Security Namespace Configuration

The namespace is designed to capture the most common uses of the framework and provide a simplified and concise syntax for enabling them within an application. The design is largely based around the large-scale dependencies within the framework, and can be divided up into the following areas:

We'll see how these work together in the following sections.

The first thing you need to do is add the following filter declaration to your web.xml file:

          
<filter>
  <filter-name>springSecurityFilterChain</filter-name>
  <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
  
<filter-mapping>
  <filter-name>springSecurityFilterChain</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>   
      

This provides a hook into the Spring Security web infrastructure. . You're then ready to start editing your application context file. Web security services are configured using the <http> element.

All you need to enable web security to begin with is

  <http auto-config='true'>
    <intercept-url pattern="/**" access="ROLE_USER" />
  </http>
  

Which says that we want all URLs within our application to be secured, requiring the role ROLE_USER to access them.

To add some users, you can define a set of test data directly in the namespace:

  <authentication-provider>
    <user-service>
      <user name="jimi" password="jimispassword" authorities="ROLE_USER, ROLE_ADMIN" />
      <user name="bob" password="bobspassword" authorities="ROLE_USER" />
    </user-service>
  </authentication-provider>
  
        

The configuration above defines two users, their passwords and their roles within the application (which will be used for access control). It is also possible to load user information from a standard properties file using the properties attribute on user-service. See ??? for more details. Using the <authentication-provider> element means that the user information will be used by the authentication manager to process authentication requests.

At this point you should be able to start up your application and you will be required to log in to proceed. Try it out, or try experimenting with the "tutorial" sample application that comes with the project. The above configuration actually adds quite a few services to the application because we have used the auto-config attribute. For example, form login processing and "remember-me" services are automatically enabled.

  <http>
    <intercept-url pattern="/**" access="ROLE_USER" />
    <form-login />
    <anonymous />
    <http-basic />
    <logout />
    <remember-me />
  </http>
  
          

  <http auto-config='true'>
    <intercept-url pattern="/login.jsp*" filters="none"/>  
    <intercept-url pattern="/**" access="ROLE_USER" />
    <form-login login-page='/login.jsp'/>
  </http>
  
        

  <http auto-config='true'>
    <intercept-url pattern="/**" access="ROLE_USER" />
    <http-basic />
  </http>
  
        

In practice you will need a more scalable source of user information than a few names added to the application context file. Most likely you will want to store your user information in something like a database or an LDAP server. LDAP namespace configuration is dealt with in the LDAP chapter, so we won't cover it here. If you have a custom implementation of Spring Security's UserDetailsService, called "myUserDetailsService" in your application context, then you can authenticate against this using

  <authentication-provider user-service-ref='myUserDetailsService'/>
  
        

If you want to use a database, then you can use

  <authentication-provider>
    <jdbc-user-service data-source-ref="securityDataSource"/>
  </authentication-provider>
  
        

Where "securityDataSource" is the name of a DataSource bean in the application context, pointing at a database containing the standard Spring Security user data tables. Alternatively, you could configure a Spring Security JdbcDaoImpl bean and point at that using the user-service-ref attribute.

<authentication-provider>
  <password-encoder hash="sha"/>
  <user-service>
    <user name="jimi" password="d7e6351eaa13189a5a3641bab846c8e8c69ba39f" authorities="ROLE_USER, ROLE_ADMIN" />
    <user name="bob" password="4e7421b1b8765d8f9406d87e7cc6aa784c4ab97f" authorities="ROLE_USER" />
  </user-service>
</authentication-provider>
  
          

<password-encoder hash="sha">
  <salt-source user-property="username"/>
</password-encoder>
    

See the separate Remember-Me chapter for information on remember-me namespace configuration.

If your application supports both HTTP and HTTPS, and you require that particular URLs can only be accessed over HTTPS, then this is directly supported using the requires-channel attribute on <intercept-url>:

  <http>
    <intercept-url pattern="/secure/**" access="ROLE_USER" requires-channel="https"/>
    <intercept-url pattern="/**" access="ROLE_USER" requires-channel="any"/>  
    ...
  </http>
        

With this configuration in place, if a user attempts to access anything matching the "/secure/**" pattern using HTTP, they will first be redirected to an HTTPS URL. The available options are "http", "https" or "any". Using the value "any" means that either HTTP or HTTPS can be used.

If your application uses non-standard ports for HTTP and/or HTTPS, you can specify a list of port mappings as follows:

        
               
  <http>
    ...
    <port-mappings>
      <port-mapping http="9080" https="9443"/>
    </port-mappings>
  </http>
        

You can find a more in-depth discussion of channel security in Chapter 7, Channel Security.

If you wish to place constraints on a single user's ability to log in to your application, Spring Security supports this out of the box with the following simple additions. First you need to add the following listener to your web.xml file to keep Spring Security updated about session lifecycle events:

        
                   
<listener>
  <listener-class>org.springframework.security.ui.session.HttpSessionEventPublisher</listener-class>
</listener>

Then add the following line to your application context:

     
  <http>
    ...
    <concurrent-session-control max-sessions="1" />
  </http>
        

This will prevent a user from logging in multiple times - a second login will cause the first to be invalidated. Often you would prefer to prevent a second login, in which case you can use

     
  <http>
    ...
    <concurrent-session-control max-sessions="1" exception-if-maximum-exceeded="true"/>
  </http>
        

The second login will then be rejected.

The namespace supports OpenID login eiter instead of, or in addition to normal form-based login, with a simple change:

  <http auto-config='true'>
    <intercept-url pattern="/**" access="ROLE_USER" />
    <openid-login />
  </http>
  

You should then register yourself with an OpenID provider (such as myopenid.com), and add the user information to your in-memory <user-service>:

  <user name="http://jimi.hendrix.myopenid.com/" password="notused" authorities="ROLE_USER" />
  

You should be able to login using the myopenid.com site to authenticate.

If you've used Spring Security before, you'll know that the framework maintains a chain of filters in order to apply its services. You may want to add your own filters to the stack at particular locations, or use a customized version of an existing filter. How can you do this with namespace configuration, since the filter chain is not directly exposed?

The order of the filters is always strictly enforced when using the namespace. Each Spring Security filter implements the Spring Ordered interface and the filters are sorted during initialization. The standard filters each have an alias in the namespace:

You can add your own filter to the stack, using the custom-filter element and one of these names to specify the position your filter should appear at:

  <beans:bean id="myFilter" class="com.mycompany.MySpecialAuthenticationFilter">
    <custom-filter position="AUTHENTICATION_PROCESSING_FILTER"/>
  </beans:bean>
  

You can also use the after or before attribtues if you want your filter to be inserted before or after another filter in the stack. The names "FIRST" and "LAST" can be used to indicate that you want your filter to appear before or after the entire stack, respectively.

Session fixation attacks are a potential risk where it is possible for a malicious attacker to create a session by accessing a site, then persuade another user to log in with the same session (by sending them a link containing the session identifier as a parameter, for example). Spring Security protects against this automatically by creating a new session when a user logs in. If you don't require this protection, or it conflicts with some other requirement, you can control the behaviour using the session-fixation-protection attribute on <http>, which has three options

If you aren't using form login, OpenID or basic authentication through the namespace, you may want to define an authentication filter and entry point using a traditional bean syntax and link them into the namespace. You can add the filter as explained in Section 2.3.5, “Adding in Your Own Filters”. The corresponding AuthenticationEntryPoint can be set using the entry-point-ref attribute on the <http> element.

The CAS sample is a good example of the use of custom beans with the namespace, including this syntax.

This element is used to enable annotation based security in your application (by setting the appropriate attributes on the element), and also to group together security pointcut declarations which will be applied across your entire application context. You should only declare one <global-method-security> element. The following declaration would enable support for both types of annotations:

  <global-method-security secured-annotations="enabled" jsr250-annotations="true"/>
  

	<global-method-security>
    <protect-pointcut expression="execution(* com.mycompany.*Service.*(..))" access="ROLE_USER"/>
	</global-method-security>

          

If you need to use a more complicated access control strategy then it is easy to set an alternative for both method and web security.

For method security, you do this by setting the access-decision-manager-ref attribute on global-securityto the Id of the appropriate AccessDecisionManager bean in the application context:

  <global-method-security access-decision-manager-ref="myAccessDecisionManagerBean">
    ... 
  </global-method-security>
  

The syntax for web security is the same, but on the http element:

  <http access-decision-manager-ref="myAccessDecisionManagerBean">
    ... 
  </http>
  

We've touched on the idea that the namespace configuration automatically registers an authentication manager bean for you. This is an instance of Spring Security's ProviderManager class, which you may already be familiar with if you've used the framework before.

You may want to register additional AuthenticationProvider beans with the ProviderManager and you can do this using the <custom-authentication-provider> element within the bean. For example:

  <bean id="casAuthenticationProvider" 
      class="org.springframework.security.providers.cas.CasAuthenticationProvider">
    <security:custom-authentication-provider />
    ...
  </bean>
  

Another common requirement is that another bean in the context may require a reference to the AuthenticationManager. There is a special element which lets you register an alias for the AuthenticationManager and you can then use this name elsewhere in your application context.

        
  <security:authentication-manager alias="authenticationManager"/>
        
  <bean id="casProcessingFilter" class="org.springframework.security.ui.cas.CasProcessingFilter">
     <security:custom-filter position="CAS_PROCESSING_FILTER"/>
     <property name="authenticationManager" ref="authenticationManager"/>
     ...
  </bean>