github
/
spring-security
mirror of https://github.com/spring-projects/spring-security


			
				
					
						
						
							1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495
							<?xml version="1.0" encoding="ISO-8859-1"?>
<document><properties><title>Acegi Security - Upgrading from version 0.8.0 to 1.0.0</title></properties><body><section name="Upgrading from 0.9.0 to 1.0.0"><p>
The following should help most casual users of the project update their
applications:
</p></section><section name="Changes 0.9.0 to RC1"><ul>

<li>The top level package name has changed. Simply find "net.sf.acegisecurity" and replace with
    "org.springframework.security".
</li>

<li>
DaoAuthenticationProvider has a property, authenticationDao. This property should now be renamed to
userDetailsService.
</li>

<li>
In JSPs, each "authz" taglib prefix must be changed from uri="http://acegisecurity.sf.net/authz"
to uri="http://acegisecurity.org/authz".
</li>

<li>net.sf.acegisecurity.providers.dao.AuthenticationDao is now
    org.springframework.security.userdetails.UserDetailsService.
    The interface signature has not changed. Similarly, User and UserDetails have moved into the latter's package as well.
If you've implemented your own AuthenticationDao, you'll need to change the class it's implementing and quite likely
the import packages for User and UserDetails. In addition, if using JdbcDaoImpl or InMemoryDaoImpl please
note they have moved to this new package.</li>

<li>Acegi Security is now localised. In net.sf.acegisecurity you will find a messages.properties. It is
suggested to register this in your application context, perhaps using ReloadableResourceBundleMessageSource.
If you do not do this, the default messages included in the source code will be used so this change is
not critical. The Spring LocaleContextHolder class is used to determine the locale of messages included in
exceptions. At present only the default messages.properties is included (which is in English). If
you localise this file to another language, please consider attaching it to a
<a href="http://opensource2.atlassian.com/projects/spring/secure/BrowseProject.jspa?id=10040">new JIRA task</a>
so that we can include it in future Acegi Security releases.</li>

</ul></section><section name="Changes RC1 to RC2"><ul>

<li>
    org.springframework.security.ui.rememberme.RememberMeProcessingFilter now requires an authenticationManager property. This will generally
point to an implementation of org.springframework.security.providers.ProviderManager.
</li>

<li>
    org.springframework.security.intercept.web.AuthenticationEntryPoint has moved to a new location,
    org.springframework.security.ui.AuthenticationEntryPoint.
</li>

<li>
    org.springframework.security.intercept.web.SecurityEnforcementFilter has moved to a new location and name,
    org.springframework.security.ui.ExceptionTranslationFilter. In addition, the "filterSecurityInterceptor"
property on the old SecurityEnforcementFilter class has been removed. This is because
SecurityEnforcementFilter will no longer delegate to FilterSecurityInterceptor as it has in the
past. Because this delegation feature has been removed (see SEC-144 for a background as to why),
please add a new filter definition for FilterSecurityInterceptor to the end of your
FilterChainProxy. Generally you'll also rename the old SecurityEnforcementFilter entry in your
FilterChainProxy to ExceptionTranslationFilter, more accurately reflecting its purpose.
If you are not using FilterChainProxy (although we recommend that you do), you will need to add
an additional filter entry to web.xml and use FilterToBeanProxy to access the FilterSecurityInterceptor.
</li>

<li>
If you are directly using SecurityContextHolder.setContext(SecurityContext) - which is not
very common - please not that best practise is now to call SecurityContextHolder.clearContext()
if you wish to erase the contents of the SecurityContextHolder. Previously code such as
SecurityContextHolder.setContext(new SecurityContextImpl()) would have been used. The revised
method internally stores null, which helps avoids redeployment issue caused by the previous
approaches (see SEC-159 for further details).
</li>

</ul></section><section name="Changes RC2 to Final"><ul>

<li>
AbstractProcessingFilter.onUnsuccessfulAuthentication(HttpServletRequest, HttpServletResponse)
has changed it signature (SEC-238). If subclassing, please override the new signature.
</li>

<li>
ExceptionTranslationFilter no longer provides a sendAccessDenied() method. Use the
new AccessDeniedHandler instead if custom handling is required.
</li>

<li>
There have been some changes to the LDAP provider APIs to allow for future improvements, as detailed in
<a href="http://opensource.atlassian.com/projects/spring/browse/SEC-264">SEC-264</a>. These
should only affect users who have written their own extensions to the provider. The general LDAP
classes are now in the packages org.springframework.security.ldap and the
    org.springframework.security.userdetails.ldap
    package has been introduced. The search and authentication classes now return an
<a href="../multiproject/acegi-security/apidocs/org/acegisecurity/userdetails/ldap/LdapUserDetails.html">LdapUserDetails</a>
instance. The LdapAuthoritiesPopulator interface and its default implementation now both make use of
LdapUserDetails. Any customized versions should be updated to use the new method signatures.
</li>

</ul></section></body></document>