Luke Taylor
|
71ab83255d
|
SEC-1242: Check that RememberMeServices is an instance of AbstractRememberMeServices before attempting to inject a UserDetailsService.
|
17 years ago |
|
Luke Taylor
|
fa7404741b
|
SEC-1167: Introduce more flexible SavedRequest handling. Add namespace support for a custom RequestCache through the request-cache element.
|
17 years ago |
|
Luke Taylor
|
aec730ae7e
|
SEC-1238: Disable portlet module
|
17 years ago |
|
Luke Taylor
|
6640eab9dc
|
SEC-1240: Added {ssha} support to PasswordEncoderParser.
|
17 years ago |
|
Luke Taylor
|
d099d14e9b
|
SEC-1235: Added test to attempt to verify (failed to reproduce).
|
17 years ago |
|
Luke Taylor
|
8632946f30
|
SEC-1213: Added "order" atrribute to global-method-security
|
17 years ago |
|
Luke Taylor
|
245fc96137
|
SEC-1075: Update the embedded LDAP server to use Apache DS 1.5. Updated to use the new 1.5.5 release for the embedded server.
|
17 years ago |
|
Luke Taylor
|
2039200617
|
SEC-1217: AbstractRememberMeServices should set 'secure' attribute on remember-me cookie if in secure context. Added "useSecureCookie" configuration property and corresponding use-secure-cookie attribute in namespace.
|
17 years ago |
|
Luke Taylor
|
dbcb13ad14
|
SEC-1229: Redesign Concurrent Session Control implementation. Renamed session strategy interface and introduced SessionAuthenticationException for rejection of session/Authentication combination.
|
17 years ago |
|
Luke Taylor
|
0d7b990e0a
|
SEC-1184: Moved ACL cache classes and interface out of jdbc package.
|
17 years ago |
|
Luke Taylor
|
471206a29d
|
SEC-1229: Redesign Concurrent Session Control implementation. Added ConcurrentSessionControlAuthenticatedSessionStrategy
|
17 years ago |
|
Luke Taylor
|
fe33f08b73
|
SEC-1201: Allow requires-channel attribute to take placeholders.
|
17 years ago |
|
Luke Taylor
|
00352227ac
|
Tidying.
|
17 years ago |
|
Luke Taylor
|
ea01e9cdf7
|
SEC-1201: PropertyPlaceholderConfigurer does not work for intercept-url attributes. Ensure that channel processing handles paths which are placeholders.
|
17 years ago |
|
Luke Taylor
|
9bf8656d66
|
SEC-1201: PropertyPlaceholderConfigurer does not work for intercept-url attributes. Added use of ManagedMaps and BeanDefinitions to support placeholders in the pattern and access attributes.
|
17 years ago |
|
Luke Taylor
|
579644fa95
|
SEC-1225: Use bean references for authentication providers. Updated AuthenticationManagerBDP to regsiter the providers as top level beans.
|
17 years ago |
|
Luke Taylor
|
24911eb606
|
Corrected links in manual, comment in schema file.
|
17 years ago |
|
Luke Taylor
|
5a8772df5b
|
Reset pom versions post release
|
17 years ago |
|
Luke Taylor
|
0e5aa7008d
|
[maven-release-plugin] prepare release spring-security-3.0.0.M2
|
17 years ago |
|
Luke Taylor
|
48988bde84
|
SEC-935: Support for OpenID attribute exchange and changes to namespace syntax to allow simple configuration of attributes to request.
|
17 years ago |
|
Luke Taylor
|
f536c80020
|
SEC-1202: Removed SpringSecurityFilter and replaced with use of GenericFilterBean from spring-web
|
17 years ago |
|
Luke Taylor
|
966f3e4101
|
SEC-1182: Added tst to confirm that this is no longer an issue due to other changes
|
17 years ago |
|
Luke Taylor
|
b4bb489638
|
SEC-1164: Further registering on bean components for tooling and removal of global ids.
|
17 years ago |
|
Luke Taylor
|
b387d63aba
|
Removing unnecessary global bean names.
|
17 years ago |
|
Luke Taylor
|
a67448c867
|
SEC-1216: Remove unused code.
|
17 years ago |
|
Luke Taylor
|
229866e293
|
SEC-1142: Support for session timeout detection. Added namespace support for invalid-session-url
|
17 years ago |
|
Luke Taylor
|
0f6642d3ab
|
SEC-1216: Replacement of custom-after-invocation-provider with after-invocation-provider element. Some changes to help prevent proxying of aop infrastructure classes (use of AopInfrastructureBean marker interface)
|
17 years ago |
|
Luke Taylor
|
eaa0dc4fce
|
typo
|
17 years ago |
|
Luke Taylor
|
e40b9fbc75
|
SEC-1196: Introduce AuthenticationManagerDelegator is MethodSecurityInterceptor which is configured by global-method-security. Prevents regression of SEC-933 caused by eager init of AuthenitcationManager and dependent beans
|
17 years ago |
|
Luke Taylor
|
997faabe1e
|
SEC-1196: Removed ConfigUtils (no longer used).
|
17 years ago |
|
Luke Taylor
|
5953af0f6b
|
SEC-1196: Change use of <authentication-manager> to actually register the global ProviderManager instance. This element now registers the global ProviderManager instance and must contain any authentication-provider elements (or ldap-authentication-provider elements).
|
17 years ago |
|
Luke Taylor
|
c5d6484b54
|
SEC-1210: RememberMe filter misses UserDetailsService in default <http /> tag config when it is declared in parent app context. Fixed by getting the UserDetailsServiceInjectionPostProcessor to check ancestor bean factories for a UserDetailsService if one isn't found in the current bean factory.
|
17 years ago |
|
Luke Taylor
|
160aa512a1
|
Remove "infrastructure" type from authentication provider bean.
|
17 years ago |
|
Luke Taylor
|
6ae61f95db
|
Minor updates to test XML context implementation.
|
17 years ago |
|
Luke Taylor
|
a4a0aab66f
|
SEC-1164: Add additional component definitions so that Spring IDE picks them up and doesn;t report missing bean definitions
|
17 years ago |
|
Luke Taylor
|
5d5df0c63d
|
Added extra 'manual' security interceptor config
|
17 years ago |
|
Luke Taylor
|
3e6054b69f
|
SEC-1211: Rename SessionFixationProtectionFilter to SessionManagementFilter, since it no longer performs session-fixation protection directly, but just executes the AuthenticatedSessionStrategy.
|
17 years ago |
|
Luke Taylor
|
609a68b12a
|
SEC-1077: Added DefaultAuthenticatedSessionStrategy test to check that saved request attribute is retained when migrateAttributes is false.
|
17 years ago |
|
Luke Taylor
|
db90122179
|
SEC-1211: Create strategy for session handling on successful authentication. Added AuthenticatedSessionStrategy interface and default implementation which encapsulates the functionality that was previously in SessionFixationProtectionFilter and AbstractAuthentictationProcessingFilter. Updated the namespace to make use of these.
|
17 years ago |
|
Luke Taylor
|
931cf90dbb
|
SEC-1203: Allow configuration of X509 subject-dn-regex attribute using PropertyPlaceholderConfigurer. Modified parser to use a BeanDefinition for the SubjectPrincipalDnExtractor to allow property subsititution.
|
17 years ago |
|
Luke Taylor
|
8b115e2a21
|
SEC-1167: Added setRequestCache to SavedRequestAwareAuthenticationSuccessHandler and updated namespace parsing to set PortResolver on created HttpRequestCache.
|
17 years ago |
|
Luke Taylor
|
f404bb3d74
|
SEC-1167: Introduce more flexible SavedRequest handling. Separated the concept of SavedRequest from SecurityContextHolderAwareFilter since the two are orthogonal requirements. This no longer takes a wrapper class property or uses reflection. SavedRequest functionality is accessed through the RequestCache interface, with the default implementation being HttpSessionRequestCache. A separate filter RequestCacheAwareFilter is now responsible for reconstituting the SavedRequest if it matches the current request. The functionality for matching and returning the wrapper is contained in the RequestCache method though.
|
17 years ago |
|
Luke Taylor
|
491837ae34
|
SEC-1197: Moved support from session-controller-ref from authentication-manager to concurrent-session-control element. Plus refactoring of config classes into separate packages.
|
17 years ago |
|
Luke Taylor
|
1afa67c954
|
SEC-1195: Added internal AuthenticationManager for use by beans which are generated by the <http> block.
|
17 years ago |
|
Luke Taylor
|
6346e31517
|
SEC-1195: Change <http> parsing behaviour to use an internal AuthenticationManager instance. Implemented "parent" AuthenticationManager in ProviderManager which is delegated to when no authentication is returned by the instances list of authentication providers. Extracted the Authentication success/failure publishing into a separate strategy.
|
17 years ago |
|
Luke Taylor
|
d59bdc0cbc
|
Reducing use of global bean Ids as part of SEC-1186
|
17 years ago |
|
Luke Taylor
|
7622dfe092
|
SEC-1194: Added support for services-alias to remember-me
|
17 years ago |
|
Luke Taylor
|
d02bbbf560
|
import cleaning.
|
17 years ago |
|
Luke Taylor
|
43dab4c3b3
|
SEC-1186: Additional changes to remove custom-filter decorator functionality.
|
17 years ago |
|
Luke Taylor
|
abddcb044a
|
SEC-1186: Remove functionality from CustomFilterBeanDefinitionDecorator and report a warning instead.
|
17 years ago |
