spring security 3.0.1

• security metadata related classes
• interception code
• Security access control annotations
• Voter-based AccessDecisionManager implementations

Expression handling code to support the use of Spring-EL based expressions in @PreAuthorize, @PreFilter, @PostAuthorizue and @PostFilter annotations. Mainly for internal framework use and liable to change.

A secure object is a term frequently used throughout the security system. It does not refer to a business object that is being secured, but instead refers to some infrastructure object that can have security facilities provided for it by Spring Security. For example, one secure object would be MethodInvocation, whilst another would be HTTP {@link org.springframework.security.web.FilterInvocation}. Note these are infrastructure objects and their design allows them to represent a large variety of actual resources that might need to be secured, such as business objects or HTTP request URLs.

Each secure object typically has its own interceptor package. Each package usually includes a concrete security interceptor (which subclasses {@link org.springframework.security.access.intercept.AbstractSecurityInterceptor}, an appropriate {@link org.springframework.security.access.SecurityMetadataSource} for the type of resources the secure object represents, and a property editor to populate the SecurityMetadataSource.

Refer to the reference guide for information on usage.

Contains the infrastructure classes for handling the @PreAuthorize, @PreFilter, @PostAuthorize and @PostFilter annotations.

The ProviderManager automatically publishes events to the application context. These events are received by all registered Spring ApplicationListeners.

A security context is associated with the current execution thread for the duration of the request, making the authentication information it contains available throughout all the layers of an application.

The LDAP authentication provider package. Interfaces are provided for both authentication and retrieval of user roles from an LDAP server.

The main provider class is LdapAuthenticationProvider. This is configured with an LdapAuthenticator instance and an LdapAuthoritiesPopulator. The latter is used to obtain the list of roles for the user.

Contains simple user and authority group account provisioning interfaces together with a a JDBC-based implementation.

The beans are wired as follows:

<bean id="test" class="org.springframework.remoting.httpinvoker.HttpInvokerProxyFactoryBean">
<property name="serviceUrl"><value>http://localhost/Test</value></property>
<property name="serviceInterface"><value>test.TargetInterface</value></property>
<property name="httpInvokerRequestExecutor"><ref bean="httpInvokerRequestExecutor"/></property>
</bean>

<bean id="httpInvokerRequestExecutor" class="org.springframework.security.core.context.httpinvoker.AuthenticationSimpleHttpInvokerRequestExecutor"/>


The beans are wired as follows:

<bean id="test" class="org.springframework.remoting.rmi.RmiProxyFactoryBean">
<property name="serviceUrl"><value>rmi://localhost/Test</value></property>
<property name="serviceInterface"><value>test.TargetInterface</value></property>
<property name="refreshStubOnConnectFailure"><value>true</value></property>
<property name="remoteInvocationFactory"><ref bean="remoteInvocationFactory"/></property>
</bean>

<bean id="remoteInvocationFactory" class="org.springframework.security.core.context.rmi.ContextPropagatingRemoteInvocationFactory"/>


General utility classes used throughout the Spring Security framework.

This package should essentially be standalone - it should not have dependencies on other parts of the framework, just on external libraries and the JDK.

Classes which are responsible for maintaining the security context between HTTP requests.

To use, simply add the SecurityContextHolderAwareRequestFilter to the Spring Security filter chain.