Spring Security

Diagram 1 shows the basic flow of an authentication request using the Spring Security system. It shows the different filters and how they interact from the initial browser request, to either a successful authentication or an HTTP 403 error.

File:ACEGI Authentication.JPG

• LDAP (using both bind-based and password comparison strategies) for centralization of authentication information.{{sfn|Deinum|Rubio|Long|Mak|2014}}{{rp|loc=§7-3|pp=358–362}}
• Single sign-on capabilities using the popular Central Authentication Service.
• Java Authentication and Authorization Service (JAAS) LoginModule, a standards-based method for authentication used within Java. Note this feature is only a delegation to a JAAS Loginmodule.{{Cite web |date=December 29, 2024 |title=Master OAuth: How To Build a Secure Authorization Server |url=https://authorization.news/master-oauth-how-to-build-a-secure-authorization-serverpart-ii/ }}
• Basic access authentication as defined through RFC 1945.
• Digest access authentication{{sfn|Deinum|Rubio|Long|Mak|2014}}{{rp|loc=§7-3|pp=356–358}} as defined through RFC 2617 and RFC 2069.
• X.509 client certificate presentation over the Secure Sockets Layer standard.
• CA, Inc SiteMinder for authentication (a popular commercial access management product).
• Su (Unix)-like support for switching principal identity over a HTTP or HTTPS connection.
• Run-as replacement, which enables an operation to assume a different security identity.
• Anonymous authentication, which means that even unauthenticated principals are allocated a security identity.
• Container adapter (custom realm) support for Apache Tomcat, Resin, JBoss and Jetty (web server).
• Windows NTLM to enable browser integration (experimental).
• Web form authentication, similar to the servlet container specification.
• "Remember-me" support via HTTP cookies.
• Concurrent session support, which limits the number of simultaneous logins permitted by a principal.
• Full support for customization and plugging in custom authentication implementations.

• AspectJ method invocation authorization.
• HTTP authorization of web request URLs using a choice of Apache Ant paths or regular expressions.

• Used for specifying access control lists applicable to domain objects.
• Spring Security offers a repository for storing, retrieving, and modifying ACLs in a database.{{sfn|Deinum|Rubio|Long|Mak|2014}}{{rp|loc=§7-7|pp=376–381}}
• Authorization features are provided to enforce policies before and after method invocations.

• Software localization so user interface messages can be in any language.
• Channel security, to automatically switch between HTTP and HTTPS upon meeting particular rules.
• Caching in all database-touching areas of the framework.
• Publishing of messages to facilitate event-driven programming.
• Support for performing integration testing via JUnit.
• Spring Security itself has comprehensive JUnit isolation tests.
• Several sample applications, detailed JavaDocs and a reference guide.
• Web framework independence.

• 2.0.0 (April 2008)
• 3.0.0 (December 2009)
• 3.1.0 (December 7, 2011)
• 3.1.2 (August 10, 2012)
• 3.2.0 (December 16, 2013)
• 4.0.0 (March 26, 2015)
• 4.1.3 (August 24, 2016)
• 4.2.0 (November 10, 2016)
• 3.2.10, 4.1.4, 4.2.1 (December 22, 2016)
• 4.2.2 (March 2, 2017)
• 4.2.3 (June 8, 2017)
• 5.0.0 (November 28, 2017)
• 5.0.8, 4.2.8 (September 11, 2018){{Cite web|url=https://spring.io/blog/2018/09/11/spring-security-5-0-8-and-4-2-8-released|title=Spring Security 5.0.8 and 4.2.8 Released|website=spring.io|access-date=2019-06-09}}
• 5.1.0 GA (September 27, 2018){{Cite web|url=https://spring.io/blog/2018/09/27/spring-security-5-1-goes-ga|title=Spring Security 5.1 goes GA|website=spring.io|access-date=2019-06-09}}
• 5.1.1, 5.0.9, 4.2.9 (October 16, 2018){{Cite web|url=https://spring.io/blog/2018/10/16/spring-security-5-1-1-5-0-9-and-4-2-9-released|title=Spring Security 5.1.1, 5.0.9, and 4.2.9 Released|website=spring.io|access-date=2019-06-09}}
• 5.1.2, 5.0.10, 4.2.10 (November 29, 2018){{Cite web|url=https://spring.io/blog/2018/11/29/spring-security-5-1-2-5-0-10-4-2-10-released|title=Spring Security 5.1.2, 5.0.10, 4.2.10 Released|website=spring.io|access-date=2019-06-09}}
• 5.1.3, 5.0.11, 4.2.11 (January 11, 2019){{Cite web|url=https://spring.io/blog/2019/01/11/spring-security-5-1-3-5-0-11-4-2-11-released|title=Spring Security 5.1.3, 5.0.11, 4.2.11 Released|website=spring.io|access-date=2019-06-09}}
• 5.1.4 (February 14, 2019){{Cite web|url=https://spring.io/blog/2019/02/14/spring-security-5-1-4-released|title=Spring Security 5.1.4 Released|website=spring.io|access-date=2019-06-09}}
• 5.1.5, 5.0.12, 4.2.12 (April 3, 2019){{Cite web|url=https://spring.io/blog/2019/04/03/spring-security-5-1-5-5-0-12-4-2-12-released|title=Spring Security 5.1.5, 5.0.12, 4.2.12 Released|website=spring.io|access-date=2019-06-09}}

{{Reflist}}

• {{cite book

| last1 = Deinum

| first1 = Marten

| last2 = Rubio

| first2 = Daniel

| last3 = Long

| first3 = Josh

| last4 = Mak

| first4 = Gary

| title = Spring Recipes: A Problem-Solution Approach

| publisher = Apress

| edition = Second

| date = September 1, 2014

| page = 1104

| isbn = 978-1-4302-2499-0

}}

• {{cite web|url=https://spring.io/blog/2007/01/25/why-the-name-acegi|title=Why the name Acegi?|website=spring.io}}

• {{Official website|projects.spring.io/spring-security/}}

{{Portal bar|Computer programming}}

Category:Java enterprise platform

Category:Computer access control