What's New in spring-security-core 2.0
9 likes5,109 views
The document summarizes the changes in spring-security-core 2.0. Some key highlights include: 1. The plugin takes a more pessimistic lockdown approach by default for security. 2. Configuration properties were renamed and new ones were added to align more closely with Spring Security. 3. Packages were reorganized under the grails.plugin.springsecurity namespace for consistency. 4. Support for features like role groups, debugging filters, and Grails 2.3/2.4 were added. 5. The codebase was updated in various ways like using Spring Security's bcrypt implementation instead of copied code. 6. 31 remaining issues are scheduled to be
![Highlights
Pessimistic Lockdown:
grails.plugin.springsecurity.
controllerAnnotations.staticRules = [
'/': ['permitAll'],
'/index': ['permitAll'],
'/index.gsp': ['permitAll'],
'/**/js/**': ['permitAll'],
'/**/css/**': ['permitAll'],
'/**/images/**': ['permitAll'],
'/**/favicon.ico': ['permitAll']
]](https://image.slidesharecdn.com/whatsnewinspringsecurity-140329073529-phpapp02/85/What-s-New-in-spring-security-core-2-0-26-320.jpg)
![Highlights
Pessimistic Lockdown:
for (String url in [
'/', '/index', '/index.gsp',
'/**/favicon.ico', '/**/js/**',
'/**/css/**', '/**/images/**',
'/login', '/login.*', '/login/*',
'/logout', '/logout.*',
'/logout/*']) {
new Requestmap(
url: url,
configAttribute: 'permitAll')
.save()
}](https://image.slidesharecdn.com/whatsnewinspringsecurity-140329073529-phpapp02/85/What-s-New-in-spring-security-core-2-0-27-320.jpg)
![Highlights
Pessimistic Lockdown:
grails.plugin.springsecurity.
interceptUrlMap = [
'/': ['permitAll'],
'/index': ['permitAll'],
'/index.gsp': ['permitAll'],
'/**/js/**': ['permitAll'],
'/**/css/**': ['permitAll'],
'/**/images/**': ['permitAll'],
'/**/favicon.ico': ['permitAll'],
'/login/**': ['permitAll'],
'/logout/**': ['permitAll']
]](https://image.slidesharecdn.com/whatsnewinspringsecurity-140329073529-phpapp02/85/What-s-New-in-spring-security-core-2-0-28-320.jpg)
![Guarding URLs
All 3 approaches support HTTP verbs
@Secured(
value=["hasRole('ROLE_ADMIN')"],
httpMethod='POST')
def someMethod() {
…
}](https://image.slidesharecdn.com/whatsnewinspringsecurity-140329073529-phpapp02/85/What-s-New-in-spring-security-core-2-0-50-320.jpg)
![New Config Properties
● printStatusMessages = true
● ajaxCheckClosure = null
●
afterInvocationManagerProviderNames = []
● authority.groupAuthorityNameField = null
● useRoleGroups = false
● apf.storeLastUsername = false
● logout.clearAuthentication = true
●
logout.invalidateHttpSession = true
● logout.targetUrlParameter = null
● logout.alwaysUseDefaultTargetUrl = false
● logout.redirectToReferer = false
● logout.postOnly = true](https://image.slidesharecdn.com/whatsnewinspringsecurity-140329073529-phpapp02/85/What-s-New-in-spring-security-core-2-0-74-320.jpg)
What's New in spring-security-core 2.0
- 1. What's New in spring-security-core 2.0 Burt Beckwith
- 3. 3 le Tex t Our Services Our services start with a foundation of planning, interaction design, and visual design. We are expert builders with a passion for protoyping, architecture and development to help bring your product to life. 
- 5. First, what's old Grails-y wrapper around Spring Security
- 6. First, what's old Many defaults, lots of configurability – designed to be customized and extended
- 7. First, what's old Easy to get started – add dependency in BuildConfig.groovy and run s2-quickstart
- 8. First, what's old Helper classes (SpringSecurityService, taglibs, controllers, etc.)
- 9. First, what's old Form, HTTP Basic, Digest auth
- 10. First, what's old Users, roles, hierarchical roles, customizable UserDetailsService
- 11. First, what's old Many password hashing options, including options for salted passwords
- 13. First, what's old Ajax support
- 14. First, what's old Switch-user (similar to “sudo”)
- 15. First, what's old HTTP/HTTPS channel security
- 16. First, what's old Session Fixation Protection
- 18. ● Convention over configuration, with centralized configuration in grails-app/conf/Config.groovy ● Highly configurable and customizable ● Registers Spring Security beans in application context, filters in web.xml ● Storing users, roles, and optionally requestmaps in the database, with access through domain classes ● Guarding URLs with annotations, requestmap domain class, or static configuration ● Password encryption (with support for salt) ● "Remember me" cookie ● Security tags; <g:ifAllGranted/>, <g:ifNotGranted/>, <g:ifLoggedIn/>, etc. ● Security service; encodePassword(), isLoggedIn(), etc. ● Multiple authentication providers ● Form-based ● HTTP Basic ● Browser certificate (x509) ● Switch User ● Channel security ● IP address restrictions ● Ajax login ● Convenient event handlers ● Digest authentication ● Session Fixation Prevention ● Salted passwords ● Hierarchical roles ● Account locking and forcing password change ● Mostly Java for performance
- 19. ● Convention over configuration, with centralized configuration in grails-app/conf/Config.groovy ● Highly configurable and customizable ● Registers Spring Security beans in application context, filters in web.xml ● Storing users, roles, and optionally requestmaps in the database, with access through domain classes ● Guarding URLs with annotations, requestmap domain class, or static configuration ● Password encryption (with support for salt) ● "Remember me" cookie ● Security tags; <g:ifAllGranted/>, <g:ifNotGranted/>, <g:ifLoggedIn/>, etc. ● Security service; encodePassword(), isLoggedIn(), etc. ● Multiple authentication providers ● Form-based ● HTTP Basic ● Browser certificate (x509) ● Switch User ● Channel security ● IP address restrictions ● Ajax login ● Convenient event handlers ● Digest authentication ● Session Fixation Prevention ● Salted passwords ● Hierarchical roles ● Account locking and forcing password change ● Mostly Java for performance Trust me, it has a lot of features
- 20. First, what's old Extension plugins (ACL, CAS, LDAP, OpenID, UI, etc.)
- 21. First, what's old And more!
- 22. So … what's new?
- 23. See the notes in the docs: What's New in Version 2.0
- 24. Highlights More aggressively secure by default
- 25. Highlights More aggressively secure by default Pessimistic Lockdown by default, use grails.plugin.springsecurity.rejectIfNoRule and grails.plugin.springsecurity.fii. rejectPublicInvocations to configure
- 26. Highlights Pessimistic Lockdown: grails.plugin.springsecurity. controllerAnnotations.staticRules = [ '/': ['permitAll'], '/index': ['permitAll'], '/index.gsp': ['permitAll'], '/**/js/**': ['permitAll'], '/**/css/**': ['permitAll'], '/**/images/**': ['permitAll'], '/**/favicon.ico': ['permitAll'] ]
- 27. Highlights Pessimistic Lockdown: for (String url in [ '/', '/index', '/index.gsp', '/**/favicon.ico', '/**/js/**', '/**/css/**', '/**/images/**', '/login', '/login.*', '/login/*', '/logout', '/logout.*', '/logout/*']) { new Requestmap( url: url, configAttribute: 'permitAll') .save() }
- 28. Highlights Pessimistic Lockdown: grails.plugin.springsecurity. interceptUrlMap = [ '/': ['permitAll'], '/index': ['permitAll'], '/index.gsp': ['permitAll'], '/**/js/**': ['permitAll'], '/**/css/**': ['permitAll'], '/**/images/**': ['permitAll'], '/**/favicon.ico': ['permitAll'], '/login/**': ['permitAll'], '/logout/**': ['permitAll'] ]
- 29. Highlights More aggressively secure by default Logout uses POST only, configure with grails.plugin.springsecurity.logout.postOnly
- 30. Highlights More aggressively secure by default Default password hash is now bcrypt, and PBKDF2 is also available (password.algorithm = 'pbkdf2')
- 31. Highlights More aggressively secure by default Session Fixation Prevention is enabled by default, configure with grails.plugin.springsecurity. useSessionFixationPrevention
- 32. Highlights Using Spring Security 3.2.3.RELEASE - originally 3.1, then 3.2.0-RC1, now 3.2.3 as of this week
- 34. Highlights Package changes Everything now under grails.plugin.springsecurity Package changes
- 35. Highlights Package changes Subpackages are similar to Spring Security packages Package changes
- 36. Highlights Package changes Subpackages are similar to Spring Security packages Package changes e.g. GormUserDetailsService → grails.plugin.springsecurity.userdetails. GormUserDetailsService
- 37. Highlights Package changes Subpackages are similar to Spring Security packages Package changes e.g. AjaxAwareAccessDeniedHandler → grails.plugin.springsecurity.web.access. AjaxAwareAccessDeniedHandler
- 38. Highlights Configuration prefix changes grails.plugins.springsecurity → grails.plugin.springsecurity
- 39. Highlights No HQL (except in UI plugin), all queries use “where” and Criteria
- 40. Highlights More configurable properties in Spring beans (goal is ~100%)
- 41. Highlights More private → protected
- 42. Highlights SpringSecurityService updates: No withTransaction, using @Transactional as needed
- 43. Highlights SpringSecurityService updates: getCurrentUser() uses get(principal.id) if principal is GrailsUser, otherwise findWhere((usernamePropName): principal.username)
- 44. Highlights SpringSecurityService updates: New loadCurrentUser() method class SomeController { def springSecurityService def someAction() { def user = springSecurityService.isLoggedIn() ? springSecurityService.loadCurrentUser() : null if (user) { CreditCard card = CreditCard.findByIdAndUser( params.id as Long, user) ... } ... } }
- 45. NoStackUsernameNotFoundException package grails.plugin.springsecurity.userdetails; import org.springframework.security.core.userdetails. UsernameNotFoundException; public class NoStackUsernameNotFoundException extends UsernameNotFoundException { private static final long serialVersionUID = 1; public NoStackUsernameNotFoundException() { super("User not found"); } @Override public synchronized Throwable fillInStackTrace() { // do nothing return this; } }
- 46. New @Authorities annotation Helps make your annotations more DRY - see http://burtbeckwith.com/blog/ ?p=1398
- 47. Guarding URLs
- 48. Guarding URLs @Secured now only works with controller methods
- 49. Guarding URLs @Secured supports Closures @Secured(closure = { assert request assert ctx authentication.name == 'admin1' }) def someMethod() { … }
- 50. Guarding URLs All 3 approaches support HTTP verbs @Secured( value=["hasRole('ROLE_ADMIN')"], httpMethod='POST') def someMethod() { … }
- 51. Anonymous Authentication Principal now is a UserDetails like when you're authenticated, but with ROLE_ANONYMOUS
- 52. I18N User-contributed Russian, Norwegian Bokmål, Brazilian Portuguese (pt-BR), Italian, and Swedish translations
- 53. Controllers and GSPs LoginController.groovy, LogoutController.groovy, auth.gsp, denied.gsp are in the plugin now - copy to app to customize
- 54. Support for Grails 2.3 Support for redirect mappings, and @Secured in RestfulController
- 55. Support for Grails 2.4 Removed a use of ApplicationHolder (using Holders instead)
- 56. New DebugFilter Based on org.springframework.security. config.debug.DebugFilter - enable with debug.useFilter (only in dev!)
- 57. Role Groups grails s2-quickstart com.yourapp User Role --groupClassName=RoleGroup
- 58. Role Groups grails.plugin.springsecurity. authority.groupAuthorityNameField = 'authorities' grails.plugin.springsecurity. useRoleGroups = true Adds to Config.groovy:
- 59. Role Groups Adds 3 new domain classes: ● RoleGroup ● RoleGroupRole (RoleGroup <-> Role many-many join class) ● UserRoleGroup (RoleGroup <-> User many-many join class)
- 60. Role Groups Changes User.getAuthorities() Set<Role> getAuthorities() { UserRole.findAllByUser(this) .collect { it.role } } Set<RoleGroup> getAuthorities() { UserRoleGroup.findAllByUser(this) .collect { it.roleGroup } } →
- 61. Role Groups New docs: ● Group Class ● PersonGroup Class ● GroupAuthority Class
- 62. Miscellaneous Using bcrypt impl from Spring Security instead of copied code
- 64. Miscellaneous provided ':webxml:1.4.1' → compile ':webxml:1.4.1'
- 66. Miscellaneous Generated User class enabled property now defaults to true def u = new User( username: 'me', password: 'itsasecret') .save()
- 67. Miscellaneous Only prints status messages (e.g. "Configuring Spring Security Core ...") if printStatusMessages is not false
- 68. Miscellaneous No default values for userLookup.userDomainClassName, authority.className, etc. - error messages now make more sense
- 69. Miscellaneous AuthenticationDetailsSource details class isn't configurable in Spring Security 3.2, so the docs describe how to customize
- 70. Miscellaneous You can configure the SecurityContextHolder strategy (defaults to ThreadLocal, but can use InheritableThreadLocal or a custom impl - configure with sch.strategyName
- 71. Miscellaneous Spring Security 3.2 doesn't store the last username in the HTTP session – to use the old behavior configure with apf.storeLastUsername
- 72. Miscellaneous Functional tests now use Geb
- 73. Miscellaneous The 1.x code is in its own branch
- 74. New Config Properties ● printStatusMessages = true ● ajaxCheckClosure = null ● afterInvocationManagerProviderNames = [] ● authority.groupAuthorityNameField = null ● useRoleGroups = false ● apf.storeLastUsername = false ● logout.clearAuthentication = true ● logout.invalidateHttpSession = true ● logout.targetUrlParameter = null ● logout.alwaysUseDefaultTargetUrl = false ● logout.redirectToReferer = false ● logout.postOnly = true
- 75. New Config Properties ● failureHandler.allowSessionCreation = true ● successHandler.useReferer = false ● adh.useForward = true ● password.hash.iterations = 10000 ● rememberMe.createSessionOnSuccess = true ● requestMap.httpMethodField = 'httpMethod' ● basic.credentialsCharset = 'UTF-8' ● switchUser.usernameParameter = SwitchUserFilter.SPRING_SECURITY_SWITCH_USERNAME_KEY ● x509.subjectDnClosure = null ● debug.useFilter = false ● sch.strategyName = SecurityContextHolder.MODE_THREADLOCAL
- 76. New Config Properties ● scr.allowSessionCreation = true ● scr.disableUrlRewriting = true ● scr.springSecurityContextKey = HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY ● scpf.forceEagerSessionCreation = false ● fii.alwaysReauthenticate = false ● fii.rejectPublicInvocations = true ● fii.validateConfigAttributes = true ● fii.publishAuthorizationSuccess = false ● fii.observeOncePerRequest = true
- 77. Changed Config Properties ● rejectIfNoRule true→ ● userLookup.userDomainClassName null→ ● userLookup.authorityJoinClassName null→ ● useSessionFixationPrevention true→ ● password.algorithm 'SHA-256' 'bcrypt'→ ● rememberMe.persistentToken.domainClassName null→ ● rememberMe.useSecureCookie false null→ ● requestMap.className null→ ● atr.anonymousClass GrailsAnonymousAuthenticationToken→ ● providerManager.eraseCredentialsAfterAuthentication true→
- 78. Removed Config Properties ● requestCache.onlyOnGet ● authenticationDetails.authClass ● anon.userAttribute ● controllerAnnotations.matcher ● controllerAnnotations.lowercase ● filterChain.stripQueryStringFromUrls
- 79. So, what's left to do?
- 80. So, what's left to do? A lot. 31 issues scheduled for 2.0
- 81. So, what's left to do? A lot. 31 issues scheduled for 2.0 But many are simple, and there will probably be an RC3 release
- 83. ¡Gracias!