Simple web application with Spring Security: Part 16

In this part we add method-level security to our web application using spring security.

Update dataAccessContext.xml

update our dataAccessContext.xml file to know about a DAO responsible for accessing data on the database.

<bean id="projectDao" class="com.heraclitus.dao.springjdbc.ProjectDaoSpringJDBC">
		<property name="dataSource" ref="dataSource" />
</bean>

Create serviceContext.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:sec="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans
               http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
               http://www.springframework.org/schema/security
               http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">

	<bean id="projectService" class="com.heraclitus.service.impl.ProjectServiceImpl">
		<property name="projectDao" ref="projectDao" />
	</bean>

</beans>

Update web.xml

<context-param>
	<param-name>contextConfigLocation</param-name>
	<param-value>
		    WEB-INF\dataAccessContext.xml
		    WEB-INF\serviceContext.xml
		    WEB-INF\applicationContext-security.xml
        </param-value>
</context-param>

Configure springsecuritywebapp-servlet.xml

Add new controller:

<bean id="methodLevelSecurityDemoController" name="/methodDemo.htm" class="com.heraclitus.web.MethodDemoController">
        <property name="projectService" ref="projectService" />
</bean>

Create new jsp page methodDemo.jsp

two new beans in initialized at startup:
projectDao,
projectService

Adding Method level security

There are a few ways we can implement this:

1) use security configuration to intercept methods on declared beans

<bean id="projectService" class="com.heraclitus.service.impl.ProjectServiceImpl">
		<property name="projectDao" ref="projectDao" />
		<sec:intercept-methods>
			<sec:protect access="ROLE_USER" method="findAllProjects" />
		</sec:intercept-methods>
</bean>

to allow ROLE_USERs access to the page we need to update http configuration to the following:

<http auto-config="false" session-fixation-protection="none">
	    <intercept-url pattern="/home.htm" access="ROLE_USER" />
	    <intercept-url pattern="/admin.htm" access="ROLE_ADMIN" />
        <intercept-url pattern="/acldemo.htm" access="ROLE_ADMIN" />
        <intercept-url pattern="/methoddemo.htm" access="ROLE_ANONYMOUS, ROLE_USER, ROLE_ADMIN" />
	    <intercept-url pattern="/**" access="ROLE_ANONYMOUS"/>
		<form-login login-page="/login.jsp" default-target-url="/home.htm" authentication-failure-url="/login.jsp?authfailed=true" />
		<anonymous />
		<logout logout-success-url="/login.jsp?loggedout=true"/>
</http>

One new bean is created: projectService.methodSecurityInterceptor,projectService.

How it works is as the method findAllProjects is invoked, A JdkDynamicAopProxy is invoked. From our configuration it detects a MethodSecurityInterceptor which verifies that the access set in the configuration matches any authorities that exist in our current authentication object. If you are not logged in this will fail and throw AcessDeniedException which will force you to login.

If you are logged in, it should work as expected and display all projects set up in database.

2) use security annotations to intercept methods

<bean id="projectService" class="com.heraclitus.service.impl.ProjectServiceImpl">
		<property name="projectDao" ref="projectDao" />
</bean>

<global-method-security secured-annotations="enabled" />

public interface ProjectService {

    @Secured( { "ROLE_USER" })
    List<Project> findAllProjects();

}

3) use jsr-250 annotations to intercept methods

<bean id="projectService" class="com.heraclitus.service.impl.ProjectServiceImpl">
		<property name="projectDao" ref="projectDao" />
</bean>

<global-method-security secured-annotations="enabled" />

public interface ProjectService {

    @RolesAllowed( {"ROLE_USER"} )
    List<Project> findAllProjects();

}

Summary

And thats how easy it is to add method level security to your pojos using spring security.

After this I updated the configuration to add back in all the functionality that existed pre part 13.

Getting the code

The code for this part is tagged and available for viewing online at: http://code.google.com/p/spring-security-series/source/browse/#svn/tags/SpringSecuritySeriesWAR-Part16

SVN Url: https://spring-security-series.googlecode.com/svn/tags/SpringSecuritySeriesWAR-Part16