Spring Security 5.0.3官方文档详解与入门指南

需积分: 9 41 浏览量更新于2024-07-19 收藏 3.98MB PDF 举报

Spring-Secutity-5.0.3 是Spring Security框架的最新版本，发布于2018年3月28日，由多位作者如Ben Alex、Luke Taylor、Rob Winch、Gunnar Hillert、Joe Grandja和Jay Bryant共同贡献。Spring Security是一款强大的开源安全解决方案，用于保护Web应用程序，提供身份验证、授权和会话管理等功能。 1. **简介**： - **Spring Security是什么**：Spring Security是一个基于Java的轻量级安全框架，它与Spring框架紧密集成，能够简化Web应用的安全性实现。它提供了易于使用的API，可以处理常见的安全需求，如HTTP Basic认证、表单登录、OAuth2.0和OpenID Connect等。 - **历史**：Spring Security自2004年开始发展，经历了多个版本迭代，从早期版本逐步增强功能和性能，以适应不断变化的网络安全需求。 - **版本编号规则**：Spring Security的版本号遵循一定的模式，通常包括主版本号、次版本号和修订号，如5.0.3.RELEASE，表示这是第5个主要版本的第0.3次修订，是正式发布版。 2. **获取Spring Security**： - **Maven使用**：对于Maven项目，用户可以直接从Spring框架的Maven仓库获取依赖，通过添加`<dependency>`元素引用对应的包，如`core-spring-security-core.jar`。 - **Gradle使用**：同样在Gradle项目中，可以通过添加`implementation`或`api`关键字添加Spring Security依赖到构建文件中，仓库地址需根据官方文档配置。 - **项目模块**：Spring Security包含多个核心模块，例如`spring-security-core.jar`处理基础安全功能，`spring-security-web.jar`专注于Web相关的安全性，还有针对特定协议（如OAuth2.0）的专门模块。 3. **许可证**： - Spring Security的文档允许用户在个人使用和非商业范围内复制和分发文档，但必须保留版权信息，无论纸质还是电子形式传播。文档详细介绍了Spring Security的安装方法、模块结构以及各模块的功能。如果你正在开发一个Web应用并需要强化其安全性，Spring-Secutity-5.0.3是一个值得深入研究和使用的工具，它能帮助你在Spring框架环境中快速集成和定制安全策略。同时，随着版本的更新，框架可能引入了新的特性和改进，务必查阅最新的官方文档以确保最佳实践。

43.3.5. <user-service>
<user-service> Attributes
Child Elements of <user-service>
43.3.6. <user>
Parent Elements of <user>
<user> Attributes
43.4. Method Security
43.4.1. <global-method-security>
<global-method-security> Attributes
Child Elements of <global-method-security>
43.4.2. <after-invocation-provider>
Parent Elements of <after-invocation-provider>
<after-invocation-provider> Attributes
43.4.3. <pre-post-annotation-handling>
Parent Elements of <pre-post-annotation-handling>
Child Elements of <pre-post-annotation-handling>
43.4.4. <invocation-attribute-factory>
Parent Elements of <invocation-attribute-factory>
<invocation-attribute-factory> Attributes
43.4.5. <post-invocation-advice>
Parent Elements of <post-invocation-advice>
<post-invocation-advice> Attributes
43.4.6. <pre-invocation-advice>
Parent Elements of <pre-invocation-advice>
<pre-invocation-advice> Attributes
43.4.7. Securing Methods using
Parent Elements of <protect-pointcut>
<protect-pointcut> Attributes
43.4.8. <intercept-methods>
<intercept-methods> Attributes
Child Elements of <intercept-methods>
43.4.9. <method-security-metadata-source>
<method-security-metadata-source> Attributes
Child Elements of <method-security-metadata-source>
43.4.10. <protect>
Parent Elements of <protect>
<protect> Attributes
43.5. LDAP Namespace Options
43.5.1. Defining the LDAP Server using the
<ldap-server> Attributes
43.5.2. <ldap-authentication-provider>
Parent Elements of <ldap-authentication-provider>
<ldap-authentication-provider> Attributes
Child Elements of <ldap-authentication-provider>
43.5.3. <password-compare>
Parent Elements of <password-compare>
<password-compare> Attributes
Child Elements of <password-compare>
43.5.4. <ldap-user-service>
<ldap-user-service> Attributes
Web page converted to PDF with the PDFmyURL PDF creation API!

Spring Security Dependencies
1. spring-security-core
2. spring-security-remoting
3. spring-security-web
4. spring-security-ldap
5. spring-security-config
6. spring-security-acl
7. spring-security-cas
8. spring-security-openid
9. spring-security-taglibs
Proxy Server Configuration
Spring Security FAQ
1. General Questions
1.1. Will Spring Security take care of all my application security requirements?
1.2. Why not just use web.xml security?
1.3. What Java and Spring Framework versions are required?
1.4. I’m new to Spring Security and I need to build an application that supports CAS single sign-on over HTTPS, while allowing Basic authentication locally
for certain URLs, authenticating against multiple back end user information sources (LDAP and JDBC). I’ve copied some configuration files I found but it
doesn’t work. What could be wrong?
2. Common Problems
2.1. When I try to log in, I get an error message that says "Bad Credentials". What’s wrong?
2.2. My application goes into an "endless loop" when I try to login, what’s going on?
2.3. I get an exception with the message "Access is denied (user is anonymous);". What’s wrong?
2.4. Why can I still see a secured page even after I’ve logged out of my application?
2.5. I get an exception with the message "An Authentication object was not found in the SecurityContext". What’s wrong?
2.6. I can’t get LDAP authentication to work. What’s wrong with my configuration?
2.7. Session Management
2.8. I’m using Spring Security’s concurrent session control to prevent users from logging in more than once at a time. When I open another browser window
after logging in, it doesn’t stop me from logging in again. Why can I log in more than once?
2.9. Why does the session Id change when I authenticate through Spring Security?
2.10. I’m using Tomcat (or some other servlet container) and have enabled HTTPS for my login page, switching back to HTTP afterwards. It doesn’t work -
I just end up back at the login page after authenticating.
2.11. I’m not switching between HTTP and HTTPS but my session is still getting lost
2.12. I’m trying to use the concurrent session-control support but it won’t let me log back in, even if I’m sure I’ve logged out and haven’t exceeded the
allowed sessions.
2.13. Spring Security is creating a session somewhere, even though I’ve configured it not to, by setting the create-session attribute to never.
2.14. I get a 403 Forbidden when performing a POST
2.15. I’m forwarding a request to another URL using the RequestDispatcher, but my security constraints aren’t being applied.
2.16. I have added Spring Security’s <global-method-security> element to my application context but if I add security annotations to my Spring MVC
controller beans (Struts actions etc.) then they don’t seem to have an effect.
2.17. I have a user who has definitely been authenticated, but when I try to access the SecurityContextHolder during some requests, the Authentication is
null. Why can’t I see the user information?
Web page converted to PDF with the PDFmyURL PDF creation API!

46.2.18. The authorize JSP Tag doesn’t respect my method security annotations when using the URL attribute.
46.3. Spring Security Architecture Questions
46.3.1. How do I know which package class X is in?
46.3.2. How do the namespace elements map to conventional bean configurations?
46.3.3. What does "ROLE_" mean and why do I need it on my role names?
46.3.4. How do I know which dependencies to add to my application to work with Spring Security?
46.3.5. What dependencies are needed to run an embedded ApacheDS LDAP server?
46.3.6. What is a UserDetailsService and do I need one?
46.4. Common "Howto" Requests
46.4.1. I need to login in with more information than just the username. How do I add support for extra login fields (e.g. a company name)?
46.4.2. How do I apply different intercept-url constraints where only the fragment value of the requested URLs differs (e.g./foo#bar and /foo#blah?
46.4.3. How do I access the user’s IP Address (or other web-request data) in a UserDetailsService?
46.4.4. How do I access the HttpSession from a UserDetailsService?
46.4.5. How do I access the user’s password in a UserDetailsService?
46.4.6. How do I define the secured URLs within an application dynamically?
46.4.7. How do I authenticate against LDAP but load user roles from a database?
46.4.8. I want to modify the property of a bean that is created by the namespace, but there is nothing in the schema to support it. What can I do short of
abandoning namespace use?
Spring Security is a powerful and highly customizable authentication and access-control framework. It is the de-facto standard for securing Spring-based applications.
Part I. Preface
Spring Security provides a comprehensive security solution for Java EE-based enterprise software applications. As you will discover as you venture through this reference
guide, we have tried to provide you a useful and highly configurable security system.
Security is an ever-moving target, and it’s important to pursue a comprehensive, system-wide approach. In security circles we encourage you to adopt "layers of security", so
that each layer tries to be as secure as possible in its own right, with successive layers providing additional security. The "tighter" the security of each layer, the more robust
and safe your application will be. At the bottom level you’ll need to deal with issues such as transport security and system identification, in order to mitigate man-in-the-middle
attacks. Next you’ll generally utilise firewalls, perhaps with VPNs or IP security to ensure only authorised systems can attempt to connect. In corporate environments you may
deploy a DMZ to separate public-facing servers from backend database and application servers. Your operating system will also play a critical part, addressing issues such as
running processes as non-privileged users and maximising file system security. An operating system will usually also be configured with its own firewall. Hopefully somewhere
along the way you’ll be trying to prevent denial of service and brute force attacks against the system. An intrusion detection system will also be especially useful for monitoring
and responding to attacks, with such systems able to take protective action such as blocking offending TCP/IP addresses in real-time. Moving to the higher layers, your Java
Virtual Machine will hopefully be configured to minimize the permissions granted to different Java types, and then your application will add its own problem domain-specific
security configuration. Spring Security makes this latter area - application security - much easier.
Of course, you will need to properly address all security layers mentioned above, together with managerial factors that encompass every layer. A non-exhaustive list of such
Web page converted to PDF with the PDFmyURL PDF creation API!

managerial factors would include security bulletin monitoring, patching, personnel vetting, audits, change control, engineering management systems, data backup, disaster

recovery, performance benchmarking, load monitoring, centralised logging, incident response procedures etc.

With Spring Security being focused on helping you with the enterprise application security layer, you will find that there are as many different requirements as there are

business problem domains. A banking application has different needs from an ecommerce application. An ecommerce application has different needs from a corporate sales

force automation tool. These custom requirements make application security interesting, challenging and rewarding.

Please read Chapter 1, Getting Started, in its entirety to begin with. This will introduce you to the framework and the namespace-based configuration system with which you

can get up and running quite quickly. To get more of an understanding of how Spring Security works, and some of the classes you might need to use, you should then read

Part II, “Architecture and Implementation”. The remaining parts of this guide are structured in a more traditional reference style, designed to be read on an as-required basis.

We’d also recommend that you read up as much as possible on application security issues in general. Spring Security is not a panacea which will solve all security issues. It is

important that the application is designed with security in mind from the start. Attempting to retrofit it is not a good idea. In particular, if you are building a web application, you

should be aware of the many potential vulnerabilities such as cross-site scripting, request-forgery and session-hijacking which you should be taking into account from the start.

The OWASP web site (http://www.owasp.org/) maintains a top ten list of web application vulnerabilities as well as a lot of useful reference information.

We hope that you find this reference guide useful, and we welcome your feedback and suggestions.

Finally, welcome to the Spring Security community.

1. Getting Started

The later parts of this guide provide an in-depth discussion of the framework architecture and implementation classes, which you need to understand if you want to do any

serious customization. In this part, we’ll introduce Spring Security 4.0, give a brief overview of the project’s history and take a slightly gentler look at how to get started using the

framework. In particular, we’ll look at namespace configuration which provides a much simpler way of securing your application compared to the traditional Spring bean

approach where you have to wire up all the implementation classes individually.

We’ll also take a look at the sample applications that are available. It’s worth trying to run these and experimenting with them a bit even before you read the later sections - you

can dip back into them as your understanding of the framework increases. Please also check out the project website as it has useful information on building the project, plus

links to articles, videos and tutorials.

2. Introduction

2.1 What is Spring Security?

Spring Security provides comprehensive security services for Java EE-based enterprise software applications. There is a particular emphasis on supporting projects built

using The Spring Framework, which is the leading Java EE solution for enterprise software development. If you’re not using Spring for developing enterprise applications, we

warmly encourage you to take a closer look at it. Some familiarity with Spring - and in particular dependency injection principles - will help you get up to speed with Spring

Security more easily.

People use Spring Security for many reasons, but most are drawn to the project after finding the security features of Java EE’s Servlet Specification or EJB Specification lack

the depth required for typical enterprise application scenarios. Whilst mentioning these standards, it’s important to recognise that they are not portable at a WAR or EAR level.

Therefore, if you switch server environments, it is typically a lot of work to reconfigure your application’s security in the new target environment. Using Spring Security

Web page converted to PDF with the PDFmyURL PDF creation API!

overcomes these problems, and also brings you dozens of other useful, customisable security features.

As you probably know two major areas of application security are "authentication" and "authorization" (or "access-control"). These are the two main areas that Spring Security

targets. "Authentication" is the process of establishing a principal is who they claim to be (a "principal" generally means a user, device or some other system which can

perform an action in your application)."Authorization" refers to the process of deciding whether a principal is allowed to perform an action within your application. To arrive at

the point where an authorization decision is needed, the identity of the principal has already been established by the authentication process. These concepts are common, and

not at all specific to Spring Security.

At an authentication level, Spring Security supports a wide range of authentication models. Most of these authentication models are either provided by third parties, or are

developed by relevant standards bodies such as the Internet Engineering Task Force. In addition, Spring Security provides its own set of authentication features. Specifically,

Spring Security currently supports authentication integration with all of these technologies:

HTTP BASIC authentication headers (an IETF RFC-based standard)

HTTP Digest authentication headers (an IETF RFC-based standard)

HTTP X.509 client certificate exchange (an IETF RFC-based standard)

LDAP (a very common approach to cross-platform authentication needs, especially in large environments)

Form-based authentication (for simple user interface needs)

OpenID authentication

Authentication based on pre-established request headers (such as Computer Associates Siteminder)

Jasig Central Authentication Service (otherwise known as CAS, which is a popular open source single sign-on system)

Transparent authentication context propagation for Remote Method Invocation (RMI) and HttpInvoker (a Spring remoting protocol)

Automatic "remember-me" authentication (so you can tick a box to avoid re-authentication for a predetermined period of time)

Anonymous authentication (allowing every unauthenticated call to automatically assume a particular security identity)

Run-as authentication (which is useful if one call should proceed with a different security identity)

Java Authentication and Authorization Service (JAAS)

Java EE container authentication (so you can still use Container Managed Authentication if desired)

Kerberos

Java Open Source Single Sign-On (JOSSO) *

OpenNMS Network Management Platform *

AppFuse *

AndroMDA *

Mule ESB *

Direct Web Request (DWR) *

Grails *

Tapestry *

JTrac *

Jasypt *

Roller *

Elastic Path *

Atlassian Crowd *

Your own authentication systems (see below)

(* Denotes provided by a third party)

Web page converted to PDF with the PDFmyURL PDF creation API!

剩余301页未读，继续阅读

xiaoCong2015

粉丝: 4
资源: 62

Spring Security 5.0.3官方文档详解与入门指南

H3CNE-Secutity笔记 (仅实验)

c代码-secutity access alogrithm

c代码-secutity access alogrithm1

H3CNE-Secutity网络安全配置实践

Spring-security_Spring-MVC_Hibernate_MySQL:Maven 项目用 Spring security 来处理登录问题和 Spring MVC 来处理请求和响应

spring-ws-1.0-m2-minimal.zip_The Tiger_spring_spring ws

RESTful_SpringSecurity_JWT:RESTful Spring-Security 5和JWT

security-demo:Springboot，SpringSecutity常见演示集

yfax-parent:SprintBoot开发的Rest API接口项目实战，集成了拦截器，日志处理，mysql，mybatis, oauth2.0, spring secutity等，已投入生产线上使用。应用了https

sreng secutity

最新资源