Spring Security 3 Secure your web applications against malicious intruders with this easy to follow practical guide Peter Mularien rpafktl Pen source cfb <A> II nv.iv I I community experience distilled PUBLISHING - BIRMINGHAM MUMBAI
Preface 1 Chapter 1: Anatomy of an Unsafe Application 9 Security audit 10 About the sample application 10 The JBCP pets application architecture 11 Application technology 12 Reviewing the audit results 13 Authentication 15 Authorization 16 Database Credential Security 16 Sensitive Information 17 Transport-Level Protection 17 Using Spring Security 3 to address security concerns 18 Why Spring Security? 18 Summary 19 Chapter 2: Getting Started with Spring Security 21 Core security concepts 22 Authentication 22 Authorization 23 Securing our application in three easy steps 26 Implementing a Spring Security XML configuration file 26 Adding the Spring DelegatingFilterProxy to your web.xml file 27 Adding the Spring Security XML configuration file reference to web.xml 28 Mind the gaps! 30 Common problems 31 Security is complicated: The architecture of secured web requests 32 How requests are processed? 32 What does auto-config do behind the scenes? 36
How users are authenticated? 37 What is spring_security_login and how did we get here? 41 Where do the user's credentials get validated? 43 When good authentication goes bad? 44 How requests are authorized? 45 Configuration of access decision aggregation 49 Access configuration using spring expression language 51 Summary 55 Chapter 3: Enhancing the User Experience 57 Customizing the login page 57 Implementing a custom login page 59 Implementing the login controller 59 Adding the login JSP 60 Configuring Spring Security to use our Spring MVC login page 61 Understanding logout functionality 63 Adding a Log Out link to the site header 63 How logout works 64 Changing the logout URL 66 Logout configuration directives 66 Remember me 67 Implementing the remember me option 67 How remember me works 68 Remember me and the user lifecycle 71 Remember me configuration directives 72 Is remember me secure? 73 Authorization rules differentiating remembered and fully authenticated sessions 74 Building an IP-aware remember me service 75 Customizing the remember me signature 79 Implementing password change management 80 Extending the in-memory credential store to support password change 80 Extending InMemoryDaolmpI with InMemoryChangePasswordDaolmpI 81 Configuring Spring Security to use InMemoryChangePasswordDaolmpI 82 Building a change password page 83 Adding a change password handler to AccountController 84 Exercise notes 85 Summary 86 Chapter 4: Securing Credential Storage 87 Database-backed authentication with Spring Security 88 Configuring a database-resident authentication store 88 Creating the default Spring Security schema 88 Configuring the HSQL embedded database 89 Configuring JdbcDaolmpI authentication store 89 Adding user definitions to the schema 90
Table ofcontents How database-backed authentication works 90 Implementing a custom JDBC UserDetailsService 92 Creating a custom JDBC UserDetailsService class 92 Adding a Spring Bean declaration for the custom UserDetailsService 92 Out of the box JDBC-based user management 93 Advanced configuration of JdbcDaolmpI 95 Configuring group-based authorization 96 Configuring JdbcDaolmpI to use groups 97 Modifying the initial load SQL script 97 Modifying the embedded database creation declaration 98 Using a legacy or custom schema with database-resident authentication 98 Determining the correct JDBC SQL queries 99 Configuring the JdbcDaolmpI to use customsql queries 100 Configuring secure passwords 101 Configuring password encoding 104 Configuring the PasswordEncoder 104 Configuring the AuthenticationProvider 104 Writing the database bootstrap password encoder 105 Configuring the bootstrap password encoder 105 Would you like some salt with that password? 106 Configuring a salted password 108 Declaring the SaltSource Spring bean 109 Wiring the PasswordEncoder to the SaltSource 109 Augmenting DatabasePasswordSecurerBean 109 Enhancing the change password functionality 111 Configuring a custom salt source 111 Extending the database schema 112 Tweaking configuration of the CustomJdbcDaolmpI UserDetails service 112 Overriding the baseline UserDetails implementation 113 Extending the functionality of CustomJdbcDaolmpI 113 Moving remember me to the database 115 Configuring database-resident remember me tokens 115 Adding SQL to create the remember me schema 115 Adding new SQL script to the embedded database declaration 116 Configuring remember me services to persist to the database 116 Are database-backed persistent tokens more secure? 116 Securing your site with SSL 117 Setting up Apache Tomcat for SSL 117 Generating a server key store 118 Configuring Tomcat's SSL Connector 118 Automatically securing portions of the site 119 Secure port mapping 121 Summary 122
Table ofcontents Chapter 5: Fine-Grained Access Control 123 Re-thinking application functionality and security 124 Planning for application security 124 Planning user roles 124 Planning page-level security 126 Methods of Fine-Grained authorization 127 Using Spring Security Tag Library to conditionally render content 128 Conditional rendering based on URL access rules 128 Conditional rendering based on Spring EL Expressions 129 Conditionally rendering the Spring Security 2 way 130 Using controller logic to conditionally render content 131 Adding conditional display of the Log In link 131 Populating model data based on user credentials 132 What is the best way to configure in-page authorization? 132 Securing the business tier 134 The basics of securing business methods 135 Adding @PreAuthorize method annotation 136 Instructing Spring Security to use method annotations 136 Validating method security 136 Several flavors of method security 137 JSR-250 compliant standardized rules 137 Method security using Spring's Secured annotation 139 Method security rules using Aspect Oriented Programming 139 Comparing method authorization types 140 How does method security work? 141 Advanced method security 144 Method security rules using bean decorators 145 Method security rules incorporating method parameters 147 How method parameter binding works 147 Securing method data through Role-based filtering 149 Adding Role-based data filtering with @PostFilter 150 Pre-filtering collections with method @PreFilter 152 Why use a @PreFilter at all? 153 A fair warning about method security 154 Summary 155 Chapter 6: Advanced Configuration and Extension 157 Writing a custom security filter 158 IP filtering at the servlet filter level 158 Writing our custom servlet filter 158 Configuring the IP servlet filter 160 Adding the IP servlet filter to the Spring Security filter chain 161
Table ofcontents Writing a custom Authentication Provider 162 Implementing simple single sign-on with an AuthenticationProvider 162 Customizing the authentication token 163 Writing the request header processing servlet filter 164 Writing the request header AuthenticationProvider 166 Combining AuthenticationProviders 167 Simulating single sign-on with request headers 169 Considerations when writing a custom AuthenticationProvider 170 Session management and concurrency 170 Configuring session fixation protection 171 Understanding session fixation attacks 171 Preventing session fixation attacks with Spring Security 172 Simulating a session fixation attack 173 Comparing session-fixation-protection options 175 Enhancing user protection with concurrent session control 176 Configuring concurrent session control 176 Understanding concurrent session control 177 Testing concurrent session control 178 Configuring expired session redirect 179 Other benefits of concurrent session control 179 Displaying a count of active users 179 Displaying information about all users 180 Understanding and configuring exception handling 182 Configuring "Access Denied" handling 184 Configuring an "Access Denied" destination URL 184 Adding controller handling of AccessDeniedException 184 Writing the Access Denied page 185 What causes an AccessDeniedException 186 The importance of the AuthenticationEntryPoint 187 Configuring Spring Security infrastructure beans manually 188 A high level overview of Spring Security bean dependencies 189 Reconfiguring the web application 189 Configuring a minimal Spring Security environment 190 Configuring a minimal servlet filter set 191 Configuring a minimal supporting object set 195 Advanced Spring Security bean-based configuration 196 Adjusting factors related to session lifecycle 196 Manual configuration of other common services 197 Declaring remaining missing filters 198 LogoutFilter 198 RememberMeAuthenticationFilter 199 ExceptionTranslationFilter 202 Explicit configuration of the SpEL expression evaluator and Voter 202
Bean-based configuration of method security 203 Wrapping up explicit configuration 204 Which type of configuration should I choose? 204 Authentication event handling 205 Configuring an authentication event listener 207 Declaring required bean dependencies 207 Building a custom application event listener 207 Out ofthe box ApplicationListeners 208 Multitudes of application events 209 Building a custom implementation of an SpEL expression handler 210 Summary 211 Chapter 7: Access Control Lists 213 Using Access Control Lists for business object security 213 Access Control Lists in Spring Security 215 Basic configuration of Spring Security ACL support 217 Defining a simple target scenario 217 Adding ACL tables to the HSQL database 218 Configuring the Access Decision Manager 220 Configuring supporting ACL beans 221 Creating a simple ACL entry 226 Advanced ACL topics 227 How permissions work 228 Custom ACL permission declaration 231 ACL-Enabling your JSPs with the Spring Security JSP tag library 234 Spring Expression Language support for ACLs 235 Mutable ACLs and authorization 237 Configuring a Spring transaction manager 238 Interacting with the JdbcMutableAclService 239 Ehcache ACL caching 241 Configuring Ehcache ACL caching 241 How Spring ACL uses Ehcache 242 Considerations for a typical ACL deployment 243 About ACL scalability and performance modelling 243 Do not discount custom development costs 245 Should I use Spring Security ACL? 247 Summary 247 Chapter 8: Opening up to OpenID 249 The promising world of OpenID 249 Signing up for an OpenID 251
Enabling OpenID authentication with Spring Security 252 Writing an OpenID login form 252 Configuring OpenID support in Spring Security 253 Adding OpenID users 254 The OpenID user registration problem 255 How OpenID identifiers are resolved 255 Implementing user registration with OpenID 258 Adding the OpenID registration option 258 Differentiating between a login and registration request 259 Configuring a custom authentication failure handler 260 Adding the OpenID registration functionality to the controller 260 Attribute Exchange 264 Enabling AX in Spring Security OpenID 265 Real-world AX support and limitations 267 Google OpenID support 267 Is OpenID secure? 268 Summary 269 Chapter 9: LDAP Directory Services 271 Understanding LDAP 272 LDAP 272 Common LDAP attribute names 273 Running an embedded LDAP server 275 Configuring basic LDAP integration 275 Configuring an LDAP server reference 275 Enabling the LDAP AuthenticationProvider 276 Troubleshooting embedded LDAP 276 Understanding how Spring LDAP authentication works 277 Authenticating user credentials 278 Determining user role membership 279 Mapping additional attributes of UserDetails 282 Advanced LDAP configuration 283 Sample JBCP LDAP users 283 Password comparison versus Bind authentication 284 Configuring basic password comparison 285 LDAP password encoding and storage 285 The drawbacks of a Password Comparison Authenticator 286 Configuring the UserDetailsContextMapper 287 Implicit configuration of a UserDetailsContextMapper 287 Viewing additional user details 287 Using an alternate password attribute 289
Using LDAP as a UserDetailsService 290 Notes about remember me with an LDAP UserDetailsService 291 Configuration for an In-Memory remember me service 291 Integrating with an external LDAP server 292 Explicit LDAP bean configuration 292 Configuring an external LDAP server reference 293 Configuring an LdapAuthenticationProvider 293 Integrating with Microsoft Active Directory via LDAP 294 Delegating role discovery to a UserDetailsService 297 Summary 298 Chapter 10: Single Sign On with Central Authentication Service 299 Introducing Central Authentication Service 299 High level CAS authentication flow 300 Spring Security and CAS 301 CAS installation and configuration 302 Configuring basic CAS integration 303 Adding the CasAuthenticationEntryPoint 304 Enabling CAS ticket verification 305 Proving authenticity with the CasAuthenticationProvider 307 Advanced CAS configuration 309 Retrieval of attributes from CAS assertion 309 How CAS internal authentication works 310 Configuring CAS to connect to our embedded LDAP server 311 Getting UserDetails from a CAS assertion 314 Examining the CAS assertion 315 Mapping LDAP attributes to CAS attributes 316 Finally, returning the attributes in the CAS assertion 318 Alternative Ticket authentication using SAML1.1 319 How is Attribute Retrieval useful? 320 Additional CAS capabilities 321 Summary 322 Chapter 11: Client Certificate Authentication 323 How Client Certificate authentication works 324 Setting up a Client Certificate authentication infrastructure 326 Understanding the purpose of a public key infrastructure 326 Creating a client certificate key pair 327 Configuring the Tomcat trust store 328 Importing the certificate key pair into a browser 330 Using Firefox 330 Using Internet Explorer 330
Wrapping up testing 331 Troubleshooting Client Certificate authentication 332 Configuring Client Certificate authentication in Spring Security 333 Configuring Client Certificate authentication using the security namespace 333 How Spring Security uses certificate information 334 How Spring Security certificate authentication works 335 Other loose ends 337 Supporting Dual-Mode authentication 338 Configuring Client Certificate authentication using Spring Beans 340 Additional capabilities of bean-based configuration 341 Considerations when implementing Client Certificate authentication 342 Summary 343 Chapter 12: Spring Security Extensions 345 Spring Security Extensions 345 A primer on Kerberos and SPNEGO authentication 346 Kerberos authentication in Spring Security 349 Overall Kerberos Spring Security authentication flow 349 Getting prepared 350 Assumptions for our examples 351 Creating a keytab file 352 Configuring Kerberos-related Spring beans 353 Wiring SPNEGO beans to the security namespace 355 Adding the Application Server machine to a Kerberos realm 357 Special considerations for Firefox users 358 Troubleshooting 358 Verifying connectivity with standard tools 359 Enabling Java GSS-API debugging 359 Other troubleshooting steps 360 Configuring LDAP UserDetailsService with Kerberos 361 Using form login with Kerberos 362 Summary 364 Chapter 13: Migration to Spring Security 3 365 Migrating from Spring Security 2 365 Enhancements in Spring Security 3 366 Changes to configuration in Spring Security 3 367 Rearranged AuthenticationManager configuration 367 New configuration syntax for session management options 368 Changes to custom filter configuration 369
Table ofcontents Changes to CustomAfterlnvocationProvider 370 Minor configuration changes 371 Changes to packages and classes 371 Summary 373 Appendix: Additional Reference Material 375 Getting started with JBCP Pets sample code 375 Available application events 376 Spring Security virtual URLs 379 Method security explicit bean configuration 379 Logical filter names migration reference 382 Index 385