Carlo Scarioni. Pro Spring Security

Transcription

1 Carlo Scarioni Pro Spring Security

2 Pro Spring Security Copyright 2013 by Carlo Scarioni This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed. Exempted from this legal reservation are brief excerpts in connection with reviews or scholarly analysis or material supplied specifically for the purpose of being entered and executed on a computer system, for exclusive use by the purchaser of the work. Duplication of this publication or parts thereof is permitted only under the provisions of the Copyright Law of the Publisher s location, in its current version, and permission for use must always be obtained from Springer. Permissions for use may be obtained through RightsLink at the Copyright Clearance Center. Violations are liable to prosecution under the respective Copyright Law. ISBN ISBN (ebook) Trademarked names, logos, and images may appear in this book. Rather than use a trademark symbol with every occurrence of a trademarked name, logo, or image we use the names, logos, and images only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. The use in this publication of trade names, trademarks, service marks, and similar terms, even if they are not identified as such, is not to be taken as an expression of opinion as to whether or not they are subject to proprietary rights. While the advice and information in this book are believed to be true and accurate at the date of publication, neither the authors nor the editors nor the publisher can accept any legal responsibility for any errors or omissions that may be made. The publisher makes no warranty, express or implied, with respect to the material contained herein. President and Publisher: Paul Manning Lead Editor: Steve Anglin Technical Reviewer: Manuel Jordan Technical Reviewer: Arup Nanda Editorial Board: Steve Anglin, Ewan Buckingham, Gary Cornell, Louise Corrigan, Morgan Ertel, Jonathan Gennick, Jonathan Hassell, Robert Hutchinson, Michelle Lowman, James Markham, Matthew Moodie, Jeff Olson, Jeffrey Pepper, Douglas Pundick, Ben Renow-Clarke, Dominic Shakeshaft, Gwenan Spearing, Matt Wade, Tom Welsh Coordinating Editor: Kevin Shea Copy Editor: Roger LeBlanc Compositor: SPi Global Indexer: SPi Global Artist: SPi Global Cover Designer: Anna Ishchenko Distributed to the book trade worldwide by Springer Science+Business Media New York, 233 Spring Street, 6th Floor, New York, NY Phone SPRINGER, fax (201) , orders-ny@springer-sbm.com, or visit For information on translations, please rights@apress.com, or visit Apress and friends of ED books may be purchased in bulk for academic, corporate, or promotional use. ebook versions and licenses are also available for most titles. For more information, reference our Special Bulk Sales ebook Licensing web page at Any source code or other supplementary materials referenced by the author in this text is available to readers at For detailed information about how to locate your book s source code, go to

3 To my wife, Monica, for her constant support and love. To my parents for always being there. And to my aunt Marisol, who we all miss so much. Carlo Scarioni

4 Contents at a Glance About the Author...xiii About the Technical Reviewer... xv Acknowledgments... xvii Introduction... xix Chapter 1: The Scope of Security...1 Chapter 2: Introducing Spring Security...9 Chapter 3: Spring Security Architecture and Design...27 Chapter 4: Web Security...57 Chapter 5: Securing the Service Layer Chapter 6: Configuring Alternative Authentication Providers Chapter 7: Business Object Security with ACLs Chapter 8: Customizing and Extending Spring Security Chapter 9: Integrating Spring Security with Other Frameworks and Languages Index v

5 Contents About the Author...xiii About the Technical Reviewer... xv Acknowledgments... xvii Introduction... xix Chapter 1: The Scope of Security...1 The Network Security Layer...1 The Operating System Layer...1 The Application Layer...2 Authentication...2 Authorization...3 ACLs...4 Authentication and Authorization: General Concepts...4 What to Secure...7 More Security Concerns...7 Java Options for Security...8 Summary...8 Chapter 2: Introducing Spring Security...9 What Is Spring Security?...9 Where Does Spring Security Fit In?...10 Spring Security and Spring...12 vii

6 CONTENTS Spring Framework: A Quick Overview...12 Dependency Injection...13 Aspect Oriented Programming (AOP) An Initial Spring Security Secured Application...15 Adding Spring Security (and Spring Core Itself) to the Project Configuring the Web Project To Be Aware of Spring Security Understanding the Simple Application...24 Summary...26 Chapter 3: Spring Security Architecture and Design...27 What Components Make Up Spring Security?...27 The 10,000-Foot View...27 The 1,000-Foot View...28 The 100-Foot View...29 Good Design and Patterns in Spring Security...55 Strategy Pattern...55 Decorator Pattern...55 SRP...56 DI...56 Summary...56 Chapter 4: Web Security...57 Introducing the Simple Example Application...57 The Special URLs...72 Custom Login Form...73 Basic HTTP Authentication...77 Digest Authentication...78 Remember-Me Authentication...80 Allowing Remember-Me Access to Selected Parts of the Application...81 Logging Out...83 The Session (javax.servlet.http.httpsession) and the SecurityContext...84 viii

7 CONTENTS Beyond Simple User Roles: Using Spring Expression Language to Secure the Web Layer...89 Extend with Your Own Expressions...91 Switching to a Different User...95 Session Management...98 Forcing the Request to HTTPS Role Hierarchies Summary Chapter 5: Securing the Service Layer The Limitations of Web-Level Security What Is Business Service-Level Security? Setting Up the Example for the Chapter How the Described Actions Happen Under the Hood Creating a Business Layer in Your Annotation Securing the Application Using SpEL Expressions Securing the Data Returned from a Method Filtering Collections Sent and Returned from Methods Security Defined in XML Security Without a Web Layer Using AspectJ AOP instead of Spring AOP Summary Chapter 6: Configuring Alternative Authentication Providers Database-Provided Authentication Creating the Basic Tables Using Groups Using Existing Schemas LDAP Authentication Installing and Configuring LDAP Other Attributes and Elements in the LDAP Spring Security Namespace ix

8 CONTENTS Authenticating with OpenID Setting Up OpenID Authentication OpenID Authentication Flow Spring Security OpenID Namespace X.509 Authentication JAAS Authentication Central Authentication Service (CAS) Authentication Integrating CAS with a Different Authentication Provider Summary Chapter 7: Business Object Security with ACLs The Security Example Application Accessing Secured Objects Filtering Returned Objects Test Scenario Securing the View Layer with ACLs The Cost of ACLs Summary Chapter 8: Customizing and Extending Spring Security Spring Security Extension Points Plug into the Spring Security Event System Authorization-Related Events Authentication-Related Events Session-Related Events Your Own AuthenticationProvider and UserDetailsService Password Encryption New Voters in AccessDecisionManager Nonvoter AccessDecisionManager Implementations New Expression Root and SpEL Non-JDBC AclService x

9 CONTENTS Custom Security Filter Handling Errors and Entry Points Changing the Security Interceptor Spring Security Extensions Project Summary Chapter 9: Integrating Spring Security with Other Frameworks and Languages Spring Security with Struts Spring Security with Spring Web Flow SpEL-Based Security with Spring Web Flow Spring Security in Other JVM Languages Spring Security and Ruby (JRuby) Web-Layer Security in Rails Spring Security, Groovy, and Grails Using Grails to Secure the Web Layer with URL Rules Using Grails Security at the Method Level Spring Security and Scala Summary Index xi

10 About the Author Carlo Scarioni is a software engineer with a Computer Science degree from Universidad Central de Venezuela. He has worked in many industry fields in three different countries and has over nine years experience. Currently living and working in London, Carlo focuses mostly on Java and Ruby software development. He has obtained multiple certifications in the Java space, including SCJP, SCBCD, and SpringSource Certified Spring Professional for Spring 2.5. Carlo fell in love with The Spring Framework when he first used it more than five years ago, and now he can t conceive starting a pure Java project without the aid of Spring and its related technologies. He is very passionate about his work and is constantly searching for the best ways to solve problems and trying to learn new and better technologies. He also likes to write on his blog as a way to give back something to the software community that he so much respects, and he is a DZone MVB (Most Valuable Blogger). You can follow Carlo s blog at xiii

11 About the Technical Reviewer Manuel Jordan Elera is a self-taught developer and researcher who enjoys learning new technologies for his own experiments and creating new integrations. Manuel won the 2010 Springy Award Community Champion. In his scarce free time, he reads the Bible and composes music on his guitar. Manuel is a Senior Member in the Spring Community Forums, where he is known as dr_pompeii. Manuel was Technical Reviewer for these books (all published by Apress): Pro SpringSource dm Server (2009) Spring Enterprise Recipes (2009) Spring Recipes (Second Edition) (2010) Pro Spring Integration (2011) Pro Spring Batch (2011) Pro Spring 3 (2012) Pro Spring MVC: With Web Flow (2012) Read and contact him through his blog at and follow him on his Twitter xv

12 Acknowledgments This book is definitely the work of more than one person. The people involved in the preparation of this book have brought so much experience and quality to the final version that the end product is many times better than if I had done all the work myself. Their input ranged from improving text style, to introducing better ways to present concepts, to performing code reviews and suggesting general improvements that have made this book a much better reading experience. I am talking, of course, about the great people at Apress who have been with me along the full journey of writing this book. I m talking about Steve Anglin, who initiated me into the project, kept an eye from afar on the progress of the book, and tried to make sure I kept on track as much as possible. I m talking about Kevin Shea, who was my main editorial contact and made sure that I stayed on schedule with the book and helped with advice and support. I m talking about Tom Welsh, who had the great responsibility of reading every chapter as I was writing them and gave great input on each section, including helping with my use of English grammar as well as ways to make the different parts more attractive to potential readers. I am talking about Manuel Jordan, who not only read every single chapter in a very detailed way, but also took on the laborious job of evaluating and executing every single line of code and made sure that the book provides code samples that can be reproduced by the readers in their own environments. His input is greatly appreciated, and it is the difference between having a full book or a half a book. There were, of course, many more people in Apress involved in the full review phases of the book, and I want to say thank you for your help to all of them. I would like to also thank the creators, committers and community of Spring and Spring Security for creating such an amazing piece of software and making it available to everyone. A big thank you to them for letting all developers share their knowledge and ways of work by freely distributing the source code of the different projects covered by the SpringSource umbrella. They make us all wiser and better developers. Finally, I want to thank my wife for being with me all the time and motivating me to keep going forward. Carlo Scarioni xvii

13 Introduction Denying the impact of the Spring Framework in the Java world would be simply impossible. Spring has brought so many advantages to the Java developer that I could say it has made better developers of all of us. The good ones, the average ones. All of us. Spring s core building blocks of Dependency Injection and Aspect Oriented Programming are widely applicable to many business and infrastructure concerns, and certainly application security can benefit from these core functionalities. So this is Spring Security: an application-level security framework built on top of the powerful Spring Framework that deals mainly with the core security concepts of authentication and authorization. Spring Security aims to be a full-featured security solution for your Java applications. Although its main focus is on Web applications and the Java programming language, you will see that it goes beyond these two domains. What I wanted to do in writing this book was to expose some of the internal works of Spring Security along with the standard explanations of how to use certain features. My idea is to teach beyond the basics of how to do something in particular, and instead focus on the plumbing inside the framework. For me, this is the best way of learning something: actually seeing how it is built in the core. That s not to say, of course, that the book doesn t cover basic setups and give quick, practical advice on using the framework, because it certainly does. The point I m making is that instead of saying, Use this to do that, I normally say, This works like this and this allows you to. This is a point of view that only tools like Spring afford (because they are open source). With that said, I suggest that the best way to use this book is to have the Spring Security source code checked out on your computer and go through the examples with both the code from the book and the code from Spring Security itself. This will not only help you understand each concept as it is introduced, but will also teach more than one good programming trick and good practice. I recommend this approach to studying any software whenever you have the chance. If the source code is out there, grab it. Sometimes a couple lines of code teach more than a thousand words. Who This Book Is For This book is written mainly for Java developers who use Spring in their work and need to add security to their applications in a way that leverages Spring s proven concepts and techniques. The book will also be helpful to developers who want to add Web-layer security to their applications, even if those applications are not fully Spring powered at their core. The book assumes you have knowledge of Java and some of its tools and libraries, such as Servlets and Maven. It also assumes that you know what you want to use security for and in what context you want to use it. This means, for example, I won t explain protocols like LDAP in much depth; instead, I ll concentrate on showing you how to integrate Spring Security with an LDAP user store. An in-depth knowledge of Spring is not essential because many of the concepts are introduced as we go along, but the more you understand about Spring, the more you are likely to get out of this book. How This Book Is Structured The book is divided into nine chapters that embody a progressive study of Spring Security. Starting from a summary of basic applications and an explanation of how the framework is structured, the content moves on to more advanced topics, such as using Spring Security in different JVM languages. The book follows a sequence that corresponds to the way this framework is normally used in real life. xix

14 INTRODUCTION The chapters in the book include the following: Chapter 1: Introduces security in general and how to approach security problems at the application level. Chapter 2: Introduces Spring Security with a simple example application that secures Web access at the URL level. Chapter 3: Provides a full introduction to the architecture of Spring Security. The chapter covers its main components and how they interact with each other. Chapter 4: Gives in-depth coverage of the web-layer security options available in Spring Security. Chapter 5: Presents, as a counterpart to Chapter 4, full coverage of service-layer security. Chapter 6: Covers a wide array of authentication providers, including LDAP and JASS, that can be plugged into Spring Security. Chapter 7: Covers access control lists (ACL) that are used to secure individual domain objects and how they fit into the general security concerns. Chapter 8: Explains how to extend the core Spring Security functionality by making use of the many extension points supported by its modular architecture. Chapter 9: Shows how to integrate Spring Security with different Java frameworks and some important JVM programming languages. Prerequisites The examples in this book are all built with Java 7 and Maven 3. The latest Spring versions are used if possible. Spring Security was the version used throughout the book. Jetty Web Server was used for the different web applications in the book, mainly through its Maven plugin. I worked mainly on my MacBook Air 2011 with 4 GBs of RAM. All the projects were developed using the IDE SpringSource Tool Suite. You are free to use your own tools and operating system. Because everything is Java based, you should be able to compile your programs on any platform without problems. Downloading the code The code for the examples shown in this book is available on the Apress web site, A link can be found on the book s information page under the Source Code/Downloads tab. This tab is located underneath the Related Titles section of the page. Contacting the Author You are more than welcome to send me any feedback regarding this book or any other subject I might help you with. You can contact me via my blog at or you can send me an at carlo.scarioni@gmail.com. xx