diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-3.1.rnc b/config/src/main/resources/org/springframework/security/config/spring-security-3.1.rnc index 056b6736ba..a37f10bc51 100644 --- a/config/src/main/resources/org/springframework/security/config/spring-security-3.1.rnc +++ b/config/src/main/resources/org/springframework/security/config/spring-security-3.1.rnc @@ -519,7 +519,7 @@ token-repository-ref = ## Reference to a PersistentTokenRepository bean for use with the persistent token remember-me implementation. attribute token-repository-ref {xsd:token} remember-me-services-ref = - ## Allows a custom implementation of RememberMeServices to be used. Note that this implementation should return RememberMeAuthenticationToken instances with the same "key" value as specified in the remember-me element. Alternatively it should register its own AuthenticationProvider. + ## Allows a custom implementation of RememberMeServices to be used. Note that this implementation should return RememberMeAuthenticationToken instances with the same "key" value as specified in the remember-me element. Alternatively it should register its own AuthenticationProvider. It should also implement the LogoutHandler interface, which will be invoked when a user logs out. Typically the remember-me cookie would be removed on logout. attribute services-ref {xsd:token}? remember-me-data-source-ref = ## DataSource bean for the database that contains the token repository schema. diff --git a/docs/manual/src/docbook/appendix-namespace.xml b/docs/manual/src/docbook/appendix-namespace.xml index 340ff7104a..773caead62 100644 --- a/docs/manual/src/docbook/appendix-namespace.xml +++ b/docs/manual/src/docbook/appendix-namespace.xml @@ -15,7 +15,7 @@ explaining their purpose. The namespace is written in RELAX NG Compact format and later converted into an XSD schema. If you are familiar with this format, you may wish to examine the schema file directly.
Web Application Security - the <literal><http></literal> Element @@ -235,7 +235,7 @@ filter stack and an LoginUrlAuthenticationEntryPoint to the application context to provide authentication on demand. This will always take precedence over other namespace-created entry points. If no attributes are supplied, - a login page will be generated automatically at the URL "/spring-security-login" + a login page will be generated automatically at the URL "/spring_security_login" This feature is really just provided for convenience and is not intended for production (where a view technology will have been chosen and can be used to render a customized login page). The class @@ -248,7 +248,7 @@ The URL that should be used to render the login page. Maps to the loginFormUrl property of the LoginUrlAuthenticationEntryPoint. Defaults to - "/spring-security-login". + "/spring_security_login".
<literal>login-processing-url</literal> @@ -322,18 +322,13 @@ will be used and configured with a JdbcTokenRepositoryImpl instance.
-
- <literal>token-repository-ref</literal> - Configures a PersistentTokenBasedRememberMeServices - but allows the use of a custom - PersistentTokenRepository bean. -
<literal>services-ref</literal> Allows complete control of the RememberMeServices implementation that will be - used by the filter. The value should be the Id of a bean in the application - context which implements this interface. + used by the filter. The value should be the id of a bean in the application + context which implements this interface. Should also implement + LogoutHandler if a logout filter is in use.
<literal>token-repository-ref</literal> @@ -365,7 +360,7 @@ UserDetailsService, so there has to be one defined in the application context. If there is only one, it will be selected and used automatically by the namespace configuration. If there are multiple - instances, you can specify a bean Id explicitly using this attribute. + instances, you can specify a bean id explicitly using this attribute.
@@ -468,7 +463,7 @@ OpenIDAuthenticationFilter and OpenIDAuthenticationProvider will be registered. The latter requires a reference to a UserDetailsService. Again, - this can be specified by Id, using the user-service-ref + this can be specified by id, using the user-service-ref attribute, or will be located automatically in the application context.
The <literal><attribute-exchange></literal> Element @@ -666,7 +661,7 @@ If you only have one server defined in your application context, the other LDAP namespace-defined beans will use it automatically. Otherwise, you can give the element an "id" attribute and refer to it from other namespace beans using - the server-ref attribute. This is actually the bean Id of the + the server-ref attribute. This is actually the bean id of the ContextSource instance, if you want to use it in other traditional Spring beans.
diff --git a/docs/manual/src/docbook/core-filters.xml b/docs/manual/src/docbook/core-filters.xml index c8642e661a..c800bbb302 100644 --- a/docs/manual/src/docbook/core-filters.xml +++ b/docs/manual/src/docbook/core-filters.xml @@ -136,7 +136,7 @@
<interfacename>AccessDeniedHandler</interfacename> - What happens if a user is already authenticated an they try to access a protected + What happens if a user is already authenticated and they try to access a protected resource? In normal usage, this shouldn't happen because the application workflow should be restricted to operations to which a user has access. For example, an HTML link to an administration page might be hidden from users who do not have an admin @@ -174,7 +174,7 @@ to save the current request before invoking the AuthenticationEntryPoint. This allows the request to be restored after the use has authenticated (see previous overview of web authentication). - A typical example would be where the user logs in with a from, and is then redirected to the + A typical example would be where the user logs in with a form, and is then redirected to the original URL by the default SavedRequestAwareAuthenticationSuccessHandler (see below). diff --git a/docs/manual/src/docbook/introduction.xml b/docs/manual/src/docbook/introduction.xml index 774ddc7915..5a50ef99a3 100644 --- a/docs/manual/src/docbook/introduction.xml +++ b/docs/manual/src/docbook/introduction.xml @@ -38,13 +38,13 @@ technologies: - HTTP BASIC authentication headers (an IEFT RFC-based standard) + HTTP BASIC authentication headers (an IETF RFC-based standard) - HTTP Digest authentication headers (an IEFT RFC-based standard) + HTTP Digest authentication headers (an IETF RFC-based standard) - HTTP X.509 client certificate exchange (an IEFT RFC-based standard) + HTTP X.509 client certificate exchange (an IETF RFC-based standard) LDAP (a very common approach to cross-platform authentication needs, @@ -62,7 +62,7 @@ JA-SIG Central Authentication Service (otherwise known as CAS, which is a - popular open source single sign on system) + popular open source single sign-on system) Transparent authentication context propagation for Remote Method Invocation @@ -73,7 +73,7 @@ re-authentication for a predetermined period of time) - Anonymous authentication (allowing every call to automatically assume a + Anonymous authentication (allowing every unauthenticated call to automatically assume a particular security identity) @@ -133,9 +133,8 @@ Your own authentication systems (see below) - (* Denotes provided by a third party; check our integration page for links to - the latest details) + (* Denotes provided by a third party + Many independent software vendors (ISVs) adopt Spring Security because of this significant choice of flexible authentication models. Doing so allows them to quickly integrate their solutions with whatever their end clients need, without undertaking a @@ -145,17 +144,9 @@ Spring Security need to integrate with "legacy" systems that don't follow any particular security standards, and Spring Security is happy to "play nicely" with such systems. - Sometimes the mere process of authentication isn't enough. Sometimes you need to also - differentiate security based on the way a principal is interacting with your - application. For example, you might want to ensure requests only arrive over HTTPS, in - order to protect passwords from eavesdropping or end users from man-in-the-middle - attacks. This is especially helpful to protect password recovery processes from brute - force attacks, or simply to make it harder for people to duplicate your application's - key content. To help you achieve these goals, Spring Security fully supports automatic - "channel security", together with JCaptcha integration for human user detection. - Irrespective of how authentication was undertaken, Spring Security provides a deep set - of authorization capabilities. There are three main areas of interest in respect of - authorization, these being authorizing web requests, authorizing whether methods can be + Irrespective of the authentication mechanism, Spring Security provides a deep set + of authorization capabilities. There are three main areas of interest + - authorizing web requests, authorizing whether methods can be invoked, and authorizing access to individual domain object instances. To help you understand the differences, consider the authorization capabilities found in the Servlet Specification web pattern security, EJB Container Managed Security and file system @@ -300,13 +291,13 @@ line that's causing the problem and work out what's happening. The source is the ultimate documentation for a project and often the simplest place to find out how something actually works. - To obtain the source for the project trunk, use the following git command: + To obtain the source for the project, use the following git command: git clone git://git.springsource.org/spring-security/spring-security.git - You can checkout specific versions from - https://src.springframework.org/svn/spring-security/tags/. + This will give you access to the entire project history (including all releases + and branches) on your local machine.
diff --git a/docs/manual/src/docbook/jaas-auth-provider.xml b/docs/manual/src/docbook/jaas-auth-provider.xml index 1961f27dae..675e5d750a 100644 --- a/docs/manual/src/docbook/jaas-auth-provider.xml +++ b/docs/manual/src/docbook/jaas-auth-provider.xml @@ -100,7 +100,7 @@ JAASTest { Spring Security, on the other hand, works with Authentication objects. Each Authentication object contains a single principal, - and multiple GrantedAuthority[]s. To facilitate + and multiple GrantedAuthoritys. To facilitate mapping between these different concepts, Spring Security's JAAS package includes an AuthorityGranter interface. diff --git a/docs/manual/src/docbook/namespace-config.xml b/docs/manual/src/docbook/namespace-config.xml index 35fde729e9..67d5df92ce 100644 --- a/docs/manual/src/docbook/namespace-config.xml +++ b/docs/manual/src/docbook/namespace-config.xml @@ -37,9 +37,9 @@ xmlns:security="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans - http://www.springframework.org/schema/beans/spring-beans-3.0.xsd + http://www.springframework.org/schema/beans/spring-beans-3.1.xsd http://www.springframework.org/schema/security - http://www.springframework.org/schema/security/spring-security-3.0.xsd"> + http://www.springframework.org/schema/security/spring-security-3.1.xsd"> ... ]]> In many of the examples you will see (and in the sample) applications, we @@ -52,9 +52,9 @@ xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans - http://www.springframework.org/schema/beans/spring-beans-3.0.xsd + http://www.springframework.org/schema/beans/spring-beans-3.1.xsd http://www.springframework.org/schema/security - http://www.springframework.org/schema/security/spring-security-3.0.xsd"> + http://www.springframework.org/schema/security/spring-security-3.1.xsd"> ... ]]> We'll assume this syntax is being used from now on in this chapter. @@ -888,7 +888,7 @@ List<OpenIDAttribute> attributes = token.getAttributes();The set an alternative for both method and web security. For method security, you do this by setting the access-decision-manager-ref attribute on - global-method-security to the Id of the appropriate + global-method-security to the id of the appropriate AccessDecisionManager bean in the application context: diff --git a/docs/manual/src/docbook/remember-me-authentication.xml b/docs/manual/src/docbook/remember-me-authentication.xml index 98fa72e95b..3b68b8f55b 100644 --- a/docs/manual/src/docbook/remember-me-authentication.xml +++ b/docs/manual/src/docbook/remember-me-authentication.xml @@ -125,7 +125,7 @@ TokenBasedRememberMeServices requires A UserDetailsService from which it can retrieve the username and password for signature comparison purposes, and generate the RememberMeAuthenticationToken to contain the - correct GrantedAuthority[]s. Some sort of logout + correct GrantedAuthoritys. Some sort of logout command should be provided by the application that invalidates the cookie if the user requests this. TokenBasedRememberMeServices also implements Spring Security's LogoutHandler interface diff --git a/docs/manual/src/docbook/samples.xml b/docs/manual/src/docbook/samples.xml index d753bb0967..c86608b003 100644 --- a/docs/manual/src/docbook/samples.xml +++ b/docs/manual/src/docbook/samples.xml @@ -8,9 +8,9 @@ distribution zip file. You can either build the others yourself, or you can obtain the war files individually from the central Maven repository. We'd recommend the former. You can get the source as described in the introduction and it's - easy to build the project using Maven. There is more information on the project web site at + easy to build the project yourself. There's more information on the project web site at - http://www.springsource.org/security/ if you need it. All paths referred to in this + http://www.springsource.org/security/ . All paths referred to in this chapter are relative to the project source directory.
Tutorial Sample @@ -35,7 +35,7 @@ administer a simple database of contacts (the domain objects). To deploy, simply copy the WAR file from Spring Security distribution into your container’s webapps directory. The war should be called - spring-security-samples-contacts-3.0.x.war (the appended version + spring-security-samples-contacts-3.1.x.war (the appended version number will vary depending on what release you are using). After starting your container, check the application can load. Visit http://localhost:8080/contacts (or whichever URL is appropriate for