Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 187a530760 SEC-1670: Take account of JNDI CompositeName escaping in value of SearchResult.getName() when performing a search for a user entry in SpringSecurityLdapTemplate. Luke Taylor 2011-02-03 17:57:43 +00:00
  • a790c7e192 SEC-1670: Take account of JNDI CompositeName escaping in value of SearchResult.getName() when performing a search for a user entry in SpringSecurityLdapTemplate. Luke Taylor 2011-02-03 17:57:43 +00:00
  • 4e349904e5 Add missing language attributes to programlisting tags for highlighting. Luke Taylor 2011-02-01 16:54:18 +00:00
  • 5caa41753a Add check for coverage data before trying to produce report. Luke Taylor 2011-02-01 15:41:17 +00:00
  • 1b6587a5d4 SEC-1666: Use constant time comparison for sensitive data. Rob Winch 2011-01-31 23:00:16 -06:00
  • 8c08eeb57b SEC-1666: Use constant time comparison for sensitive data. Rob Winch 2011-01-31 23:00:16 -06:00
  • 6a62b51870 Fix typo in FAQ. Luke Taylor 2011-01-31 12:31:43 +00:00
  • 2e822e9abe SEC-1659: Ensure that Digester is returning digest(digest(value)...) instead of digesting the same value multiple times. Rob Winch 2011-01-27 22:17:16 -06:00
  • 347a2a91a9 SEC-1494: Document the use of system properties for disabling authorize tag functionality. Luke Taylor 2011-01-30 14:04:19 +00:00
  • 66e2a5246d SEC-1652: Use a URI for resolving the LDIF file for loading in ApacheDS container to allow for loading files which are contained in a jar. Luke Taylor 2011-01-27 13:23:05 +00:00
  • ece824fca2 SEC-1592: Updated CasAuthenticationFilter so that it does not continue FilterChain when handling proxy requests. Rob Winch 2011-01-27 10:49:24 -06:00
  • 3f7f87e19f SEC-1592: Updated CasAuthenticationFilter so that it does not continue FilterChain when handling proxy requests. Rob Winch 2011-01-27 09:14:42 -06:00
  • e3644e2d27 SEC-1661: Use a DistinguishedName to wrap the search base to avoid the need for JNDI escaping. Luke Taylor 2011-01-26 17:13:11 +00:00
  • 077af5e187 SEC-1661: Use a DistinguishedName to wrap the search base to avoid the need for JNDI escaping. Luke Taylor 2011-01-26 17:13:11 +00:00
  • 866615ceaa SEC-1662: Cater for the case where a user uses two <http> elements without patterns and the RequestMatcher does not have two arguments. Luke Taylor 2011-01-26 16:39:50 +00:00
  • d58dd79a52 SEC-1494: Updated the tutorial webapp to use CSS and make use of the securityHiddenUI element when UI security is disabled. Luke Taylor 2011-01-25 13:15:57 +00:00
  • 00200cecbc SEC-1494: Added system property "spring.security.disableUISecurity" which will prevent authorize tags from hiding content. By default, the property will also cause the area that would normally be hidden to be decorated with a <span class="securityHiddenUI"> tag, thus allowing the area to be rendered with some distinguishing css (e.g. a different background colour). Luke Taylor 2011-01-25 13:13:38 +00:00
  • 1b32babbf9 SEC-1545: Removed unused i18n keys, changed keys to follow naming conventions, found missing keys based upon old keys, sorted keys, any unknown keys are entered as a comment with the English value. Rob Winch 2011-01-21 12:56:43 -06:00
  • 95b416b0e7 SEC-1660: Minor addition to FAQ text. Luke Taylor 2011-01-21 16:26:14 +00:00
  • b542c73907 SEC-1660: Updated FAQ to explain that session-fixation protection may cause problems if switching between HTTP and HTTPS, and also updated information to advise against switching in the first place. Luke Taylor 2011-01-21 16:24:18 +00:00
  • b3943ac268 SEC-1545: Removed unused i18n keys, changed keys to follow naming conventions, found missing keys based upon old keys, sorted keys, any unknown keys are entered as a comment with the English value. Rob Winch 2011-01-21 10:24:07 -06:00
  • 6b1b012e2c Added check for maximum AES key size in crypto.gradle to skip tests if limited strength crypto policy files are in place. Luke Taylor 2011-01-20 02:13:33 +00:00
  • 594f6694bb Add logging of jdk version to crypto build file Luke Taylor 2011-01-20 01:31:30 +00:00
  • d686f64f26 Skip EncryptorsTests when using <JDK 1.6 as AES isn't available Luke Taylor 2011-01-19 23:43:13 +00:00
  • 60befb063a SEC-1659: Added crypto module to list of project modules in reference manual intro and to dependencies appendix. Luke Taylor 2011-01-19 18:26:30 +00:00
  • 162cb64baa SEC-1659: Label crypto utils package as only for internal use. Luke Taylor 2011-01-19 18:19:58 +00:00
  • 38327d1b16 SEC-1659: crypto docs Keith Donald 2011-01-15 15:16:32 -05:00
  • b646e44646 SEC-1659: fixed bundlor step of build Keith Donald 2011-01-15 10:40:53 -05:00
  • ea76efdb2c SEC-1659: favor AES encryption instead of DES as standard symmetric encryption algorithm Keith Donald 2011-01-14 17:05:07 -05:00
  • ffa7301e7f SEC-1569: initial commit of spring-security-crypto module, consisting of encrypt, keygen, password, and util packages Keith Donald 2011-01-13 22:40:47 -05:00
  • afd586c96e Re-instate the CAS integration sequence description in the CAS chapter, with corrections (and minus proxying). Luke Taylor 2011-01-18 16:50:18 +00:00
  • 2eefbf3a23 SEC-1657: Added support for 'name' attribute in <http> element to expose filter chain as a list bean. Luke Taylor 2011-01-14 17:21:22 +00:00
  • f20649f035 SEC-1648: added null check for getTargetUrlParameter() in SavedRequestAwareAuthenticationSuccessHandler.onAuthenticationSuccess and updated validation for AbstractAuthenticationTargetUrlRequestHandler.setTargetUrlParameter Rob Winch 2011-01-13 20:29:37 -06:00
  • 075b30ab44 SEC-1651: Added paragraph to FAQ mentioning dependencies appendix. Luke Taylor 2011-01-12 15:27:30 +00:00
  • 8da0de459b SEC-1651: Added remaining module information to dependencies appendix. Luke Taylor 2011-01-12 15:09:01 +00:00
  • 79b8edbd1e Update CAS client to 3.1.12 Luke Taylor 2011-01-12 14:56:16 +00:00
  • eeb466b613 SEC-1648: Implemented Rob's suggestion to use a null value for the targetUrlParameter rather than a boolean property. It should thus only be used if this value is set. Luke Taylor 2011-01-12 13:26:05 +00:00
  • 537d8f108a SEC-1654: Correct debug output in DigestAuthenticationFilter. Luke Taylor 2011-01-11 14:27:45 +00:00
  • 6de2197c0f SEC-1653: Ensure UserDetailsServiceFactoryBean is registered using the tools API to prevent errors in STS. Luke Taylor 2011-01-11 00:10:07 +00:00
  • 19e56f4397 Stripping out unnecessary dependencies from sample jars. Luke Taylor 2011-01-10 17:27:58 +00:00
  • 39b48c6d95 Update gradle wrapper to 0.9.1 in order to use mavenLocal() repo syntax. Luke Taylor 2011-01-10 17:27:22 +00:00
  • bf59c75886 Test class to improve coverage of WAS-specific preauth code. Luke Taylor 2011-01-07 19:49:50 +00:00
  • b858b23927 SEC-1651: Added first draft of dependencies appendix to reference manual. Luke Taylor 2011-01-07 19:23:06 +00:00
  • 6779822325 Remove GRADLE-1090 workarounds from config.gradle. Luke Taylor 2011-01-07 18:28:21 +00:00
  • 8d7830a1ee SEC-1603: Add support in namespace for use of AuthenticationSuccessHandler with remember-me. Luke Taylor 2011-01-06 15:16:13 +00:00
  • 7fd3aa2b45 SEC-1603: Add support for injecting an AuthenticationSuccessHandler into RememberMeAuthenticationFilter. Luke Taylor 2011-01-06 13:02:38 +00:00
  • c1f2fa1983 SEC-1558: Changed signatures of PrePostInvocationAttributeFactory to take strings rather than annotation types to allow the metadata to be obtained from other sources (not just annotations). Luke Taylor 2011-01-05 16:56:28 +00:00
  • 423f9eae7a SEC-1648: Added a useTargetUrlparameter property to AbstractAuthenticationTargetUrlRequestHandler which defaults to false. Luke Taylor 2011-01-05 13:13:30 +00:00
  • 313fe78cc1 Corrected snapshot version Luke Taylor 2010-12-20 23:04:49 +00:00
  • 2487a3e27b Reset to snapshot version Luke Taylor 2010-12-20 23:02:58 +00:00
  • 0ca5157f47 Set project release version to 3.1.0.M2 Luke Taylor 2010-12-20 22:46:02 +00:00
  • 7316bcff75 Updated outdated CAS sample readme with instructions for running CAS using gradle Luke Taylor 2010-12-20 22:22:19 +00:00
  • bbcc611af5 CAS server version upgrade and minor tweaks to CAS sample build file. Luke Taylor 2010-12-20 22:12:35 +00:00
  • 592782dc7f Added test for getAdditionalRoles in DefaultLdapAuthoritiesPopulator. Luke Taylor 2010-12-20 17:31:14 +00:00
  • eebcfd28ef Move Ldap authorities populator tests to the correct package. Luke Taylor 2010-12-20 17:23:43 +00:00
  • dbe270f132 SEC-1641: Correct code and test for null groupSearchBase. Luke Taylor 2010-12-20 16:50:11 +00:00
  • d0bada2bad SEC-1641: Correct code and test for null groupSearchBase. Luke Taylor 2010-12-20 16:50:11 +00:00
  • 428a0b7dce SEC-1639: Removed url argument from FilterChainProxy's VirtualFilterChain, since this can be directly computed from the request instance in the debug statements. Luke Taylor 2010-12-20 14:13:13 +00:00
  • 5f6dab67e1 SEC-1492: Added SimpleAuthoritiesMapper which provides a one-to-one authority mapping with case-conversion and the addition of a "role" prefix to the authority name. Luke Taylor 2010-12-19 17:32:24 +00:00
  • 3547cfcc92 SEC-1641: Remove the private setGroupSearchBase method and allowed a null value to be set for the group search base in the constructor. Luke Taylor 2010-12-19 16:18:30 +00:00
  • 952af853ac SEC-1641: Remove the private setGroupSearchBase method and allowed a null value to be set for the group search base in the constructor. Luke Taylor 2010-12-19 16:18:30 +00:00
  • f1fe3ce7e6 Update wrapper to gradle 0.9 release Luke Taylor 2010-12-19 14:41:41 +00:00
  • 48ea0a6249 SEC-1638: Added paragraph to docs explaining that for complete security, an app should not switch out of HTTPS at all. Luke Taylor 2010-12-17 17:34:08 +00:00
  • 7cf9740fd4 SEC-1638: Added an example configuration to the Javadoc for ChannelProcessingFilter and a pointer from the reference manual. Luke Taylor 2010-12-17 17:09:20 +00:00
  • d5b72275e5 SEC-1639: FirewalledRequest is now called on the specific FirewalledRequest instance rather that looping through ServletRequestWrappers. Rob Winch 2010-12-17 09:42:25 -06:00
  • 4dea140331 SEC-1639: FirewalledRequest is now called on the specific FirewalledRequest instance rather that looping through ServletRequestWrappers. Rob Winch 2010-12-16 23:53:15 -06:00
  • 1ed5227d75 Removed @Override from HttpFirewallBeanDefinitionParser.parse since it does not override a method definition, it implements one. Rob Winch 2010-12-16 22:20:20 -06:00
  • 7c04fdbc90 SEC-1639: FirewalledRequest is now called on the specific FirewalledRequest instance rather that looping through ServletRequestWrappers. Rob Winch 2010-12-16 21:57:26 -06:00
  • 46f83c8a08 SEC-1492: Added RoleHierarchyAuthoritiesMapper as the new preferred way of using a RoleHierarchy. Luke Taylor 2010-12-16 16:00:43 +00:00
  • c8820166c8 SEC-1576: Parameterize the secured object type in AccessDecisionVoter. Luke Taylor 2010-12-16 15:21:22 +00:00
  • 85d685f7d3 SEC-1611: Make access attribute in authorize tag a runtime expression Luke Taylor 2010-12-14 16:55:34 +00:00
  • ce421f22bf SEC-1635: Stop security interceptors from calling AfterInvocationManager if exception occurs during invocation Luke Taylor 2010-12-14 16:20:27 +00:00
  • 2be2660b13 SEC-1636: Add optimizations for simple pattern cases in AntPathRequestMatcher. "/**" and "**" are treated as universal matches and a trailing "/**" is now optimized using a substring match. Luke Taylor 2010-12-10 17:47:04 +00:00
  • bb3a973fcb SEC-1636: Add optimizations for universal match cases in AntUrlPathMatcher (using "/**" and "**" equality checks on the path). Luke Taylor 2010-12-11 20:29:30 +00:00
  • 522e8db5da Javadoc fix Luke Taylor 2010-12-09 12:39:05 +00:00
  • 523f6add60 Javadoc fix Luke Taylor 2010-12-09 12:39:05 +00:00
  • 08a933f930 SEC-1608: Ensure request wrapper is reset for empty filter chains. Luke Taylor 2010-12-08 13:56:08 +00:00
  • 4a40d80da1 SEC-1418: Deprecate GrantedAuthorityImpl in favour of final SimpleGrantedAuthority. Luke Taylor 2010-12-03 16:41:46 +00:00
  • 978b7d4707 SEC-1631: Reduced use of reflection in DefaultAuthenticationEventPublisher and added tests. Luke Taylor 2010-12-02 18:19:27 +00:00
  • 8f71f6febf SEC-1557: Added getter to DelegatingMethodSecurityMetadataSource. Luke Taylor 2010-12-01 21:57:16 +00:00
  • bfb723feac SEC-1557: Added getter to DelegatingMethodSecurityMetadataSource. Also added some optimizations of cache lookup key equals method. A class type check is unnecessary since the key class is a private inner class. Luke Taylor 2010-12-01 21:55:33 +00:00
  • 441aa25383 SEC-1615: Changed key generation for anonymous provider to only use SecureRandom on demand. Luke Taylor 2010-12-01 20:46:46 +00:00
  • 4ad0652787 Removed array of authorities constructor from TestingAuthenticationToken and RunAsUserToken. Luke Taylor 2010-11-30 17:12:04 +00:00
  • ca679e1479 Reformatting. Luke Taylor 2010-11-30 00:29:39 +00:00
  • 69a1fb76d3 SEC-1615: Changed key generation for anonymous provider to only use SecureRandom on demand. Luke Taylor 2010-12-01 20:51:13 +00:00
  • 9b29dcb8bf SEC-1430: Removed username attribute from WebAttributes class. Luke Taylor 2010-11-26 14:20:19 +00:00
  • 43be9ea2a4 SEC-1430: Removed caching of username in session upon failed authentication. Improved Javadoc. Luke Taylor 2010-11-26 13:58:49 +00:00
  • d64efe9747 SEC-1492: Added GrantedAuthoritiesMapper to provide mapping of loaded authorities to those which are eventually stored in the user Authentication object. Luke Taylor 2010-11-25 15:19:37 +00:00
  • 156a6924fa Move docs on request matching to correct file and delete unused one Luke Taylor 2010-11-24 00:22:54 +00:00
  • 89f80659a1 Move docs on request matching to correct file and delete unused one Luke Taylor 2010-11-24 00:19:08 +00:00
  • 49242729e4 Added imgSrcPath parameter for use in docbookFopPdf task. Luke Taylor 2010-11-19 22:53:57 +00:00
  • d53db3ba13 Update version to 3.0.6.CI-SNAPSHOT. Luke Taylor 2010-11-18 12:39:19 +00:00
  • 90304f64c6 Update version for 3.0.5 release Luke Taylor 2010-11-18 12:36:08 +00:00
  • 6349359b77 Enable aspectj module in 3.0.x build. Luke Taylor 2010-11-18 12:35:49 +00:00
  • 51a53ddbaa Minor refactoring of GAE code to use specific GrantedAuthority type. Luke Taylor 2010-11-17 14:15:11 +00:00
  • 60970dd9c4 Added some tests for web expression handling code. Luke Taylor 2010-11-15 20:01:38 +00:00
  • e80853b698 SEC-1412: DefaultSavedRequest should ignore "If-Modified-Since" headers to prevent re-displaying the login form (the cached result of the original request). Luke Taylor 2010-11-15 16:14:24 +00:00
  • 2d9f98d535 SEC-1412: DefaultSavedRequest should ignore "If-Modified-Since" headers to prevent re-displaying the login form (the cached result of the original request). Luke Taylor 2010-11-15 16:14:24 +00:00
  • fc00d7ef1d Move the unix scripts for the tutorial sample into a subdirectory Luke Taylor 2010-11-12 15:19:46 +00:00
  • 37810a19c4 SEC-1619: Added check in GAE sample for change of Google user while still logged into the app. Luke Taylor 2010-11-10 15:37:42 +00:00