Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-2783: XML Configuration Defaults Should Match JavaConfig

Browse Source 
* j_username -> username
* j_password -> password
* j_spring_security_check -> login
* j_spring_cas_security_check -> login/cas
* j_spring_cas_security_proxyreceptor -> login/cas/proxyreceptor
* j_spring_openid_security_login -> login/openid
* j_spring_security_switch_user -> login/impersonate
* j_spring_security_exit_user -> logout/impersonate
* login_error -> error
* use-expressions=true by default
This commit is contained in:
Rob Winch
2014-12-05 09:52:29 -06:00
parent b56e5edbbd
commit c67ff42b8a
125 changed files with 8122 additions and 395 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
samples/cas/sample-xml/src/integration-test/groovy/org/springframework/security/samples/cas/CasSampleTests.groovy
View File

@@ -52,7 +52,7 @@ class CasSampleTests extends AbstractCasTests {
def 'authenticate attempt with invaid ticket fails'() {
when: 'present invalid ticket'
go "j_spring_cas_security_check?ticket=invalid"
go "login/cas?ticket=invalid"
then: 'the login failed page is displayed'
$("h2").text() == 'Login to CAS failed!'
}

12
samples/cas/sample-xml/src/main/webapp/WEB-INF/applicationContext-security.xml
View File

@@ -10,7 +10,7 @@
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.0.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd">
<http entry-point-ref="casEntryPoint" use-expressions="true">
<http entry-point-ref="casEntryPoint">
<intercept-url pattern="/" access="permitAll"/>
<intercept-url pattern="/index.jsp" access="permitAll"/>
<intercept-url pattern="/cas-logout.jsp" access="permitAll"/>
@@ -41,7 +41,7 @@
<b:bean id="singleLogoutFilter" class="org.jasig.cas.client.session.SingleSignOutFilter"/>
<!-- This filter redirects to the CAS Server to signal Single Logout should be performed -->
<b:bean id="requestSingleLogoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter"
p:filterProcessesUrl="/j_spring_cas_security_logout">
p:filterProcessesUrl="/logout/cas">
<b:constructor-arg value="https://${cas.server.host}/cas/logout"/>
<b:constructor-arg>
<b:bean class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"/>
@@ -50,7 +50,7 @@
<b:bean id="serviceProperties"
class="org.springframework.security.cas.ServiceProperties"
p:service="https://${cas.service.host}/cas-sample/j_spring_cas_security_check"
p:service="https://${cas.service.host}/cas-sample/login/cas"
p:authenticateAllArtifacts="true"/>
<b:bean id="casEntryPoint"
class="org.springframework.security.cas.web.CasAuthenticationEntryPoint"
@@ -60,10 +60,10 @@
p:authenticationManager-ref="authManager"
p:serviceProperties-ref="serviceProperties"
p:proxyGrantingTicketStorage-ref="pgtStorage"
p:proxyReceptorUrl="/j_spring_cas_security_proxyreceptor">
p:proxyReceptorUrl="/login/cas/proxyreceptor">
<b:property name="authenticationDetailsSource">
<b:bean class="org.springframework.security.cas.web.authentication.ServiceAuthenticationDetailsSource">
<b:constructor-arg ref="serviceProperties"/>
<b:constructor-arg ref="serviceProperties"/>
</b:bean>
</b:property>
<b:property name="authenticationFailureHandler">
@@ -89,7 +89,7 @@
<b:bean
class="org.jasig.cas.client.validation.Cas20ProxyTicketValidator"
p:acceptAnyProxy="true"
p:proxyCallbackUrl="https://${cas.service.host}/cas-sample/j_spring_cas_security_proxyreceptor"
p:proxyCallbackUrl="https://${cas.service.host}/cas-sample/login/cas/proxyreceptor"
p:proxyGrantingTicketStorage-ref="pgtStorage">
<b:constructor-arg value="https://${cas.server.host}/cas" />
</b:bean>

2
samples/cas/sample-xml/src/main/webapp/cas-logout.jsp
View File

@@ -9,7 +9,7 @@
<p>You have logged out of this application, but may still have an active single-sign on session with CAS.</p>
<p><a href="j_spring_cas_security_logout">Logout of CAS</a></p>
<p><a href="logout/cas">Logout of CAS</a></p>
</body>
</html>

2
samples/cas/sample-xml/src/main/webapp/secure/extreme/index.jsp
View File

@@ -6,7 +6,7 @@ This is a protected page. You can only see me if you are a supervisor.
<p><a href="../../">Home</a>
<p><a href="../../secure/index.jsp">Secure page</a></p>
<p><a href="../../secure/ptSample">Proxy Ticket Sample page</a></p>
<p><a href="../../j_spring_security_logout">Logout</a>
<p><a href="../../logout">Logout</a>
<
</body>
</html>

2
samples/cas/sample-xml/src/main/webapp/secure/index.jsp
View File

@@ -10,6 +10,6 @@ or if you've authenticated this session.</p>
<p><a href="../">Home</a>
<p><a href="ptSample">Proxy Ticket Sample page</a></p>
<p><a href="../j_spring_security_logout">Logout</a>
<p><a href="../logout">Logout</a>
</body>
</html>

4
samples/contacts-xml/src/integration-test/groovy/org/springframework/security/samples/pages/LoginPage.groovy
View File

@@ -27,8 +27,8 @@ class LoginPage extends Page {
static at = { assert driver.title == 'Login'; true}
static content = {
login(required:false) { user='rod', password='koala' ->
loginForm.j_username = user
loginForm.j_password = password
loginForm.username = user
loginForm.password = password
submit.click()
}
loginForm { $('form') }

4
samples/contacts-xml/src/main/resources/applicationContext-security.xml
View File

@@ -17,13 +17,13 @@
<expression-handler ref="expressionHandler"/>
</global-method-security>
<http realm="Contacts Realm">
<http realm="Contacts Realm" use-expressions="false">
<intercept-url pattern="/" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
<intercept-url pattern="/index.jsp" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
<intercept-url pattern="/hello.htm" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
<intercept-url pattern="/login.jsp*" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
<intercept-url pattern="/switchuser.jsp" access="ROLE_SUPERVISOR"/>
<intercept-url pattern="/j_spring_security_switch_user" access="ROLE_SUPERVISOR"/>
<intercept-url pattern="/login/impersonate" access="ROLE_SUPERVISOR"/>
<intercept-url pattern="/**" access="ROLE_USER"/>
<form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?login_error=1"/>

2
samples/contacts-xml/src/main/webapp/WEB-INF/jsp/index.jsp
View File

@@ -29,7 +29,7 @@
</table>
<p><a href="<c:url value="add.htm"/>">Add</a> </p>
<form action="<c:url value="/j_spring_security_logout"/>" method="post">
<form action="<c:url value="/logout"/>" method="post">
<input type="submit" value="Logoff"/> (also clears any remember-me cookie)
<security:csrfInput/>
</form>

2
samples/contacts-xml/src/main/webapp/exitUser.jsp
View File

@@ -19,7 +19,7 @@
</font>
</c:if>
<form action="<c:url value='j_spring_security_exit_user'/>" method="POST">
<form action="<c:url value='logout/impersonate'/>" method="POST">
<table>
<tr><td>Current User:</td><td>

8
samples/contacts-xml/src/main/webapp/login.jsp
View File

@@ -6,7 +6,7 @@
<title>Login</title>
</head>
<body onload="document.f.j_username.focus();">
<body onload="document.f.username.focus();">
<h1>Login</h1>
<p>Valid users:
@@ -31,10 +31,10 @@
</font>
</c:if>
<form name="f" action="<c:url value='j_spring_security_check'/>" method="POST">
<form name="f" action="<c:url value='login'/>" method="POST">
<table>
<tr><td>User:</td><td><input type='text' name='j_username' value='<c:if test="${not empty param.login_error}"><c:out value="${SPRING_SECURITY_LAST_USERNAME}"/></c:if>'/></td></tr>
<tr><td>Password:</td><td><input type='password' name='j_password'></td></tr>
<tr><td>User:</td><td><input type='text' name='username' value='<c:if test="${not empty param.login_error}"><c:out value="${SPRING_SECURITY_LAST_USERNAME}"/></c:if>'/></td></tr>
<tr><td>Password:</td><td><input type='password' name='password'></td></tr>
<tr><td><input type="checkbox" name="_spring_security_remember_me"></td><td>Don't ask for my password for two weeks</td></tr>
<tr><td colspan='2'><input name="submit" type="submit"></td></tr>

4
samples/contacts-xml/src/main/webapp/switchUser.jsp
View File

@@ -30,9 +30,9 @@
</p>
</c:if>
<form action="<c:url value='j_spring_security_switch_user'/>" method="POST">
<form action="<c:url value='login/impersonate'/>" method="POST">
<table>
<tr><td>User:</td><td><input type='text' name='j_username'></td></tr>
<tr><td>User:</td><td><input type='text' name='username'></td></tr>
<tr><td colspan='2'><input name="switch" type="submit" value="Switch to User"></td></tr>
</table>
<input type="hidden" name="<c:out value="${_csrf.parameterName}"/>" value="<c:out value="${_csrf.token}"/>"/>

2
samples/contacts-xml/src/site/resources/sslhowto.txt
View File

@@ -73,7 +73,7 @@ TROUBLESHOOTING
load the Acegi Security webapp, get redirected to the CAS server, then
after login they get redirected back to the Acegi Security webapp and
receive a failure. This is because the CAS server redirects to something
like https://server3.company.com/webapp/j_spring_cas_security_check?ticket=ST-0-ER94xMJmn6pha35CQRoZ
like https://server3.company.com/webapp/login/cas?ticket=ST-0-ER94xMJmn6pha35CQRoZ
which causes the "service ticket" (the "ticket" parameter) to be validated.
net.sf.acegisecurity.providers.cas.ticketvalidator.CasProxyTicketValidator
performs service ticket validation by delegation to CAS'

8
samples/form-jc/src/main/webapp/WEB-INF/views/login.jspx
View File

@@ -22,10 +22,10 @@
You have been logged out.
</div>
</c:if>
<label for="j_username">Username</label>
<input type="text" id="j_username" name="username" value="${username}"/>
<label for="j_password">Password</label>
<input type="password" id="j_password" name="password"/>
<label for="username">Username</label>
<input type="text" id="username" name="username" value="${username}"/>
<label for="password">Password</label>
<input type="password" id="password" name="password"/>
<div class="form-actions">
<button type="submit" class="btn">Log in</button>
</div>

16
samples/helloworld-xml/build.gradle Normal file
View File

@@ -0,0 +1,16 @@
apply from: WAR_SAMPLE_GRADLE
dependencies {
providedCompile "javax.servlet:javax.servlet-api:3.0.1",
'javax.servlet.jsp:jsp-api:2.1'
compile project(":spring-security-config"),
project(":spring-security-web"),
jstlDependencies,
"org.slf4j:jcl-over-slf4j:$slf4jVersion"
runtime "ch.qos.logback:logback-classic:$logbackVersion"
integrationTestCompile gebDependencies
}

203
samples/helloworld-xml/pom.xml Normal file
View File

@@ -0,0 +1,203 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<modelVersion>4.0.0</modelVersion>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-samples-helloworld-jc</artifactId>
<version>4.0.0.CI-SNAPSHOT</version>
<packaging>war</packaging>
<name>spring-security-samples-helloworld-jc</name>
<description>spring-security-samples-helloworld-jc</description>
<url>http://spring.io/spring-security</url>
<organization>
<name>spring.io</name>
<url>http://spring.io/</url>
</organization>
<licenses>
<license>
<name>The Apache Software License, Version 2.0</name>
<url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
<distribution>repo</distribution>
</license>
</licenses>
<developers>
<developer>
<id>rwinch</id>
<name>Rob Winch</name>
<email>rwinch@gopivotal.com</email>
</developer>
</developers>
<scm>
<connection>scm:git:git://github.com/spring-projects/spring-security</connection>
<developerConnection>scm:git:git://github.com/spring-projects/spring-security</developerConnection>
<url>https://github.com/spring-projects/spring-security</url>
</scm>
<build>
<plugins>
<plugin>
<artifactId>maven-compiler-plugin</artifactId>
<configuration>
<source>1.7</source>
<target>1.7</target>
</configuration>
</plugin>
<plugin>
<artifactId>maven-war-plugin</artifactId>
<version>2.3</version>
<configuration>
<failOnMissingWebXml>false</failOnMissingWebXml>
</configuration>
</plugin>
</plugins>
</build>
<repositories>
<repository>
<id>spring-snasphot</id>
<url>https://repo.spring.io/snapshot</url>
</repository>
</repositories>
<dependencies>
<dependency>
<groupId>javax.servlet.jsp.jstl</groupId>
<artifactId>javax.servlet.jsp.jstl-api</artifactId>
<version>1.2.1</version>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>org.apache.taglibs</groupId>
<artifactId>taglibs-standard-jstlel</artifactId>
<version>1.2.1</version>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>jcl-over-slf4j</artifactId>
<version>1.7.5</version>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-config</artifactId>
<version>4.0.0.CI-SNAPSHOT</version>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-web</artifactId>
<version>4.0.0.CI-SNAPSHOT</version>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-core</artifactId>
<version>4.1.0.RC2</version>
<scope>compile</scope>
<exclusions>
<exclusion>
<artifactId>commons-logging</artifactId>
<groupId>commons-logging</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
<version>1.1.1</version>
<scope>compile</scope>
<optional>true</optional>
</dependency>
<dependency>
<groupId>javax.servlet.jsp</groupId>
<artifactId>jsp-api</artifactId>
<version>2.1</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>javax.servlet</groupId>
<artifactId>javax.servlet-api</artifactId>
<version>3.0.1</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
<version>0.9.29</version>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>commons-httpclient</groupId>
<artifactId>commons-httpclient</artifactId>
<version>3.1</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>4.11</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.codehaus.groovy</groupId>
<artifactId>groovy</artifactId>
<version>2.0.5</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.easytesting</groupId>
<artifactId>fest-assert</artifactId>
<version>1.4</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.gebish</groupId>
<artifactId>geb-spock</artifactId>
<version>0.9.0</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.mockito</groupId>
<artifactId>mockito-core</artifactId>
<version>1.9.5</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.seleniumhq.selenium</groupId>
<artifactId>selenium-htmlunit-driver</artifactId>
<version>2.33.0</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.spockframework</groupId>
<artifactId>spock-core</artifactId>
<version>0.7-groovy-2.0</version>
<scope>test</scope>
<exclusions>
<exclusion>
<artifactId>junit-dep</artifactId>
<groupId>junit</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.spockframework</groupId>
<artifactId>spock-spring</artifactId>
<version>0.7-groovy-2.0</version>
<scope>test</scope>
<exclusions>
<exclusion>
<artifactId>junit-dep</artifactId>
<groupId>junit</groupId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-test</artifactId>
<version>4.1.0.RC2</version>
<scope>test</scope>
</dependency>
</dependencies>
<properties>
<m2eclipse.wtp.contextRoot>/sample</m2eclipse.wtp.contextRoot>
</properties>
</project>

57
samples/helloworld-xml/src/integration-test/groovy/org/springframework/security/samples/HelloWorldXmlTests.groovy Normal file
View File

@@ -0,0 +1,57 @@
/*
* Copyright 2011 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.samples
import geb.spock.*
import org.junit.Ignore
import spock.lang.Shared
import spock.lang.Stepwise
import org.springframework.security.samples.pages.*
/**
* Tests the CAS sample application using service tickets.
*
* @author Rob Winch
*/
@Stepwise
class HelloWorldXmlTests extends GebReportingSpec {
def 'access home page with unauthenticated user sends to login page'() {
when: 'Unauthenticated user accesses the Home Page'
via HomePage
then: 'The login page is displayed'
at LoginPage
}
def 'authenticated user is sent to original page'() {
when: 'user authenticates'
login()
then: 'The home page is displayed'
at HomePage
and: 'The username is displayed'
message == 'Hello user'
}
def 'authenticated user logs out'() {
when: 'user logs out'
logout()
then: 'the login page is displayed'
at LoginPage
when: 'Unauthenticated user accesses the Home Page'
via HomePage
then: 'The login page is displayed'
at LoginPage
}
}

32
samples/helloworld-xml/src/integration-test/groovy/org/springframework/security/samples/pages/HomePage.groovy Normal file
View File

@@ -0,0 +1,32 @@
/*
* Copyright 2011 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.samples.pages;
import geb.*
/**
* The home page
*
* @author Rob Winch
*/
class HomePage extends Page {
static url = ''
static at = { assert driver.title == 'Hello Security'; true}
static content = {
message { $('p').text() }
logout { $('input', type: 'submit').click() }
}
}

37
samples/helloworld-xml/src/integration-test/groovy/org/springframework/security/samples/pages/LoginPage.groovy Normal file
View File

@@ -0,0 +1,37 @@
/*
* Copyright 2011 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.samples.pages;
import geb.*
/**
* The login page.
*
* @author Rob Winch
*/
class LoginPage extends Page {
static url = 'login'
static at = { assert driver.title == 'Login Page'; true}
static content = {
login(required:false) { user='user', password='password' ->
loginForm.username = user
loginForm.password = password
submit.click()
}
loginForm { $('form') }
submit { $('input', type: 'submit') }
}
}

2
samples/helloworld-xml/src/main/webapp/META-INF/MANIFEST.MF Normal file
View File

@@ -0,0 +1,2 @@
Manifest-Version: 1.0

11
samples/helloworld-xml/src/main/webapp/WEB-INF/spring/security.xml Normal file
View File

@@ -0,0 +1,11 @@
<b:beans xmlns="http://www.springframework.org/schema/security"
xmlns:b="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
<http />
<user-service>
<user name="user" password="password" authorities="ROLE_USER" />
</user-service>
</b:beans>

36
samples/helloworld-xml/src/main/webapp/WEB-INF/web.xml Normal file
View File

@@ -0,0 +1,36 @@
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">
<!--
- Location of the XML file that defines the root application context
- Applied by ContextLoaderListener.
-->
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
/WEB-INF/spring/*.xml
</param-value>
</context-param>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!--
- Loads the root application context of this web app at startup.
- The application context is then available via
- WebApplicationContextUtils.getWebApplicationContext(servletContext).
-->
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
</web-app>

38
samples/helloworld-xml/src/main/webapp/index.jsp Normal file
View File

@@ -0,0 +1,38 @@
<?xml version="1.0" encoding="UTF-8" ?>
<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page"
xmlns:c="http://java.sun.com/jsp/jstl/core" version="2.0">
<jsp:directive.page contentType="text/html" pageEncoding="UTF-8" />
<jsp:output omit-xml-declaration="true" />
<jsp:output doctype-root-element="HTML"
doctype-system="about:legacy-compat" />
<html lang="en">
<head>
<title>Hello Security</title>
<c:url var="faviconUrl" value="/resources/img/favicon.ico"/>
<link rel="icon" type="image/x-icon" href="${faviconUrl}"/>
<c:url var="bootstrapUrl" value="/resources/css/bootstrap.css"/>
<link href="${bootstrapUrl}" rel="stylesheet"></link>
<c:url var="bootstrapResponsiveUrl" value="/resources/css/bootstrap-responsive.css"/>
<link href="${bootstrapResponsiveUrl}" rel="stylesheet"></link>
<!-- HTML5 shim, for IE6-8 support of HTML5 elements -->
<!--[if lt IE 9]>
<script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>
<![endif]-->
</head>
<body>
<div class="container">
<h1>This is secured!</h1>
<p>
Hello <b><c:out value="${pageContext.request.remoteUser}"/></b>
</p>
<c:url var="logoutUrl" value="/logout"/>
<form class="form-inline" action="${logoutUrl}" method="post">
<input type="submit" value="Log out" />
<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>
</form>
</div>
</body>
</html>
</jsp:root>

1092
samples/helloworld-xml/src/main/webapp/resources/css/bootstrap-responsive.css vendored Normal file
View File

File diff suppressed because it is too large Load Diff

6039
samples/helloworld-xml/src/main/webapp/resources/css/bootstrap.css vendored Normal file
View File

File diff suppressed because it is too large Load Diff

BIN
samples/helloworld-xml/src/main/webapp/resources/img/favicon.ico Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 1.1 KiB

BIN
samples/helloworld-xml/src/main/webapp/resources/img/logo.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 1.1 KiB

2
samples/jaas-xml/src/integration-test/groovy/org/springframework/security/samples/JaasXmlTests.groovy
View File

@@ -52,7 +52,7 @@ class JaasXmlTests extends GebReportingSpec {
when: 'user logs out'
logout()
then: 'the default logout success page is displayed'
at HomePage
at LogoutPage
when: 'Unauthenticated user accesses the Secure Page'
via SecurePage
then: 'The login page is displayed'

4
samples/jaas-xml/src/integration-test/groovy/org/springframework/security/samples/pages/LoginPage.groovy
View File

@@ -27,8 +27,8 @@ class LoginPage extends Page {
static at = { assert driver.title == 'Login Page'; true}
static content = {
login(required:false) { user='user', password='user' ->
loginForm.j_username = user
loginForm.j_password = password
loginForm.username = user
loginForm.password = password
submit.click()
}
loginForm { $('form') }

28
samples/jaas-xml/src/integration-test/groovy/org/springframework/security/samples/pages/LogoutPage.groovy Normal file
View File

@@ -0,0 +1,28 @@
/*
* Copyright 2011 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.samples.pages
import geb.Page
/**
* The login page.
*
* @author Rob Winch
*/
class LogoutPage extends LoginPage {
static url = 'login'
static at = { assert driver.title == 'Login Page' && $('p').text() == 'You have been logged out'; true}
}

92
samples/jaas-xml/src/main/resources/applicationContext-security.xml
View File

@@ -1,52 +1,52 @@
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:sec="http://www.springframework.org/schema/security"
xmlns:p="http://www.springframework.org/schema/p"
xmlns:util="http://www.springframework.org/schema/util"
xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.0.xsd">
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:sec="http://www.springframework.org/schema/security"
xmlns:p="http://www.springframework.org/schema/p"
xmlns:util="http://www.springframework.org/schema/util"
xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.0.xsd">
<sec:http auto-config="true" use-expressions="true" jaas-api-provision="true">
<sec:intercept-url pattern="/secure/**" access="isAuthenticated()"/>
</sec:http>
<sec:authentication-manager>
<sec:authentication-provider ref="jaasAuthProvider"/>
</sec:authentication-manager>
<sec:http auto-config="true" jaas-api-provision="true">
<sec:intercept-url pattern="/secure/**" access="isAuthenticated()"/>
</sec:http>
<bean id="jaasAuthProvider"
class="org.springframework.security.authentication.jaas.DefaultJaasAuthenticationProvider">
<property name="configuration">
<bean
class="org.springframework.security.authentication.jaas.memory.InMemoryConfiguration">
<constructor-arg>
<map>
<entry key="SPRINGSECURITY">
<array>
<bean class="javax.security.auth.login.AppConfigurationEntry">
<constructor-arg
value="samples.jaas.UsernameEqualsPasswordLoginModule" />
<constructor-arg>
<util:constant
static-field="javax.security.auth.login.AppConfigurationEntry$LoginModuleControlFlag.REQUIRED" />
</constructor-arg>
<constructor-arg>
<map></map>
</constructor-arg>
</bean>
</array>
</entry>
</map>
</constructor-arg>
</bean>
</property>
<property name="authorityGranters">
<list>
<bean class="samples.jaas.RoleUserAuthorityGranter" />
</list>
</property>
</bean>
<sec:authentication-manager>
<sec:authentication-provider ref="jaasAuthProvider"/>
</sec:authentication-manager>
<bean id="jaasAuthProvider"
class="org.springframework.security.authentication.jaas.DefaultJaasAuthenticationProvider">
<property name="configuration">
<bean
class="org.springframework.security.authentication.jaas.memory.InMemoryConfiguration">
<constructor-arg>
<map>
<entry key="SPRINGSECURITY">
<array>
<bean class="javax.security.auth.login.AppConfigurationEntry">
<constructor-arg
value="samples.jaas.UsernameEqualsPasswordLoginModule" />
<constructor-arg>
<util:constant
static-field="javax.security.auth.login.AppConfigurationEntry$LoginModuleControlFlag.REQUIRED" />
</constructor-arg>
<constructor-arg>
<map></map>
</constructor-arg>
</bean>
</array>
</entry>
</map>
</constructor-arg>
</bean>
</property>
<property name="authorityGranters">
<list>
<bean class="samples.jaas.RoleUserAuthorityGranter" />
</list>
</property>
</bean>
</beans>

2
samples/jaas-xml/src/main/webapp/secure/index.jsp
View File

@@ -49,7 +49,7 @@
<% }
%>
<form action="<c:url value="/j_spring_security_logout"/>" method="post">
<form action="<c:url value="/logout"/>" method="post">
<input type="submit" value="Log Out"/>
<sec:csrfInput/>
</form>

2
samples/ldap-xml/src/integration-test/groovy/org/springframework/security/samples/LdapXmlTests.groovy
View File

@@ -51,7 +51,7 @@ class LdapXmlTests extends GebReportingSpec {
when: 'user logs out'
logout.click()
then: 'the default logout success page is displayed'
at HomePage
at LogoutPage
when: 'Unauthenticated user accesses the Manage Page'
via SecurePage
then: 'The login page is displayed'

4
samples/ldap-xml/src/integration-test/groovy/org/springframework/security/samples/pages/LoginPage.groovy
View File

@@ -27,8 +27,8 @@ class LoginPage extends Page {
static at = { assert driver.title == 'Login Page'; true}
static content = {
login(required:false) { user='rod', password='koala' ->
loginForm.j_username = user
loginForm.j_password = password
loginForm.username = user
loginForm.password = password
submit.click()
}
loginForm { $('form') }

25
samples/ldap-xml/src/integration-test/groovy/org/springframework/security/samples/pages/LogoutPage.groovy Normal file
View File

@@ -0,0 +1,25 @@
/*
* Copyright 2011 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.samples.pages
/**
* The login page.
*
* @author Rob Winch
*/
class LogoutPage extends LoginPage {
static url = 'login'
static at = { assert driver.title == 'Login Page' && $('p').text() == 'You have been logged out'; true}
}

6
samples/ldap-xml/src/main/webapp/WEB-INF/applicationContext-security.xml
View File

@@ -5,9 +5,9 @@
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
<s:http>
<s:intercept-url pattern="/secure/extreme/**" access="ROLE_SUPERVISOR"/>
<s:intercept-url pattern="/secure/**" access="IS_AUTHENTICATED_REMEMBERED" />
<s:intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
<s:intercept-url pattern="/secure/extreme/**" access="hasRole('ROLE_SUPERVISOR')"/>
<s:intercept-url pattern="/secure/**" access="authenticated" />
<s:intercept-url pattern="/**" access="permitAll" />
<s:form-login />
<s:anonymous />

2
samples/ldap-xml/src/main/webapp/secure/extreme/index.jsp
View File

@@ -7,7 +7,7 @@
This is a protected page. You can only see me if you are a supervisor.
<p><a href="../../">Home</a>
<form action="<c:url value="/j_spring_security_logout"/>" method="post">
<form action="<c:url value="/logout"/>" method="post">
<input type="submit" value="Logoff"/>
<security:csrfInput/>
</form>

2
samples/ldap-xml/src/main/webapp/secure/index.jsp
View File

@@ -13,7 +13,7 @@ or if you've authenticated this session.<br><br>
<p><a href="../">Home</a>
<form action="<c:url value="/j_spring_security_logout"/>" method="post">
<form action="<c:url value="/logout"/>" method="post">
<input type="submit" value="Logoff"/> (also clears any remember-me cookie)
<security:csrfInput/>
</form>

2
samples/openid-xml/src/main/webapp/WEB-INF/applicationContext-security.xml
View File

@@ -16,7 +16,7 @@
<http pattern="/js/*" security="none" />
<http>
<intercept-url pattern="/**" access="ROLE_USER"/>
<intercept-url pattern="/**" access="authenticated"/>
<logout/>
<openid-login login-page="/openidlogin.jsp" user-service-ref="registeringUserService"
authentication-failure-url="/openidlogin.jsp?login_error=true">

2
samples/openid-xml/src/main/webapp/index.jsp
View File

@@ -21,6 +21,6 @@ by the application and will be recognized if you return.
<p>
Your principal object is....: <%= request.getUserPrincipal() %>
</p>
<p><a href="j_spring_security_logout">Logout</a>
<p><a href="logout">Logout</a>
</body>
</html>

2
samples/openid-xml/src/main/webapp/openidlogin.jsp
View File

@@ -36,7 +36,7 @@
</c:if>
<!-- Simple OpenID Selector -->
<form action="<c:url value='j_spring_openid_security_check'/>" method="post" id="openid_form">
<form action="<c:url value='login/openid'/>" method="post" id="openid_form">
<input type="hidden" name="action" value="verify" />
<fieldset>

8
samples/preauth-jc/src/main/resources/views/login.html
View File

@@ -13,10 +13,10 @@
<div th:if="${param.logout}" class="alert alert-success">
You have been logged out.
</div>
<label for="j_username">Username</label>
<input type="text" id="j_username" name="j_username"/>
<label for="j_password">Password</label>
<input type="password" id="j_password" name="j_password"/>
<label for="username">Username</label>
<input type="text" id="username" name="username"/>
<label for="password">Password</label>
<input type="password" id="password" name="password"/>
<div class="form-actions">
<button type="submit" class="btn">Log in</button>
</div>

2
samples/preauth-xml/src/main/webapp/secure/extreme/index.jsp
View File

@@ -5,6 +5,6 @@
This is a protected page. You can only see me if you are a supervisor.
<p><a href="../../">Home</a>
<p><a href="../../j_spring_security_logout">Logout</a>
<p><a href="../../logout">Logout</a>
</body>
</html>

2
samples/preauth-xml/src/main/webapp/secure/index.jsp
View File

@@ -10,6 +10,6 @@ or if you've authenticated this session.<br><br>
<p><a href="../">Home</a>
<p><a href="../j_spring_security_logout">Logout</a>
<p><a href="../logout">Logout</a>
</body>
</html>

2
samples/servletapi-xml/src/main/resources/applicationContext-security.xml
View File

@@ -8,7 +8,7 @@
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.0.xsd">
<http auto-config="true" use-expressions="true">
<http auto-config="true">
<intercept-url pattern="/**" access="permitAll"/>
</http>

2
samples/tutorial-xml/src/main/webapp/WEB-INF/applicationContext-security.xml
View File

@@ -18,7 +18,7 @@
<http pattern="/static/**" security="none"/>
<http pattern="/loggedout.jsp" security="none"/>
<http use-expressions="true">
<http>
<intercept-url pattern="/secure/extreme/**" access="hasRole('supervisor')"/>
<intercept-url pattern="/secure/**" access="isAuthenticated()" />
<!--

2
samples/tutorial-xml/src/main/webapp/WEB-INF/jsp/listAccounts.jsp
View File

@@ -47,7 +47,7 @@ Anyone can view this page, but posting to an Account requires login and must be
</c:forEach>
</table>
<p><a href="j_spring_security_logout">Logout</a></p>
<p><a href="logout">Logout</a></p>
</div>
</body>
</html>

2
samples/tutorial-xml/src/main/webapp/secure/extreme/index.jsp
View File

@@ -19,7 +19,7 @@ This is a protected page. You can only see me if you are a supervisor.
</authz:authorize>
<p><a href="../../">Home</a></p>
<p><a href="../../j_spring_security_logout">Logout</a></p>
<p><a href="../../logout">Logout</a></p>
</div>
</body>
</html>

2
samples/tutorial-xml/src/main/webapp/secure/index.jsp
View File

@@ -43,7 +43,7 @@ or if you've authenticated this session.
<p><a href="../">Home</a></p>
<p><a href="../j_spring_security_logout">Logout</a></p>
<p><a href="../logout">Logout</a></p>
</div>
</body>
</html>

8
samples/x509-jc/src/main/webapp/WEB-INF/views/login.jspx
View File

@@ -22,10 +22,10 @@
You have been logged out.
</div>
</c:if>
<label for="j_username">Username</label>
<input type="text" id="j_username" name="j_username" value="${username}"/>
<label for="j_password">Password</label>
<input type="password" id="j_password" name="j_password"/>
<label for="username">Username</label>
<input type="text" id="username" name="username" value="${username}"/>
<label for="password">Password</label>
<input type="password" id="password" name="password"/>
<div class="form-actions">
<button type="submit" class="btn">Log in</button>
</div>