Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 8fd2963e6b Deprecate storage of Authentication object in AuthenticationException. Luke Taylor 2011-11-01 13:05:42 +00:00
  • b60367e30c Upgrade to validater 4.2 Luke Taylor 2011-11-01 00:20:45 +00:00
  • 0bccbbfc18 SEC-1779: Make new getters protected rather than public. Luke Taylor 2011-11-01 00:20:34 +00:00
  • 178765cf83 SEC-1836: Forgot taglib comment update. Luke Taylor 2011-11-01 00:19:37 +00:00
  • f456db267f SEC-1779: Added getters for success and failure handlers to AbstractAuthenticationProcessingFilter. Luke Taylor 2011-11-01 00:06:23 +00:00
  • 30088f19ae SEC-1806: Log that bean definition is being created rather than bean in LdapServerBDP. Luke Taylor 2011-10-31 23:50:06 +00:00
  • 09ac4bd8f9 SEC-1833: Remove unused securityContextClass from HttpSessionSecurityContextRepository. Luke Taylor 2011-10-31 23:44:43 +00:00
  • fc399af136 SEC-1836: use GET as the default method with authorize tag. Luke Taylor 2011-10-31 23:23:37 +00:00
  • 2f67bb3032 SEC-1847: Add authentication-manager-ref attribute to http and global-method-security namespace elements. Luke Taylor 2011-10-30 21:51:02 +00:00
  • bce4d81142 Mark overriding "extraInformation" methods in account status exceptions as deprecated. Luke Taylor 2011-10-30 21:47:04 +00:00
  • c0c283029a Upgrade Jetty version. Luke Taylor 2011-10-30 21:45:58 +00:00
  • 44e2543015 Minor changes to make filter chain validation more robust with custom request matchers. Luke Taylor 2011-10-24 21:21:10 +01:00
  • f2786805e6 SEC-1841: Added request-matcher-ref attribute to namespace for defining a filter chain. Luke Taylor 2011-10-21 20:04:35 +01:00
  • 58f7d3acc6 SEC-1835: Changed xsd:ID to xsd:token. Luke Taylor 2011-10-21 18:35:06 +01:00
  • f1e63f3008 SEC-1802: Add digits to valid URL scheme regex. Luke Taylor 2011-10-21 17:24:05 +01:00
  • 7a3135f0f9 SEC-1839: Updated preauth example to use </security:authentication-manager> instead of </security-authentication-manager> Rob Winch 2011-10-18 19:18:56 -05:00
  • 2fd0a65049 SEC-1839: Updated preauth example to use </security:authentication-manager> instead of </security-authentication-manager> Rob Winch 2011-10-18 19:18:56 -05:00
  • ac6ed671a1 SEC-1830: Use constructor injection in namespace parsing code for creation of ProviderManager Luke Taylor 2011-09-26 18:24:36 +01:00
  • 9d66e1fac3 Exclude static resources from filter chain in tutorial sample. Luke Taylor 2011-09-25 22:30:14 +01:00
  • 82163e2546 Remove ancient code formatter artifacts. Luke Taylor 2011-09-25 21:20:02 +01:00
  • 2953f56b2b Remove ancient code formatter artifacts. Luke Taylor 2011-09-25 21:17:21 +01:00
  • 869c6a7c18 SEC-1800: Set input size to 30 for OpenID login. Luke Taylor 2011-09-25 21:13:37 +01:00
  • 44364d0101 SEC-1826: Empty attribute list should be treated the same as null in DelegatingMethodSecurityMetadataSource. Luke Taylor 2011-09-24 14:13:57 +01:00
  • be8ee61f82 PreInvocationAuthorizationAdviceVoter was checking the wrong type in its "supports" method. Luke Taylor 2011-09-24 13:13:38 +01:00
  • a573e7b395 SEC-1820: Added null check for attributesToFetch in OpenID4JavaConsumer. Luke Taylor 2011-09-20 21:46:21 +01:00
  • 4a000d040c SEC-1815: Downgrade openid to use HttpClient 4.1.1 to avoid bug in openid4java's usage of HttpClient Rob Winch 2011-09-18 18:52:27 -05:00
  • 2d27b28199 Set version to 3.0.8.CI-SNAPSHOT. Luke Taylor 2011-09-05 19:05:30 +01:00
  • 714ee3e960 Set version to 3.0.7.RELEASE. Luke Taylor 2011-09-05 19:02:06 +01:00
  • ee74c4ced2 SEC-1803: Add check in AbstractAuthenticationTargetUrlRequestHandler for null targetUrlParameter before attempting to read it from the request. Prevents NPE when targetUrlParameter is not set. Luke Taylor 2011-08-29 13:47:31 +01:00
  • 102027a44c SEC-1804: Updated Javadoc wrt immutability of User class. Luke Taylor 2011-08-25 10:50:50 +01:00
  • 799a43d72e SEC-1804: Update InMemoryDaoImpl to use User class directly and create a copy. Otherwise credentials are cleared on cached user instances. Luke Taylor 2011-08-25 11:09:02 +01:00
  • 359bd7c468 SEC-1804: Updated Javadoc wrt immutability of User class. Luke Taylor 2011-08-25 10:50:50 +01:00
  • 7bde24af6c Reset version to 3.1.0.CI-SNAPSHOT. Luke Taylor 2011-08-19 14:49:26 -07:00
  • 9e619611ae Set release version to 3.1.0.RC3 Luke Taylor 2011-08-19 14:38:15 -07:00
  • 8ce6c73802 Add check for empty attributes list as well as null, in DelegatingMethodSecurityMetadataSource Luke Taylor 2011-08-19 15:23:02 -07:00
  • d6b7b52a79 Update to Spring 3.0.6. Luke Taylor 2011-08-19 14:37:56 -07:00
  • 55e501711d Set version to 2.0.8.CI-SNAPSHOT Luke Taylor 2011-08-19 13:23:04 -07:00
  • d5e6f0b575 Set release version to 2.0.7.RELEASE Luke Taylor 2011-08-19 13:14:13 -07:00
  • 76dc21469e SEC-1750: Make sure RunAs replacement is constrained to the SecurityContext of the current thread. Luke Taylor 2011-05-20 20:42:54 +01:00
  • 22b7c9b905 SEC-1742: Make extraInformation in AuthenticationException transient. Luke Taylor 2011-05-20 19:29:13 +01:00
  • 0cdf202b10 SEC-1744: Do not trust authorities contained in the authentication request in JaasAuthenticationProvider. Luke Taylor 2011-05-20 19:27:37 +01:00
  • a507e3612a SEC-1741: Modify ContextPropagatingRemoteInvocation to pass a simple combination of principal/credentials as Strings, rather than serializing the whole SecurityContext object from the client. Luke Taylor 2011-05-20 19:21:38 +01:00
  • f5fbda42e5 SEC-1790: Reject redirect locations containing CR or LF. Luke Taylor 2011-07-27 16:47:15 +01:00
  • 3dc4158f7d Set version to 3.0.7.CI-SNAPSHOT Luke Taylor 2011-08-19 12:52:39 -07:00
  • 62f70f17ff Set project release version to 3.0.6.RELEASE Luke Taylor 2011-08-19 12:47:55 -07:00
  • 4b0fbe1606 Remove session timeout check in tutorial sample. Luke Taylor 2011-08-19 12:46:57 -07:00
  • a8bce41876 SEC-1795: Fix possible NPEs in AclImpl.equals() Luke Taylor 2011-08-19 11:45:34 -07:00
  • 3e4fc0b948 SEC-1795: Fix possible NPEs in AclImpl.equals() Luke Taylor 2011-08-19 11:45:34 -07:00
  • a4c05239e5 SEC-1719: Lithuanian messages translation. Luke Taylor 2011-08-19 11:17:05 -07:00
  • cea1f4499f SEC-1686: Upgrade to Spring 3.0.6 Luke Taylor 2011-08-19 10:15:48 -07:00
  • 503ac9ae7c SEC-1798: Remove internal evaluation of EL in JSP tag implementations. Luke Taylor 2011-08-12 19:42:53 +01:00
  • 45d938566c Some tests for Base64 encoding. Luke Taylor 2011-08-11 23:04:27 +01:00
  • 59a07175a6 SEC-1744: Do not trust authorities contained in the authentication request in JaasAuthenticationProvider. Luke Taylor 2011-07-04 11:22:24 +01:00
  • c618f4ab52 Add missing package to remoting bundlor template. Luke Taylor 2011-07-04 11:04:15 +01:00
  • 5fce0a58bd SEC-1750: Make sure RunAs replacement is constrained to the SecurityContext of the current thread. Luke Taylor 2011-07-04 11:03:54 +01:00
  • b48fc53fa2 SEC-1741: Modify ContextPropagatingRemoteInvocation to pass a simple combination of principal/credentials as Strings, rather than serializing the whole SecurityContext object from the client. Luke Taylor 2011-05-20 18:23:56 +01:00
  • 249610c7ed SEC-1742: Remove deprecated "includeDetailsObject" field from DaoAuthenticationProvider. Luke Taylor 2011-05-14 11:57:30 +01:00
  • 1976cb1bf7 SEC-1742: Deprecate use of extraInformation field in AuthenticationException, making it transient and removing any sensitive data in UserDetails objects which are stored in it. Luke Taylor 2011-05-14 11:05:42 +01:00
  • 824464516c SEC-1790: Reject redirect locations containing CR or LF. Luke Taylor 2011-07-27 16:24:30 +01:00
  • 6333909107 SEC-1797: Create a new session in AbstractPreAuthenticatedProcessingFilter when the existing session is invalidated on detecting a principal change. Luke Taylor 2011-08-12 19:07:17 +01:00
  • c19a5ffd73 SEC-1796: Check for annotated annotations at class/interface level. Previously only the specific security annotation was checked for. By delegating to Spring's AnnotationUtils, custom annotations carrying the security annotation are also detected. Luke Taylor 2011-08-12 14:36:42 +01:00
  • 74daa68691 SEC-1796: Check for annotated annotations at class/interface level. Previously only the specific security annotation was checked for. By delegating to Spring's AnnotationUtils, custom annotations carrying the security annotation are also detected. Luke Taylor 2011-08-12 14:29:55 +01:00
  • 8ce4d326f5 Update HttpClient to 4.1.2 and removed incorrect bundlor references to commons version. Luke Taylor 2011-08-12 00:22:42 +01:00
  • 594ee9515e Taglib test fixes to take latest SFW changes into account. Luke Taylor 2011-08-11 23:44:01 +01:00
  • 0120643721 SEC-1794: Convert OpenIDAuthenticationStatus to an enum. Luke Taylor 2011-08-10 17:09:33 +01:00
  • 0c2a950fa0 SEC-1788: Avoid unnecessary call to getPreAuthenticatedPrincipal() in AbstractPreAuthenticatedProcessingFilter when not checking for principal changes is not enabled. Luke Taylor 2011-08-04 14:33:54 +01:00
  • a087e828a6 SEC-1790: Disable use of spring-security-redirect by default for SimpleUrlLogoutSuccesshandler. Luke Taylor 2011-08-05 16:54:35 +01:00
  • 5238ba0e26 SEC-1790: Reject redirect locations containing CR or LF. Luke Taylor 2011-07-27 16:24:30 +01:00
  • 887e3361d2 SEC-1750: Make sure RunAs replacement is constrained to the SecurityContext of the current thread. Luke Taylor 2011-05-20 21:34:32 +01:00
  • a24570ae06 SEC-1744: Do not trust authorities contained in the authentication request in JaasAuthenticationProvider. Luke Taylor 2011-05-20 18:26:43 +01:00
  • ba719dc0e1 SEC-1741: Modify ContextPropagatingRemoteInvocation to pass a simple combination of principal/credentials as Strings, rather than serializing the whole SecurityContext object from the client. Luke Taylor 2011-05-20 18:23:56 +01:00
  • 28e70db8f2 SEC-1742: Deprecate use of extraInformation field in AuthenticationException, making it transient and removing any sensitive data in UserDetails objects which are stored in it. Luke Taylor 2011-05-14 11:05:42 +01:00
  • 84031c6001 SEC-1792: Fixed NullPointerException in RunAsUserToken#toString() Rob Winch 2011-07-29 09:24:02 -05:00
  • 7399c9a7a5 SEC-1792: Fixed NullPointerException in RunAsUserToken#toString() Rob Winch 2011-07-29 09:24:02 -05:00
  • dfd467f26e cleaned imports in RunAsUserToken Rob Winch 2011-07-29 09:38:40 -05:00
  • 7e44580c75 Minor refactoring of aspects tests. Luke Taylor 2011-07-20 17:42:05 +01:00
  • 8740efc0f5 Added constructor injection options to ConcurrentSessionFilter Luke Taylor 2011-07-18 15:09:31 +01:00
  • a1c714cff4 SEC-1754: Added an InvalidSessionStrategy to allow SessionManagementFilter to delegate out the behaviour when an invalid session identifier is submitted. Luke Taylor 2011-07-14 16:29:43 +01:00
  • ac3d8b25f2 Expand LDAP authentication FAQ with information about bind authentication and unreadable password attributes. Luke Taylor 2011-07-14 13:13:39 +01:00
  • 8440743108 Remove Sql query objects from JdbcTokenRepositoryImpl in favour of direct JdbcTemplate use. Luke Taylor 2011-07-13 23:28:41 +01:00
  • 89fa771093 SEC-1753: Cater for missing DiscoveryInformation object in OpenID4JavaConsumer.endConsumption. Luke Taylor 2011-07-13 22:29:47 +01:00
  • 700fa9e0b6 SEC-1772: remote URL decoding of targetUrlParameter in AbstractAuthenticationTargetUrlRequestHandler. Luke Taylor 2011-07-13 22:13:52 +01:00
  • de97bac85b SEC-1763: Prevent nested switches in SwitchUserFilter by calling attemptExitUser() before doing the switch. Luke Taylor 2011-07-13 21:56:06 +01:00
  • ca2af8bc59 SEC-1770: Call refreshLastRequest on the session registry rather than the SessionInformation object to make sure it works with alternative SessionRegistry implementations. Luke Taylor 2011-07-13 20:56:47 +01:00
  • a504cfae1a SEC-1770: Call refreshLastRequest on the session registry rather than the SessionInformation object to make sure it works with alternative SessionRegistry implementations. Luke Taylor 2011-07-13 20:56:47 +01:00
  • d5946b81b4 Added FAQ on how to add ApacheDS entries to pom. Luke Taylor 2011-07-13 17:50:29 +01:00
  • 6f59805ef3 SEC-1782: Javadoc correction for LdapAuthenticationProvider. Luke Taylor 2011-07-12 01:47:04 +01:00
  • c117c643df SEC-1782: Javadoc correction for LdapAuthenticationProvider. Luke Taylor 2011-07-12 01:43:48 +01:00
  • f359bed596 SEC-1777: Corrected log in HttpSessionSecurityContextRepository to reference itself instead of HttpSessionContextIntegrationFilter Rob Winch 2011-07-09 19:19:57 -05:00
  • 0f1ae574ab SEC-1776: Corrected typo in manual Florian Fankhauser 2011-07-09 19:11:54 -05:00
  • 330f82f562 SEC-1777: Corrected log in HttpSessionSecurityContextRepository to reference itself instead of HttpSessionContextIntegrationFilter Rob Winch 2011-07-09 19:19:57 -05:00
  • 2e83d98c8f SEC-1776: Corrected typo in manual Florian Fankhauser 2011-07-09 19:11:54 -05:00
  • 825f0061fb SEC-1761: Support HttpOnly Flag for Cookies when using Servlet 3.0 Rob Winch 2011-07-09 17:31:25 -05:00
  • 56e86dd36f Adding assertions on constructor arg values. Luke Taylor 2011-07-06 20:50:25 +01:00
  • f92589f051 Extract a SecurityFilterChain interface and create a default implementation to facilitate other configuration options. Luke Taylor 2011-07-06 00:12:48 +01:00
  • 2d271666a4 Add constructors to facilitate constructor-based injection for required/shared bean properties. Luke Taylor 2011-07-05 20:25:49 +01:00
  • 73442125de SEC-1775: Removed internal use of UserAttribute class in AnonymousAuthenticationFilter. Luke Taylor 2011-07-04 21:09:23 +01:00
  • 5d20f57fa8 Import cleaning. Luke Taylor 2011-07-02 20:33:53 +01:00
  • b15475ab3d SEC-1771: Change TokenBasedRememberMeServices to obtain password from UserDetailsService if necessary. Luke Taylor 2011-06-25 23:09:56 +01:00
  • 737a9d1825 Improved toString methods on request wrappers. Luke Taylor 2011-06-25 22:23:03 +01:00