Introduction to Spring Security 3/3.1

Mike Wiesner demoes using Spring Security 3 with its new features, such as expression language-based authorization and extensions, to implement authentication and authorization in Java applications. A video recording is available here: http://www.infoq.com/presentations/Spring-Security-3

Transcript

1. SpringOne 2GX 2010. All rights reserved. Do not distribute without permission. Chicago, October 19 - 22, 2010 Introduction to Spring Security 3/3.1 Mike Wiesner - SpringSource
2. Mike Wiesner • Senior Consultant with SpringSource • 10+ years experience in Java • Spring Security Developer • Focus: – Application Security – Integration – Authentication Systems • mwiesner@vmware.com
3. Spring + Security = Spring Security
4. What is Spring Security? • A flexible and powerful Java Enterprise Security Framework • which is build on top of Spring • but can be used for EVERY Java application 4
5. Spring + Authentication + Authorization = Spring Security
6. Spring Security 2.x • Built on Spring 2.0 / Java 1.4 • Successor of the Acegi Security System for Spring • Simpler configuration (Namespace) • Better LDAP support • More Single Sign On options 6
7. Spring Security 3.0 • Built on: Spring 3 / Java 5 • Spring Expression Language support • Extended Namespace support • Simpler API (Array -> Collections, varargs, ...) • Aspect Library for AspectJ weaving • Smaller modules • Fine tuning based on user feedback 7
8. Around Spring Security 3 • Spring Security Extensions – SAML2 (contributed by Vladimir Schäfer) – Kerberos – Start your own! • OAuth for Spring Security (contributed by Ryan Heaton) • Facelets tag library for Spring Security (Web Flow 2.2.0) 8
9. Authentication Highlights • Form • Basic / Digest • JDBC • LDAP • JAAS • JA-SIG CAS • Atlassian Crowd • OpenID • X.509 • JOSSO 9
10. SpringOne 2GX 2009. All rights reserved. Do not distribute without permission. Chicago, October 19 - 22, 2010 Demo Time!
11. Encoding Problems 11 Internet Tomcat Browser File- System ../ %C0%AE%C0%AE%C0%AF
12. Defense in Depth
13. SpringOne 2GX 2009. All rights reserved. Do not distribute without permission. Chicago, October 19 - 22, 2010 Demo Time!
14. Method Security 14 Security Business Caller Service Security Interceptor call call exception security check
15. User Role
16. User Role Right
17. User Role Right
18. User Role Right
19. User Role Right
20. User Role Right Role
21. SpringOne 2GX 2009. All rights reserved. Do not distribute without permission. Chicago, October 19 - 22, 2010 Demo Time!
22. Request requestor from to deletable
23. Request requestor from to deletable
24. Request requestor from to deletable
25. Request requestor from to Secured deletable
26. Request requestor from to Secured deletable AspectJ Request requestor from to deletable
27. SpringOne 2GX 2009. All rights reserved. Do not distribute without permission. Chicago, October 19 - 22, 2010 Demo Time!
28. Kerberos/SPNEGO Client Kerberos Server (e.g. Active Directory) Your web application (1) GET (2) AUTH required (5) GET + Service Ticket (3) Request Service Ticket (4) Return Service Ticket
29. SpringOne 2GX 2009. All rights reserved. Do not distribute without permission. Chicago, October 19 - 22, 2010 Spring Security 3.1
30. SpringOne 2GX 2009. All rights reserved. Do not distribute without permission. Chicago, October 19 - 22, 2010 Q&A Mike Wiesner mwiesner@vmware.com http://git.springsource.org/ s2gx-2010/spring-security-3