Spring security

Spring security

1. Portable

2. Beyond specification (Java EE)

3. customizable

4. Protect from knowledge attacks

5. Authentication

   • @Override protected void configure(HttpSecurity http) throws Exception { http .authorizeRequests() .antMatchers("/spitters/me").authenticated() .antMatchers(HttpMethod.POST, "/spittles").authenticated() .anyRequest().permitAll(); }
     • .antMatchers("/spitters/**").authenticated()
       • .antMatchers("/spitters/**", "/spittles/mine").authenticated();
         • .regexMatchers("/spitters/.*").authenticated()
   • is the process of establishing a principal is who they claim to be
   • First

6. Authorization

   • Method Nivel
   • Object instance nivel
   • SPEL as a authorization mechanism
   • Process of deciding whether a principal is allowed to perform an action
   • Second

7. Principal

   • Authentication authentication = SecurityContextHolder.getContext().getAuthentication(); String currentPrincipalName = authentication.getName();
   • Its just a object
   • Most of the time this can be cast into a UserDetails
     • UserDetails is core Interface in Spring security
   • Adapter between your own user database and what Spring Security needs inside the SecurityContextHolder
   • A user, device or some other system which can perform an action in your application

8. To store user details

   • JAAS
   • Database
   • LDAP
   • Properties File

9. Spring in a controller

   • @Secured({ "ROLE_USER", "ROLE_ADMIN" })
     • Spring security only
   • @RolesAllowed("ROLE_MEMBER")
     • JSR 250
   • IN XML
   • @PreAuthorize
     • can work with SPEL
     • @PreAuthorize("#contact.name == principal.name")
     • Verify authorization before entre into method
   • @PostAuthorize
     • after method have been executed
       • verifying authorization on returned values
         • @PostAuthorize ("returnObject.type == authentication.name")
           • Spring EL provides returnObject
             • reflects the actual object returned from method.

10. DelegatingFilterProxy

    • Instead of a multiple filter declaration, you can declare only it. It will delegate responsability to another spring bean

11. @EnableWebSecurity

    • Must be configured in a bean that implements WebSecurityConfigurer or extends WebSecurityConfigurerAdapter
      • Has method configure(httpSecurity)
        • @Override protected void configure(HttpSecurity http) throws Exception { http .authorizeRequests() .antMatchers("/spitters/me").authenticated() .antMatchers(HttpMethod.POST, "/spittles").authenticated() .anyRequest().permitAll(); }
          • <http use-expressions="true"> <intercept-url pattern="/**" access="authenticated"/> <form-login /> <http-basic /> </http>

12. @EnableWebMvcSecurity

13. Is based entirely on standard servlet filters.

    • Has no strong links to any particular web technology

14. @EnableGlobalMethodSecurity

    • on any @Configuration instance
    • jsr250Enabled = true (Attribute)
    • <global-method-security secured-annotations="enabled">