Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 82d105cbc3 SEC-1587: Add explicit call to removeAttribute() to remove the context from the session if the current context is empty or anonymous. Luke Taylor 2010-11-10 13:01:49 +00:00
  • e88f47a96a SEC-1561: Add check on whether the security context attribute is set in the current session to make sure it is stored when a new session has been created during the request. Luke Taylor 2010-11-10 12:53:56 +00:00
  • 8b51c2c97d SEC-1587: Add explicit call to removeAttribute() to remove the context from the session if the current context is empty or anonymous. Luke Taylor 2010-11-09 13:55:45 +00:00
  • 7754882ba9 SEC-1550: Additional signature change (in AnonymousAuthenticationToken) Luke Taylor 2010-11-09 13:47:56 +00:00
  • ffccc5f446 SEC-1617: Added spring-security-taglibs as a runtime dependency to jaas.gradle Rob Winch 2010-11-08 19:27:44 -06:00
  • 4b6a2168c7 SEC-1550: Additional signature change (in LdapUserDetailsManager.removeAuthorities()) Luke Taylor 2010-11-08 15:14:30 +00:00
  • 979ea63980 SEC-1613: Corrected preauth docs. Luke Taylor 2010-11-04 14:34:02 +00:00
  • 6b691f6fc0 SEC-1613: Corrected preauth docs. Luke Taylor 2010-11-04 14:32:06 +00:00
  • 4f51eb09c0 SEC-1606: Added a FirewalledRequestAwareRequestDispatcher that will call FirewalledRequest.reset() before a forward Rob Winch 2010-11-03 15:27:59 -05:00
  • 54ffc98bb4 SEC-1606: Added a FirewalledRequestAwareRequestDispatcher that will call FirewalledRequest.reset() before a forward Rob Winch 2010-11-03 15:01:39 -05:00
  • b9a98613eb SEC-1593: Added tests to try to reproduce issue. Luke Taylor 2010-11-03 19:37:25 +00:00
  • 0bdc9c176b SEC-1606: Added a FirewalledRequestAwareRequestDispatcher that will call FirewalledRequest.reset() before a forward Rob Winch 2010-11-03 14:25:52 -05:00
  • 1c8d28501c SEC-1550: Convert signatures to use Collection<? extends GrantedAuthority> where appropriate. Luke Taylor 2010-11-03 13:45:35 +00:00
  • 8d867e8b67 Updated integration tests to detect case reported as SPR-7563. Luke Taylor 2010-09-19 18:09:59 +01:00
  • 265cdaf2a6 SEC-1595: Added extra constructor to OpenID4JavaConsumer which takes a ConsumerManager to allow a version compatible with GAE to be injected. Luke Taylor 2010-11-02 20:18:22 +00:00
  • 337477de6a SEC-1604: Change log level to debug for "Validated configuration attributes" message. Luke Taylor 2010-11-02 20:06:42 +00:00
  • 54d0a263de SEC-1590: Removed WebAuthenticatioDetails.doPopulateAdditionalInformation() method which is caled from superclass constructor. Luke Taylor 2010-11-02 19:50:40 +00:00
  • 80fd238c3a Backport updates to TarUpload for easier uploading of docs to website. Luke Taylor 2010-11-02 16:38:19 +00:00
  • 5c597c8cde Update doc version number to 3.0.4 Luke Taylor 2010-11-02 16:31:01 +00:00
  • 43ec2beec0 SEC-1183: Modified Attributes2GrantedAuthoritiesMapper to return Collection<? extends GrantedAuthority>. Luke Taylor 2010-11-02 14:02:55 +00:00
  • 84efffb937 SEC-1542: Add a setter for the UserDetailsChecker in AbstractRememberMeServices. Luke Taylor 2010-11-02 13:41:59 +00:00
  • 2671e52d5a Expand message on incorrect Spring version to suggest checking the classpath for unwanted jars. Luke Taylor 2010-11-02 12:31:44 +00:00
  • ec7b9703a6 Expand message on incorrect Spring version to suggest checking the classpath for unwanted jars. Luke Taylor 2010-11-02 12:31:14 +00:00
  • 71b2af31ee SEC-1608: Make sure FirewalledRequest.reset() is called when filter="none" Luke Taylor 2010-11-02 12:19:22 +00:00
  • 0696bed78e SEC-1608: Make sure FirewalledRequest.reset() is called when filter="none" Luke Taylor 2010-11-02 12:08:39 +00:00
  • fc75b69ab8 SEC-1607: Report correct version for Spring Security (not Spring version). Luke Taylor 2010-11-02 11:13:32 +00:00
  • deef2706ef SEC-1607: Report correct version for Spring Security (not Spring version). Luke Taylor 2010-11-02 11:13:32 +00:00
  • 6141ef79b3 Remove use of @Override with an interface method Luke Taylor 2010-10-28 16:10:48 +01:00
  • f85baac943 Updated to Spring 3.0.5 Luke Taylor 2010-10-26 13:52:57 +01:00
  • 21ed5feb8d SEC-1600: Added Implementation-Version and Implementation-Title to manifest templates and checking of version numbers in namespace config module and core. Config checks the version of core it is running against and core checks the Spring version, reporting any mismatches or situations where the app is running with less than the recommended Spring version. Luke Taylor 2010-10-26 13:52:40 +01:00
  • 4de8b84b0d SEC-1543: Change IpAddressMatcher to return false when comparing an Inet6Address with an Inet4Address rather than raising an exception. Luke Taylor 2010-10-23 22:25:08 +01:00
  • cf0289bc02 SEC-1598: Removed invalid properties from SessionFixationProtectionStrategy bean declaration in Session Management chapter docbook. Luke Taylor 2010-10-23 18:24:04 +01:00
  • fabadff5f1 SEC-1597: Corrected bean class name for RememberMeAuthenticationProvider in docbook source. Luke Taylor 2010-10-23 18:20:59 +01:00
  • 31afb9c76d Deleted superseded dao-auth-provider.xml chapter. Luke Taylor 2010-10-23 17:36:29 +01:00
  • 07b9ded126 SEC-1599: Corrected docbook source. Luke Taylor 2010-10-23 17:35:41 +01:00
  • 091a6d26f1 SEC-1548: Added extra logging to Dao-authentication classes to clarify reasons for authentication failure (missing user vs wrong password etc.). Luke Taylor 2010-10-20 17:00:06 +01:00
  • 883ca2a55d Import cleaning. Luke Taylor 2010-10-20 16:29:15 +01:00
  • 1724d1eac6 SEC-1561: HttpSessionSecurityContextRepository should check whether the session contains the context attribute in case a new session has been created during the request. If the attribute is empty, then the context should be stored regardless of whether a change is detected or not. Luke Taylor 2010-10-20 16:29:01 +01:00
  • 54694d5ab7 SEC-1583: Added hasAuthority and hasAnyAuthority imlementations to SecurityExpressionRoot. Luke Taylor 2010-10-15 15:14:48 +01:00
  • f70942c6f5 SEC-1589: Add support for property placeholder in intercept-methods access attribute. Luke Taylor 2010-10-14 13:39:26 +01:00
  • 173537f4f2 SEC-1584: Added namespace support for injecting custom HttpFirewall instance into FilterChainProxy. Luke Taylor 2010-10-13 19:34:04 +01:00
  • 0961671772 Reinstated missing 3.0.3 schema file Luke Taylor 2010-10-08 01:30:16 +01:00
  • a6d47203db FilterInvocation should set queryString on dummy request. Luke Taylor 2010-10-03 22:54:21 +01:00
  • f455e9a5a4 SEC-1584: Documentation of request-checking and matching process. Logging of servletPath and and pathInfo in DebugFilter for comparison. Luke Taylor 2010-10-03 22:53:37 +01:00
  • 0fd2c48dfb SEC-1584: Additional integration tests. Luke Taylor 2010-10-03 22:48:58 +01:00
  • 7d97adc687 SEC-1584: Addition of HttpFirewall strategy to FilterChainProxy to reject un-normalized requests and wrap the incoming request object before processing by the security filter chain to provide a more consistent representation of paths than is guaranteed by the servlet spec. The wrapper strips path parameters from pathInfo and servletPath to provide consistency of URL matching across servlet containers and protect against bypassing security constraints by the malicious addition of such parameters to the URL. The paths are canonicalized further by replacing of multiple sequences of "/" characters with a single "/". Luke Taylor 2010-10-03 01:04:26 +01:00
  • 695c8f4ad6 Import cleaning and suppression of deprecation warnings. Luke Taylor 2010-10-02 17:12:36 +01:00
  • 3cfe23f60d Update versions to 3.0.5.CI-SNAPSHOT Luke Taylor 2010-10-26 14:49:38 +01:00
  • 82d140ffb1 Version 3.0.4.RELEASE Luke Taylor 2010-10-26 14:48:06 +01:00
  • 1563491322 SEC-1600: Added Implementation-Version and Implementation-Title to manifest templates and checking of version numbers in namespace config module and core. Config checks the version of core it is running against and core checks the Spring version, reporting any mismatches or situations where the app is running with less than the recommended Spring version. Luke Taylor 2010-10-26 13:52:40 +01:00
  • b688bb69ee SEC-1543: Change IpAddressMatcher to return false when comparing an Inet6Address with an Inet4Address rather than raising an exception. Luke Taylor 2010-10-23 22:25:08 +01:00
  • 36f008643d SEC-1598: Removed invalid properties from SessionFixationProtectionStrategy bean declaration in Session Management chapter docbook. Luke Taylor 2010-10-23 18:29:36 +01:00
  • cbdf77e991 SEC-1597: Corrected bean class name for RememberMeAuthenticationProvider in docbook source. Luke Taylor 2010-10-23 18:20:59 +01:00
  • 399e921d14 SEC-1599: Corrected docbook source. Luke Taylor 2010-10-23 17:35:41 +01:00
  • c458311d2d SEC-1548: Added extra logging to Dao-authentication classes to clarify reasons for authentication failure (missing user vs wrong password etc.). Luke Taylor 2010-10-20 17:00:06 +01:00
  • d6f408e8bf SEC-1583: Added hasAuthority and hasAnyAuthority imlementations to SecurityExpressionRoot. Luke Taylor 2010-10-15 15:14:48 +01:00
  • 1739628e6a SEC-1589: Add support for property placeholder in intercept-methods access attribute. Luke Taylor 2010-10-14 13:39:26 +01:00
  • 8e68fa1334 SEC-1584: Added namespace support for injecting custom HttpFirewall instance into FilterChainProxy. Luke Taylor 2010-10-13 19:34:04 +01:00
  • 82cd72768d doc updates to be merged with orgininal sec-1584 doc changes Luke Taylor 2010-10-12 23:26:21 +01:00
  • 161710cc87 SEC-1584: Doc updates to explain request matching process. Luke Taylor 2010-10-03 22:43:19 +01:00
  • dc1b652512 SEC-1584: Additional integration tests. Luke Taylor 2010-10-03 22:42:07 +01:00
  • ed9411c660 SEC-1584: Addition of HttpFirewall strategy to FilterChainProxy to reject un-normalized requests and wrap the incoming request object before processing by the security filter chain to provide a more consistent representation of paths than is guaranteed by the servlet spec. The wrapper strips path parameters from pathInfo and servletPath to provide consistency of URL matching across servlet containers and protect against bypassing security constraints by the malicious addition of such parameters to the URL. The paths are canonicalized further by replacing of multiple sequences of "/" characters with a single "/". Luke Taylor 2010-10-03 22:41:43 +01:00
  • bd84a2bfa1 SWC-1552 Update .tld in integration test to match change in taglib. Rossen Stoyanchev 2010-10-26 14:00:45 +01:00
  • 70600a0277 SEC-1552 Refactor AuthorizeTag and LegacyAuthorize tag to make them independent of JSP tag rendering. Rossen Stoyanchev 2010-10-26 12:33:51 +01:00
  • 1c3d530b60 Switch versions to 2.0.7.CI-SNAPSHOT Luke Taylor 2010-10-25 17:20:25 +01:00
  • beb0ec4ba9 Version 2.0.6.RELEASE Luke Taylor 2010-10-25 17:18:16 +01:00
  • dec2e59fba SEC-1584: Backport of namespace support for injecting custom HttpFirewall instance into FilterChainProxy. Luke Taylor 2010-10-14 20:32:01 +01:00
  • ed7f589998 SEC-1584: Additional integration tests. Luke Taylor 2010-10-03 22:42:07 +01:00
  • 8f6ddb0f17 SEC-1584: Backport to 2.0.x branch of request firewalling (normalization checks and path-parameter stripping from servletPath and pathInfo). Luke Taylor 2010-10-03 23:57:04 +01:00
  • 7258abbbf4 SEC-1585: changed spring-beans-3.1.xsd to spring-beans-3.0.xsd Rob Winch 2010-10-10 19:51:37 -05:00
  • ee12d54bec SEC-1536: moved web.authentication.jaas to web.jaasapi Rob Winch 2010-10-05 21:42:44 -05:00
  • e58f982351 Updating gitignore and removing unnecessary casts from FilterChainProxyConfigTests. Luke Taylor 2010-10-03 22:22:49 +01:00
  • 072b73354f Update namespace handler message to account for later schema versions being used by mistake. Luke Taylor 2010-10-03 22:06:18 +01:00
  • 443231d1e8 SEC-1578: Use ThreadLocal.remove() instead of ThreadLocal.set(null) Rob Winch 2010-10-04 17:07:04 -05:00
  • 8249492ce9 SEC-1578: Use ThreadLocal.remove() instead of ThreadLocal.set(null) Rob Winch 2010-10-04 17:07:04 -05:00
  • 62a8aca853 .gitignore updates Luke Taylor 2010-10-03 23:39:33 +01:00
  • e69b981c72 Make method in MatcherType public for use in OAuth. Luke Taylor 2010-09-25 20:09:12 +01:00
  • f978814bb1 Improve entry of username and password for scp upload. Luke Taylor 2010-09-24 21:01:18 +01:00
  • 685e0417a7 SEC-1544: Update the tutorial sample to attempt to delete the JSESSIONID cookie on logout. Luke Taylor 2010-09-19 18:30:52 +01:00
  • 11a87d1fa0 Switch to using xsd:boolean in schema file. Luke Taylor 2010-09-19 18:17:06 +01:00
  • 1b2b371970 SEC-1544: Added CookieClearingLogoutHandler and 'delete-cookies' attribute to the 'logout' namespace element. Luke Taylor 2010-09-16 16:03:24 +01:00
  • 383211561c Moved LDAP placeholder config test into LDAP tests to prevent issues with parallel tests. Converted LdapProviderBDP tests to groovy/spock. Other misc tidying of config tests. Luke Taylor 2010-09-16 12:31:23 +01:00
  • 7dd8cd2fb9 Make sure ApacheDS work directory is set correctly for separate LDAP test task in config module. Luke Taylor 2010-09-16 10:50:12 +01:00
  • 551166a577 ApacheDS workDir property should be passed to the test process, not set as a system property in the main build process. Luke Taylor 2010-09-14 14:32:58 +01:00
  • a128e3b4fe http://forum.springsource.org/showthread.php?p=318755 Added PlaceHolderAndELConfigTests.ldapAuthenticationProviderWorksWithPlaceholders rwinch 2010-09-13 13:44:12 -05:00
  • de819378fc SEC-1536: added JAAS API Integration, updated doc, updated jaas sample rwinch 2010-09-13 13:12:45 -05:00
  • 0217e98bdb Added an AppListener to collect events for use in tests Luke Taylor 2010-09-13 14:20:21 +01:00
  • 62cbd51d54 SEC-1562: Made SecurityExpressionRootPropertyAccessor a package private class as it is no longer referenced from multiple packages. Luke Taylor 2010-09-13 13:52:24 +01:00
  • c5231fc213 SEC-1538: Deprecate PreAuthenticatedGrantedAuthoritiesAuthenticationDetails (forgot originally) and update documentation to remove reference to AbstractPreAuthenticationAuthenticationDetailsSource. Luke Taylor 2010-09-13 12:19:21 +01:00
  • 829444d59b SEC-1564: testCompile configurations should include jcl-over-slf4j rather than logback. Luke Taylor 2010-09-11 11:01:12 +01:00
  • 58d9903ebc SEC-1564: JAAS Configuration can now be injected into DefaultJaasAuthenticationProvider rwinch 2010-09-10 20:17:22 -05:00
  • 8bf1b8420a SEC-1563: Move PermissionEvaluator and related methods to SecurityExpressionRoot Luke Taylor 2010-09-07 22:32:34 +01:00
  • ca44ebd3cc SEC-1338: Applied submitted patch, making use of java.util.concurrent classes in place of traditional synchronization. Luke Taylor 2010-09-08 12:59:49 +01:00
  • af56f4844d SEC-1562: Created SecurityExpressionHandler interface and AbstractSecurityExpressionHandler. Luke Taylor 2010-09-07 19:45:37 +01:00
  • b0998c01bc SEC-1553: Make WebAuthenticationDetails serializable Luke Taylor 2010-09-01 18:43:07 +01:00
  • 577ec27507 Polishing. Luke Taylor 2010-08-30 19:03:47 +01:00
  • 7a3892556c Added a "docs" convenience task Luke Taylor 2010-08-30 19:03:15 +01:00
  • f4d57ab5e8 SEC-1456: Remove maven poms as we are now using gradle for the build. Luke Taylor 2010-08-30 19:02:19 +01:00
  • 696150f3c3 Remove unused import. Luke Taylor 2010-08-30 11:52:52 +01:00
  • 1a1372ab84 Removed deprecated AspectJInterceptor classes since these cannot be used with the existing MethodSecurityMetadataSource implementations (which no longer support JoinPoin as a secured object). Added some more tests. Luke Taylor 2010-08-28 21:41:19 +01:00