spring-security/upgrade-05-06.txt

===============================================================================
          ACEGI SECURITY SYSTEM FOR SPRING - UPGRADING FROM 0.5 TO 0.6
===============================================================================

The following should help most casual users of the project update their
applications:

- Locate and remove all property references to 
  DaoAuthenticationProvider.key and 
  DaoAuthenticationProvider.refreshTokenInterval.

- If you are using DaoAuthenticationProvider and either (i) you are using
  container adapters or (ii) your code relies on the Authentication object
  having its getPrincipal() return a String, you must set the new
  DaoAuthenticationProvider property, forcePrincipalAsString, to true.
  By default DaoAuthenticationProvider returns an Authentication object
  containing the relevant User, which allows access to additional properties.
  Where possible, we recommend you change your code to something like this,
  so that you can leave forcePrincipalAsString to the false default:
  
    String username = authentication.getPrincipal();
    if (authentication.getPrincipal() instanceof User) {
      username = ((User) authentication.getPrincipal()).getUsername();
    }

- The signature of AuthenticationDaos have changed. In concrete
  implementations, modify the User to UserDetails, as shown below:

    public User loadUserByUsername(String username)
        throws UsernameNotFoundException, DataAccessException {

    to:
  
    public UserDetails loadUserByUsername(String username)
        throws UsernameNotFoundException, DataAccessException {

  Existing concrete implementations would be returning User, which implements
  UserDetails, so no further code changes should be required.

- Similar signature changes (User -> UserDetails) are also required to any
  custom implementations of UserCache and SaltSource.

- Any custom event listeners relying on AuthenticationEvent should note a
  UserDetails is now provided in the AuthenticationEvent (not a User).


$Id$