Home Explore Help
Register Sign In
github
/
spring-security
mirror of https://github.com/spring-projects/spring-security
2
0
Fork 0
Files Issues 0 Wiki
Tree: dc726ac75c
Branches Tags
spring-security
/
doc
/
xdocs
/
index.html

index.html 9.5 KB
History Raw

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157 
  1. <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
    2. 

  2. <HTML><HEAD><TITLE>Acegi Security System for Spring</TITLE>
    3. 

  3. <META http-equiv=Content-Type content="text/html; charset=windows-1252">
    4. 

  4. <META content="MSHTML 6.00.2900.2180" name=GENERATOR></HEAD>
    5. 

  5. <BODY>
    6. 

  6.       <CENTER>
    7. 

  7.       </CENTER><BR><BR><FONT 
    8. 

  8.       face=Arial size=-1>
    9. 

  9.       <CENTER><B>
    10. 

  10.       <HR>
    11. 

  11. 

  12.       <CENTER>Mission Statement</CENTER></B>
    13. 

  13.       <HR>
    14. 

  14.       <BR>To provide comprehensive security services for <A 
    15. 

  15.       href="http://www.springframework.org/"><I>The Spring Framework</I></A>. 
    16. 

  16.       </CENTER><BR><B>
    17. 

  17.       <HR>
    18. 

  18. 

  19.       <CENTER>Key Features</CENTER></B>
    20. 

  20.       <HR>
    21. 

  21.       <BR>
    22. 

  22.       <UL>
    23. 

  23.         <LI><B>It is ready NOW.</B> As explained in the reference guide, the API 
    24. 

  24.         is now quite stable. We also use the <A 
    25. 

  25.         href="http://apr.apache.org/versioning.html">Apache APR Project 
    26. 

  26.         Versioning Guidelines</A> so you can identify backward 
    27. 

  27.         compatibility.<BR><BR>
    28. 

  28.         <LI><B>Easy to use:</B> View our samples/quick-start directory for XML 
    29. 

  29.         you can simply copy and paste into applicationContext.xml and web.xml. 
    30. 

  30.         From there it's easy to customise Acegi Security to your unique security 
    31. 

  31.         needs.<BR><BR>
    32. 

  32.         <LI><B>Enterprise-wide single sign on:</B> Using Yale University's open 
    33. 

  33.         source <A href="http://www.yale.edu/tp/auth/">Central Authentication 
    34. 

  34.         Service</A> (CAS), the Acegi Security System for Spring can participate 
    35. 

  35.         in an enterprise-wide single sign on environment. You no longer need 
    36. 

  36.         every web application to have its own authentication database. Nor are 
    37. 

  37.         you restricted to single sign on across a single web container. Advanced 
    38. 

  38.         single sign on features like proxy support and forced refresh of logins 
    39. 

  39.         are supported by both CAS and Acegi Security.<BR><BR>
    40. 

  40.         <LI><B>Reuses your Spring expertise:</B> We use Spring application 
    41. 

  41.         contexts for all configuration, which should help Spring developers get 
    42. 

  42.         up-to-speed nice and quickly.<BR><BR>
    43. 

  43.         <LI><B>Domain object instance security:</B> In many applications it's 
    44. 

  44.         desirable to define Access Control Lists (ACLs) for individual domain 
    45. 

  45.         object instances. We provide a comprehensive ACL package with features 
    46. 

  46.         including integer bit masking, permission inheritence (including 
    47. 

  47.         blocking), a JDBC-backed ACL repository, caching and a pluggable, 
    48. 

  48.         interface-driven design.<BR><BR>
    49. 

  49.         <LI><B>Non-intrusive setup:</B> The entire security system can operate 
    50. 

  50.         within a single web application using the provided filters. There is no 
    51. 

  51.         need to make special changes or deploy libraries to your Servlet or EJB 
    52. 

  52.         container.<BR><BR>
    53. 

  53.         <LI><B>Full (but optional) container integration:</B> The credential 
    54. 

  54.         collection and authorization capabilities of your Servlet or EJB 
    55. 

  55.         container can be fully utilised via included "container adapters". We 
    56. 

  56.         currently support Catalina (Tomcat), Jetty, JBoss and Resin, with 
    57. 

  57.         additional containers easily added.<BR><BR>
    58. 

  58.         <LI><B>Keeps your objects free of security code:</B> Many applications 
    59. 

  59.         need to secure data at the bean level based on any combination of 
    60. 

  60.         parameters (user, time of day, authorities held, method being invoked, 
    61. 

  61.         parameter on method being invoked....). This package gives you this 
    62. 

  62.         flexibility without adding security code to your Spring business 
    63. 

  63.         objects.<BR><BR>
    64. 

  64.         <LI><B>Secures your HTTP requests as well:</B> In addition to securing 
    65. 

  65.         your beans, the project also secures your HTTP requests. No longer is it 
    66. 

  66.         necessary to rely on web.xml security constraints. Best of all, your 
    67. 

  67.         HTTP requests can now be secured by your choice of regular expressions 
    68. 

  68.         or Apache Ant paths, along with pluggable authentication, authorization 
    69. 

  69.         and run-as replacement managers.<BR><BR>
    70. 

  70.         <LI><B>Channel security:</B> The Acegi Security System for Spring can 
    71. 

  71.         automatically redirect requests across an appropriate transport channel. 
    72. 

  72.         Whilst flexible enough to support any of your "channel" requirements (eg 
    73. 

  73.         the remote user is a human, not a robot), a common channel security 
    74. 

  74.         feature is to ensure your secure pages will only be available over 
    75. 

  75.         HTTPS, and your public pages only over HTTP. Acegi Security also 
    76. 

  76.         supports unusual port combinations and pluggable transport decision 
    77. 

  77.         managers.<BR><BR>
    78. 

  78.         <LI><B>Supports HTTP BASIC authentication:</B> Perfect for remoting 
    79. 

  79.         protocols or those web applications that prefer a simple browser pop-up 
    80. 

  80.         (rather than a form login), Acegi Security can directly process HTTP 
    81. 

  81.         BASIC authentication requests as per RFC 1945.<BR><BR>
    82. 

  82.         <LI><B>Convenient security taglib:</B> Your JSP files can use our taglib 
    83. 

  83.         to ensure that protected content like links and messages are only 
    84. 

  84.         displayed to users holding the appropriate granted authorities.<BR><BR>
    85. 

  85.         <LI><B>Application context or attribute-based configuration:</B> You 
    86. 

  86.         select the method used to configure your security environment. The 
    87. 

  87.         project supports configuration via Spring application contexts as well 
    88. 

  88.         as Jakarta Commons Attributes.<BR><BR>
    89. 

  89.         <LI><B>Various authentication backends:</B> We include the ability to 
    90. 

  90.         retrieve your user and granted authority definitions from either an XML 
    91. 

  91.         file or JDBC datasource. Alternatively, you can implement the 
    92. 

  92.         single-method DAO interface and obtain authentication details from 
    93. 

  93.         anywhere you like.<BR><BR>
    94. 

  94.         <LI><B>Event support:</B> Building upon Spring's 
    95. 

  95.         <CODE>ApplicationEvent</CODE> services, you can write your own listeners 
    96. 

  96.         for login, invalid password and account disabled events. This enables 
    97. 

  97.         you to implement account lockout and audit log systems, with complete 
    98. 

  98.         decoupling from Acegi Security code.<BR><BR>
    99. 

  99.         <LI><B>Easy integration with existing databases:</B> Our implementations 
    100. 

  100.         have been designed to make it very easy to use your existing 
    101. 

  101.         authentication schema and data (without modification).<BR><BR>
    102. 

  102.         <LI><B>Caching:</B> Use our <A 
    103. 

  103.         href="http://ehcache.sourceforge.net/">EHCACHE</A> wrapper to cache your 
    104. 

  104.         authentication information, or plug in your own cache implementation. 
    105. 

  105.         This flexibility means your database (or other authentication 
    106. 

  106.         repository) is not repeatedly queried for authentication 
    107. 

  107.         information.<BR><BR>
    108. 

  108.         <LI><B>Pluggable architecture:</B> Every critical aspect of the package 
    109. 

  109.         has been modelled using high cohesion, loose coupling, interface-driven 
    110. 

  110.         design principles. You can easily replace, customise or extend parts of 
    111. 

  111.         the package.<BR><BR>
    112. 

  112.         <LI><B>Startup-time validation:</B> Every critical object dependency and 
    113. 

  113.         configuration parameter is validated at application context startup 
    114. 

  114.         time. Security configuration errors are therefore detected early and 
    115. 

  115.         corrected quickly.<BR><BR>
    116. 

  116.         <LI><B>Remoting support:</B> Does your project use a rich client? Not a 
    117. 

  117.         problem. Acegi Security integrates with standard Spring remoting 
    118. 

  118.         protocols, because it automatically processes the HTTP BASIC 
    119. 

  119.         authentication headers they present. Add our BASIC authentication filter 
    120. 

  120.         to your web.xml and you're done.<BR><BR>
    121. 

  121.         <LI><B>Advanced password encoding:</B> Of course, passwords in your 
    122. 

  122.         authentication repository need not be in plain text. We support both SHA 
    123. 

  123.         and MD5 encoding, and also pluggable "salt" providers to maximise 
    124. 

  124.         password security.<BR><BR>
    125. 

  125.         <LI><B>Run-as replacement:</B> The security system fully supports 
    126. 

  126.         temporarily replacing the authenticated user for the duration of the web 
    127. 

  127.         request or bean invocation. This enables you to build public-facing 
    128. 

  128.         object tiers with different security configurations than your backend 
    129. 

  129.         objects.<BR><BR>
    130. 

  130.         <LI><B>Unit tests:</B> A must-have of any quality security project, unit 
    131. 

  131.         tests are included. Clover coverage is currently 98.3%.<BR><BR>
    132. 

  132.         <LI><B>Container integration tests:</B> To ensure the security project 
    133. 

  133.         properly operates with major container versions, we provide an 
    134. 

  134.         integration test system that deploys those containers from scratch and 
    135. 

  135.         fully tests our sample web application from the perspective of a HTTP 
    136. 

  136.         client.<BR><BR>
    137. 

  137.         <LI><B>Supports your own unit tests:</B> We provide a number of classes 
    138. 

  138.         that assist with your own unit testing of secured business objects. For 
    139. 

  139.         example, you can change the authentication identity and its associated 
    140. 

  140.         granted authorities directly within your test methods.<BR><BR>
    141. 

  141.         <LI><B>Peer reviewed:</B> Whilst nothing is ever completely secure, 
    142. 

  142.         using an open source security package leverages the continuous design 
    143. 

  143.         and code quality improvements that emerge from peer review.<BR><BR>
    144. 

  144.         <LI><B>Thorough documentation:</B> All APIs are fully documented using 
    145. 

  145.         JavaDoc, with a 40+ page reference guide providing an easy-to-follow 
    146. 

  146.         introduction.<BR><BR>
    147. 

  147.         <LI><B>Apache license.</B><BR><BR></LI></UL><BR><B>
    148. 

  148.       <HR>
    149. 

  149. 

  150.       <CENTER>Project Resources</CENTER></B>
    151. 

  151.       <HR>
    152. 

  152.       <BR>
    153. 

  153.       <CENTER><A href="http://forum.springframework.org/"><B>Support 
    154. 

  154.       Forums</B></A><BR><BR><A 
    155. 

  155.       href="http://sourceforge.net/project/showfiles.php?group_id=104215"><B>Downloads</B></A>
    156. 

  156.       </CENTER></FONT>
    157. 

  157. </BODY></HTML>
    158.