Spring Security 3 (the Book)

Why this Book?

I was inspired to write this book after my 5 Minute Guide to Spring Security tutorial became one of the top Google search results for "spring security tutorial". Packt and I joined up, and, almost one year later, here we are with a May 29, 2010 release date!

After spending a lot of time on the Spring Security community forums helping people, I realized that fundamentally many users of Spring Security (and Acegi before it) really do not understand how it's all put together from a high-level perspective. Furthermore, many users have the additional complexity of requiring integration with external authentication systems such as CAS, LDAP, or Active Directory, and fail to fully understand the integrations in a holistic way. These are the primary reasons why I wrote this book.

Why should you buy it?

• You are implementing Spring Security 3 in a web-based application and want to understand how and why it works.
• You are extending Spring Security 3 to incorporate your business needs for authentication, authorization, or custom integration.
• You are a beginner to Spring Security 3 and would like an example-driven approach to learning to secure a web application from scratch.
• You are integrating Spring Security 3 with an advanced security technology such as OpenID, CAS, LDAP, or Microsoft Active Directory.

I'm very proud of this book, and you should know that hours and hours of research went into it, to make it the most accurate, yet approachable, book on Spring Security 3 on the market. If you have any feedback, do write me at the email address in the "About this Site" section.

Best,

Peter Mularien, May 2010

What does it Cover?

In a nutshell, all of the following and more. You can see the full table of contents using the book preview feature on Amazon.

• Overall Spring Security architecture, at both a high and low level
• Implementation of all major Spring Security features, including:
  • JDBC-backed authentication
  • Method security with annotations and pointcuts
  • Session fixation protection
  • Concurrent session control
  • Password hashing
  • Access control lists (ACLs)
• Integration of Spring Security with external authentication providers, including:
  • OpenID
  • LDAP
  • CAS
  • Client certificates (X.509)
  • Kerberos
  • Microsoft Active Directory
• Full configuration of Spring Security using explicit Spring Bean declarations
• Many custom coding samples, including custom servlet filters, custom AuthenticationProviders, exception handlers, and much more.

It's the only source for written, detailed documentation on many of these topics as they relate to Spring Security. If you value your time, the book is definitely a worthwhile investment! You may wish to read my blog post announcing the release of the book for additional information and commentary.

Where to get it?

You can purchase the book from the following online vendors:

• Amazon.com
• Barnes & Noble
• Packtpub.com (the publisher)

The Spring Security 3 book is also available on at least two subscription services (that I am aware of):

• PacktLib (from Packt Publishing) - online copies of all Packt Publishing books
• Safari (from O'Reilly Publishing) - thousands of books from various publishers

My understanding is that Packt stocks physical books in some bookstores in the US and UK - please refer to their web site for more details on their distribution channels in your country.

For Purchasers of the Book

Many purchasers of the book have written to me regarding questions, problems, or issues. Let me try to help you ensure that you get the best and most prompt response to your issue:

• Problems with orders from Packtpub.com (or any other vendor): please contact the vendor directly to ensure they address any problems. Note that Packt in particular can have a 24-hour lag time to responses, as their order processing occurs largely overseas. If you haven't heard anything within 48 to 72 hours, let me know and I can attempt to help.
• Problems with sample code: please do contact me (email address on the "About this Site" tab above) and I will try to help you out. If you are having trouble getting JSTL working in Tomcat, please review my blog post on this very subject.
• Problems with Spring Security: although I am certainly happy to help out, I would suggest that your question (provided it's not specific to the book or sample code) is best reviewed by the larger community of experts at the Spring Security Community Forums. The forums are routinely monitored by both myself and experts from SpringSource and the community, and are a great way to learn and expand your knowledge, or answer specific problems!

I would also like to extend my deepest thanks and gratitude to those kind readers who have very nicely contacted me by email or in real life to express thanks, offer suggestions, or talk shop. Please don't hesitate to write!

Errata

While any developer hates to find bugs in their deliverables, it's incredibly frustrating with a book, because there's no chance of correcting it! Although I tried hard to avoid any errors in the book, in some cases edits were made without my knowledge that introduced errors. I'll document these here, and will communicate them to Packt as they are reported. If you notice anything, please contact me!

Chapter 2

• The source code listings on Pages 28 and 36 should have <filter-class> and <servlet-class>, instead of <filterclass> and <servletclass>, respectively. The source code for this chapter contains the correct element names.

Chapter 3

• When running the sample code for this chapter, you may encounter an error:
  • org.springframework.beans.NotReadablePropertyException: Invalid property 'principal.username' of bean class
  • If this occurs, please edit header.jsp and modify the following line:
    • Welcome, <strong><sec:authentication property="principal.username"/></strong>
      
  • To:
    • <sec:authorize access="isAuthenticated()">
      Welcome, <strong><sec:authentication property="principal.username"/> </strong>
      </sec:authorize>
  • I apologize for any inconvenience this may cause you!
    
• The following section was inadvertently removed from the end of the chapter by the Packt editors. I apologize for missing this during my review of this chapter.

Introducing the Spring Security Tag Library

The Spring Security Tag Library is a standard JSP tag library which provides several bits of helpful functionality, invoked similarly to other JSP tag libraries. We’ll make more full use of the more sophisticated portions of the tag library in Chapters 5 and 7, but here we’ll add a minor feature to help out our users which will serve as an introduction to the tag library.

Adding Tag Library Reference to Header JSP

In WEB-INF/common/header.jsp, we’ll add a reference to the Spring Security tag library:

<%@ taglib prefix="sec" uri="www.springframework.org/security/tags" %>

Much like the JSTL tag library reference we added earlier, the Spring Security tag library reference will need to be added to any page on which you use it.

Displaying the Current User’s Name

We’d like to have our authenticated users greeted when they visit the site, and display something like Welcome, guest in the header, when they are logged in. Fortunately, we can use the Spring Security tag library to accomplish this quickly and easily. Simply add the following to WEB-INF/common/header.jsp:

<div id="header">
<div class="username">
Welcome, <strong><sec:authentication property="principal.username"/></strong>
</div>
<ul>

We will see that when we log in, the friendly greeting is now displayed to the user. In fact, the <authentication> tag exposes the entire Authentication object for display. Any property on the object can be rendered, using standard JavaBeans property syntax. Recall from Chapter 2 that Authentication contains a getPrincipal() method, which typically returns a UserDetails object after authentication. We’d suggest referring to the JavaDoc for these interfaces to see what other kinds of information are available for use with the <authentication> tag!.

Code Updates for Spring Security 3.1

We'll attempt to keep this section updates as progress continues on Spring Security 3.1 (as of Sept 2010, currently at 3.1.0M1 release, with active development continuing in the git repository). I haven't yet reviewed all the chapters, so please drop me an email if you spot anything!

Note that there are a number of enhancements in Spring Security 3.1. We aren't covering those here, but I hope to follow up with some relevant articles as Spring Security 3.1 gets finalized.

If you wish to use Spring Security 3.1 with the code in the book, the following changes are required:

Overall

• With Spring Security 3.1, you must use Spring Framework 3.0.3 or greater. The Dependencies ZIP included in the book source code contains Spring Framework 3.0.0 (the most recent available as of the time of publishing). If you do not use Spring Framework 3.0.3 or greater, you may encounter various errors at runtime, although you are unlikely to experience compilation errors (making this mismatch harder to catch).
• The reference to the Spring Security XSD has been updated, and should now be
  www.springframework.org/schema/security/spring-security-3.1.xsd. Note that as of this writing, this URL doesn't exist on the springframework.org site, so you may have to use the existing XSD reference, or www.springframework.org/schema/config/spring-security.xsd.

Chapter 6 / Appendix

Several changes are required to the bean-based configuration in this chapter, and the accompanying appendix. Thanks to alert reader Jaron Schut for giving me the heads up on this issue!

• Page 185: The code reference to AccessDeniedHandlerImpl.SPRING_SECURITY_ACCESS_DENIED_EXCEPTION_KEY has (happily) been removed completely. The code should instead now use org.springframework.security.web.WebAttributes.ACCESS_DENIED_403.
• Appendix: The constructor for MethodSecurityMetadataSourceAdvisor has an additional required parameter. This should match the name of the bean you've defined for DelegatingMethodSecurityMetadataSource. In our code sample, the resultant constructor should look like this:
  

  <bean 
                id="methodSecurityMetadataSourceAdvisor">
  	<constructor-arg value="methodSecurityInterceptor"/>
  	<constructor-arg ref="delegatingMetadataSource"/>
  	<!-- Spr Sec 3.1 -->
  	<constructor-arg value="delegatingMetadataSource"/>
  </bean>

• Speaking of DelegatingMethodSecurityMetadataSource, the fix for SEC-1467 changed this bean to use constructor injection. This means the explicit bean configuration has to change to compensate:
  

  <bean 
                id="delegatingMetadataSource">
  <!-- Spr Sec 3.1 -->
  	<constructor-arg name="methodSecurityMetadataSources">
  		<list>
  			<ref local="prePostMetadataSource"/>
  			<ref local="securedMetadataSource"/>
  			<ref local="jsr250MetadataSource"/>
  		</list>
  	</constructor-arg>
  </bean>

• Page 210: CustomWebSecurityExpressionHandler requires many changes in order to continue to work with Spr Sec 3.1. I'm hopeful that an alternative method of binding custom expression methods will be provided, and we can do away with the current implementation in the book, which requires us to copy a lot of private members and methods. I'll update this bullet as Spring Sec 3.1 progresses.