Security - In Real Life

Security In Real Life

2 Johannes Schmitt | Security: In Real Life | 07.06.2012
Agenda Introduction Authentication System Authorization System Real Life Use Cases

The authentication system consists of many classes with a distinct purpose FirewallListener FirewallMap

The authentication system consists of many classes with a distinct purpose FirewallListener FirewallMap Listeners

The authentication system consists of many classes with a distinct purpose FirewallListener FirewallMap Listeners Token

The authentication system consists of many classes with a distinct purpose FirewallListener FirewallMap Listeners AuthenticationProvider Token

The authentication system consists of many classes with a distinct purpose FirewallListener FirewallMap Listeners AuthenticationProvider Token UserProvider

The authentication system consists of many classes with a distinct purpose FirewallListener FirewallMap Listeners AuthenticationProvider Token UserProvider Encoder

The authentication system consists of many classes with a distinct purpose FirewallListener FirewallMap Listeners AuthenticationProvider Token UserProvider Encoder UserChecker

The authentication system consists of many classes with a distinct purpose FirewallListener FirewallMap Listeners AuthFailureHandler AuthenticationProvider Token UserProvider Encoder UserChecker

The authentication system consists of many classes with a distinct purpose FirewallListener FirewallMap Listeners AuthFailureHandler AuthenticationProvider Token SessionAuthStrategy UserProvider Encoder UserChecker

The authentication system consists of many classes with a distinct purpose FirewallListener FirewallMap Listeners AuthSuccessHandler AuthFailureHandler AuthenticationProvider Token SessionAuthStrategy UserProvider Encoder UserChecker

The authentication system consists of many classes with a distinct purpose FirewallListener FirewallMap Listeners AuthSuccessHandler AuthFailureHandler AuthenticationProvider Token SessionAuthStrategy RememberMe UserProvider Encoder UserChecker

The authentication system consists of many classes with a distinct purpose FirewallListener FirewallMap Listeners AuthSuccessHandler AuthFailureHandler AuthenticationProvider Token SessionAuthStrategy RememberMe LogoutHandler LogoutSuccessHandler UserProvider Encoder UserChecker

The authorization system consists of many classes with a distinct purpose AccessListener SecurityContext MethodSecurityInterceptor

The authorization system consists of many classes with a distinct purpose AccessListener SecurityContext MethodSecurityInterceptor AccessDecisionManager

The authorization system consists of many classes with a distinct purpose AccessListener SecurityContext MethodSecurityInterceptor AccessDecisionManager Voter

The authorization system consists of many classes with a distinct purpose AccessListener SecurityContext MethodSecurityInterceptor AccessDecisionManager Voter AclVoter RoleVoter AuthenticatedVoter

The authorization system consists of many classes with a distinct purpose AccessListener SecurityContext MethodSecurityInterceptor AccessDecisionManager Voter AclVoter RoleVoter AuthenticatedVoter AclProvider PermissionMap

The authorization system consists of many classes with a distinct purpose AccessListener SecurityContext MethodSecurityInterceptor AccessDecisionManager Voter AclVoter RoleVoter AuthenticatedVoter RoleHierarchy AclProvider PermissionMap

The authorization system consists of many classes with a distinct purpose AccessListener SecurityContext MethodSecurityInterceptor AccessDecisionManager Voter AclVoter RoleVoter AuthenticatedVoter RoleHierarchy AclProvider AuthenticationTrustResolver PermissionMap

The authorization system consists of many classes with a distinct purpose AccessListener SecurityContext MethodSecurityInterceptor AccessDecisionManager Voter AclVoter RoleVoter AuthenticatedVoter RoleHierarchy AclProvider AuthenticationTrustResolver PermissionMap ExpressionVoter

Use Case #1: I want to functionally test my application. How can I test parts that need a logged-in user?

Use Case #2: In my application, I want to customize what happens when access is denied.

ExceptionListener The exception listener can be invoked from any part of your code EntryPoint AccessDeniedHandler Do not write your own exception listener which handles AccessDeniedExceptions! AuthenticationException AccessDeniedException

We only need to adjust specific parts of the security system - AccessDeniedHandler - Configuration

Use Case #3: In my application, I want to use the ACL system. Are there best practices for integrating it?

Use Case #4: In my application, I do not want to use an ORM, but receive all user details via an API.

We only need to adjust specific parts of the security system - AuthenticationProvider - Configuration

Use Case #5: In my application, I want to allow login via AJAX.

We only need to adjust specific parts of the security system - AuthenticationSuccessHandler - AuthenticationFailureHandler - Configuration

Use Case #6: In my application, I want to have localized paths for login.

What needs to be changed? Configuration only!

Use Case #7: In my application, I want to offer multiple login options like Twitter, Facebook, etc. in addition to form login.

We are going to assume the following database schema

We only need to adjust specific parts of the security system - EntryPoint - User Providers - Github User Provider - Twitter User Provider - Id-based User Provider - Email-based User Provider - Configuration

Thanks! Twitter: @JohannesMS Github: schmittjoh http://jmsyst.com/

The authentication system consists of many classes with a distinct purpose FirewallListener FirewallMap Listeners AuthSuccessHandler AuthFailureHandler AuthenticationProvider Token SessionAuthStrategy RememberMe LogoutHandler LogoutSuccessHandler UserProvider Encoder UserChecker

The authorization system consists of many classes with a distinct purpose AccessListener SecurityContext MethodSecurityInterceptor AccessDecisionManager Voter AclVoter RoleVoter AuthenticatedVoter RoleHierarchy AclProvider AuthenticationTrustResolver PermissionMap ExpressionVoter

ExceptionListener The exception listener can be invoked from any part of your code EntryPoint AccessDeniedHandler AuthenticationException AccessDeniedException

Security - In Real Life

Security - In Real Life

More Decks by schmittjoh

Featured

Transcript