Add Spring Boot Hello World guide

Add Spring Boot Hello World Guide

Fixes gh-3866

docs/guides/src/docs/asciidoc/_hello-includes/exploring-the-secured-application-boot.asc

@@ -0,0 +1,21 @@
+=== Exploring the secured application
+
+Start the application as we did in <<running-the-{starter-appname}-application>>
+
+Navigate to http://localhost:8080/ and click on the *_secured pages_* link and you will be prompted to login.
+
+==== Authenticating to the secured application
+
+Try entering an invalid username and password:
+
+* *Username* _invalid_
+* *Password* _invalid_
+
+You should see an error message stating that authentication failed. Now try entering a valid username and password:
+
+* *Username* _user_
+* *Password* _password_
+
+You should now see the page that we wanted to secure.
+
+NOTE: The reason we can successfully authenticate with *Username* _user_ and *Password* _password_ is because that is what we configured in our <<security-config-java,SecurityConfig>>.

docs/guides/src/docs/asciidoc/_hello-includes/secure-the-application-boot.asc

@@ -0,0 +1,118 @@
+== Securing the application
+
+Before securing the application, it is important to ensure that the existing application works as we did in <<running-the-{starter-appname}-application>>. Now that the application runs without security, we are ready to add security to our application. This section demonstrates the minimal steps to add Spring Security to our application.
+
+=== Updating your dependencies
+
+include::../{include-maven-repository}[]
+
+In order to use Spring Security you must add the necessary dependencies. For the sample we will add the following Spring Security dependencies:
+
+.pom.xml
+[source,xml]
+[subs="verbatim,attributes"]
+----
+<dependencies>
+  <!-- ... other dependency elements ... -->
+  <dependency>
+	<groupId>org.springframework.security</groupId>
+	<artifactId>spring-security-web</artifactId>
+	<version>{spring-security-version}</version>
+  </dependency>
+  <dependency>
+	<groupId>org.springframework.security</groupId>
+	<artifactId>spring-security-config</artifactId>
+	<version>{spring-security-version}</version>
+  </dependency>
+  <dependency>
+	<groupId>org.thymeleaf.extras</groupId>
+	<artifactId>thymeleaf-extras-springsecurity4</artifactId>	<1>
+	<version>2.1.2.RELEASE</version>
+  </dependency>
+</dependencies>
+----
+
+<1> We are using http://www.thymeleaf.org/[Thymeleaf] for our view template engine
+and need to add an additional dependency for the https://github.com/thymeleaf/thymeleaf-extras-springsecurity[Thymeleaf - Spring Security integration module].
+
+After you have completed this, you need to ensure that STS knows about the updated dependencies by:
+
+* Right click on the _spring-security-samples-{starter-config-type}-{starter-appname}_ application
+* Select *Maven->Update project...*
+* Ensure the project is selected, and click *OK*
+
+=== Creating your Spring Security configuration
+
+The next step is to create a Spring Security configuration.
+
+* Right click the _spring-security-samples-{starter-config-type}-{starter-appname}_ project in the Package Explorer view
+* Select *New->Class*
+* Enter _org.springframework.security.samples.config_ for the *Package*
+* Enter _SecurityConfig_ for the *Name*
+* Click *Finish*
+* Replace the file with the following contents:
+
+[[security-config-java]]
+.src/main/java/org/springframework/security/samples/config/SecurityConfig.java
+[source,java]
+----
+package org.springframework.security.samples.config;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+
+@EnableWebSecurity
+public class SecurityConfig extends WebSecurityConfigurerAdapter {
+
+	@Override
+	protected void configure(HttpSecurity http) throws Exception {
+		http
+			.authorizeRequests()
+				.antMatchers("/css/**", "/index").permitAll()		<1>
+				.antMatchers("/user/**").hasRole("USER")			<2>
+				.and()
+			.formLogin()
+				.loginPage("/login").failureUrl("/login-error");	<3>
+	}
+
+	@Autowired
+	public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
+		auth
+			.inMemoryAuthentication()
+				.withUser("user").password("password").roles("USER");
+	}
+}
+----
+
+<1> requests matched against _/css/**_ and _/index_ are fully accessible
+<2> requests matched against _/user/**_ require a user to be authenticated and must be associated to the _USER_ role
+<3> form-based authentication is enabled with a custom login page and failure url
+
+
+NOTE: The name of the configureGlobal method is not important. However, it is important to only configure AuthenticationManagerBuilder in a class annotated with either `@EnableWebSecurity`, `@EnableGlobalMethodSecurity`, or `@EnableGlobalAuthentication`. Doing otherwise has unpredictable results.
+
+[[servlet-api-integration]]
+The <<security-config-java,SecurityConfig>> will:
+
+* Require authentication to requests matched against _/user/**_
+* Specifies the URL to send users to for form-based login
+* Allow the user with the *Username* _user_ and the *Password* _password_ to authenticate with form based authentication
+* Allow the user to logout
+* http://en.wikipedia.org/wiki/Cross-site_request_forgery[CSRF attack] prevention
+* http://en.wikipedia.org/wiki/Session_fixation[Session Fixation] protection
+* Security Header integration
+** http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security[HTTP Strict Transport Security] for secure requests
+** http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx[X-Content-Type-Options] integration
+** Cache Control (can be overridden later by your application to allow caching of your static resources)
+** http://msdn.microsoft.com/en-us/library/dd565647(v=vs.85).aspx[X-XSS-Protection] integration
+** X-Frame-Options integration to help prevent http://en.wikipedia.org/wiki/Clickjacking[Clickjacking]
+* Integrate with the following Servlet API methods
+** http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#getRemoteUser()[HttpServletRequest#getRemoteUser()]
+** http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#getUserPrincipal()[HttpServletRequest.html#getUserPrincipal()]
+** http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#isUserInRole(java.lang.String)[HttpServletRequest.html#isUserInRole(java.lang.String)]
+** http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#login(java.lang.String,%20java.lang.String)[HttpServletRequest.html#login(java.lang.String, java.lang.String)]
+** http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#logout()[HttpServletRequest.html#logout()]
+