What is Acegi Security Key features Conclusion Examples in reality References Aureliusz Rempala Emily Brand Fan Wang
- What is Acegi Security? Provides o advanced authentication o advanced authorization o and other features for enterprise application built using the Spring Framework It is an official Spring Sub-Project Commercial support and training available from interface21. Authentication Procedure 1. Check if resource is secure 2. Check if the user has been authenticated 3. Check if authenticated user is authorized 4. Serve the requested resource
- Authentication Overview Authentication mechanism key participants: o ExceptionTranslationFilter Detects any Acegi Security exceptions that are thrown o AuthenticationEntryPoint When the user is not authenticated, it sends back a response indicating that s/he must authenticate. o authentication mechanism collects authentication details from a user agent (usually a web browser), builds "Authentication request" object from the collected data, presents the Authentication object to an AuthenticationProvider. o AuthenticationProvider obtains UserDetail object from the UserDetailsService validates the content of the Authentication object against UserDetail object puts the Authentication object is put in the SecurityContextHolder if authentication is successful.
- Key features (cont.) Acegi performs HTTP session authentication through the use of a servlet filter: Web.xml: <filter> <filter-name>acegi Authentication Processing Filter</filter-name> <filter-class>net.sf.acegisecurity.util.filtertobeanproxy </filter-class> <init-param> <param-name>targetclass</param-name> <param-value> net.sf.acegisecurity.ui.webapp.authenticationprocessingfilter </param-value> </init-param> </filter> <filter-mapping> <filter-name>acegi Authentication Processing Filter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> How and when authentication takes place is decided by the content of the applicationcontext.xml
- securitycontext.xml FilterChainProxy o all of the requests pass through this bean o defines a cascade of filters o allows to define a different set of filters for different URL o the order of the filters is important. Sample FilterChainProxy bean: <bean id="filterchainproxy" class="org.acegisecurity.util.filterchainproxy"> <property name="filterinvocationdefinitionsource"> <value><![cdata[convert_url_to_lowercase_before_comparison PATTERN_TYPE_APACHE_ANT /**=httpsessioncontextintegrationfilter,logoutfilter,authenticatio nprocessingfilter, basicprocessingfilter, securitycontextholderawarerequestfilter, remembermeprocessingfilter, anonymousprocessingfilter, exceptiontranslationfilter, filterinvocationinterceptor]]></value> </property>
- Commonly Used Filters HttpSessionContextIntegrationFilter: o keeps the contents of the SecurityContext between HTTP requests. AuthenticationProcessingFilter: o Form based authentications (JSP for ex) BasicProcessingFilter: o BASIC HTTP header-based authentication (WebServices) RememberMeProcessingFilter: o cookie that enables remember-me services AnonymousProcessingFilter: o allows anonymous access FilterSecurityInterceptor: o protects web URIs
- Filters (a closer look) HttpSessionContextIntegrationFilter <bean id="httpsessioncontextintegrationfilter" class="org.acegisecurity.context.httpsessioncontextintegrationfilter"> AuthenticationProcessingFilter: <bean id="authenticationprocessingfilter class="org.acegisecurity.ui.webapp.authenticationprocessingfilter"> <property name="authenticationmanager" ref="authenticationmanager"/> <property name="authenticationfailureurl" value="/acegilogin.jsp?login_error=1"/> <property name="defaulttargeturl" value="/"/> <property name="filterprocessesurl" value="/j_acegi_security_check"/> <property name="remembermeservices" ref="remembermeservices"/> BasicProcessingFilter: <bean id="basicprocessingfilter" class="org.acegisecurity.ui.basicauth.basicprocessingfilter"> <property name="authenticationmanager"><ref local="authenticationmanager"/></property> <property name="authenticationentrypoint"><ref local="basicprocessingfilterentrypoint"/></property>
- Filters (a closer look) RememberMeProcessingFilter: <bean id="remembermeprocessingfilter" class="org.acegisecurity.ui.rememberme.remembermeprocessingfilter"> <property name="authenticationmanager"><ref local="authenticationmanager"/></property> <property name="remembermeservices"><ref local="remembermeservices"/></property> <bean id="remembermeservices" class="org.acegisecurity.ui.rememberme.tokenbasedremembermeservices "> <property name="userdetailsservice" ref="userdetailsservice"/> <property name="key" value="changethis"/> AnonymousProcessingFilter: <bean id="anonymousprocessingfilter" class="org.acegisecurity.providers.anonymous.anonymousprocessingfil ter"> <property name="key" value="changethis"/> <property name="userattribute" value="anonymoususer,role_anonymous"/>
- Filters (a closer look) FilterSecurityInterceptor: o Allows to incorporate all kinds of managers that will participate in the authentication/authorization process. o More specific URLs should be listed at the top <bean id="filterinvocationinterceptor" class="org.acegisecurity.intercept.web.filtersecurityinterceptor"> <property name="authenticationmanager"> <ref bean="authenticationmanager"/> </property> <property name="accessdecisionmanager"> <ref local="httprequestaccessdecisionmanager"/> </property> <property name="objectdefinitionsource"> <value><![cdata[convert_url_to_lowercase_before_comparison PATTERN_TYPE_APACHE_ANT /index.jsp=role_anonymous,role_user /switchuser.jsp=role_supervisor /acegilogin.jsp*=role_anonymous,role_user /**=ROLE_USER]]> </value> </property>
- Authentication Manager AuthenticationManager is responsible for passing requests through a chain of AuthenticationProviders, and it might be configured in a following way: <bean id="authenticationmanager" class="org.acegisecurity.providers.providermanager"> <property name="providers"> <list> <ref local="daoauthenticationprovider"/> <ref local="anonymousauthenticationprovider"/> <ref local="remembermeauthenticationprovider"/> </list> </property>
- Authentication Provider AuthenticationProvider points to the location where principal information such as usernames,passwords, and access rights are stored. <bean id="daoauthenticationprovider" class="org.acegisecurity.providers.dao.daoauthenticationprovider"> <property name="userdetailsservice" ref="userdetailsservice"/> <!-- UserDetailsService is the most commonly frequently Acegi Security interface implemented by end users --> <bean id="userdetailsservice" class="org.acegisecurity.userdetails.memory.inmemorydaoimpl"> <property name="userproperties"> <bean class="org.springframework.beans.factory.config.propertiesfactorybe an"> <property name="location" value="/web-inf/users.properties"/>
- Key features (cont.) Authentication Provider (Easy to understand, configure, and demonstrate) o ProviderManager Most popular implementation a wrapper around a list of one or more Authentication Providers provided to the class Authenticate method of the AuthenticationManager delegates to that specific provider Wrapper class cycles through the list of providers until it locate a compatible one. o Recommendation for Developers Developers should examine providers to determine the one that suits their needs best
- Key features Authorization - Security Interception o key to protecting resources under Acegi o Prior to access to the resource and interception determines whether or not the resource should be protected o Traces the chain of authorization to receive access to a protected resource o Assuming the user is authenticated, it delegates to an implementation of the AccessDecisionManager receives key parameters such as the authenticated Authentication object resource properties, among others. The final decision for access is left in the hands of the AccessDecisionManager.
- Key features (cont.) AccessDecisionManager o tallies votes ConsensusBased grants or denies access based upon the consensus of nonabstain votes UnanimousBased requires unanimous consent in order to grant access but does ignore abstains AffirmativeBased grants access if at least one access granted is received while deny votes are disregarded.
- Key features (cont.) Configure the authorization system starting with the RoleVoter and UnanimousBased : applicationcontext.xml: <bean id="rolevoter" class="net.sf.acegisecurity.vote.rolevoter"/> <bean id="accessdecisionmanager" class="net.sf.acegisecurity.vote.unanimousbased"> <property name="allowifallabstaindecisions"> <value>false</value> </property> <property name="decisionvoters"> <list> <ref local="rolevoter"/> </list> </property>
Future Will be promoted to be an official part of the Spring Framework o New name Spring Security o In version 2M1 Spring Security 2 will offer o considerably simplified configuration o Windows NTLM authentication o a user management API o persistence-backed remember-me services o hierarchical roles o Spring LdapTemplate support o considerable ACL enhancements o portlet support o and much more.
- References http://en.wikipedia.org/wiki/acegi_security_framework_(java) http://www.thespringexperience.com/show_session_view.jsp?pres entationid=9249&showid=147 http://www.javalobby.org/articles/acegisecurity/part1.jsp