diff --git a/doc/docbook/acegi.xml b/doc/docbook/acegi.xml index 9bc641f36a..f680cb5522 100644 --- a/doc/docbook/acegi.xml +++ b/doc/docbook/acegi.xml @@ -2035,7 +2035,7 @@ if (obj instanceof UserDetails) { Most JAAS LoginModules require a callback of some sort. These callbacks are usually used to obtain the - username and password from the user. + username and password from the user. In an Acegi Security deployment, Acegi Security is responsible for this user interaction (via the authentication mechanism). Thus, @@ -2079,7 +2079,7 @@ if (obj instanceof UserDetails) { principal, and multiple GrantedAuthority[]s. To facilitate mapping between these different concepts, Acegi Security's JAAS package includes an - AuthorityGranter interface. + AuthorityGranter interface. An AuthorityGranter is responsible for inspecting a JAAS principal and returning a @@ -5955,6 +5955,51 @@ END; if you're ambitious: try client _cas_stateless_ YOUR-SERVICE-TICKET-ID. + + + Tutorial Sample + + Whilst the Contacts + Sample is quite advanced in that illustrates the more powerful + features of domain object access control lists and so on, sometimes + you just want to start with a nice basic template. The tutorial sample + is intended to provide this initial base. + + The compiled tutorial is included in the distribution ZIP file, + ready to be deployed into your web container. Authentication is + handled by the DaoAuthenticationProvider, using the + in-memory + UserDetailsService that sources information from + the users.properties file located in the WAR's + /WEB-INF directory. The form-based authentication mechanism is used, + with the commonly-used remember-me + authentication provider used to automatically remember the login using + cookies. + + In terms of authorization, to keep things simple we've + configured the tutorial to only perform some basic web filter + authorization. We've wired two common pre-invocation access decision voters, + being the RoleVoter and + AuthenticatedVoter, such that + ROLE_* configuration attributes and + IS_AUTHENTICATED_* configuration attributes may be + used. Of course, it's extremely easy to add in other providers, with + most users probably starting with some services-layer security using + MethodSecurityInterceptor. + + We recommend you start with the tutorial sample, as the XML is + minimal and easy to follow. All of the needed filters are configured properly, and using + best practise. Most importantly, you can easily this one XML file (and + its corresponding web.xml entries) to your existing + application. Only when this basic integration is achieved do we + suggest you attempt adding in method authorization or domain object + security. + diff --git a/samples/tutorial/project.properties b/samples/tutorial/project.properties new file mode 100644 index 0000000000..7b4168ee38 --- /dev/null +++ b/samples/tutorial/project.properties @@ -0,0 +1 @@ +maven.multiproject.type=war diff --git a/samples/tutorial/project.xml b/samples/tutorial/project.xml new file mode 100644 index 0000000000..127f32b37a --- /dev/null +++ b/samples/tutorial/project.xml @@ -0,0 +1,13 @@ + + + ${basedir}/../project.xml + 3 + acegi-security-sample-tutorial + Acegi Security System for Spring - Tutorial sample + /home/groups/a/ac/acegisecurity/htdocs/multiproject/acegi-security-sample-tutorial + + scm:svn:https://svn.sourceforge.net/svnroot/acegisecurity/trunk/acegisecurity + scm:svn:https://svn.sourceforge.net/svnroot/acegisecurity/trunk/acegisecurity + http://svn.sourceforge.net/viewcvs.cgi/acegisecurity/trunk/acegisecurity/samples/tutorial/ + + diff --git a/samples/tutorial/src/webapp/WEB-INF/applicationContext-acegi-security.xml b/samples/tutorial/src/webapp/WEB-INF/applicationContext-acegi-security.xml new file mode 100644 index 0000000000..f64466ea77 --- /dev/null +++ b/samples/tutorial/src/webapp/WEB-INF/applicationContext-acegi-security.xml @@ -0,0 +1,148 @@ + + + + + + + + + + + CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON + PATTERN_TYPE_APACHE_ANT + /**=httpSessionContextIntegrationFilter,logoutFilter,authenticationProcessingFilter,securityContextHolderAwareRequestFilter,rememberMeProcessingFilter,anonymousProcessingFilter,exceptionTranslationFilter,filterInvocationInterceptor + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON + PATTERN_TYPE_APACHE_ANT + /secure/extreme/**=ROLE_SUPERVISOR + /secure/**=IS_AUTHENTICATED_REMEMBERED + /**=IS_AUTHENTICATED_ANONYMOUSLY + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/samples/tutorial/src/webapp/WEB-INF/classes/log4j.properties b/samples/tutorial/src/webapp/WEB-INF/classes/log4j.properties new file mode 100644 index 0000000000..2d22f01b3d --- /dev/null +++ b/samples/tutorial/src/webapp/WEB-INF/classes/log4j.properties @@ -0,0 +1,18 @@ +# Global logging configuration +log4j.rootLogger=WARN, stdout, fileout + +log4j.logger.org.acegisecurity=DEBUG, stdout, fileout + +# Console output... +log4j.appender.stdout=org.apache.log4j.ConsoleAppender +log4j.appender.stdout.layout=org.apache.log4j.PatternLayout +log4j.appender.stdout.layout.conversionPattern=[%p,%c{1},%t] %m%n + +# Rolling log file output... +log4j.appender.fileout=org.apache.log4j.RollingFileAppender +log4j.appender.fileout.File=contacts.log +#log4j.appender.fileout.File=${webapp.root}/WEB-INF/log4j.log +log4j.appender.fileout.MaxFileSize=1024KB +log4j.appender.fileout.MaxBackupIndex=1 +log4j.appender.fileout.layout=org.apache.log4j.PatternLayout +log4j.appender.fileout.layout.conversionPattern=%d{ABSOLUTE} %5p %c{1},%t:%L - %m%n diff --git a/samples/tutorial/src/webapp/WEB-INF/users.properties b/samples/tutorial/src/webapp/WEB-INF/users.properties new file mode 100644 index 0000000000..4332a9055e --- /dev/null +++ b/samples/tutorial/src/webapp/WEB-INF/users.properties @@ -0,0 +1,4 @@ +marissa=koala,ROLE_SUPERVISOR +dianne=emu,ROLE_USER +scott=wombat,ROLE_USER +peter=opal,disabled,ROLE_USER diff --git a/samples/tutorial/src/webapp/WEB-INF/web.xml b/samples/tutorial/src/webapp/WEB-INF/web.xml new file mode 100644 index 0000000000..b5dad47408 --- /dev/null +++ b/samples/tutorial/src/webapp/WEB-INF/web.xml @@ -0,0 +1,54 @@ + + + + + + + + Acegi Security Tutorial Application + + + + contextConfigLocation + + /WEB-INF/applicationContext-acegi-security.xml + + + + + Acegi Filter Chain Proxy + org.acegisecurity.util.FilterToBeanProxy + + targetClass + org.acegisecurity.util.FilterChainProxy + + + + + Acegi Filter Chain Proxy + /* + + + + + org.springframework.web.context.ContextLoaderListener + + + + index.jsp + + + diff --git a/samples/tutorial/src/webapp/accessDenied.jsp b/samples/tutorial/src/webapp/accessDenied.jsp new file mode 100644 index 0000000000..816d4526f8 --- /dev/null +++ b/samples/tutorial/src/webapp/accessDenied.jsp @@ -0,0 +1,16 @@ +<%@ page import="org.acegisecurity.context.SecurityContextHolder" %> +<%@ page import="org.acegisecurity.Authentication" %> +<%@ page import="org.acegisecurity.ui.AccessDeniedHandlerImpl" %> + +

Sorry, access is denied

+ + +

+<%= request.getAttribute(AccessDeniedHandlerImpl.ACEGI_SECURITY_ACCESS_DENIED_EXCEPTION_KEY)%> + +

+ +<% Authentication auth = SecurityContextHolder.getContext().getAuthentication(); + if (auth != null) { %> + Authentication object as a String: <%= auth.toString() %>

+<% } %> diff --git a/samples/tutorial/src/webapp/acegilogin.jsp b/samples/tutorial/src/webapp/acegilogin.jsp new file mode 100644 index 0000000000..eccdc7b0af --- /dev/null +++ b/samples/tutorial/src/webapp/acegilogin.jsp @@ -0,0 +1,45 @@ +<%@ taglib prefix='c' uri='http://java.sun.com/jstl/core' %> +<%@ page import="org.acegisecurity.ui.AbstractProcessingFilter" %> +<%@ page import="org.acegisecurity.ui.webapp.AuthenticationProcessingFilter" %> +<%@ page import="org.acegisecurity.AuthenticationException" %> + + + + Login + + + +

Login

+ +

Valid users: +

+

username marissa, password koala (supervisor) +

username dianne, password emu (normal user) +

username scott, password wombat (normal user) +

username peter, password opal (user disabled) +

+ + <%-- this form-login-page form is also used as the + form-error-page to ask for a login again. + --%> + + + Your login attempt was not successful, try again.

+ Reason: <%= ((AuthenticationException) session.getAttribute(AbstractProcessingFilter.ACEGI_SECURITY_LAST_EXCEPTION_KEY)).getMessage() %> + + + +

+ + + + + + + +
User:value='<%= session.getAttribute(AuthenticationProcessingFilter.ACEGI_SECURITY_LAST_USERNAME_KEY) %>'>
Password:
Don't ask for my password for two weeks
+ +
+ + + diff --git a/samples/tutorial/src/webapp/index.jsp b/samples/tutorial/src/webapp/index.jsp new file mode 100644 index 0000000000..b8c5668259 --- /dev/null +++ b/samples/tutorial/src/webapp/index.jsp @@ -0,0 +1,9 @@ + + +

Home Page

+Anyone can view this page. + +

Secure page +

Extremely secure page + + \ No newline at end of file diff --git a/samples/tutorial/src/webapp/secure/extreme/index.jsp b/samples/tutorial/src/webapp/secure/extreme/index.jsp new file mode 100644 index 0000000000..801e2992ba --- /dev/null +++ b/samples/tutorial/src/webapp/secure/extreme/index.jsp @@ -0,0 +1,9 @@ + + +

VERY Secure Page

+This is a protected page. You can only see me if you are a supervisor. + +

Home +

Logout + + \ No newline at end of file diff --git a/samples/tutorial/src/webapp/secure/index.jsp b/samples/tutorial/src/webapp/secure/index.jsp new file mode 100644 index 0000000000..f9a24e4a08 --- /dev/null +++ b/samples/tutorial/src/webapp/secure/index.jsp @@ -0,0 +1,10 @@ + + +

Secure Page

+This is a protected page. You can get to me if you've been remembered, +or if you've authenticated this session. + +

Home +

Logout + + \ No newline at end of file