Spring Security 3.0 and ICEfaces 3 Tutorial
About Spring SecuritySpring Security 3 provides an API for configuring authentication and authorization. Authentication is possible against any number of repositories and databases. Authorization is applied at either the web resource level using Servlet Filters and/or at the business/service method level using aspects and annotations. About This TutorialThe purpose of this tutorial is to demonstrate how application developers can use both Spring Security 3.0.7 and ICEfaces 3.0.1 in the same application. Both technologies leverage the Servlet API so it is essential one understands how the various parts of the web.xml file are organized to accommodate both frameworks. Its also important to be mindful that Spring Security is highly configurable. The example below shows only one extension (Session Management). There are several others filters and configuration options your requirements may warrant. Tutorial Use CaseThe simple business case for this tutorial is a "product documentation" web application. Some of the documentation is publicly available and some of it requires authorization. To satisfy this requirement all content requiring authorization is accessible behind the spring intercept pattern "/secure/*" Technologies/Libraries UsedThis tutorial uses Spring Security 3.0.7, Spring Framework 3.1.1, JSF 2.1.4 and ICEfaces 3.0.1. The project has been modified to use Maven as the build environment. Configuration Areas:
Part 1: Configure Web.xml For Spring SecurityThe web.xml below contains additional parameters showing where the spring configuration is located, the Spring Security filter chain, the context loader listener, and the SessionEventPublisher. These should be added to any existing ICEfaces web.xml configuration parameters show below in step 3. web.xml <?xml version="1.0" encoding="UTF-8"?> <web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" version="2.5"> <context-param> <param-name>contextConfigLocation</param-name> <param-value> /WEB-INF/applicationContext.xml /WEB-INF/applicationContext-security.xml </param-value> </context-param> <filter> <filter-name>springSecurityFilterChain</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> </filter> <filter-mapping> <filter-name>springSecurityFilterChain</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <listener> <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> </listener> <listener> <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class> </listener> </web-app> Part 2: Configure Your applicationContext.xml For Spring SecurityIn this step we configure Spring Security in the file applicationContext-security.xml. applicationContext-security.xml <?xml version="1.0" encoding="UTF-8"?> <beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd"> <!-- key configuration here is an entry point to be used by security intercepts --> <http realm="Sample Realm" entry-point-ref="authenticationEntryPoint"> <!-- any role that is used to protect a directory, can be multiples --> <intercept-url pattern='/secure/**' access='ROLE_READER' /> <!-- enable form login to use UsernamePasswordAuthenticationFilter [/j_spring_security_check] --> <form-login login-page="/general/logins/htmlLogin.faces" authentication-failure-url="/general/logins/loginFailed.faces"/> <!-- logout page uses the default LogoutFilter, no changes are needed as IT accepts a GET call... --> <!-- here is an example logout link: <a href="#{request.contextPath}/j_spring_security_logout">Logout</a> --> <logout logout-url="/j_spring_security_logout" logout-success-url="/general/main.faces" invalidate-session="true"/> </http> <beans:bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"> <beans:property name="loginFormUrl" value="/general/logins/htmlLogin.faces" /> </beans:bean> <!-- test with this before you hook up your LDAP or other Authentication Manager --> <authentication-manager alias="authenticationManager"> <authentication-provider> <user-service> <user name="joe.blow@icesoft.com" password="pass1234" authorities="ROLE_READER"/> <user name="ben.simpson@icesoft.com" password="pass5678" authorities="ROLE_READER"/> </user-service> </authentication-provider> </authentication-manager> </beans:beans> Part 3: Configure Web.xml For JSFIn this step we extend the web.xml to support JSF like we would any other ICEfaces application. web.xml ... <servlet> <servlet-name>Faces Servlet</servlet-name> <servlet-class>javax.faces.webapp.FacesServlet</servlet-class> <load-on-startup>1</load-on-startup> </servlet> <servlet> <servlet-name>Resource Servlet</servlet-name> <servlet-class>com.icesoft.faces.webapp.CompatResourceServlet</servlet-class> <load-on-startup>1</load-on-startup> </servlet> <servlet-mapping> <servlet-name>Faces Servlet</servlet-name> <url-pattern>*.faces</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>Faces Servlet</servlet-name> <url-pattern>/icefaces/*</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>Resource Servlet</servlet-name> <url-pattern>/xmlhttp/*</url-pattern> </servlet-mapping> ... Step 4: Configure Your Spring Security redirectStrategyThe example configuration below contains all of the previous security configurations and an added session management filter. When the session applicationContext-security.xml <?xml version="1.0" encoding="UTF-8"?> <beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"> <!-- key configuration here is an entry point to be used by security intercepts --> <http realm="Sample Realm" entry-point-ref="authenticationEntryPoint" auto-config="false"> <custom-filter ref="sessionManagementFilter" before="SESSION_MANAGEMENT_FILTER" /> <!-- any role that is used to protect a directory, can be multiples --> <intercept-url pattern='/secure/**' access='ROLE_READER' /> <!-- enable form login to use UsernamePasswordAuthenticationFilter [/j_spring_security_check] --> <form-login login-page="/general/logins/htmlLogin.faces" authentication-failure-url="/general/logins/loginFailed.jsf"/> <!-- logout page uses the default LogoutFilter, no changes are needed as IT accepts a GET call... --> <!-- here is an example logout link: <a href="#{request.contextPath}/j_spring_security_logout">Logout</a> --> <logout logout-url="/j_spring_security_logout" logout-success-url="/general/main.jsf" invalidate-session="true"/> </http> <beans:bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"> <beans:property name="loginFormUrl" value="/general/logins/login.jsf" /> </beans:bean> <!-- test with this before you hook up your LDAP or other Authentication Manager --> <authentication-manager alias="authenticationManager"> <authentication-provider> <user-service> <user name="joe.blow@icesoft.com" password="pass1234" authorities="ROLE_READER"/> <user name="ben.simpson@icesoft.com" password="pass5678" authorities="ROLE_READER"/> </user-service> </authentication-provider> </authentication-manager> <beans:bean id="sessionManagementFilter" class="org.springframework.security.web.session.SessionManagementFilter"> <beans:constructor-arg name="securityContextRepository" ref="httpSessionSecurityContextRepository" /> <beans:property name="invalidSessionUrl" value="/general/logins/sessionExpired.jsf" /> <!-- this permits redirection to session timeout page from javascript/ajax or http --> <beans:property name="redirectStrategy" ref="jsfRedirectStrategy" /> </beans:bean> <beans:bean id="jsfRedirectStrategy" class="com.icesoft.spring.security.JsfRedirectStrategy"/> <beans:bean id="httpSessionSecurityContextRepository" class="org.springframework.security.web.context.HttpSessionSecurityContextRepository"/> </beans:beans> ResourcesFor more information on Spring Security, please check out the content below: |
Spring Security 3.0
© Copyright 2021 ICEsoft Technologies Canada Corp.