diff --git a/.gitignore b/.gitignore index fca2ff7..3c95620 100644 --- a/.gitignore +++ b/.gitignore @@ -5,6 +5,7 @@ target .idea *.db .lock +.log *.iml *.springBeans .gradle diff --git a/pom.xml b/pom.xml index 6375f6e..3bd0ce4 100644 --- a/pom.xml +++ b/pom.xml @@ -70,6 +70,7 @@ flyway-example workflow-activiti-example spring4-hibernate4-example + spring3-security-example @@ -345,7 +346,7 @@ 2.14.1 - + org.apache.maven.plugins maven-pmd-plugin @@ -384,7 +385,7 @@ 2.3 - + org.codehaus.mojo cobertura-maven-plugin @@ -404,7 +405,7 @@ true false 2.0 - + .settings/org.eclipse.core.resources.prefs diff --git a/spring3-security-example/README.md b/spring3-security-example/README.md new file mode 100644 index 0000000..c0f5f97 --- /dev/null +++ b/spring3-security-example/README.md @@ -0,0 +1,70 @@ +spring3-security-example +========================= + +This is an example of a basic Spring 3.2.x MVC application protected by Spring Security. + +To run the app locally, run *mvn tomcat7:run*. + +In your browser, go to http://127.0.0.1:9090 + +By default there are four users: + +* user / password +* admin / password +* user-disabled / password +* admin-disabled / password + +All passwords are simply *password*. The 3rd and 4th user are, of course, disabled within +the database *active* boolean value, and will not be able to login. + +While Spring Security makes it relatively easy (once the basic filter mechanism is understood), to +add basic web security to an application, it is not exactly straightforward when deviating from the +default database based schema for users and roles. + +The SQL files to create and insert data are located under */src/main/resources/spring/db*. + +This application uses an embedded HSQL database with the following schema: + +***Users table*** + +* id (UUID) +* name (Unique varchar) +* role (FK to Roles(id)) +* password (varchar) +* active (boolean) + +***Roles table*** + +* id (UUID) +* name (Unique varchar) + +-------------------------------- + +The Spring Security configuration is located under */src/main/resources/spring/spring-security.xml*. + +The basic idea is as follows: + +1. An *HsqlAuthenticationProvider* bean is defined which overrides the framework class *AbstractUserDetailsAuthenticationProvider*. +This class is responsible for checking the credentials passed by Spring Security's +default login page. The provider has a Spring data source injected for database access. + +2. Various abstract methods overridden to perform the authentication. The class checks to ensure that the user is in the database, +that the password matches, and the user is active. The provider uses the data source to join on the user name and role table to pull +the user and its role from the database. Using Spring's *JdbcTemplate.queryForObject()*, an exception is thrown automatically if a single +row is not returned. + +3. If the user is valid, the method returns a Spring Security *UsernamePasswordAuthenticationToken*. If not, an exception is thrown. + +4. Spring takes care of the rest - if successful, the token is added to the session which enables the application to obtain the user +and its roles anytime from Spring Security. If not, Spring Security will take the error message and display an error back on the auto +generated login page. + +5. Once the user is logged in, she will be redirected to the main index.htm page. Within the spring-security.xml configuration, this page is +defined to require either roles *USER* or *ADMIN* (based on the */*** expression) joined with *hasAnyRole('USER, ADMIN')*. + +6. The *index.htm* page has a link to *admin.htm*. Only users with *ADMIN* role are able to access this page based on expression *hasAnyRole('ADMIN')*. + +7. Note that anyone, even users that have yet to login to the app, can access files located behind the /resources URL. For example, before +logging in, go to the URL: http://127.0.0.1:9090/resources/unprotected.js +In many cases, resources (CSS, javascript, images, etc.) may need to be protected. + diff --git a/spring3-security-example/pom.xml b/spring3-security-example/pom.xml new file mode 100644 index 0000000..b099435 --- /dev/null +++ b/spring3-security-example/pom.xml @@ -0,0 +1,138 @@ + + + 4.0.0 + + net.aimeizi + maven-framework-project + 1.0.0 + + spring3-security-example + spring3-security-example + war + http://maven.apache.org + + + 3.2.6.RELEASE + 3.2.0.RELEASE + + + + + javax.servlet + servlet-api + 2.5 + provided + + + javax.servlet.jsp + jsp-api + 2.1 + provided + + + javax.servlet + jstl + 1.2 + + + + org.springframework + spring-core + ${spring.version} + + + commons-logging + commons-logging + + + + + + org.springframework + spring-context + ${spring.version} + + + + org.springframework + spring-webmvc + ${spring.version} + + + + org.springframework.security + spring-security-web + ${spring.security.version} + + + org.springframework.security + spring-security-config + ${spring.security.version} + + + org.springframework.security + spring-security-taglibs + ${spring.security.version} + + + + org.hsqldb + hsqldb + 2.2.9 + + + commons-lang + commons-lang + 2.6 + + + + + junit + junit + 4.11 + test + + + + org.springframework + spring-test + ${spring.version} + test + + + + + log4j + log4j + 1.2.17 + + + + + + + org.apache.maven.plugins + maven-compiler-plugin + 3.1 + + 1.6 + 1.6 + + + + org.apache.tomcat.maven + tomcat7-maven-plugin + 2.2 + + / + 9090 + + true + + + + + + diff --git a/spring3-security-example/src/main/java/org/spring3/security/example/ApplicationController.java b/spring3-security-example/src/main/java/org/spring3/security/example/ApplicationController.java new file mode 100644 index 0000000..6826ed3 --- /dev/null +++ b/spring3-security-example/src/main/java/org/spring3/security/example/ApplicationController.java @@ -0,0 +1,48 @@ +package org.spring3.security.example; + +import org.apache.log4j.Logger; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.security.authentication.AnonymousAuthenticationToken; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.GrantedAuthority; +import org.springframework.security.core.context.SecurityContextHolder; +import org.springframework.security.core.userdetails.UserDetails; +import org.springframework.stereotype.Controller; +import org.springframework.ui.ModelMap; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestMethod; + +import java.util.Collection; + +@Controller +public class ApplicationController { + private static final Logger log = Logger.getLogger(ApplicationController.class); + + @Autowired + private UserService userService; + + @RequestMapping(value = "/index.htm", method = RequestMethod.GET) + public String index(ModelMap map) { + log.debug("index.htm"); + Authentication authentication = SecurityContextHolder.getContext().getAuthentication(); + UserDetails userDetails = + (UserDetails) authentication.getPrincipal(); + map.addAttribute("userDetails", userDetails); + Collection roles = userService.getAuthorities(userDetails); + map.addAttribute("userDetails", userDetails); + map.addAttribute("userAuthorities", roles); + + return "index"; + } + + @RequestMapping(value = "/admin.htm", method = RequestMethod.GET) + public String admin(ModelMap map) { + log.debug("admin.htm"); + UserDetails userDetails = + (UserDetails) SecurityContextHolder.getContext().getAuthentication().getPrincipal(); + Collection roles = userService.getAuthorities(userDetails); + map.addAttribute("userDetails", userDetails); + map.addAttribute("userAuthorities", roles); + return "admin"; + } +} diff --git a/spring3-security-example/src/main/java/org/spring3/security/example/UserService.java b/spring3-security-example/src/main/java/org/spring3/security/example/UserService.java new file mode 100644 index 0000000..b9b681b --- /dev/null +++ b/spring3-security-example/src/main/java/org/spring3/security/example/UserService.java @@ -0,0 +1,16 @@ +package org.spring3.security.example; + +import org.springframework.security.access.prepost.PreAuthorize; +import org.springframework.security.core.GrantedAuthority; +import org.springframework.security.core.userdetails.UserDetails; +import org.springframework.stereotype.Service; + +import java.util.Collection; + +@Service +public class UserService { + @PreAuthorize("hasRole('admin')") + public Collection getAuthorities(UserDetails userDetails) { + return userDetails.getAuthorities(); + } +} diff --git a/spring3-security-example/src/main/java/org/spring3/security/example/model/User.java b/spring3-security-example/src/main/java/org/spring3/security/example/model/User.java new file mode 100644 index 0000000..f4d556a --- /dev/null +++ b/spring3-security-example/src/main/java/org/spring3/security/example/model/User.java @@ -0,0 +1,85 @@ +package org.spring3.security.example.model; + +import java.io.Serializable; + +public class User implements Serializable { + + private static final long serialVersionUID = 1L; + private String id; + private String name; + private String password; + private String role; + private Boolean active; + + public User(){} + + public String getId() { + return this.id; + } + + public void setId(String id) { + this.id = id; + } + + public String getName() { + return this.name; + } + + public void setName(String name) { + this.name = name; + } + + public String getPassword() { + return this.password; + } + + public void setPassword(String password) { + this.password = password; + } + + public String getRole() { + return this.role; + } + + public void setRole(String role) { + this.role = role; + } + + public Boolean getActive() { + return this.active; + } + + public void setActive(Boolean active) { + this.active = active; + } + + @Override + public String toString() { + return "User [id=" + this.id + ", name=" + this.name + ", role=" + this.role + ", active=" + this.active + "]"; + } + + @Override + public int hashCode() { + final int prime = 31; + int result = 1; + result = prime * result + ((this.name == null) ? 0 : this.name.hashCode()); + return result; + } + + @Override + public boolean equals(Object obj) { + if (this == obj) + return true; + if (obj == null) + return false; + if (getClass() != obj.getClass()) + return false; + User other = (User) obj; + if (this.name == null) { + if (other.name != null) + return false; + } else if (!this.name.equals(other.name)) + return false; + return true; + } +} diff --git a/spring3-security-example/src/main/java/org/spring3/security/example/security/HSQLAuthenticationProvider.java b/spring3-security-example/src/main/java/org/spring3/security/example/security/HSQLAuthenticationProvider.java new file mode 100644 index 0000000..ba80cb3 --- /dev/null +++ b/spring3-security-example/src/main/java/org/spring3/security/example/security/HSQLAuthenticationProvider.java @@ -0,0 +1,125 @@ +package org.spring3.security.example.security; + +import java.sql.ResultSet; +import java.sql.SQLException; +import java.util.Collection; +import java.util.HashMap; +import java.util.Map; + +import javax.sql.DataSource; + +import org.apache.commons.lang.StringUtils; +import org.apache.log4j.Logger; +import org.spring3.security.example.model.User; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.jdbc.core.RowMapper; +import org.springframework.jdbc.core.namedparam.NamedParameterJdbcTemplate; +import org.springframework.security.authentication.BadCredentialsException; +import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; +import org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.AuthenticationException; +import org.springframework.security.core.GrantedAuthority; +import org.springframework.security.core.authority.AuthorityUtils; +import org.springframework.security.core.userdetails.UserDetails; +import org.springframework.security.core.userdetails.UsernameNotFoundException; +import org.springframework.stereotype.Service; +import org.springframework.transaction.annotation.Transactional; + + +@Service("hsqlAuthenticationProvider") +public class HSQLAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider{ + + private static final Logger log = Logger.getLogger(HSQLAuthenticationProvider.class); + + protected DataSource ds; + protected NamedParameterJdbcTemplate jdbcTemplate; + + @Autowired + public void setDataSource(DataSource ds){ + log.trace("setDateSource()"); + this.ds = ds; + this.jdbcTemplate = new NamedParameterJdbcTemplate(ds); + } + + @Override + public Authentication authenticate(Authentication authentication) throws AuthenticationException { + log.trace("authenticate()"); + log.debug("authenticating: " + authentication); + String clearText = String.valueOf(authentication.getCredentials()); + UserDetails userDetails = this.retrieveUser(authentication.getName(), (UsernamePasswordAuthenticationToken) authentication); + + if (!StringUtils.equals(clearText, userDetails.getPassword())){ + throw new BadCredentialsException("invalid password"); + } + if (!userDetails.isEnabled()){ + throw new BadCredentialsException("User not enabled"); + } + return new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities()); + } + + @Override + protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException { + log.trace("additionalAuthenticationChecks()"); + log.debug("isEnabled: " + userDetails.isEnabled()); + if (!userDetails.isEnabled()){ + throw new BadCredentialsException("User not enabled"); + } + } + + @Override + @Transactional(readOnly = true) + protected UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException { + log.trace("retrieveUser()"); + log.debug("retrieving user: " + username); + User user; + try { + user= this.read(username); + } + catch(Exception e){ + throw new UsernameNotFoundException("User " + username + " cannot be found"); + } + + String userName = user.getName(); + String pw = user.getPassword(); + String role = user.getRole(); + Collection auths = AuthorityUtils.createAuthorityList(role); + boolean enabled = user.getActive(); + + UserDetails userDetails = new org.springframework.security.core.userdetails.User(userName, pw, enabled, true, true, true, auths); + log.debug("returning new userDetails: " + userDetails); + return userDetails; + } + + @Transactional(readOnly = true) + protected User read(String name) { + log.trace("read()"); + log.debug("reading user: " + name); + String sql = "SELECT users.id, users.name, users.active, users.password, roles.name FROM users, roles " + + " WHERE roles.id = users.role AND" + + " UPPER(users.name) = :name"; + Map params = new HashMap(); + params.put("name", StringUtils.upperCase(name)); + User user = this.jdbcTemplate.queryForObject(sql, params, new UserRowMapper()); + return user; + } + + private class UserRowMapper implements RowMapper{ + @Override + public User mapRow(ResultSet rs, int rowNum) throws SQLException { + User user = new org.spring3.security.example.model.User(); + user.setName(StringUtils.trim(rs.getString("users.name"))); + user.setId(StringUtils.trim(rs.getString("users.id"))); + user.setPassword(StringUtils.trim(rs.getString("users.password"))); + user.setRole(StringUtils.trim(rs.getString("roles.name"))); + user.setActive(rs.getBoolean("users.active")); + log.trace(user.toString()); + return user; + } + + } + + +} + + diff --git a/spring3-security-example/src/main/resources/log4j.dtd b/spring3-security-example/src/main/resources/log4j.dtd new file mode 100644 index 0000000..1aabd96 --- /dev/null +++ b/spring3-security-example/src/main/resources/log4j.dtd @@ -0,0 +1,227 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/spring3-security-example/src/main/resources/log4j.xml b/spring3-security-example/src/main/resources/log4j.xml new file mode 100644 index 0000000..593d84c --- /dev/null +++ b/spring3-security-example/src/main/resources/log4j.xml @@ -0,0 +1,62 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/spring3-security-example/src/main/resources/messages/messages.properties b/spring3-security-example/src/main/resources/messages/messages.properties new file mode 100644 index 0000000..517e58f --- /dev/null +++ b/spring3-security-example/src/main/resources/messages/messages.properties @@ -0,0 +1,32 @@ +welcome=Welcome from the message bundle +invalid=invalid +required=required +notFound=has not been found +duplicate=is already in use +nonNumeric=must be all numeric +duplicateFormSubmission=Duplicate form submission is not allowed +password.noMatch=The passwords do not match. +password.invalid=The password is invalid - it must be at least 8 characters +notAllowed=This field cannot be submitted + + +typeMismatch.date=invalid date +typeMismatch.org.joda.time.DateTime=invalid date format (please use YYYY-MM-DD) +typeMismatch.java.math.BigDecimal=invalid number +typeMismatch.birthDate=invalid date +typeMismatch=Invalid Type + +negative.widget.price=price cannot be negative +required.widget.price=price is required + +required.widget.cool=cool is required +required.widget.initialTime=initial time is required +beginDateAfterEndDate=the ending date must be later than the initial date + +#contactModel +required.contactModel.recipientEmail=Recipient is required. +required.contactModel.message=Message is required. +required.contactModel.subject=Subject is required. +length.contactModel.message=Message must be no larger than {0} characters + +parameters.oneOrOther=Cannot have both character value and numeric value - one or the other. diff --git a/spring3-security-example/src/main/resources/messages/messages_de.properties b/spring3-security-example/src/main/resources/messages/messages_de.properties new file mode 100644 index 0000000..124bee4 --- /dev/null +++ b/spring3-security-example/src/main/resources/messages/messages_de.properties @@ -0,0 +1,8 @@ +welcome=Willkommen +required=muss angegeben werden +notFound=wurde nicht gefunden +duplicate=ist bereits vergeben +nonNumeric=darf nur numerisch sein +duplicateFormSubmission=Wiederholtes Absenden des Formulars ist nicht erlaubt +typeMismatch.date=ungltiges Datum +typeMismatch.birthDate=ungltiges Datum diff --git a/spring3-security-example/src/main/resources/messages/messages_en.properties b/spring3-security-example/src/main/resources/messages/messages_en.properties new file mode 100644 index 0000000..12551b1 --- /dev/null +++ b/spring3-security-example/src/main/resources/messages/messages_en.properties @@ -0,0 +1 @@ +# This file is intentionally empty. Message look-ups will fall back to the default "messages.properties" file. diff --git a/spring3-security-example/src/main/resources/spring/app.properties b/spring3-security-example/src/main/resources/spring/app.properties new file mode 100644 index 0000000..48f48c1 --- /dev/null +++ b/spring3-security-example/src/main/resources/spring/app.properties @@ -0,0 +1,12 @@ +studerw.jdbc.driver=org.hsqldb.jdbcDriver +studerw.jdbc.url=jdbc\:hsqldb\:file\:./target/app-db;shutdown\=true; +studerw.jdbc.user=SA +studerw.jdbc.pw= + +#HSQL Internal database +studerw.jdbc.db.createSql=classpath\:spring/db/db_create.sql +studerw.jdbc.db.dataSql=classpath\:spring/db/db_data.sql + +#Should we initialize the internal DB with creation / insertion scripts [true|false] +studerw.jdbc.db.initialize=true + diff --git a/spring3-security-example/src/main/resources/spring/applicationContext.xml b/spring3-security-example/src/main/resources/spring/applicationContext.xml new file mode 100644 index 0000000..08fc4a0 --- /dev/null +++ b/spring3-security-example/src/main/resources/spring/applicationContext.xml @@ -0,0 +1,28 @@ + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/spring3-security-example/src/main/resources/spring/db/db_create.sql b/spring3-security-example/src/main/resources/spring/db/db_create.sql new file mode 100644 index 0000000..45c3c94 --- /dev/null +++ b/spring3-security-example/src/main/resources/spring/db/db_create.sql @@ -0,0 +1,30 @@ +--SET DATABASE DEFAULT INITIAL SCHEMA PUBLIC + +CREATE TABLE users ( + id character varying(36) PRIMARY KEY, + name character varying(50) NOT NULL, + role character varying(36) NOT NULL, + password character varying(100) NOT NULL, + active boolean default true NOT NULL +); + + +CREATE TABLE roles ( + id character varying(36) PRIMARY KEY, + name character varying(50) NOT NULL +); + + +GRANT ALL ON TABLE users TO SA; +GRANT ALL ON TABLE roles TO SA; + + +ALTER TABLE users + ADD CONSTRAINT role_fk FOREIGN KEY (role) + REFERENCES roles (id); + +ALTER TABLE users + ADD CONSTRAINT user_name_unique UNIQUE (name); + +ALTER TABLE roles +ADD CONSTRAINT role_name_unique UNIQUE (name); diff --git a/spring3-security-example/src/main/resources/spring/db/db_data.sql b/spring3-security-example/src/main/resources/spring/db/db_data.sql new file mode 100644 index 0000000..c02a0b6 --- /dev/null +++ b/spring3-security-example/src/main/resources/spring/db/db_data.sql @@ -0,0 +1,10 @@ + +INSERT INTO roles VALUES('4A7E4CB3-97C6-40E5-839E-0C3E02972DA5', 'USER'); +INSERT INTO roles VALUES('35316C1F-86EB-4D82-A4D1-B262C031BF5C', 'ADMIN'); + +INSERT INTO users VALUES ('C61CE088-754D-4879-BF1F-6D8E9F6C8F42', 'user', '4A7E4CB3-97C6-40E5-839E-0C3E02972DA5', 'password', true); +INSERT INTO users VALUES ('C61CE088-754D-4879-BF1F-6D8E9F6C8F43', 'admin', '35316C1F-86EB-4D82-A4D1-B262C031BF5C', 'password', true); +INSERT INTO users VALUES ('C61CE088-754D-4879-BF1F-6D8E9F6C8F44', 'user-disabled', '4A7E4CB3-97C6-40E5-839E-0C3E02972DA5', 'password', false); +INSERT INTO users VALUES ('C61CE088-754D-4879-BF1F-6D8E9F6C8F45', 'admin-disabled', '35316C1F-86EB-4D82-A4D1-B262C031BF5C', 'password', false); + + diff --git a/spring3-security-example/src/main/resources/spring/jdbc-config.xml b/spring3-security-example/src/main/resources/spring/jdbc-config.xml new file mode 100644 index 0000000..7e887dc --- /dev/null +++ b/spring3-security-example/src/main/resources/spring/jdbc-config.xml @@ -0,0 +1,23 @@ + + + + + + + + + + + + + + + diff --git a/spring3-security-example/src/main/resources/spring/spring-security.xml b/spring3-security-example/src/main/resources/spring/spring-security.xml new file mode 100644 index 0000000..dbd3f69 --- /dev/null +++ b/spring3-security-example/src/main/resources/spring/spring-security.xml @@ -0,0 +1,23 @@ + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/spring3-security-example/src/main/webapp/WEB-INF/mvc-dispatcher-servlet.xml b/spring3-security-example/src/main/webapp/WEB-INF/mvc-dispatcher-servlet.xml new file mode 100644 index 0000000..f784178 --- /dev/null +++ b/spring3-security-example/src/main/webapp/WEB-INF/mvc-dispatcher-servlet.xml @@ -0,0 +1,42 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/spring3-security-example/src/main/webapp/WEB-INF/pages/admin.jsp b/spring3-security-example/src/main/webapp/WEB-INF/pages/admin.jsp new file mode 100644 index 0000000..15a0d62 --- /dev/null +++ b/spring3-security-example/src/main/webapp/WEB-INF/pages/admin.jsp @@ -0,0 +1,13 @@ +<%@ page contentType="text/html;charset=UTF-8" language="java" %> + + + + +

Admin-Only Page

+

Hello, ${userDetails.username}!

+ +

User authorities: ${userAuthorities}

+ + Back + + \ No newline at end of file diff --git a/spring3-security-example/src/main/webapp/WEB-INF/pages/index.jsp b/spring3-security-example/src/main/webapp/WEB-INF/pages/index.jsp new file mode 100644 index 0000000..44a9e47 --- /dev/null +++ b/spring3-security-example/src/main/webapp/WEB-INF/pages/index.jsp @@ -0,0 +1,25 @@ +<%@ page contentType="text/html;charset=UTF-8" language="java" %> +<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %> + + + + + Home + + +
+

All authenticated users can see this page

+ + +

Hello, ${userDetails.username}!

+

User authorities: ${userAuthorities}

+

Sign Out

+ + +

+

Only Admins will be able to see this page.

+ Admin page +

+
+ + \ No newline at end of file diff --git a/spring3-security-example/src/main/webapp/WEB-INF/web.xml b/spring3-security-example/src/main/webapp/WEB-INF/web.xml new file mode 100644 index 0000000..40d6963 --- /dev/null +++ b/spring3-security-example/src/main/webapp/WEB-INF/web.xml @@ -0,0 +1,50 @@ + + + Spring Security Custom Database + + + contextConfigLocation + classpath:spring/applicationContext.xml classpath:spring/spring-security.xml + + + + webAppRootKey + tutorial.root + + + + springSecurityFilterChain + org.springframework.web.filter.DelegatingFilterProxy + + + + springSecurityFilterChain + /* + + + + org.springframework.web.context.ContextLoaderListener + + + + org.springframework.security.web.session.HttpSessionEventPublisher + + + + mvc-dispatcher + org.springframework.web.servlet.DispatcherServlet + 1 + + + + mvc-dispatcher + / + + + + index.jsp + + \ No newline at end of file diff --git a/spring3-security-example/src/main/webapp/index.jsp b/spring3-security-example/src/main/webapp/index.jsp new file mode 100644 index 0000000..aed8254 --- /dev/null +++ b/spring3-security-example/src/main/webapp/index.jsp @@ -0,0 +1,4 @@ +<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%> +<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%> +<%-- Redirected because we can't set the welcome page to a virtual URL. --%> + diff --git a/spring3-security-example/src/main/webapp/resources/unprotected.js b/spring3-security-example/src/main/webapp/resources/unprotected.js new file mode 100644 index 0000000..5e0402f --- /dev/null +++ b/spring3-security-example/src/main/webapp/resources/unprotected.js @@ -0,0 +1 @@ +//this page is accessible to all users - authenticated or not.