can be found in Namespace Configuration section of the reference. + Added stateless option for http@create-session + Added support for http@authentication-manager-ref + and global-method-security@authentication-manager-ref. + Added http@name + Added http@request-matcher-ref and + filter-chain@request-matcher-ref + Added <debug> Added Support for setting the AuthenticationDetailsSource using the namespace. See - form-login@authentication-details-source-ref, - openid-login@authentication-details-source-ref, - http-basic@authentication-details-source-ref, and - x509@authentication-details-source-ref. + form-login@authentication-details-source-ref, + openid-login@authentication-details-source-ref, + http-basic@authentication-details-source-ref, and + x509@authentication-details-source-ref. Added support for http/expression-handler. This allows - <expression-handler> to be used for web access expressions. - Added authentication-manager@erase-credentials - Added http-basic@entry-point-ref - Added logout@delete-cookies - Added remember-me@authentication-success-handler-ref - Added <metadata-source-ref> - Added global-method-security@metadata-source-ref - Added global-method-security@mode - Added <attribute-exchange> - Added remember-me@use-secure-cookie - Added http@jaas-api-provision - Added form-login@username-parameter and - form-login@password-parameter + <expression-handler> to be used for web access expressions. + Added authentication-manager@erase-credentials + Added http-basic@entry-point-ref + Added logout@delete-cookies + Added remember-me@authentication-success-handler-ref + Added <metadata-source-ref> + Added global-method-security@metadata-source-ref + Added global-method-security@mode + Added <attribute-exchange> + Added remember-me@use-secure-cookie + Added http@jaas-api-provision + Added form-login@username-parameter and + form-login@password-parameter
diff --git a/docs/manual/src/docbook/preauth.xml b/docs/manual/src/docbook/preauth.xml index 8c0fa1b6d0..db371b30e0 100644 --- a/docs/manual/src/docbook/preauth.xml +++ b/docs/manual/src/docbook/preauth.xml @@ -29,7 +29,7 @@ pre-authenticated authentication providers. This removes duplication and allows new implementations to be added in a structured fashion, without having to write everything from scratch. You don't need to know about these classes if you want to use something - like X.509 authentication, as it already has a namespace + like X.509 authentication, as it already has a namespace configuration option which is simpler to use and get started with. If you need to use explicit bean configuration or are planning on writing your own implementation then an understanding of how the provided implementations work will be useful. You will find @@ -107,7 +107,7 @@
Http403ForbiddenEntryPoint The AuthenticationEntryPoint was discussed in the - technical overview chapter. + technical overview chapter. Normally it is responsible for kick-starting the authentication process for an unauthenticated user (when they try to access a protected resource), but in the pre-authenticated case this doesn't apply. You would only configure the @@ -121,7 +121,7 @@
Concrete Implementations - X.509 authentication is covered in its own chapter. + X.509 authentication is covered in its own chapter. Here we'll look at some classes which provide support for other pre-authenticated scenarios.
@@ -169,7 +169,7 @@ class="org.springframework.security.web.authentication.preauth.PreAuthenticatedA ]]> - We've assumed here that the security namespace + We've assumed here that the security namespace is being used for configuration. It's also assumed that you have added a UserDetailsService (called userDetailsService) to your configuration to load the user's diff --git a/docs/manual/src/docbook/remember-me-authentication.xml b/docs/manual/src/docbook/remember-me-authentication.xml index 5ca9bdb90b..d5c4c6cd63 100644 --- a/docs/manual/src/docbook/remember-me-authentication.xml +++ b/docs/manual/src/docbook/remember-me-authentication.xml @@ -45,7 +45,7 @@ more significant security is needed you should use the approach described in the next section. Alternatively remember-me services should simply not be used at all. If you are familiar with the topics discussed in the chapter on namespace configuration, you can enable remember-me + linkend="ns-config">namespace configuration, you can enable remember-me authentication just by adding the <remember-me> element: ... diff --git a/docs/manual/src/docbook/samples.xml b/docs/manual/src/docbook/samples.xml index 79e2c4f53d..6138476d72 100644 --- a/docs/manual/src/docbook/samples.xml +++ b/docs/manual/src/docbook/samples.xml @@ -6,7 +6,7 @@ There are several sample web applications that are available with the project. To avoid an overly large download, only the "tutorial" and "contacts" samples are included in the distribution zip file. The others can be built directly from the source which you can obtain - as described in the introduction. It's easy to build + as described in the introduction. It's easy to build the project yourself and there's more information on the project web site at http://www.springsource.org/security/ . All paths referred to in this chapter are @@ -17,8 +17,8 @@ namespace configuration throughout. The compiled application is included in the distribution zip file, ready to be deployed into your web container (spring-security-samples-tutorial-3.1.x.war). The form-based authentication mechanism is used in - combination with the commonly-used remember-me + linkend="ns-form-and-basic">form-based authentication mechanism is used in + combination with the commonly-used remember-me authentication provider to automatically remember the login using cookies. We recommend you start with the tutorial sample, as the XML is minimal and easy to follow. Most importantly, you can easily add this one XML file (and its corresponding @@ -122,7 +122,7 @@ Success! Your web filters appear to be properly configured! CAS Sample The CAS sample requires that you run both a CAS server and CAS client. It isn't included in the distribution so you should check out the project code as described in - the introduction. You'll find the relevant files + the introduction. You'll find the relevant files under the sample/cas directory. There's also a Readme.txt file in there which explains how to run both the server and the client directly from the source tree, complete with SSL support. @@ -132,12 +132,12 @@ Success! Your web filters appear to be properly configured! The JAAS sample is very simple example of how to use a JAAS LoginModule with Spring Security. The provided LoginModule will successfully authenticate a user if the username equals the password otherwise a LoginException is thrown. The AuthorityGranter used in this example always grants the role ROLE_USER. The sample application also demonstrates how to run as the JAAS Subject - returned by the LoginModule by setting jaas-api-provision equal to "true". + returned by the LoginModule by setting jaas-api-provision equal to "true".
Pre-Authentication Sample This sample application demonstrates how to wire up beans from the pre-authentication framework to make use of login + linkend="preauth">pre-authentication framework to make use of login information from a J2EE container. The user name and roles are those setup by the container. The code is in samples/preauth. diff --git a/docs/manual/src/docbook/secured-objects.xml b/docs/manual/src/docbook/secured-objects.xml index 44c5a7f6db..b25e779615 100644 --- a/docs/manual/src/docbook/secured-objects.xml +++ b/docs/manual/src/docbook/secured-objects.xml @@ -9,7 +9,7 @@ Prior to Spring Security 2.0, securing MethodInvocations needed quite a lot of boiler plate configuration. Now the recommended approach for - method security is to use namespace + method security is to use namespace configuration. This way the method security infrastructure beans are configured automatically for you so you don't really need to know about the implementation classes. We'll just provide a quick overview of the classes that are involved here. diff --git a/docs/manual/src/docbook/security-filter-chain.xml b/docs/manual/src/docbook/security-filter-chain.xml index 5424047248..12e3c7686e 100644 --- a/docs/manual/src/docbook/security-filter-chain.xml +++ b/docs/manual/src/docbook/security-filter-chain.xml @@ -12,7 +12,7 @@ Spring Security maintains a filter chain internally where each of the filters has a particular responsibility and filters are added or removed from the configuration depending on which services are required. The ordering of the filters is important as there are - dependencies between them. If you have been using namespace + dependencies between them. If you have been using namespace configuration, then the filters are automatically configured for you and you don't have to define any Spring beans explicitly but here may be times when you want full control over the security filter chain, either because you are using features which aren't supported @@ -111,7 +111,7 @@ lifecycle methods on the filters it is configured with. We recommend you use Spring's application context lifecycle interfaces as an alternative, just as you would for any other Spring bean. - When we looked at how to set up web security using When we looked at how to set up web security using namespace configuration, we used a DelegatingFilterProxy with the name springSecurityFilterChain. You should now be able to see that this is the name of the FilterChainProxy which is created by the diff --git a/docs/manual/src/docbook/session-mgmt.xml b/docs/manual/src/docbook/session-mgmt.xml index 24b30e0345..bff3c464c6 100644 --- a/docs/manual/src/docbook/session-mgmt.xml +++ b/docs/manual/src/docbook/session-mgmt.xml @@ -33,7 +33,7 @@ is just to redirect to a fixed URL and this is encapsulated in the standard implementation SimpleRedirectInvalidSessionStrategy. The latter is also used when configuring an invalid session URL through the namespace, - as described earlier. + as described earlier.
<interfacename>SessionAuthenticationStrategy</interfacename> diff --git a/docs/manual/src/docbook/taglibs.xml b/docs/manual/src/docbook/taglibs.xml index 29a6a1bfe4..1ab1830c32 100644 --- a/docs/manual/src/docbook/taglibs.xml +++ b/docs/manual/src/docbook/taglibs.xml @@ -16,7 +16,7 @@ Spring Security 3.0, it can be used in two ways The legacy options from Spring Security 2.0 are also supported, but discouraged. - . The first approach uses a web-security + . The first approach uses a web-security expression, specified in the access attribute of the tag. The expression evaluation will be delegated to the SecurityExpressionHandler<FilterInvocation> defined in the application diff --git a/docs/manual/src/docbook/technical-overview.xml b/docs/manual/src/docbook/technical-overview.xml index fd97688aab..d1c91ed040 100644 --- a/docs/manual/src/docbook/technical-overview.xml +++ b/docs/manual/src/docbook/technical-overview.xml @@ -115,7 +115,7 @@ if (principal instanceof UserDetails) { On successful authentication, UserDetails is used to build the Authentication object that is stored in the SecurityContextHolder (more on this below). The good news is that we + linkend="tech-intro-authentication">below). The good news is that we provide a number of UserDetailsService implementations, including one that uses an in-memory map (InMemoryDaoImpl) and another that uses JDBC @@ -132,7 +132,7 @@ if (principal instanceof UserDetails) { to other components within the framework. In particular, it does not authenticate the user, which is done by the AuthenticationManager. In many cases it makes more sense to - implement AuthenticationProvider + implement AuthenticationProvider directly if you require a custom authentication process. @@ -355,7 +355,7 @@ Successfully authenticated. Security context contains: \ If you're wondering how the AuthenticationManager is implemented in a real world example, we'll look at that in the core services + linkend="core-services-authentication-manager">core services chapter.
@@ -600,7 +600,7 @@ Successfully authenticated. Security context contains: \ RoleVoter. This is only relevant when a voter-based AccessDecisionManager is in use. We'll see how the AccessDecisionManager is implemented in the - authorization chapter. + authorization chapter.
RunAsManager