diff --git a/spring-webflow-reference/src/flow-security.xml b/spring-webflow-reference/src/flow-security.xml new file mode 100644 index 00000000..cc0b61aa --- /dev/null +++ b/spring-webflow-reference/src/flow-security.xml @@ -0,0 +1,182 @@ + + + Securing Flows + + Introduction + + Security is an important concept for any application. + End users should not be able to access any portion of your site simply by guessing the URL. + Areas of a site that are sensitive should insure that only authorized requested are processed. + Spring Security is a proven security platform that can integrate with your application at multiple levels. + This section will focus on securing flow execution. + + + + How do I secure a flow? + + Securing flow execution is a three step process: + + Configure Spring Security with allowed users and roles + Annotate the flow definition with the secured element to define the security rules + Add the SecurityFlowExecutionListener to process the security rules. + + + + Each of these steps must be completed or else flow security rules will not be applied. + + + + The secured element + + The secured element designates that its containing element should apply the authorization checks before fully entering. + This element is optional and should occur only once per stage of the flow execution that is secured. + + + There are three phases of flow execution that can be secured: flows, states and transitions. + In each case the syntax for the secured element is identical. + + + Security attributes + + The attributes attribute is a comma separated list of Spring Security attributes. + Often these are specific security roles. + These attributes will be compared against the user's granted attributes by a Spring Security access decision manager. + + +<secured attributes="ROLE_USER" /> + + + By default a role based access decision manager is used to determine if the user is allowed access. + This will need to be overridden if your application is not using authorization roles. + + + + Matching type + + There are two types of matching available: any and all. + Any will allow access if at least one of the required security attributes is granted to the user. + All allows access only if each of the required security attributes are granted to the user. + + +<secured attributes="ROLE_USER, ROLE_ANONYMOUS" match="any" /> + + + The default value is any. + + + The match attribute will only be respected if the default access decision manager is used. + + + + + The SecurityFlowExecutionListener + + Defining security rules in your flow by itself will not protect the flow execution. + A SecurityFlowExecutionListener must also be defined in the webflow configuration and applied to the flow executor. + + +<webflow:flow-executor id="flowExecutor" flow-registry="flowRegistry"> + <webflow:flow-execution-listeners> + <webflow:listener ref="securityFlowExecutionListener" /> + ... + </webflow:flow-execution-listeners> +</webflow:flow-executor> + +<bean id="securityFlowExecutionListener" + class="org.springframework.webflow.security.SecurityFlowExecutionListener" /> + + + If your application is using authorities that are not role based, you will need to configure a custom AccessDecisionManager. + You can override the default decision manager by setting the accessDecisionManager property on the security listener. + Please consult the Spring Security documentation to learn more about decision managers. + + +<bean id="securityFlowExecutionListener" + class="org.springframework.webflow.security.SecurityFlowExecutionListener"> + <property name="accessDecisionManager" ref="myCustomAccessDecisionManager" /> +</bean> + + + If access is denied to a portion of the application an AccessDeniedException will be thrown. + This exception will later be caught by Spring Security and used to prompt the user to authenticate. + It is important that this exception be allowed to travel up the execution stack uninhibited, otherwise the end user may not be prompted to authenticate. + + + + Configuring Spring Security + + Spring Security has robust configuration options available. + As every application and environment has its own security requirements, the Spring Security reference guide is the best place to learn about all of the available options. + + + Both the booking-faces and booking-mvc sample applications are configured to use Spring Security. + Spring Security needs to be configured for both the Spring configuration and the web.xml level. + + + Spring configuration + + The Spring configuration defines http specifics (such as protected URLs and login/logout mechanics) and the authentication-provider. + For the sample applications, a local authentication provider is configured. + + +<security:http auto-config="true"> + <!-- restrict URLs based on role --> + <security:intercept-url pattern="/spring/login*" access="ROLE_ANONYMOUS" /> + <security:intercept-url pattern="/spring/logout-success*" access="ROLE_ANONYMOUS" /> + <security:intercept-url pattern="/spring/logout*" access="ROLE_USER" /> + + <!-- override default login and logout pages --> + <security:form-login login-page="/spring/login" + login-url="/spring/login-process" + default-target-url="/spring/main" + authentication-failure-url="/spring/login?login_error=1" /> + <security:logout logout-url="/spring/logout" + logout-success-url="/spring/logout-success" /> +</security:http> + +<!-- + Define local authentication provider, a real app would use an + external provider (JDBC, LDAP, CAS, etc) + + usernames/passwords are: + keith/melbourne + erwin/leuven + jeremy/atlanta + scott/rochester +--> +<security:authentication-provider> + <security:password-encoder hash="md5" /> + <security:user-service> + <security:user name="keith" password="417c7382b16c395bc25b5da1398cf076" + authorities="ROLE_USER, ROLE_SUPERVISOR" /> + <security:user name="erwin" password="12430911a8af075c6f41c6976af22b09" + authorities="ROLE_USER, ROLE_SUPERVISOR" /> + <security:user name="jeremy" password="57c6cbff0d421449be820763f03139eb" + authorities="ROLE_USER" /> + <security:user name="scott" password="942f2339bf50796de535a384f0d1af3e" + authorities="ROLE_USER" /> + </security:user-service> +</security:authentication-provider> + + + + web.xml Configuration + + In the web.xml file, a filter is defined to intercept all requests. + This filter will listen for login/logout requests and process them accordingly. + It will also catch AccesDeniedExceptions and redirect the user to the login page. + + +<filter> + <filter-name>springSecurityFilterChain</filter-name> + <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> +</filter> + +<filter-mapping> + <filter-name>springSecurityFilterChain</filter-name> + <url-pattern>/*</url-pattern> +</filter-mapping> + + + + \ No newline at end of file diff --git a/spring-webflow-reference/src/spring-webflow-reference.xml b/spring-webflow-reference/src/spring-webflow-reference.xml index 206c7977..a62345d4 100644 --- a/spring-webflow-reference/src/spring-webflow-reference.xml +++ b/spring-webflow-reference/src/spring-webflow-reference.xml @@ -4,6 +4,7 @@ [ + ]> @@ -49,5 +50,6 @@ &overview; &defining-flows; + &flow-security;