diff --git a/src/docbkx/namespace-config.xml b/src/docbkx/namespace-config.xml index 1f0acb7685..b1ab63b7a1 100644 --- a/src/docbkx/namespace-config.xml +++ b/src/docbkx/namespace-config.xml @@ -553,6 +553,23 @@ + +
+ The <literal>intercept-methods</literal> Bean Decorator + + This alternative syntax allows you to specify security for a specific bean by adding this element within the bean itself. + + + + + + + +]]> + This allows you to configure security attributes for individual methods on the bean or simple wildcarded patterns. + +
diff --git a/src/docbkx/secured-objects.xml b/src/docbkx/secured-objects.xml index 156b2e361f..3de54edd44 100644 --- a/src/docbkx/secured-objects.xml +++ b/src/docbkx/secured-objects.xml @@ -1,221 +1,55 @@ - + Secure Object Implementations
- AOP Alliance (MethodInvocation) Security Interceptor + + AOP Alliance (MethodInvocation) Security Interceptor + + Prior to Spring Security 2.0, securing MethodInvocations needed quite a + lot of boiler plate configuration. Now the recommended approach for method security + is to use namespace configuration. + This way the method security infrastructure beans are configured automatically for you so you don't really need to + know about the implementation classes. We'll just provide a quick overview of the classes that are involved here. + - To secure MethodInvocations, developers - simply add a properly configured - MethodSecurityInterceptor into the application - context. Next the beans requiring security are chained into the - interceptor. This chaining is accomplished using Spring’s - ProxyFactoryBean or - BeanNameAutoProxyCreator, as commonly used by many - other parts of Spring (refer to the sample application for examples). - Alternatively, Spring Security provides a - MethodDefinitionSourceAdvisor which may be used - with Spring's DefaultAdvisorAutoProxyCreator to - automatically chain the security interceptor in front of any beans - defined against the MethodSecurityInterceptor. The - MethodSecurityInterceptor itself is configured as - follows: + + Method security in enforced using a MethodSecurityInterceptor, which secures + MethodInvocations. Depending on the configuration approach, an interceptor may be specific to a single + bean or shared between multiple beans. The interceptor uses a MethodDefinitionSource + instance to obtain the configuration attributes that apply to a particular method invocation. + MapBasedMethodDefinitionSource is used to store configuration attributes keyed by method names + (which can be wildcarded) and will be used internally when the attributes are defined in the application context using + the <intercept-methods> or <protect-point> elements. Other implementations + will be used to handle annotation-based configuration. + + +
+ Explicit MethodSecurityIterceptor Configuration + + You can of course configure a MethodSecurityIterceptor directly in your application context + for use with one of Spring AOP's proxying mechanisms: + + + + + + + org.springframework.security.context.BankManager.delete*=ROLE_SUPERVISOR + org.springframework.security.context.BankManager.getBalance=ROLE_TELLER,ROLE_SUPERVISOR + + + ]]> + + +
- <bean id="bankManagerSecurity" - class="org.springframework.security.intercept.method.aopalliance.MethodSecurityInterceptor"> -<property name="validateConfigAttributes"><value>true</value></property> -<property name="authenticationManager"><ref bean="authenticationManager"/></property> -<property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property> -<property name="runAsManager"><ref bean="runAsManager"/></property> -<property name="afterInvocationManager"><ref bean="afterInvocationManager"/></property> -<property name="objectDefinitionSource"> -<value> - org.springframework.security.context.BankManager.delete*=ROLE_SUPERVISOR,RUN_AS_SERVER - org.springframework.security.context.BankManager.getBalance=ROLE_TELLER,ROLE_SUPERVISOR,BANKSECURITY_CUSTOMER,RUN_AS_SERVER - </value> -</property> -</bean> - - As shown above, the MethodSecurityInterceptor - is configured with a reference to an - AuthenticationManager, - AccessDecisionManager and - RunAsManager, which are each discussed in separate - sections below. In this case we've also defined an - AfterInvocationManager, although this is entirely - optional. The MethodSecurityInterceptor is also - configured with configuration attributes that apply to different - method signatures. A full discussion of configuration attributes is - provided in the High Level Design section of this document. - - The MethodSecurityInterceptor can be - configured with configuration attributes in three ways. The first is - via a property editor and the application context, which is shown - above. The second is via defining the configuration attributes in your - source code using Jakarta Commons Attributes or Java 5 Annotations. - The third is via writing your own - ObjectDefinitionSource, although this is beyond the - scope of this document. Irrespective of the approach used, the - ObjectDefinitionSource is responsible for returning - a ConfigAttributeDefinition object that contains - all of the configuration attributes associated with a single secure - method. - - It should be noted that the - MethodSecurityInterceptor.setObjectDefinitionSource() - method actually expects an instance of - MethodDefinitionSource. This is a marker interface - which subclasses ObjectDefinitionSource. It simply - denotes the ObjectDefinitionSource understands - MethodInvocations. In the interests of simplicity - we'll continue to refer to the - MethodDefinitionSource as an - ObjectDefinitionSource, as the distinction is of - little relevance to most users of the - MethodSecurityInterceptor. - - If using the application context property editor approach (as - shown above), commas are used to delimit the different configuration - attributes that apply to a given method pattern. Each configuration - attribute is assigned into its own SecurityConfig - object. The SecurityConfig object is discussed in - the High Level Design section. - - If you are using the Jakarta Commons Attributes approach, your - bean context will be configured differently: - - <bean id="attributes" class="org.springframework.metadata.commons.CommonsAttributes"/> -<bean id="objectDefinitionSource" - class="org.springframework.security.intercept.method.MethodDefinitionAttributes"> -<property name="attributes"><ref local="attributes"/></property> -</bean> - -<bean id="bankManagerSecurity" - class="org.springframework.security.intercept.method.aopalliance.MethodSecurityInterceptor"> -<property name="validateConfigAttributes"><value>false</value></property> -<property name="authenticationManager"><ref bean="authenticationManager"/></property> -<property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property> -<property name="runAsManager"><ref bean="runAsManager"/></property> -<property name="objectDefinitionSource"><ref bean="objectDefinitionSource"/></property> -</bean> - - In addition, your source code will contain Jakarta Commons - Attributes tags that refer to a concrete implementation of - ConfigAttribute. The following example uses the - SecurityConfig implementation to represent the - configuration attributes, and results in the same security - configuration as provided by the property editor approach - above: - - public interface BankManager { - -/** - * @@SecurityConfig("ROLE_SUPERVISOR") - * @@SecurityConfig("RUN_AS_SERVER") - */ -public void deleteSomething(int id); - -/** - * @@SecurityConfig("ROLE_SUPERVISOR") - * @@SecurityConfig("RUN_AS_SERVER") - */ -public void deleteAnother(int id); - -/** - * @@SecurityConfig("ROLE_TELLER") - * @@SecurityConfig("ROLE_SUPERVISOR") - * @@SecurityConfig("BANKSECURITY_CUSTOMER") - * @@SecurityConfig("RUN_AS_SERVER") - */ -public float getBalance(int id); -} - - If you are using the Spring Security Java 5 Annotations - approach, your bean context will be configured as follows: - - <bean id="attributes" - class="org.springframework.security.annotation.SecurityAnnotationAttributes"/> -<bean id="objectDefinitionSource" - class="org.springframework.security.intercept.method.MethodDefinitionAttributes"> -<property name="attributes"><ref local="attributes"/></property> -</bean> - -<bean id="bankManagerSecurity" - class="org.springframework.security.intercept.method.aopalliance.MethodSecurityInterceptor"> -<property name="validateConfigAttributes"><value>false</value></property> -<property name="authenticationManager"><ref bean="authenticationManager"/></property> -<property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property> -<property name="runAsManager"><ref bean="runAsManager"/></property> -<property name="objectDefinitionSource"><ref bean="objectDefinitionSource"/></property> -</bean> - - In addition, your source code will contain Spring Security Java - 5 Security Annotations that represent the - ConfigAttribute. The following example uses the - @Secured annotations to represent the configuration - attributes, and results in the same security configuration as provided - by the property editor approach: - - import org.springframework.security.annotation.Secured; - - public interface BankManager { - -/** - * Delete something - */ -@Secured({"ROLE_SUPERVISOR","RUN_AS_SERVER" }) -public void deleteSomething(int id); - -/** - * Delete another - */ -@Secured({"ROLE_SUPERVISOR","RUN_AS_SERVER" }) -public void deleteAnother(int id); - -/** - * Get balance - */ -@Secured({"ROLE_TELLER","ROLE_SUPERVISOR","BANKSECURITY_CUSTOMER","RUN_AS_SERVER" }) -public float getBalance(int id); -} - - You might have noticed the - validateConfigAttributes property in the above - MethodSecurityInterceptor examples. When set to - true (the default), at startup time the - MethodSecurityInterceptor will evaluate if the - provided configuration attributes are valid. It does this by checking - each configuration attribute can be processed by either the - AccessDecisionManager or the - RunAsManager. If neither of these can process a - given configuration attribute, an exception is thrown. If using the - Jakarta Commons Attributes method of configuration, you should set - validateConfigAttributes to - false. - - Please note that when using - BeanNameAutoProxyCreator to create the required - proxy for security, the configuration must contain the property - proxyTargetClass set to true. - Otherwise, the method passed to - MethodSecurityInterceptor.invoke is the proxy's - caller, not the proxy's target. Note that this introduces a - requirement on CGLIB. See an example of using - BeanNameAutoProxyCreator below: - - <bean id="autoProxyCreator" class="org.springframework.aop.framework.autoproxy.BeanNameAutoProxyCreator"> -<property name="interceptorNames"> -<list><value>methodSecurityInterceptor</value></list> -</property> -<property name="beanNames"> -<list><value>targetObjectName</value></list> -</property> -<property name="proxyTargetClass" value="true"/> -</bean>
-
AspectJ (JoinPoint) Security Interceptor - +
+ AspectJ (JoinPoint) Security Interceptor The AspectJ security interceptor is very similar to the AOP Alliance security interceptor discussed in the previous section. @@ -237,20 +71,19 @@ public float getBalance(int id); AspectJSecurityInterceptor is configured in the Spring application context: - <bean id="bankManagerSecurity" - class="org.springframework.security.intercept.method.aspectj.AspectJSecurityInterceptor"> -<property name="validateConfigAttributes"><value>true</value></property> -<property name="authenticationManager"><ref bean="authenticationManager"/></property> -<property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property> -<property name="runAsManager"><ref bean="runAsManager"/></property> -<property name="afterInvocationManager"><ref bean="afterInvocationManager"/></property> -<property name="objectDefinitionSource"> -<value> - org.springframework.security.context.BankManager.delete*=ROLE_SUPERVISOR,RUN_AS_SERVER - org.springframework.security.context.BankManager.getBalance=ROLE_TELLER,ROLE_SUPERVISOR,BANKSECURITY_CUSTOMER,RUN_AS_SERVER - </value> -</property> -</bean> + + + + + + + org.springframework.security.context.BankManager.delete*=ROLE_SUPERVISOR + org.springframework.security.context.BankManager.getBalance=ROLE_TELLER,ROLE_SUPERVISOR + + +]]> As you can see, aside from the class name, the AspectJSecurityInterceptor is exactly the same as @@ -337,7 +170,8 @@ if (this.securityInterceptor == null) applied.
-
FilterInvocation Security Interceptor +
+ FilterInvocation Security Interceptor To secure FilterInvocations, developers need