Fast Track to Spring 3 and Spring Web Flow 2.1

Transcription

1 Fast Track to Spring 3 and Spring Web Flow 2.1 on Tomcat/Eclipse LearningPatterns, Inc. Courseware Student Guide

2 This material is copyrighted by LearningPatterns Inc. This content and shall not be reproduced, edited, or distributed, in hard copy or soft copy format, without express written consent of LearningPatterns Inc. Copyright LearningPatterns Inc. For more information about Java Enterprise Java, or related courseware, please contact us. Our courses are available globally for license, customization and/or purchase. LearningPatterns. Inc. Global Courseware Services 55 Wanaque Ave. #188 Pompton Lakes, NJ USA voice fax Java, and all Java-based trademarks and logo trademarks are registered trademarks of Sun Microsystems, Inc., in the United States and other countries. LearningPatterns and its logos are trademarks of LearningPatterns Inc. All other products referenced herein are trademarks of their respective holders.

3 Table Of Contents Fast Track to Spring 3, MVC and Spring Web Flow FAST TRACK TO SPRING 3, SPRING MVC, AND SPRING WEB FLOW... 1 WORKSHOP OVERVIEW... 2 WORKSHOP OBJECTIVES... 3 WORKSHOP AGENDA... 4 TYPOGRAPHIC CONVENTIONS... 5 LABS... 6 RELEASE LEVEL... 7 SESSION 1: INTRODUCTION TO SPRING... 8 LESSON OBJECTIVES... 9 OVERVIEW THE CHALLENGE OF ENTERPRISE APPLICATIONS SHORTCOMINGS OF JAVA/JAVA EE WHAT IS SPRING? THE SPRING MODULES THE SPRING DISTRIBUTION THE SPRING DISTRIBUTION LAB 1.1 SETTING UP THE ENVIRONMENT SPRING INTRODUCTION MANAGING BEANS A BASIC SPRING APPLICATION SOME BEAN CLASSES...42 CONFIGURATION METADATA DECLARING BEANS THE SPRING CONTAINER WORKING WITH SPRING A SIMPLE SPRING EXAMPLE WHY BOTHER? SOME BEANFACTORY METHODS LAB 1.2 HELLO SPRING WORLD DEPENDENCIES AND DEPENDENCY INJECTION DEPENDENCIES BETWEEN OBJECTS EXAMPLE OF A DIRECT DEPENDENCY DEPENDENCY INVERSION PRINCIPAL EXAMPLE OF DEPENDENCY INVERSION EXAMPLE OF DEPENDENCY INVERSION DEPENDENCY INJECTION (DI) IN SPRING DEPENDENCY INJECTION CONFIGURATION DEPENDENCY INJECTION EXAMPLE ADVANTAGES OF DEPENDENCY INJECTION DEPENDENCY INJECTION REDUCES COUPLING LAB 1.3 DEPENDENCY INJECTION REVIEW QUESTIONS LESSON SUMMARY LESSON SUMMARY SESSION 2: MORE ABOUT BEAN PROPERTIES Copyright , LearningPatterns Inc. All rights reserved i

4 LESSON OBJECTIVES WORKING WITH PROPERTIES CONFIGURING VALUE BASED PROPERTIES USING VALUE BASED PROPERTIES PROPERTY CONVERSIONS CONSTRUCTOR INJECTION CONSTRUCTOR ARGUMENT RESOLUTION CONSTRUCTOR ARGUMENT RESOLUTION CONSTRUCTOR ARGUMENT RESOLUTION SETTER INJECTION VS. CONSTRUCTOR INJECTION SETTER INJECTION VS. CONSTRUCTOR INJECTION LAB 2.1 SPRING CONFIGURATION COLLECTION VALUED PROPERTIES WORKING WITH COLLECTIONS COLLECTION PROPERTY EXAMPLE CONFIGURING <LIST> AND <SET> PROPERTIES CONFIGURING COLLECTION OF BEAN REFERENCES MAP VALUED PROPERTIES JAVA.UTIL.PROPERTIES VALUED PROPERTIES LAB 2.2 COLLECTION VALUED PROPERTIES ADDITIONAL CAPABILITIES FACTORY METHODS INSTANCE FACTORY METHODS BEAN ALIASES BEAN DEFINITION INHERITANCE INHERITANCE EXAMPLE AUTOWIRING AUTOWIRING BYNAME EXAMPLE AUTOWIRING BYTYPE PROS AND CONS OF AUTOWIRING TO AUTOWIRE OR NOT TO AUTOWIRE REVIEW QUESTIONS LESSON SUMMARY LESSON SUMMARY SESSION 3: THE SPRING CONTAINER AND API LESSON OBJECTIVES APPLICATIONCONTEXT APPLICATIONCONTEXT INTERFACE APPLICATIONCONTEXT IMPLEMENTATIONS CONSTRUCTORS USING AN APPLICATIONCONTEXT SPRING RESOURCE ACCESS BUILT-IN RESOURCE IMPLEMENTATIONS LAB 3.1 WORKING WITH APPLICATIONCONTEXTS BEAN SCOPE AND LIFECYCLE BEAN SCOPE SPECIFYING BEAN SCOPE INNER BEANS COMPOUND NAMES DEPENDS ON Copyright , LearningPatterns Inc. All rights reserved ii

5 BEAN CREATION LIFECYCLE BEAN CREATION LIFECYCLE DETAILS USING THE LIFECYCLE INTERFACES FOR BEANS BEAN DESTRUCTION LIFECYCLE BEANPOSTPROCESSOR EVENT HANDLING LAB 3.2 BEAN LIFECYCLE MESSAGESOURCES ISSUES WITH MESSAGES RESOURCE BUNDLES DEFINING RESOURCE BUNDLES USING RESOURCE BUNDLES AND MESSAGESOURCE LOCALIZATION / INTERNATIONALIZATION PARAMETERIZING MESSAGES LAB 3.3 MESSAGESOURCES ANNOTATION DRIVEN CONFIGURATION ANNOTATIONS IN SPRING ENABLING SPRING ANNOTATIONS... AND AUTO-DETECTING BEANS DI 171 COMPLETE DECLARATIONS USING ANNOTATIONS OTHER STEREOTYPE ANNOTATIONS... - ADDITIONAL USES... EXAMPLES QUALIFIERS LIFECYCLE ANNOTATIONS XML CONFIG - ANNOTATIONS AND SCANNING ANNOTATION CONFIGURATION - PRO / CON A NOTE ON THE XML CONFIGURATION A BRIEF NOTE ON ANNOTATIONS ANNOTATION DEFINITION EXAMPLE LAB 3.4 SPRING ANNOTATIONS JAVA-BASED CONFIGURATION JAVA CONFIGURATION OVERVIEW USING JAVA-BASED CONFIGURATION DEPENDENCY INJECTION MORE ON HOW IT WORKS DEPENDENCIES BETWEEN CONFIGURATION CLASSES OTHER USAGE SCENARIOS CLASSPATH SCANNING CAPABILIITES JAVA-BASED CONFIGURATION - PRO / CON [OPTIONAL] LAB 3.5 JAVA-BASED CONFIG OTHER CAPABILITIES SPEL: SPRING EXPRESSION LANGUAGE OTHER SPEL CAPABILITIES VALIDATION USING VALIDATION CONFIGURING VALIDATION VALIDATION CONSTRAINTS Copyright , LearningPatterns Inc. All rights reserved iii

6 ADDITIONAL CAPABILITIES REVIEW QUESTIONS LESSON SUMMARY SESSION 4: DATABASE ACCESS WITH SPRING LESSON OBJECTIVES ISSUES WITH JDBC PROBLEMS USING JDBC DIRECTLY LET'S REVIEW SOME SIMPLE JDBC USAGE SIMPLE QUERY ON THE DATABASE PROBLEMS WITH THE PREVIOUS APPROACH SPRING SUPPORT FOR THE DAO PATTERN SPRING DAO SUPPORT THE SPRING DATABASE API THE JDBCTEMPLATE CLASS THE JDBCDAOSUPPORT CLASS DATASOURCES SPRING JDBC EXCEPTION HIERARCHY DAO BASED ON SPRING CLASSES AN EXAMPLE OF USING JDBCDAOSUPPORT CONFIGURING A DATASOURCE EXAMPLE USING THE DAO LOOKING UP A DATASOURCE IN JNDI BUILDING A DAO WITHOUT THE SUPPORT CLASS LAB 4.1 SPRING JDBC QUERIES AND UPDATES QUERYING WITH JDBCTEMPLATE EXAMPLE USING QUERYFORINT() MAPPING RESULT ROWS TO OBJECTS DEFINING A ROWMAPPER CLASS QUERY EXAMPLE USING A ROW MAPPER EXAMPLE USING THE DAO INSERTING/UPDATING ANOTHER INSERT EXAMPLE OTHER KINDS OF QUERY METHODS THE SIMPLEJDBCTEMPLATE CLASS LAB 4.2 QUERYING [OPTIONAL] USING SPRING WITH HIBERNATE HIBERNATE OVERVIEW TYPICAL HIBERNATE CONFIGURATION FILE USING HIBERNATE DIRECTLY SPRING SUPPORT FOR HIBERNATE TEMPLATE SUPPORT FOR HIBERNATE LOCALSESSIONFACTORYBEAN CONFIGURING A HIBERNATE SESSION FACTORY CONTEXTUAL SESSIONS SPRING FREE DAO WHAT APPROACH TO USE [OPTIONAL] USING SPRING WITH JPA TEMPLATE SUPPORT FOR JPA SUPPORT FOR MANAGING ENTITYMANAGER Copyright , LearningPatterns Inc. All rights reserved iv

7 LOCALENTITYMANAGERFACTORYBEAN OBTAINING AN ENTITYMANAGER FROM JNDI LOCALCONTAINERENTITYMANAGERFACTORYBEAN CONTAINER-MANAGED ENTITYMANAGER ADDITIONAL SPRING CONFIGURATION SPRING CONFIGURATION EXAMPLE JPA DATA ACCESS OBJECT EXTENDED PERSISTENCE CONTEXT [OPTIONAL] LAB 4.3 INTEGRATING SPRING AND JPA REVIEW QUESTIONS LESSON SUMMARY SESSION 5: ASPECT ORIENTED PROGRAMMING LESSON OBJECTIVES OVERVIEW THE ISSUE WITH CROSSCUTTING CONCERNS CROSSCUTTING ILLUSTRATED ASPECT ORIENTED PROGRAMMING (AOP) DEFINED SPRING AOP INTRODUCTION SPRING AOP WITH ASPECTJ ANNOTATIONS DEFINING AN ASPECT 309 DEFINING A POINTCUT DEFINING ADVICE CONFIGURING SPRING A PROGRAM THAT TRIGGERS ADVICE MORE ON HOW SPRING AOP WORKS LAB 5.1 HELLO AOP WORLD POINTCUT EXPRESSIONS AND ADVICE POINTCUT EXPRESSIONS SAMPLE EXECUTION DESIGNATOR PATTERNS SAMPLE EXECUTION DESIGNATOR PATTERNS OTHER DESIGNATORS AVAILABLE IN SPRING AOP SAMPLE DESIGNATOR PATTERNS COMBINING POINTCUT EXPRESSIONS KINDS OF ADVICE ADVICE EXAMPLES AROUND EXAMPLE AROUND EXAMPLE LAB 5.2 MORE SPRING AOP XML BASED AOP SUPPORT DEFINING ASPECTS USING XML AOP XML CONFIGURATION EXAMPLE SPECIFYING ADVICE WITH XML LAB 5.3 USING AOP XML CONFIGURATION [OPTIONAL] [OPTIONAL] LAB 5.3 XML CONFIGURATION OTHER CONSIDERATIONS SPRING PROXIES AND DIRECT INVOCATION EXAMPLE INVOKING DIRECTLY EXAMPLE INVOKING DIRECTLY MORE ON SPRING PROXIES ISSUES WITH AOP Copyright , LearningPatterns Inc. All rights reserved v

8 ISSUES WITH AOP IS AOP WORTH IT? OTHER AOP CAPABILITIES AND FUNCTIONALITY REVIEW QUESTIONS LESSON SUMMARY LESSON SUMMARY SESSION 6: TRANSACTIONS LESSON OBJECTIVES OVERVIEW TRANSACTION OVERVIEW TRANSACTION LIFECYCLE SPRING TRANSACTION MANAGEMENT TRANSACTION MANAGERS CONFIGURING TRANSACTION MANAGERS JTA TRANSACTION MANAGER SPRING DECLARATIVE TRANSACTION MANAGEMENT TRANSACTIONAL SCOPE TRANSACTION ATTRIBUTES FOR PROPAGATION MANDATORY NESTED NEVER NOT_SUPPORTED REQUIRED REQUIRES_NEW SUPPORTS TRANSACTION EXAMPLE TRANSACTION ATTRIBUTES SOME CHOICES TRANSACTION ATTRIBUTES - SOME CHOICES SPECIFYING TRANSACTION ATTRIBUTES SPECIFYING TRANSACTION ATTRIBUTES ADDITIONAL TRANSACTIONAL ATTRIBUTES ROLLING BACK AND EXCEPTIONS XML CONFIGURATION SPECIFYING TRANSACTIONS USING XML LINKING ADVICE WITH POINTCUTS <TX:METHOD> ATTRIBUTES LAB 6.1 SPRING TRANSACTIONS REVIEW QUESTIONS LESSON SUMMARY SESSION 7: WEB APPLICATIONS WITH SPRING MVC LESSON OBJECTIVES INTEGRATION WITH JAVA EE SPRING AND JAVA EE JAVA EE WEB APPLICATIONS WEB APPLICATION STRUCTURE WEB APPLICATION COMPONENTS APPLICATIONCONTEXT AND WEB APPS CONFIGURING CONTEXTLOADERLISTENER USING THE APPLICATION CONTEXT LAB 7.1 SPRING AND THE WEB Copyright , LearningPatterns Inc. All rights reserved vi

9 SPRING MVC BASICS WHAT IS SPRING MVC? MVC ARCHITECTURE MVC PATTERN FLOW SPRING MVC ARCHITECTURE SIMPLE SEARCH APP MODEL - SERVLETS/JSP SIMPLE SEARCH APP MODEL - SPRING MVC DISPATCHERSERVLET DISPATCHERSERVLET INITIALIZATION CONTROLLERS A VERY SIMPLE CONTROLLER CONTROL FLOW LAB 7.2 SPRING MVC BASICS... PARAMETER BINDING RETURNING MODEL DATA THE ASSOCIATED JSP PAGES OTHER HANDLER METHOD CAPABILITIES EXAMPLE OTHER HANDLER CAPABILITIES LAB 7.3 PARAMETERS AND MODELS VIEW RESOLVERS CONTROLLER WITH LOGICAL NAMES OTHER VIEW RESOLVERS LAB 7.4 VIEW RESOLVERS FORMS AND COMMAND OBJECTS SPRING MVC FORM TAGS A JAVABEAN COMMAND CLASS WORKING WITH MODEL CLASSES REQUEST HANDLING FLOW EXPOSING REFERENCE DATA IN THE MODEL LAB 7.5 FORMS AND COMMAND OBJECTS PRE-ANNOTATION BASED CONFIGURATION MVC WITHOUT ANNOTATIONS COMMAND CONTROLLERS CONFIGURING THE COMMAND CONTROLLER WORKING WITH FORMS DEFINING A FORMCONTROLLER DEFINING A FORMCONTROLLER CONFIGURING A FORM CONTROLLER RENDERING THE FORM VIA SPRING MVC HANDLERMAPPINGS SUMMARY NON-ANNOTATION METHOD REVIEW QUESTIONS LESSON SUMMARY LESSON SUMMARY SESSION 8: SPRING SECURITY OVERVIEW SPRING SECURITY SPRING WEB SECURITY - WEB.XML SPRING WEB SECURITY - SPRING CONFIGURATION SPRING WEB SECURITY - SPRING CONFIGURATION MORE <HTTP> CAPABILITIES OTHER AUTHENTICATION PROVIDERS LAB 8.1 SPRING WEB SECURITY Copyright , LearningPatterns Inc. All rights reserved vii

10 METHOD SECURITY METHOD SECURITY - ANNOTATIONS METHOD SECURITY - POINTCUT EXPRESSIONS METHOD SECURITY - XML CONFIGURATION LAB 8.2 METHOD SECURITY SESSION 9: INTRODUCING SPRING WEB FLOW LESSON OBJECTIVES SPRING WEB FLOW OVERVIEW THE NEED FOR SPRING WEB FLOW WHAT IS SPRING WEB FLOW? BENEFITS OF SPRING WEB FLOW OVERVIEW OF A FLOW IN SWF ELEMENTS OF A FLOW DEFINING A FLOW DEFINING FLOWS ELEMENTS OF A FLOW DEFINITION HOW A FLOW WORKS START STATE HOW A FLOW WORKS - TRANSITION HOW A FLOW WORKS END STATE HOW A FLOW WORKS WEB PAGES HOW A FLOW WORKS WEB PAGES HOW A FLOW WORKS WEB PAGES LEAVING A FLOW LAB 9.1 SPRING WEB FLOW BASICS BASIC SYSTEM CONFIGURATION CONFIGURING SPRING WEB FLOW CONFIGURING A FLOW REGISTRY INTEGRATING WITH SPRING MVC CUSTOMIZING THE FLOW REGISTRY COMPLETE APPLICATION CONTEXT CONFIGURATION COMPLETE APPLICATION CONTEXT CONFIGURATION COMPLETE APPLICATION CONTEXT CONFIGURATION OVERALL REQUEST FLOW LAB 9.2 SPRING WEB FLOW CONFIGURATION WORKING WITH DATA AND ACTIONS DATA AVAILABLE TO A FLOW FLOW INSTANCE VARIABLES IN FLOW DEFINITIONS BINDING MODEL OBJECTS TO VIEWS VIEW PAGES AND MODEL BINDING FLOW INPUTS IN FLOW DEFINITIONS ACTIONS AND PROGRAMMING IN FLOW DEFINITIONS EXAMPLE OF ACTION: <SET> EXAMINING AN ACTION: <SET> LAB 9.3 USING ACTIONS IN A FLOW REVIEW QUESTIONS LESSON SUMMARY LESSON SUMMARY SESSION 10 : MORE ON SPRING WEB FLOW LESSON OBJECTIVES Copyright , LearningPatterns Inc. All rights reserved viii

11 THE SPRING EXPRESSION LANGUAGE EL SYNTAX MORE ON SPEL EXPRESSIONS EL LITERALS AND IMPLICIT OBJECTS EL IMPLICIT OBJECTS EXAMPLES OF EL EXPRESSIONS FLOW CONTROL USING EL EXPRESSIONS LAB 10.1 ADDING A SHOPPING CART DATA SCOPES VARIABLE SCOPES POST REDIRECT GET IDIOM REQUEST VS. FLASH SCOPE FLOW SCOPE CONVERSATION SCOPE, AND SUBFLOWS SESSION SCOPE ACCESSING THE SCOPES WITHIN A FLOW LAB 10.2 USING SESSION SCOPED DATA FLOW LANGUAGE ELEMENTS OVERVIEW OF LANGUAGE ELEMENTS OVERVIEW OF ACTION RELATED ELEMENTS OVERVIEW OF OTHER ELEMENTS <ACTION-STATE> ROUTING DECISION-STATE ON-* ACTIONS CONFIGURING SECURITY LAB 10.3 ADDING MORE BEHAVIOR REVIEW QUESTIONS LESSON SUMMARY LESSON SUMMARY SESSION 11: PROGRAMMING WITH SPRING WEB FLOW LESSON OBJECTIVES CREATING CUSTOM ACTIONS PROGRAMMING YOUR OWN ACTIONS EXAMPLE: DEFINING A CUSTOM ACTION THE REQUESTCONTEXT THE EXTERNALCONTEXT USING A CUSTOM ACTION LAB 11.1 CUSTOM ACTIONS VALIDATION AND ERROR REPORTING VALIDATING A MODEL DEFINING A VALIDATOR METHOD IN THE MODEL VALIDATION AND VALIDATIONCONTEXT THE MESSAGECONTEXT USING VALIDATION VALIDATION AT WORK DEFINING A VALIDATOR CLASS RESOURCE BUNDLES PARAMETERIZING ERROR MESSAGES LAB 11.2 VALIDATION CONVERTERS Copyright , LearningPatterns Inc. All rights reserved ix

12 DATA CONVERSION IN SPRING WEB FLOW DEFINING A CONVERTER REGISTERING A CONVERTER USING SUBFLOWS USING SUBFLOWS BRANCHING ON SUBFLOW END-STATE USING INPUT/OUTPUT VARIABLES USING INPUT/OUTPUT VARIABLES USING CONVERSATION SCOPE USING CONVERSATION SCOPE WHEN TO USE SUBFLOWS LAB 11.3 SUBFLOWS REVIEW QUESTIONS LESSON SUMMARY LESSON SUMMARY RECAP RECAP OF WHAT WE'VE DONE WHAT ELSE IS THERE RESOURCES Copyright , LearningPatterns Inc. All rights reserved x

13 Introduction Fast Track to Spring 3, Spring MVC, and Spring Web Flow The Java Developer Education Series Copyright LearningPatterns Inc. All rights reserved. 1

14 Introduction Workshop Overview This is an in-depth course covering the use of the Spring 3 framework to build enterprise applications using Java The course, at a high level, covers the following areas of Spring technology Core features of Spring Data Access Features Aspect Oriented Programming (AOP) Transaction Support Web Application Support including Spring Web Flow Spring Security Copyright LearningPatterns Inc. All rights reserved. 2

15 Introduction Workshop Objectives At completion you should understand the Spring framework, and use its capabilities in the following areas: Spring Core: Understand and use Dependency Injection (DI) and the Spring container to manage the lifecycles of your application objects and the dependencies between them Be able to use the Spring API and configuration metadata (both XML and annotation based) to write Spring programs Data Access: Program data access code using Spring's Jdbc or Hibernate templates and create DAOs (Data Access Objects) using its DAO support AOP: Use Spring's AOP (Aspect Oriented Programming) capabilities to easily inject crosscutting concerns into your program Especially using the annotation based configuration Transactions: Control transactions declaratively with Spring Use the Spring annotations and XML configuration elements Web: Integrate Spring with Web applications and understand the structure and basic use of Spring MVC and Spring Web Flow Security: Understand the architecture and basic use of Spring Security Copyright LearningPatterns Inc. All rights reserved. 3

16 Introduction Workshop Agenda Session 1: Introduction to Spring Session 2: More About Bean Properties Session 3: The Spring Container and API Session 4: Database Access With Spring Session 5: Aspect Oriented Programming (AOP) Session 6: Transactions Session 7: Web Applications with Spring MVC Session 8: Spring Security Overview Session 9: Introducing Spring Web Flow Session 10: More on Spring Web Flow Session 11: Programming with Spring Web Flow Copyright LearningPatterns Inc. All rights reserved. 4

17 Introduction Typographic Conventions Code that is inline in the text will appear in a fixed-width code font, such at this: JavaTeacher teacher = new JavaTeacher() Any class names, such as JavaTeacher, method names, or other code fragments will also appear in the same font If we want to emphasize a particular piece of code, we'll also bold it (and in the slide, change it's color) such as BeanFactory Filenames will be in italics, such as JavaInstructor.java We sometimes denote more info in the notes with a star * Lastly, longer code examples will appear in a separate code box as shown below package com.javatunes.teach; public class JavaInstructor implements Teacher { public void teach() { System.out.println("BeanFactories are way cool"); } } * If we had additional information about a starred item in the slide, it would appear here in the notes We might also put other related information that generally pertains to the material in the slide Copyright LearningPatterns Inc. All rights reserved. 5

18 Introduction Labs Lab The workshop consists of approximately 50% discussion, 50% hands-on lab exercises, including a series of brief labs Many of the labs follow a common fictional case study - JavaTunes, an online music store The labs are contained directly in the course book, and have detailed instructions on what needs to be done The course includes setup zip files that contain skeleton code for the labs Students just need to add code for the particular capabilities that they are working with There is also a solution zip file that contains completed lab code Lab slides contain an icon like the one in the upper right corner of this slide The end of each lab is clearly marked with a stop like this one to the right STOP Copyright LearningPatterns Inc. All rights reserved. 6

19 Introduction Release Level Lab This manual has been tested with and contains instructions for running the labs using the following platforms: Spring 3.0 (tested with 3.0.2) Spring Security 3.0 (tested with 3.0.2) Spring Web Flow 2.1 (tested with 2.1 RELEASE) Java 5 or Java 6 Eclipse Java EE Edition (Ganymede/3.4 or Galileo/3.5) Tomcat 6.0.x for the Spring/Web material Most recent similar versions of most of the software will likely work except for potentially small configuration changes For example, another 3.0.x version of Spring or a later version of Eclipse or Tomcat At the time of this writing, Spring Web Flow 2.1 was at an early release It integrates the Spring Expression language into Spring Web Flow SWF development is lagging behind Spring 3 - SWF 3 is just under very preliminary development All labs have been tested on Microsoft Windows XP using the software listed above The labs should work on Unix with little modification, except for the database setup scripts, which would need to be redone for the Unix shell Copyright LearningPatterns Inc. All rights reserved. 7

20 Session 1: Introduction to Spring Session 1: Introduction to Spring Overview Spring Introduction Dependency Injection Copyright LearningPatterns Inc. All rights reserved. 8

21 Session 1: Introduction to Spring Lesson Objectives Understand why we need something like the Spring Framework Understand what the Spring framework is, and how it simplifies the development of enterprise applications using Java Learn how Spring uses configuration information and Dependency Injection (DI) to manage the beans (objects) in an application Copyright LearningPatterns Inc. All rights reserved. 9

22 Session 1: Introduction to Spring Overview Overview Spring Introduction Dependency Injection Copyright LearningPatterns Inc. All rights reserved. 10

23 Session 1: Introduction to Spring The Challenge of Enterprise Applications Enterprise applications have many complex requirements which makes them difficult to write Many object types, with complex dependencies between them Persistent data to be retrieved from and stored to a data store Transactional requirements Remote (distributed) access requirements Web access requirements Java/Java EE (Enterprise Edition) has many capabilities to build these enterprise applications Java SE defines basic building blocks like Java primitives and core libraries like Collections Java EE defines a large suite of technologies for building enterprise applications - e.g. EJB and JDBC However, there are shortcomings to the Java solution There really is no formal definition of an enterprise application Typically though, some of the characteristics they have are: Used in a business environment, often in business-critical domains Have some form of persistent storage Have some form of remote access (Web/HTTP, Web service, Distributed Objects, etc) Require some measure of scalability and fault tolerance The definition of enterprise application is not important Many Java applications share some of the requirements that we are outlining here Copyright LearningPatterns Inc. All rights reserved. 11

24 Session 1: Introduction to Spring Shortcomings of Java/Java EE Java/Java EE can have significant shortcomings, including: Basic Java has little support for managing the lifecycle of your objects and the dependencies between them Managing large numbers of objects requires significant effort The Java EE platform is quite large and requires a fairly heavyweight application server Even if you are not using most of the capabilities of Java EE, the application server generally supports all of them Java EE has been difficult to use, and intrusive in its design For example, using Enterprise JavaBeans (EJB) required you to write business classes that implemented a specific API This is changing, and newer releases, such as EJB 3, are less intrusive Though rich in functionality, due to its complexity, and the complexity of the systems being written, Java / Java EE can have a number of shortcomings for writing these systems These programs are composed of many collaborating objects and technologies, which require significant effort to manage There are many design guidelines to help you with managing the collaboration of objects Best practices, design patterns, etc. These help you create a good design to make it easier to write and maintain your program However, these still require that you write the code that manages the collaboration of objects The newer Java and Java EE technologies have started to address the ease of use issue The use of Java annotations (introduced in Java 5), new versions of existing technologies (such as EJB 3), and completely new technologies such as JavaServer Faces (JSF) have made it significantly easier to use Java Copyright LearningPatterns Inc. All rights reserved. 12

25 Session 1: Introduction to Spring What is Spring? Spring is a lightweight framework for building enterprise applications It is "lightweight" in the sense that it is non-intrusive in your programming, and allows you to use only those parts you need It includes the following capabilities A Dependency Injection (Inversion of Control) / container to manage objects and their dependencies A DAO package that abstracts JDCB and simplifies its use An ORM package providing integration with technologies such as Hibernate and JPA (Java Persistence API) An AOP package for doing aspect-oriented programming A Web package to integrate with Web technologies An MVC package that provides a full Model-View-Controller based Web framework for Web applications A security framework for authentication and authorization DAO stands for Data Access Object ORM stands for Object-Relational Mapping Copyright LearningPatterns Inc. All rights reserved. 13

26 Session 1: Introduction to Spring The Spring Modules Module diagram from the Spring Reference Documentation, Sec. 1.2 Copyright LearningPatterns Inc. All rights reserved. 14

27 Session 1: Introduction to Spring The Spring Distribution The Spring home page is Spring can be downloaded from this site The framework is distributed as a set of zip files Generally speaking, each module is packaged in its own zip Spring also has a large number of dependencies on other technologies For example, commons logging, log4j, and many others There is a core download which has the spring jars for all the modules, a reference manual, and API docs There is a dependencies download which has all the jars spring depends on it is much larger than the basic download You can download the distribution from As of the Spring 2.5 release, the Spring security framework is a separate download from the regular Spring distribution Copyright LearningPatterns Inc. All rights reserved. 15

28 Session 1: Introduction to Spring The Spring Distribution Below left, you can see the directory structure of the core distribution Below right, you can see the jars in the dist directory, and at bottom the contents of the docs directory Copyright LearningPatterns Inc. All rights reserved. 16

29 Lab 1.1: Setting Up the Environment Lab 1.1 Setting Up the Environment Copyright LearningPatterns Inc. All rights reserved. 17

30 Lab 1.1: Setting Up the Environment Lab 1.1 Set up the Environment Lab Overview: In this lab, we will become familiar with the lab structure, set up our working environment, and test it to make sure it is running well The end goal is to compile and run an application that requires the Spring libraries Objectives: Become familiar with the lab structure Set up our environment Write and run a simple application that requires Spring Builds on previous labs: None Approximate Time: minutes Copyright LearningPatterns Inc. All rights reserved. 18

31 Lab 1.1: Setting Up the Environment Information Content and Task Content Lab Within a lab, information only content is presented in the normal way the same as in the student manual pages Like these bullets at the top of the page Tasks that the student needs to perform are in a box with a slightly different look to help you identify them An example appears below Tasks to Perform Look at these instructions, and notice the different look of the box as compared to that above Make a note of how it looks, as future labs will use this format OK Now get out your setup CD; we're ready to start working Copyright LearningPatterns Inc. All rights reserved. 19

32 Lab 1.1: Setting Up the Environment Setup Environment Lab Tasks to Perform Make sure that Spring 3.0 is installed likely in a directory such as C:\spring-framework RELEASE If it's been installed in a different directory, you'll need to modify the instructions in the lab to refer to your install directory If it isn't installed, you'll need to download it (from and unzip it Make sure that you have Java 5 (or later) installed Java 5 is most likely installed in a directory like C:\Program Files\Java\jdk1.5.x If not, you'll need to install it It can be downloaded from: You will need Java 5 or later for this course, as Spring 3 depends on Java 5 annotations Earlier versions of Spring were usable with older Java versions, but Spring 3 added a dependency on Java 5 In general, Java 5 is becoming more of a requirement, as frameworks adopt its technologies Copyright LearningPatterns Inc. All rights reserved. 20

33 Lab 1.1: Setting Up the Environment Extract the Lab Setup Zip File Lab To set up the labs, you'll need the course setup zip file * It has a name like: Spring_LabSetup_.zip Our base working directory for this course will be C:\StudentWork\Spring This directory will be created when we extract the Setup zip It includes a directory structure and files (e.g., Java files, XML files, other files) that will be needed in the labs All instructions assume that this zip file is extracted to C:\. If you choose a different directory, please adjust accordingly Tasks to Perform Unzip the lab setup file to C:\ This will create the directory structure, described in the next slide, containing files that you will need for doing the labs The setup zip will either be given to you on a CD or supplied by your instructor The nnnn stands for the version number of the course The CD may also contain additional folders with extra content InstallFiles: Extra software install files (e.g. simple editor) Resources: Documentation, specifications, etc. Which extra files are supplied will vary based on space limitations Copyright LearningPatterns Inc. All rights reserved. 21

34 Lab 1.1: Setting Up the Environment Lab Directory Structure Lab StudentWork\Spring\workspace will contain the following folders: common: shared files LabNN : Directory for Lab NN LabNN/bin/ : compiled code (we use this to be Eclipse compatible) LabNN/src/ : Java source StudentWork\Spring contains Derby: Database files LabSetup: files needed for lab work LabNN: directory for any lab with additional setup files Resources : Extra files (e.g. docs) To make it easier to open command windows in the lab dirs, we've included a utility in the setup that allows you to right click on a folder to open a command prompt in it To install this: Go to the Resources/CommandPromptHere folder Right click on the.reg file there, and select Merge Once you've done that, right clicking on a folder will show a Command Prompt Here selection in the context menu - Select that to open a command prompt in the directory Copyright LearningPatterns Inc. All rights reserved. 22

35 Lab 1.1: Setting Up the Environment General Instructions Lab The root lab directory where you will do your work for this lab is: C:\StudentWork\Spring\workspace\Lab01.1 This directory already exists in your workspace you'll need to edit files under this directory, and build the application from within this directory In general, all the files you will work on for a lab will be under the root directory (and instructions are given relative to this directory) Detailed instructions are included in this lab They include complete instructions for working in the Eclipse environment, as well as details about the lab requirements Subsequent labs require you to do the same thing as this lab to build/run, so they include fewer detailed instructions on how to do so Copyright LearningPatterns Inc. All rights reserved. 23

36 Lab 1.1: Setting Up the Environment The Eclipse Development Environment Lab Eclipse is an open source platform for building integrated development environments (IDEs) Used mainly for Java development Can be extended via plugins to create applications useful in many areas (e.g. C# programming) is the main website The remainder of this lab gives detailed instructions on using Eclipse to run the labs Starting it, creating and configuring projects, etc. The other labs in the course include fewer specific details regarding Eclipse they may just say build/run as previously For these labs, you should use the same procedures to build/run as in this lab Refer back to these lab instructions as needed The Eclipse source base was originally developed by IBM It was released by IBM into open source IBM's RAD (and previously its WSAD) environment is built on top of Eclipse Copyright LearningPatterns Inc. All rights reserved. 24

37 Lab 1.1: Setting Up the Environment Launch Eclipse Lab Tasks to Perform To launch eclipse, go to c:\eclipse and run eclipse.exe A dialog box should appear prompting for workbench location Set the workbench location to C:\StudentWork\Spring\workspace If a different default Workbench location is set, change it Click OK In the window that opens, click the Workbench icon (see notes) If Eclipse was installed elsewhere, adjust the paths to the Eclipse executable accordingly You can put a shortcut to this executable on your desktop The workbench icon is in different places in Eclipse 3.4 (below on left) and 3.5 (below on right) Copyright LearningPatterns Inc. All rights reserved. 25

38 Lab 1.1: Setting Up the Environment Workbench and Java Perspective Lab Tasks to Perform You'll likely be in a Java EE perspective * If in a Java EE perspective, open a Java one by clicking the Perspective icon at the top right of the Workbench, and select Java (as shown below left) Close the Java EE perspective by right clicking its icon, and selecting close (as shown below right) If you were in a Java perspective, then just remain in it The Eclipse Java EE version opens in the Java EE perspective by default If you're using the Basic version, it will open in the Java perspective In that case, you don't need to switch perspectives, and there is nothing for you to do Note that you'll need the Eclipse Java EE version for the Web and Security labs Copyright LearningPatterns Inc. All rights reserved. 26

39 Lab 1.1: Setting Up the Environment Unclutter the Workbench Lab Tasks to Perform Let's unclutter the Java Perspective by closing some views Close the Task List, Outline and Hierarchy views (click on the X) Open the Navigator View (Window Show View Navigator) You can save this as the default if you want (see note) To save the perspective as the default Java perspective go to Window Save Perspective As Java You can reset the perspective to it's defaults via Window Reset Perspective Copyright LearningPatterns Inc. All rights reserved. 27

40 Lab 1.1: Setting Up the Environment Create User Libraries Lab We'll need to include a number of Spring jars in our classpath We'll set these up as a user library for ease of use Tasks to Perform Go to Window Preferences Java Build Path User Libraries Click New, in the next dialog, call the library Spring, and press OK Click the Add JARs button, browse to <spring>\dist *, select (org.springframework.)beans-*.jar, core-*.jar, and click OK (see notes) Select the Spring library again, click Add JARs again, and browse to <spring>\projects\spring-build\lib\ivy Add in commons-logging.jar (which the core container depends on) Select the Spring library again, click Add JARs, and browse to workspace\common\lib Add in the log4j jar file (see notes) Those are all the jars you need for the core functionality <spring> stands for the directory that Spring is installed in For example, C:\spring-framework RELEASE The jar files in the dist dir have names like org.springframework.beans release.jar Since the names are long, and will change with each release, we just abbreviate these as beans-*.jar in the labs leaving out the org.springframework prefix, and the release suffix In previous releases there was a single jar (spring.jar) containing the complete Spring distribution - that is no longer available in Spring 3 For the labs that use the core capabilities in this section and the next section, the jar files that are needed are the core and beans jars, so we add in those Spring uses commons-logging by default, so there is at least a known logging implementation that is always available However, we will use log4j which many people are familiar with, which is done by just adding in the log4j jar to the classpath, which we supply for you for ease of use Note that we supply the one that is distributed with the Spring dependencies download, which is why it has a name other than the simple log4j.jar Note - you can select multiple files by holding down the Control key as you select each file Copyright LearningPatterns Inc. All rights reserved. 28

41 Lab 1.1: Setting Up the Environment Create a Project for our Application Lab Tasks to Perform Close any open welcome screens Create a Java Project * Call the project Lab01.1 Make sure Create new project in workspace is checked Eclipse will then automatically set the project directory to Lab01.1 Click Next This will bring you to a dialog where you can set the Java Settings for the project To create a new Java Project, use the menu item File New Project Java Java Project There are many other ways to create a project You can use the new icon on the left hand side of the toolbar, as shown above You will need to create a new Java project in Eclipse each time the lab instructions tell you to use a new Lab directory This happens several times in the course, and you'll need to create a new project each time Copyright LearningPatterns Inc. All rights reserved. 29

42 Lab 1.1: Setting Up the Environment Add the Spring Library to the ClassPath Lab Tasks to Perform In the Java Settings dialog, click the Libraries tab * Click the Add Library button, and in the dialog that comes up, select User Library then click Next Check off Spring, then click Finish in all open dialogs * If you forget to add the library in this step, you can always add it later as follows Right click on the project, select Properties, then select Java Build Path Go to the Libraries tab, and add in the Spring library as described above When the project is created, Eclipse will attempt to compile all the Java source This will lead to warnings about unused imports, variables, etc. You can just ignore these most of them are because the files we give you are just skeletons, and not complete. If you want, you can shut these warnings off as follows: Window Preferences Java Compiler Errors/Warnings Go to the "Unnecessary Code" section, and change the settings for "Unused import", "Unused local or private member", and "Local variable is never read" to "Ignore" Copyright LearningPatterns Inc. All rights reserved. 30

43 Lab 1.1: Setting Up the Environment Running the Lab Lab Tasks to Perform We will use Eclipse to run a skeleton program we supply in TeachMeSpring.java After a clean build (one that is error-free, but not necessarily warning-free), do the following In the Package Explorer pane, right click on TeachMeSpring.java (in package com.javatunes.teach) Select: Run As -> Java Application This will automatically find the main method in TechMeSpring and run it for you Copyright LearningPatterns Inc. All rights reserved. 31

44 Lab 1.1: Setting Up the Environment Program Output Lab You should see output in the Eclipse Console view showing the results of running the program Note: You will follow similar procedures whenever you have a Java program to run in the labs The only thing that may change is the program class that you'll need to right click on to run Copyright LearningPatterns Inc. All rights reserved. 32

45 Lab 1.1: Setting Up the Environment Important Notes for Using Eclipse Lab Each lab that has a separate lab directory will require you to create a new Eclipse project Sometimes several labs are done one directory, in which case you will use the same project for all of them Each time you create a new project, you'll need to add the Spring library to the project build path to compile and run If you COPY files (e.g. from the lab setup) into a project directory using Windows Explorer you need to Refresh it (Right click on the project, select Refresh) For anyone not familiar with Eclipse, the next few slides give a (very) brief overview of how Eclipse is structured There is nothing you need to do in those slides they are for information purposes only Take note of the Lab instructions Any lab that starts out saying that it will be done in a new directory will require you to create a new Java project You'll create the project with the name of the directory specified in the lab You'll do it in the same way as you created this one, by checking the box to Create project from existing source, and setting the lab directory to the specified directory on the file system Any lab that has you copy files from the setup to your working directory will require you to refresh the project as described above This allows Eclipse to become aware of the new files. Copyright LearningPatterns Inc. All rights reserved. 33

46 Lab 1.1: Setting Up the Environment The Eclipse Paradigm Lab Eclipse products have two fundamental layers The Workspace files, packages, projects, resource connections, configuration properties The Workbench editors, views, and perspectives The Workbench sits on top of the Workspace and provides visual artifacts that allow you to access and manipulate various aspects of the underlying resources, such as: Editor A component that allows a developer to interact with and modify the contents of a file. View A component that exposes meta-data about the currently selected resource. Perspective A grouping of related editors and views that are relevant to a particular task and/or role. You can have multiple perspectives open to provide access to different aspects of the underlying resources The physical directory structure for the Workspace can be found in the workspace directory The default location is directly under the Eclipse home directory You can specify a different workspace location when you start Eclipse It is even possible to set up multiple workspaces (with corresponding Workbenchs). Simply create a folder to house the additional workspace, and write a script that uses the Eclipse executable file and supplies the data argument with the location of the workspace directory to load: c:\eclipse\eclipse.exe -data other_workspace_folder A Perspective is basically a collection of views that are focused on a given task They provide different tools to work with the resources For example, the debugging perspective has views open for debugging, such as: Active Threads, Variables, Breakpoints, etc. There are perspectives for Java development (Java Perspective), and so on What perspectives are available depends on what version of Eclipse you have, and what plugins you have installed Copyright LearningPatterns Inc. All rights reserved. 34

47 Lab 1.1: Setting Up the Environment Workbench and Workspace Lab Workspace (Model) Workbench (View) We use the terms Model and View here in the same sense as when talking about Model-View-Controller (MVC) The Model is the actual data (the files) The View is the Eclipse Workbench Copyright LearningPatterns Inc. All rights reserved. 35

48 Lab 1.1: Setting Up the Environment Navigator View Lab Shows how different resources are structured There are three kinds of resources: Files Correspond to files on the file system Folders Like directories on the file system Projects Used to organize all your resources and for version control. When you create a new project, you assign a physical location for it on the file system. A third-party SCM (Source Control Manager) may be used to properly share project files amongst developers. The Navigator view is one of the most commonly used views. It provides a file-based organization of the various resources. There are other views that give application-based, and project-based organization of data Copyright LearningPatterns Inc. All rights reserved. 36

49 Lab 1.1: Setting Up the Environment Package Explorer Lab The Package Explorer view, is shown by default in the Java perspective It shows the Java element hierarchy of the Java projects in your workbench It provides a Java-specific view of the resources shown in the Navigator It also makes it easy to work with Java resources for example to create a new class, just click on the package you want and select New Class * Similarly, if you wanted to create a new JSP file, you could click on the JSP folder and select New File Then name the file with a.jsp extension If you wanted to create a new folder under WebContent, you could just right click on the WebContent folder and select New Folder For example, we'll need to do this in one of the later labs to create a WebContent\js folder, and then a file underneath the js folder Copyright LearningPatterns Inc. All rights reserved. 37

50 Lab 1.1: Setting Up the Environment Editors Lab There is a source editor (like this one for a.java file) for all character files. (.java,.jsp,.html, etc.) STOP Copyright LearningPatterns Inc. All rights reserved. 38

51 Session 1: Introduction to Spring Spring Introduction Overview Spring Introduction Dependency Injection Copyright LearningPatterns Inc. All rights reserved. 39

52 Session 1: Introduction to Spring Managing Beans Managing application objects is a core Spring capability These managed objects are called beans A bean is just a POJO (Plain Old Java Object) Spring borrowed this terminology from JavaBeans and EJB Spring uses a container, the Dependency Injection (DI) or Inversion of Control (IoC) container, to manage objects Configuration metadata is supplied to the container so it knows how to instantiate, configure, and assemble your beans Generally, this configuration data is in a simple XML format You use the configuration metadata to provide bean definitions and dependencies to the container The container then does all the work of managing the beans We'll cover the Spring container, and the principles behind it, in more detail later For now, we will just describe some of its basic capabilities Configuration metadata can also be provided in the Java properties format, or even provided programmatically (using Spring's public API) These are generally more cumbersome to use, and we won't cover them in this course The vast majority of Spring users use the XML format In fact, the Spring IoC container is totally decoupled from the external form of the metadata It has its own internal format which it uses to store this information We mostly only cover the XML format in this course Spring 2.x also added a number of Java 5 annotations that can be used We'll cover the most important annotations Spring will create and initialize bean instances based on your configuration data You can then request those instances from the Spring container by name We'll see how this works soon Copyright LearningPatterns Inc. All rights reserved. 40

53 Session 1: Introduction to Spring A Basic Spring Application Copyright LearningPatterns Inc. All rights reserved. 41

54 Session 1: Introduction to Spring Some Bean Classes Let's say we had the following types (your business objects) An interface, Teacher, defining the functionality we want to use A concrete class, JavaInstructor, which implemented this interface, and provided the functionality Note that Spring strongly advocates the concept of programming to interfaces (see notes) Let's look at how to manage them using Spring package com.javatunes.teach; public interface Teacher { public void teach(); } package com.javatunes.teach; public class JavaInstructor implements Teacher { public void teach() { System.out.println("BeanFactories are way cool"); } } Programming to interfaces provides many advantages by decoupling your code from concrete implementation classes This is not a concept unique to Spring Many design patterns are based on the decoupling gained by programming to an interface We'll soon see how the Spring framework makes these advantages even more usable and powerful by helping manage the dependencies that have been abstracted using interfaces Copyright LearningPatterns Inc. All rights reserved. 42

55 Session 1: Introduction to Spring Configuration Metadata A Spring configuration contains bean definitions Contain information about your beans (the metadata) Bean definitions correspond to actual objects in your application that the Spring container will manage Typically, there are many bean definitions and dependencies Beans are configured with a top level <beans> element It contains namespace declarations (for Spring 3 in the example) and <bean> elements as shown in the beans.xml file below <?xml version="1.0" encoding="utf-8"?> <!-- The beans namespace is the default one for the document --> <beans xmlns=" xmlns:xsi=" xsi:schemalocation=" <bean id="springguru" class="com.javatunes.teach.javainstructor"/> </beans> Spring 2.0 and later provided an XML Schema for the XML configuration file The examples and lab setup files have the necessary XML syntax in them to refer to the Spring XML Schema properly This is standard XML usage, and we don't go into the details here of how to use an XML Schema Refer to an XML reference if you need more detail on this The XML Schema is now the recommended way to use Spring, and we'll use it in this course Earlier versions of Spring used a DTD to describe the XML configuration file Typically you'll configure beans such as Service layer objects, DAO objects, Hibernate session factories, JMS queue references Some BeanFactory implementations also permit the registration of existing objects that have been created outside the factory (by user code) The schemalocation property shown in the slide is for Spring 3.0 For Spring 2.0/2.5, you would use spring-beans-2.0.xsd or 2.5.xsd rather than spring-beans- 3.0.xsd in the schemalocation property Copyright LearningPatterns Inc. All rights reserved. 43

56 Session 1: Introduction to Spring Declaring Beans Each bean definition must specify a package-qualified class name for the bean Usually the actual implementation class of the bean (i.e. the class that the container will instantiate) In our example, the class attribute, specifies the implementation as com.javatunes.teach.javainstructor In general, a bean identifier (or name) is also specified In our example, we used the id attribute, to specify the identifier as springguru Serves as a label for the bean both in code and the config file A bean can have multiple names (or aliases) Generally, bean names use camelcase as the convention for bean names (e.g. springguru) There are more sophisticated ways to create beans, for example with a factory class, in which case the class name may not be the actual implementation class If you don't specify a bean name, the container will generate a unique name for the bean This can be useful in some more sophisticated scenarios The springguru name follows the same convention as Java instance field names Bean names start with a lowercase letter, and are camel cased from then on Bean names must be unique within the container the bean is hosted in Usually a bean will have a single name If it has multiple names, these are considered aliases The id attribute must follow the standard XML rules for ids There is a limited set of characters that are allowed for XML ids The name attribute can also be used to specify (multiple) names You can have a value that specifies multiple bean ids separated by a comma, semicolon, or whitespace If there is no id attribute, the first name becomes the identifier, the rest are aliases You may use the id and name attributes at the same time Copyright LearningPatterns Inc. All rights reserved. 44

57 Session 1: Introduction to Spring The Spring Container The Spring container is represented by the interface org.springframework.beans.factory.beanfactory It provides a configuration mechanism for managing any kind of object Spring comes with a number of BeanFactory implementations XMLBeanFactory, the most common implementation, uses the XML configuration metadata we just saw The interface org.springframework.core.io.resource is used to abstract access to resources (e.g. a config file) Often used to access the XML data to configure a BeanFactory FileSystemResource is a concrete implementation that allows you to easily access resources on the file system We'll show a simple example first, then more depth later Some of the responsibilities of the container are: Instantiating and configuring application objects Assembling dependencies between objects Spring also uses the ApplicationContext class to represent the container ApplicationContext extends BeanFactory, and adds some additional capabilities which we'll look at later The Resource interface allows you to specify paths to resources as resource strings These are then mapped by a particular implementation to the actual resource, for example a file on a file system or from the Java classpath Copyright LearningPatterns Inc. All rights reserved. 45

58 Session 1: Introduction to Spring Working With Spring At the very highest level, a typical scenario for using Spring includes the following main steps: Create (XML) configuration data for your beans e.g. A file "beans.xml" containing the Spring configuration This is the cookbook that tells Spring how to create objects Access the configuration information in your code using the Spring resource classes e.g. Use FileSystemResource to access beans.xml Create a bean factory which gets its configuration data from the resource you created This creates a bean factory tailored to your beans Create beans using the bean factory e.g. using the BeanFactory.getBean method There are many, many usage scenarios for Spring And many, many different alternatives for each scenario Spring is very large, and has a lot of flexibility and capability In this initial introduction we show you one straightforward way of using Spring We will gradually introduce more capabilities throughout the course Copyright LearningPatterns Inc. All rights reserved. 46

59 Session 1: Introduction to Spring A Simple Spring Example The following code, along with the beans.xml configuration file shown earlier, gives a simple example of using Spring We first instantiate a FileSystemResource to read beans.xml We next instantiate an XMLBeanFactory based on beans.xml Lastly, we ask the factory to instantiate the springguru bean package com.javatunes.teach; import org.springframework.core.io.resource; import org.springframework.core.io.filesystemresource; import org.springframework.beans.factory.beanfactory; import org.springframework.beans.factory.xml.xmlbeanfactory; public class TeachMeSpring { public static void main(string[] args) { Resource res = new FileSystemResource("beans.xml"); BeanFactory factory = new XmlBeanFactory(res); // Note that getbean is a new Spring 3 version using generics Teacher teacher = factory.getbean("springguru", Teacher.class); teacher.teach(); // Use our bean } } There are many resource implementations that come with Spring Another example is the ClassPathResource which locates resources on the Java classpath If beans.xml was on the classpath, then you could access it with the following code Resource resource = new ClassPathResource("beans.xml"); A bean definition can be seen as a recipe for creating one or more actual objects The container looks at the recipe for a named bean when asked, and uses the configuration metadata encapsulated by that bean definition to create (or acquire) an actual object Copyright LearningPatterns Inc. All rights reserved. 47

60 Session 1: Introduction to Spring Why Bother? The example looks like a lot of work to create a single object! The main benefit, in this simple example, is that we've decoupled our program code from a dependency on the implementation class JavaInstructor Our code does not need to know about JavaInstructor All we know is that it provides the functionality we need (i.e. implements the Teacher interface) We are free to configure the program with any implementation we want, and our code will not change This can be very useful for complex systems We'll soon see additional capabilities that make Spring useful In this simple example, it looks like we've done quite a bit of work to instantiate a single instance of a single class What is the benefit? The decoupling we've achieved seems like a simple thing, but it has a lot of benefits, especially when maintaining large systems We'll see how useful it can be when we explore more of the capabilities Copyright LearningPatterns Inc. All rights reserved. 48

61 Session 1: Introduction to Spring Some BeanFactory Methods boolean containsbean(string): returns true if BeanFactory contains a bean definition or instance with the given name <T> T getbean(string, Class<T> requiredtype): returns a bean instance, registered under the given name Spring 3.0 style using Java generics (see notes) and is preferred Object getbean(string): old style non generics version Requires cast Class gettype(string name): returns the Class of the bean with the given name boolean issingleton(string): determines whether or not the named bean is a singleton String[] getaliases(string): Return the aliases for the given bean name, if any There are many more we'll look at some, but view the javadoc for more info getbean(string, Class) returns either a singleton (shared) instance, or newly created bean We'll look at how this is configured later NoSuchBeanDefinitionException thrown if the bean can't be found BeansException thrown if an exception occurred while instantiating/preparing the bean BeanNotOfRequiredTypeException thrown if the bean is not of the required type Object getbean(string) returns an object which is then cast to the required type The newer getbean(string,class) method is generally preferred. gettype(string) throws NoSuchBeanDefinitionException if the bean can't be found issingleton(string) throws NoSuchBeanDefinitionException if bean can't be found The method <T> T getbean(string, Class<T> requiredtype) may look strange The first <T> in the return type simply indicates that this is a generic method, parameterized by the type parameter <T> The T return value indicates that the return type is generic (that is, it will take on different types based on the <T> parameter) The Class<T> argument indicates that when you call the method, you pass in the class which specifies what type <T> actually is in that call Copyright LearningPatterns Inc. All rights reserved. 49

62 Lab 1.2: Hello Spring World Lab 1.2 Hello Spring World Copyright LearningPatterns Inc. All rights reserved. 50

63 Lab 1.2: Hello Spring World Lab 1.2 Hello Spring World Lab Overview: In this lab, we will write a very simple Spring program The end goal is to build a simple Spring application and run it This lab uses the JavaInstructor, Teacher, and TeachMeSpring types shown previously in the student manual Objectives: Become familiar with the different parts of a basic Spring program Write and run a (very) simple Spring application Builds on previous labs: 1.1 Approximate Time: minutes The purpose of this lab is to become familiar with the different parts of a Spring application Accordingly, the program is as simple as we can make it It mirrors the code already shown in the previous section In later labs, we'll work with more complex applications Copyright LearningPatterns Inc. All rights reserved. 51

64 Lab 1.2: Hello Spring World Writing and Configuring a Bean in Spring Lab Tasks to Perform Continue to work in the Lab01.1 project Open up the JavaInstructor.java file The class is in the com.javatunes.teach package, which means the file is in src\com\javatunes\teach Make sure that JavaInstructor implements the Teacher interface (in file Teacher.java) Remember that we code to interfaces to decouple us from a specific implementation Open up the src/beans.xml file Finish up the declaration of the <bean> element by declaring a bean with an id of springguru, and a class of com.javatunes.teach.javainstructor There are two other files in the src tree that we will use in the next lab InfoSource.java and SpringCourseBook.java Ignore these for now Copyright LearningPatterns Inc. All rights reserved. 52

65 Lab 1.2: Hello Spring World Using a Bean in a Program Lab Tasks to Perform Open up TeachMeSpring.java, look for the TODO comments, and add in the following code First, create a FileSystemResource to read src/beans.xml Next, create a BeanFactory with the resource above Next, look up the springguru bean from the BeanFactory Finally call teach() on the springguru bean Make sure you have no compilation errors in your code Run the TeachMeSpring program again Run the same way as in previous labs You should see the output from the teach() method You've successfully configured and used a bean with Spring Congratulations! Copyright LearningPatterns Inc. All rights reserved. 53

66 Lab 1.2: Hello Spring World Logging and Additional Things (Optional) We've provided a log4j.properties file in the src directory This configures some of the logging that Spring will do You can reduce the logging output by opening this file, and changing the INFO to WARN at the top line of the file: log4j.rootlogger=warn, stdout You can increase the logging by using DEBUG instead Other things to try Try looking up the bean by a different name what happens? Try casting the bean you look up to a JavaInstructor instead of a Teacher Does this work? Is it a good idea? Change your code back to your original solution before going on STOP Spring has logging built into it It uses commons-logging by default, which will detect the log4j jar file and use that if it is on the classpath You can see the logging by properly configuring it, as we do in the log4j.properties file The details of log4j are beyond the scope of this course Casting the bean you look up to a JavaInstructor will work These are POJOs, and the actual type is JavaInstructor It's not a good idea though, because you are defeating the purpose of decoupling your code from the actual implementation type Copyright LearningPatterns Inc. All rights reserved. 54

67 Session 1: Introduction to Spring Dependencies and Dependency Injection Overview Spring Introduction Dependency Injection Copyright LearningPatterns Inc. All rights reserved. 55

68 Session 1: Introduction to Spring Dependencies Between Objects Typically, different objects work together in an OO application e.g., Object A directly uses Object B to accomplish a goal In that case, Object A depends on Object B Direct dependencies like this can lead to undesirable characteristics in large / complex applications Rigidity: Hard to make changes - they affect too many other parts of the system Fragility: Changes cause unexpected parts of the system to break Immobility: Hard to reuse functionality in another system - modules can't be disentangled from the application We'll show an example of a direct dependency, then show an alternative design approach that uses Dependency Inversion In straightforward applications, Object A will often just create an instance of Object B and use it Object A is highly coupled to, and directly dependent on, Object B Copyright LearningPatterns Inc. All rights reserved. 56

69 Session 1: Introduction to Spring Example of a Direct Dependency Assume JavaInstructor uses a class SpringCourseBook In the example below, JavaInstructor creates an instance of SpringCourseBook directly JavaInstructor depends on the details in lower level modules If we decide that Java instructors will get the latest information from the Spring Wiki, instead of from a SpringCourseBook, JavaInstructor code has to be changed public class SpringCourseBook { // package statements not shown * public String getdata() { return "Dependencies are not so cool"; } } public class JavaInstructor implements Teacher { SpringCourseBook springbook = new SpringCourseBook(); public void teach() { System.out.println(springBook.getData()); } } Assume that all the classes in the examples in this session are in the com.javatunes.teach package We'll be leaving out all the package statements in the Java code examples for brevity Copyright LearningPatterns Inc. All rights reserved. 57

70 Session 1: Introduction to Spring Dependency Inversion Principal High level or low level modules should should depend upon abstractions and not upon each other Use abstractions, e.g. interfaces, that all modules depend on High level modules written in terms of abstractions (the interfaces), and not directly in terms of low level modules Dependencies still exist, but details not in implementation classes Using this design strategy has a number of advantages: Facilitates less coupled components With a high degree of separation of responsibilities Produces greater flexibility Implementations can be swapped without affecting other modules Facilitates reuse of components They're less coupled to other parts of an application Dependency Inversion is not a new idea The idea of "Programming to Interfaces" has been around since long before Java It has been used in non-oo languages also, for example the stdio module in the C programming language abstracted away the details of the actual devices doing the output Many people don't use this design in building applications Even though we know of good design principals, there is no way to make sure people use them We'll soon look at Spring's Dependency Injection which makes this design strategy even easier to use We talk of modules here, which in Java are basically reflected as dependencies between different classes Copyright LearningPatterns Inc. All rights reserved. 58

71 Session 1: Introduction to Spring Example of Dependency Inversion Both JavaInstructor and SpringCourseBook depend on InfoSource neither depend on the other public interface InfoSource { public String getdata(); } public class SpringCourseBook implements InfoSource { public String getdata() { return "Dependencies are not so cool"; } } public class JavaInstructor implements Teacher { private InfoSource info; public void setinfo (InfoSource infoin) { info=infoin; } public void teach() { System.out.println(info.getData()); } } In the code example, we can see that JavaInstructor knows nothing about SpringCourseBook Instead, it depends on the InfoSource interface (the abstraction) When JavaInstructor is created, it is initialized with an instance of some InfoSource implementation However, it doesn't know any details of this implementation, and doesn't even know its exact type SpringCourseBook likewise depends on the abstraction (it implements the InfoSource interface) The abstraction (the interface) is the common language that lets the different part of the system work together with depending directly on each other Copyright LearningPatterns Inc. All rights reserved. 59

72 Session 1: Introduction to Spring Example of Dependency Inversion In the example code below, JavaInstructor is initialized with a specific implementation of InfoSource (an instance of SpringCourseBook) But JavaInstructor only sees this as the InfoSource type It would make no difference to JavaInstructor if we initialized it with some other type that implemented InfoSource for example an EJBCourseBook We've decoupled the modules, and made them more flexible and easier to use, reuse, and maintain public class TeachMeSpring { } public static void main(string[] args) { SpringCourseBook springbook = new SpringCourseBook(); JavaInstructor myinstructor = new JavaInstructor(); myinstructor.setinfo(springbook); myinstructor.teach(); } In the example above, we are still creating SpringCourseBook in a fairly straightforward way This exposes the actual implementation class of the lower level module (SpringCourseBook) in our TeachMeSpring code There are other, more sophisticated, ways to create these lower level modules For example, we could use factories of some sort to more completely abstract which InfoSource is being used Whenever you have modules depending on one another, something has to know about the implementation details Even if it's abstracted through multiple layers, there is still a bottom layer somewhere which creates the instance of the actual implementation The goal is to do this in a way that makes your code easier to write, reuse, and maintain We'll see how Spring deals with this soon Copyright LearningPatterns Inc. All rights reserved. 60

73 Session 1: Introduction to Spring Dependency Injection (DI) in Spring Using Dependency Injection, Spring allows you to abstract dependencies between modules even more The Spring container can inject dependencies into a bean and initialize them when it creates the bean It can inject dependencies via constructors, properties in the bean, or arguments to a factory method Dependencies are defined in the Spring configuration file The Spring container uses these dependency definitions to initialize the bean No need to explicitly initialize dependencies in your code Your bean classes are still normal POJO classes The Spring container only requires that you have the appropriate methods needed to initialize the dependencies (e.g. setters) There is nothing else special about the bean classes Dependency injection is a fancy way of saying that the container will initialize all the dependencies in the bean when the bean is created The bean has to be a bean whose lifecycle is managed by the container Copyright LearningPatterns Inc. All rights reserved. 61

74 Session 1: Introduction to Spring Dependency Injection Configuration The Spring configuration below uses DI It declares two beans: springbook and springguru The <property name="info" ref="springbook"/> element tells the container to initialize the info property of springguru with the instance of SpringCourseBook defined above it It uses setter injection - calling JavaInstructor.setInfo() You don't need to write any code for the injection to happen <?xml version="1.0" encoding="utf-8"?> <beans > <!-- Namespace declarations omitted --> <bean id="springbook" class="com.javatunes.teach.springcoursebook"/> <bean id="springguru" class="com.javatunes.teach.javainstructor"> <property name="info" ref="springbook"/> </bean> </beans> The container first creates an instance of SpringCourseBook, with the id springbook The container next creates an instance of JavaInstructor using the no-arg constructor To accomplish the DI, the container calls the setinfo method, passing in the instance of SpringCourseBook that it had created The result is a fully initialized JavaInstructor instance The <property> element tells the container to use setter injection to initialize the dependency Setter injection uses the standard setter methods on your bean It follows the standard property naming conventions, so if the property is named info, it will call the setinfo method to initialize the dependency There are other ways of initializing the dependency, such as constructor injection, that we'll see later The bean reference can also be declared using a nested <ref> element as shown below <property name="info"><ref bean="springbook"/></property> Generally, the ref attribute shown in the slide is easier to use and understand You can use the nested element if for some reason it is clearer to express it this way than as an attribute (this is also provided for backwards compatibility with earlier Spring releases) Copyright LearningPatterns Inc. All rights reserved. 62

75 Session 1: Introduction to Spring Dependency Injection Example The example below shows how to use our beans with Spring Notice that all our code is written completely in terms of the abstract Teacher interface Note also that our code, including the JavaInstructor class, is totally decoupled from the concrete class SpringCourseBook The JavaInstructor instance has its info property initialized with a SpringCourseBook instance by the Spring container The dependency is injected by the container transparently // imports not shown public class TeachMeSpring { } public static void main(string[] args) { Resource res = new FileSystemResource("beans.xml"); BeanFactory factory = new XmlBeanFactory(res); Teacher teacher = factory.getbean("springguru", Teacher.class); teacher.teach(); } Note that your SpringCourseBook and JavaInstructor class definitions didn't need to change to use DI Of course, they had to support the design principle of Dependency Inversion, which we had already done Once this was done, we didn't need any changes or additional code to support DI Note also that there is nothing in your TeachMeSpring code which shows that JavaInstructor depends on SpringCourseBook This is defined in your configuration, and handled for you by the container Note that the no-arg constructor is present by default in JavaInstructor since we haven't defined any constructors at all If we defined constructors, and still wanted to use only setter injection, as for the configuration file in this example, we would have to include a no-arg constructor We'll take a look at constructor injection, which allows us to use constructor arguments, a little later Copyright LearningPatterns Inc. All rights reserved. 63

76 Session 1: Introduction to Spring Advantages of Dependency Injection DI reduces the coupling between modules in your code Coupling is basically a measure of the dependencies We've seen this reduction in two ways in our example: JavaInstructor is not coupled to SpringCourseBook TeachMeSpring is not coupled to JavaInstructor or SpringCourseBook The dependencies are still there but not in the code The dependency is moved to the spring configuration They're injected into beans without your needing to write code This is also commonly referred to as wiring beans together This leads to more flexible code that is easier to maintain At a cost using Spring, and maintaining the spring configuration Coupling is the measure of how much a module of code relies on other modules Loosely coupled code is generally considered better code Consider some of the following scenarios, and how DI makes them easier Testing your code with testing framework such as JUnit can be much easier with DI you can configure the application to use mock objects wherever you want without changing your code at all Testing different versions of classes can be done just by changing the configuration metadata In fact, any implementation class that implements the particular interfaces being used can be swapped into your program simply by changing the configuration information There is debate about how worthwhile DI and frameworks like Spring are However, the principles that it is based on that lead to loose coupling are widely accepted Spring simply makes it easier to apply these principles The effort required to adopt and use Spring is not trivial, but for larger projects the initial cost of adopting Spring can be well worth it Copyright LearningPatterns Inc. All rights reserved. 64

77 Session 1: Introduction to Spring Dependency Injection Reduces Coupling The simplest case, JavaInstructor coupled to SpringCourseBook JavaInstructor SpringCourseBook JavaInstructor coupled to InfoSource only TeachMeSpring coupled to JavaInstructor and SpringCourseBook JavaInstructor creates TeachMeSpring creates <<interface>> InfoSource implements SpringCourseBook Using DI - TeachMeSpring only coupled to Teacher JavaInstructor only coupled to InfoSource <<interface>> Teacher looks up implements injects JavaInstructor <<interface>> InfoSource TeachMeSpring BeanFactory In the DI example, the couplings are ONLY to interfaces This is much better than being coupled to actual implementation classes It increases flexibility, testability, and ease of maintenance Copyright LearningPatterns Inc. All rights reserved. 65

78 Lab 1.3: Dependency Injection Lab 1.3 Dependency Injection Copyright LearningPatterns Inc. All rights reserved. 66

79 Lab 1.3: Dependency Injection Lab 1.3 Dependency Injection Lab Overview: In this lab, we will work with the DI capabilities of Spring We will add a property (a dependency on another bean) to the JavaInstructor class, and initialize it using Spring DI The main program will not change at all Again, the program is kept very simple so the concepts will be clear Objectives: Become familiar with Spring DI, and use it in a program Builds on previous labs: 1.2 Approximate Time: minutes Copyright LearningPatterns Inc. All rights reserved. 67

80 Lab 1.3: Dependency Injection Writing and Configuring a Bean in Spring Lab Tasks to Perform Continue to work in the Lab01.1 project Open up the SpringCourseBook.java file Make sure that SpringCourseBook implements the InfoSource interface Open up the JavaInstructor.java file Add in a property called info, of type InfoSource You'll need an instance field of type InfoSource, as well as a setter method for this field Modify the teach() method to print out the data from the info properties getdata() method We won't initialize the info property that will be done with DI All the classes we're working with are in the com.javatunes.teach package Copyright LearningPatterns Inc. All rights reserved. 68

81 Lab 1.3: Dependency Injection Using a Bean in a Program Lab Tasks to Perform Open up the src/beans.xml file Add in a new bean element for SpringCourseBook Give it an id of springbook Modify the <bean> element for springguru by initializing it's info property with a <property> element Use the springbook bean to initialize the info property Run the program as before The output should now be whatever data the SpringCourseBook returns The main program doesn't change at all the JavaInstructor dependency on SpringCourseBook is completely hidden JavaInstructor is decoupled from SpringCourseBook Copyright LearningPatterns Inc. All rights reserved. 69

82 Lab 1.3: Dependency Injection Additional Things to Try (Optional) Lab In beans.xml, try leaving out the initialization of the springguru bean's info property Run your program What happens? Why? Change your code back to your original solution before going on STOP Copyright LearningPatterns Inc. All rights reserved. 70

83 Session 1: Introduction to Spring Review Questions What is Spring? How does Spring help you to build enterprise applications? What is Dependency Injection, and how does it work in Spring Copyright LearningPatterns Inc. All rights reserved. 71

84 Session 1: Introduction to Spring Lesson Summary Spring is a lightweight framework for building enterprise applications whose capabilities include: Dependency Injection, Persistence support (DAO and ORM), AOP capabilities, integration with Web technologies, and its own MVC based Web package Spring helps you build complex enterprise applications by providing a non-intrusive, light weight solution for managing the complex dependencies and interactions between Java objects in your program. It supplies many of the important capabilities of Java EE in a less complex and lighter weight manner Copyright LearningPatterns Inc. All rights reserved. 72

85 Session 1: Introduction to Spring Lesson Summary Spring reinforces the use of loose coupling between components by promoting the technique of coding to interfaces, rather than concrete implementation classes This by itself is an important design technique, It provides support for initialization of beans and bean dependencies through configuration metadata Usually done using XML configuration files Dependency Injection is used by the Spring container to inject bean dependencies based on configuration information This allows the complete decoupling of your types from concrete implementation types Copyright LearningPatterns Inc. All rights reserved. 73

86 Session 8: Spring Security Overview Session 8: Spring Security Overview Copyright LearningPatterns Inc. All rights reserved. 484

87 Session 8: Spring Security Overview Spring Security Comprehensive security services for Spring / Java EE apps Evolved from Acegi Security - Became Spring Security in 2007 Comprehensive support for authentication (identifying users) HTTP Basic, Digest, Form-Based, X.509 client certificate Integration with common containers (Tomcat, JBoss, etc) LDAP, JAAS, and much more Authentication supported in different areas Authorizing Web requests Authorizing invocations on a bean Accessing domain objects Fairly simple XML configuration Much improved from previous releases Copyright LearningPatterns Inc. All rights reserved. 485

88 Session 8: Spring Security Overview Spring Web Security - web.xml Spring security can be easily used to protect Web apps Via the web.xml file, and the Spring configuration file web.xml requires the addition of a filter that applies to the URLS you want to protect, as shown at bottom This provides a hook into the Spring security system Below, we use DelegatingFilterProxy (a supplied Spring class) to protect all the URLS in the Web app (via /* url-pattern) <filter> <filter-name>springsecurityfilterchain</filter-name> <filter-class> org.springframework.web.filter.delegatingfilterproxy </filter-class> </filter> <filter-mapping> <filter-name>springsecurityfilterchain</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> DelegatingFilterProxy comes with the Spring framework, and it delegates to a filter implementation which comes as a Spring bean in the application context In this case, the bean is called springsecurityfilterchain, which is an internal infrastructure bean created by the namespace to handle Web security (we'll look at the security namespace next) You must use this bean name for the filter-name to use the supplied filter - though it is also possible to define your own filter class with a different name, which you'd then use in web.xml You should not use the springsecurityfilterchain name for another bean in your Spring configuration Copyright LearningPatterns Inc. All rights reserved. 486

89 Session 8: Spring Security Overview Spring Web Security - Spring Configuration Web security services are configured using the <http> element from the Spring security namespace, as shown below Below, <http> is used with the auto-config attribute to set up a default configuration that easily enables security processing <intercept-url> specifies that all URLs in the application will be secured, requiring the ROLE_USER role to be accessed <?xml version="1.0" encoding="utf-8"?> <beans xmlns=" xmlns:xsi=" xmlns:security=" xsi:schemalocation=" <security:http auto-config="true"> <security:intercept-url pattern="/**" access="role_user" /> </security:http> </beans> In the slide, we won't include the security namespace in the elements (e.g. we'll use <http> instead of <security:http>) - you can also make it the default namespace in the XML file The configuration that results from auto-config="true" is: <http> <intercept-url pattern="/**" access="role_user" /> <form-login /> <!-- Use form based login --> <anonymous /> <!-- Adds anonymous processing --> <http-basic /> <!-- Support HTTP basic login --> <logout /> <!-- Adds logout URL - /j_spring_security_logout --> <remember-me /> <!-- Remember principal across sessions --> </http> The form login page that results from this, is a default page that is generated by Spring security - you can also specify your own login page You can add ROLE_ANONYMOUS to the access to allow anonymous access Multiple <intercept-url> elements can be used to specify different access requirements for different URLs They'll be evaluated in the order listed, and the first match will be used Copyright LearningPatterns Inc. All rights reserved. 487

90 Session 8: Spring Security Overview Spring Web Security - Spring Configuration You can define users using an authentication provider Which checks the validity of authentication credentials Configured in XML via <authentication-provider> Authentication providers generally depend on a user details service to get/store authentication information Spring supplies a version to define data directly in the config file Below, we show the elements to define two users, jane and john, their passwords, and their roles <security:authentication-manager> <security:authentication-provider> <security:user-service> <security:user name="jane" password="password" authorities="role_user, ROLE_ADMIN" /> <security:user name="john" password="password" authorities="role_user" /> </security:user-service> </security:authentication-provider> </security:authentication-manager> <authentication-provider> is a shorthand syntax for creating a Spring DaoAuthenticationProvider bean - it should appear in the Spring configuration file This bean implementation retrieves user details from a UserDetailsService A UserDetailsService just needs to supply details (e.g. name, password, roles) for a user <user-service> creates an in-memory UserDetailsService implementation with the information contained in the enclosed configuration elements The result of the configuration in the slide is two users, as follows: name: jane, password: password, authorities: ROLE_USER, ROLE_ADMIN name: john, password: password, authorities: ROLE_USER We wouldn't use this simple provider in a production application, but it's very useful for testing You can also specify usage of encrypted passwords using <password-encoder>, e.g. <authentication-provider> <password-encoder hash="sha"/> </authentication-provider> In this case, you would store all your passwords in encrypted format - there are other options, such as setting a salt, and other hash algorithms like md5 are supported Copyright LearningPatterns Inc. All rights reserved. 488

91 Session 8: Spring Security Overview More <http> Capabilities <http> has a number of configuration attributes, including lowercase-comparisons : Convert URLs to lower case? realm: Realm name if basic authentication is used access-denied-page: Forwarding page for failed access <http> is also configurable via sub-elements, including <http-basic>: Basic authentication (used if forms not enabled) <form-login>: Form login configuration, including login page, login processing url, default target, url, etc. <anonymous>: Enables anonymous principals <logout>: Enables logout and its configuration <intercept-url>: URL patterns for security - with attributes: pattern: The URL path to match method: HTTP method to match (used in combination with pattern) access: Roles to allow access to channel: Can be "http", "https", or "any" to define access allowed <anonymous> must be present if you are using the IS_AUTHENTICATED_ANONOMOUSLY attribute To set up an access denied page, you can use <http access-denied-page="/jsp/login-problem.jsp"/> <form-login> is configurable via a number of attributes, including: login-page: URL used to render the login login-processing-url: Maps to the URL of the authentication processing filter. The default value is "/j_spring_security_check" default-target-url: Maps to the target URL of the authentication processing filter. If not set, the default value is "/" (the application root). A user will be taken to this URL after logging in, provided they were not asked to login while attempting to access a secured resource, when they'll be taken to the originally requested URL always-use-default-target: If "true", user always taken to default-target-url, regardless of how they arrived at the login page. Default value is "false". For example, to set a login page, and default target page: <form-login login-page="/jsp/mylogin.jsp" default-target-url="/jsp/welcome.jsp"/> Copyright LearningPatterns Inc. All rights reserved. 489

92 Session 8: Spring Security Overview Other Authentication Providers Database-based authentication providers are available User/authority info stored in a DB with a specified schema * Easily accessed by configuring a datasource to the DB, then using it in the authentication provider, as shown below <!-- securitydatasource configured elsewhere --> <security:authentication-provider> <security:jdbc-user-service data-source-ref="securitydatasource"/> </security:authentication-provider> LDAP-based authentication providers are available Can configure mapping of user name to LDAP DN Can configure binding of user to LDAP directory Can configure mapping of LDAP groups to authorities The default database schema for security is below (shown for the Hypersonic DB) create table users( username varchar_ignorecase(50) not null primary key, password varchar_ignorecase(50) not null, enabled boolean not null); create table authorities ( username varchar_ignorecase(50) not null, authority varchar_ignorecase(50) not null, constraint fk_authorities_users foreign key(username) references users(username)); create unique index ix_auth_username on authorities (username,authority); You You can also specify the queries to fetch the data via the attributes: authorities-by-username-query and users-by-username-query Copyright LearningPatterns Inc. All rights reserved. 490

93 Lab 8.1: Spring Web Security Lab 8.1 Spring Web Security Copyright LearningPatterns Inc. All rights reserved. 491

94 Lab 8.1: Spring Web Security Lab 8.1 Spring Web Security Lab Overview: In this lab, we'll explore Spring security We'll use it to add security to the JavaTunes Web application form previous labs Objectives: Become more familiar with Spring security Use Spring security to enforce access to a Web application Builds on previous labs: none Approximate Time: minutes Copyright LearningPatterns Inc. All rights reserved. 492

95 Lab 8.1: Spring Web Security Lab Preparation Lab The new root lab directory where you will do all your work is: C:\StudentWork\Spring\workspace\Lab08.1 Tasks to Perform Remove any other Web projects from the server * Make sure Spring security is installed e.g. in C:\spring-security RELEASE Create a new Dynamic Web project called Lab08.1 Remember to set the context root to javatunes Add the following files in <spring-security>\dist to the build path *-config-*.jar, *-core-*.jar, *-web-*.jar * Add the Spring user library to the build path Add the Spring library and all the spring security jars as Java EE Module Dependencies To remove a project from the server, do the following In the Servers view, right click on the server, select Add and Remove Projects Remove any project on the server Restart the server (Right click on the server, select Restart) To add a jar to the build path Right click on the JavaTunes project in Project Explorer and select Build Path Configure Build Path Select the Libraries Tab, and click Add External Jars Browse to the directory needed, and add the jar Copyright LearningPatterns Inc. All rights reserved. 493

96 Lab 8.1: Spring Web Security Configure Application Lab Tasks to Perform Open WebContent\WEB-INF\web.xml for editing Find the <filter> element for the Spring security filter Finish <filter-mapping> so security is applied to all requests Open WebContent\WEB-INF\beans.xml for editing Note the security namespace declaration at the top Finish <security:http> so auto-config is true Finish <security:intercept-url> so it applies to all requests, and access is granted to users in ROLE_USER In beans.xml, find <security:authentication-provider> Finish the two user elements with name, password, & authorities At least one user should contain the ROLE_USER authority Copyright LearningPatterns Inc. All rights reserved. 494

97 Lab 8.1: Spring Web Security Test Your Application Lab Tasks to Perform Deploy to the server as you did in Lab 7.1 (restart the server) A browser should open on: You'll be prompted for a username/password - enter the data for the user that has the ROLE_USER authority You should be forwarded to the JavaTunes home page Try logging out (browse to javatunes/j_spring_security_logout) Log in again with invalid information, or with a non ROLE_USER user You should be prompted for another login Add ROLE_ANONYMOUS to <intercept-url> in beans.xml Redeploy, and access the app in the browser - you should be able to access it without logging in now (try logging out first) Optional: set auto-config="false" in <security:http> Try adding in <security:http-basic> to the <http> and run the app - you'll see that the login uses HTTP basic now STOP To deploy to the server, right click on the project, and select Run As Run on Server Follow the same steps as in Lab 7.1 Once you log in, you should get exactly the same view as in earlier labs When you allow anonymous access, you'll see that the security framework doesn't prompt you for a login Because anonymous access is allowed, you don't need to login to access the Web app resources Even if you log out, you'll be directed to the Web app home page again You'll never be directed to the login page Note that when using <http-basic>, you can't really log out, even if you include <logout/> That's because the browser caches the login information, and resubmits it with each request If you want to "log out" you need to close the browser down completely to clear its (inmemory) cache of the login data Copyright LearningPatterns Inc. All rights reserved. 495

98 Session 8: Spring Security Overview Method Security Method security is very simple, and can be added three ways Via annotations on your bean class Via AspectJ pointcut expressions Via XML configuration on a bean definition Annotations are enabled via the configuration element below Enables Spring specific annotations (@Secured) Enables JSR-250 These annotations can be used on your Spring bean classes You would declare access in terms of the roles defined by your authentication provider <security:global-method-security secured-annotations="enabled" jsr250-annotations="enabled"/> The secured-annotation attribute enables Spring annotations The jsr250-annotations attribute enables JSR250 annotations Copyright LearningPatterns Inc. All rights reserved. 496

99 Session 8: Spring Security Overview Method Security - Annotations Below, we to secure a bean class from our lab We specify all methods of the class can only be accessed by users in the role ROLE_USER You can also apply annotations to individual methods That's all you need to do - the security runtime will check and enforce access requirements on bean invocations import org.springframework.security.annotation.secured; // Other imports, details public class JavaTunesCatalog implements Catalog { /* */ } Below, we use JSR-250 annotations Useful if you don t want Spring specific code in your beans import javax.annotation.security.rolesallowed; // Other imports, details public class JavaTunesCatalog implements Catalog { /* */ } We're assuming that you have an authentication provider configured, as was done in the earlier examples We don't show that again here Copyright LearningPatterns Inc. All rights reserved. 497

100 Session 8: Spring Security Overview Method Security - Pointcut Expressions Pointcut expressions can be used to apply security to many beans with a single expression They use <protect-pointcut>, and the AspectJ expression language in the Spring configuration file In the example at bottom, we declare that any method in the type com.javatunes.catalog.catalog can only be accessed by ROLE_USER users You can have multiple <protect-pointcut> elements Again - that's all you need to do to protect method invocations You can see how powerful this is <security:global-method-security> <security:protect-pointcut expression="execution(* com.javatunes.catalog.catalog.*(..))" access="role_user"/> </security:global-method-security> In the pointcut expression in the example * = the return type (any type) com.javatunes.catalog.catalog.* = the method name, and matches any method in the Catalog interface (..) Matches "any number of parameters" (zero or more) Notice, that in the example we write the pointcut expression so that it applies to an interface Any class that implements the interface will be affected We could also do this with annotations, by adding them to the interface class Pointcut expressions are a very powerful way to apply security to a large number of classes You can also be much more sophisticated than our example For example, you can apply one security to all methods that start with set, and another security to all methods that start with get - effectively creating different access for read and write operations Copyright LearningPatterns Inc. All rights reserved. 498

101 Session 8: Spring Security Overview Method Security - XML Configuration XML can be used to apply security to a particular bean declaration via <intercept-methods> This allows you to set protections on an individual bean Below, we specify that all methods in the javatunescatalog bean that start with find, can only be accessed by ROLE_USER users This allows simple configuration within the bean definition Not as powerful as the pointcut declarations, but easier to use and understand <bean id="javatunescatalog" class="com.javatunes.catalog.javatunescatalog"> <security:intercept-methods> <security:protect method="find*" access="role_user" /> </security:intercept-methods> </bean> Notice, that in the example we are writing the pointcut expression so that it applies to an interface Any class that implements the interface will be affected We could also do this with annotations, by adding them to the interface class Pointcut expressions are a very powerful way to apply security to a large number of classes You can also be much more sophisticated than our example For example, you can apply one security to all methods that start with set, and another security to all methods that start with get - effectively creating different access for read and write operations Copyright LearningPatterns Inc. All rights reserved. 499

102 Lab 8.2: Method Security Lab 8.2 Method Security Copyright LearningPatterns Inc. All rights reserved. 500