Browse Library
Sign In Start Free Trial
Close icon Search icon
Account
Browse Library Advanced Search Sign In Start Free Trial

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Spring Security
  • Toc
  • feedback
Spring Security

Spring Security

By : Mick Knutson, Robert Winch, Mularien
4.5 (4)
close
Spring Security

Spring Security

4.5 (4)
By: Mick Knutson, Robert Winch, Mularien

Overview of this book

Knowing that experienced hackers are itching to test your skills makes security one of the most difficult and high-pressured concerns of creating an application. The complexity of properly securing an application is compounded when you must also integrate this factor with existing code, new technologies, and other frameworks. Use this book to easily secure your Java application with the tried and trusted Spring Security framework, a powerful and highly customizable authentication and access-control framework. The book starts by integrating a variety of authentication mechanisms. It then demonstrates how to properly restrict access to your application. It also covers tips on integrating with some of the more popular web frameworks. An example of how Spring Security defends against session fixation, moves into concurrency control, and how you can utilize session management for administrative functions is also included. It concludes with advanced security scenarios for RESTful webservices and microservices, detailing the issues surrounding stateless authentication, and demonstrates a concise, step-by-step approach to solving those issues. And, by the end of the book, readers can rest assured that integrating version 4.2 of Spring Security will be a seamless endeavor from start to finish.
Table of Contents (19 chapters)
close
close
Preface
Preface
What this book covers
What you need for this book
Who this book is for
Conventions
Reader feedback
Customer support
Free Chapter
1
Anatomy of an Unsafe Application
Anatomy of an Unsafe Application
Security audit
Application technology
Authentication
Authorization
Summary
2
Getting Started with Spring Security
Getting Started with Spring Security
Hello Spring Security
A little bit of polish
Summary
3
Custom Authentication
Custom Authentication
JBCP calendar architecture
Logging in new users using SecurityContextHolder
Creating a custom UserDetailsService object
Creating a custom AuthenticationProvider object
Which authentication method to use?
Summary
4
JDBC-Based Authentication
JDBC-Based Authentication
Required dependencies
Using the H2 database
The default user schema of Spring Security
The UserDetailsManager interface
Support for a custom schema
Configuring secure passwords
The PasswordEncoder method
Using salt in Spring Security
Trying out the salted passwords
Summary
5
Authentication with Spring Data
Authentication with Spring Data
Spring Data JPA
Refactoring from SQL to ORM
Application services
The UserDetailsService object
Document database implementation with MongoDB
Summary
6
LDAP Directory Services
LDAP Directory Services
Understanding LDAP
Understanding how Spring LDAP authentication works
Determining roles with Apache Directory Studio
Configuring the UserDetailsContextMapper object
Updating AccountController to use LdapUserDetailsService
Explicit LDAP bean configuration
Integrating with Microsoft Active Directory via LDAP
Summary
7
Remember-Me Services
Remember-Me Services
What is remember-me?
MD5
Is remember-me secure?
Configuring the persistent-based remember-me feature
The remember-me architecture
Custom cookie and HTTP parameter names
Summary
8
Client Certificate Authentication with TLS
Client Certificate Authentication with TLS
How does client certificate authentication work?
Configuring client certificate authentication using Spring beans
Summary
9
Opening up to OAuth 2
Opening up to OAuth 2
The promising world of OAuth 2
Configuring OAuth 2 support in Spring Security
Executing the OAuth 2 provider connection workflow
Additional OAuth 2 providers
Is OAuth 2 secure?
10
Single Sign-On with the Central Authentication Service
Single Sign-On with the Central Authentication Service
Introducing the Central Authentication Service
High-level CAS authentication flow
Spring Security and CAS
Configuring basic CAS integration
Single logout
Clustered environments
Using proxy tickets
Customizing the CAS server
Getting the UserDetails object from a CAS assertion
Additional CAS capabilities
Summary
11
Fine-Grained Access Control
Fine-Grained Access Control
Gradle dependencies
Conditional rendering with the Thymeleaf Spring Security tag library
Interface-based proxies
JSR-250 compliant standardized rules
Summary
12
Access Control Lists
Access Control Lists
The conceptual module of ACL
Access control lists in Spring Security
Basic configuration of Spring Security ACL support
Summary
13
Custom Authorization
Custom Authorization
Authorizing the requests
Dynamically defining access control to URLs
Creating a custom expression
Summary
14
Session Management
Session Management
Configuring session fixation protection
Restricting the number of concurrent sessions per user
Configuring expired session redirect
Common problems with concurrency control
Other benefits of concurrent session control
Displaying active sessions for a user
Summary
15
Additional Spring Security Features
Additional Spring Security Features
Security vulnerabilities
Cross-Site Scripting
Cross-Site Request Forgery
Security HTTP response headers
Summary
16
Migration to Spring Security 4.2
Migration to Spring Security 4.2
Introduction
Sample migration
Deprecations
Summary
17
Microservice Security with OAuth 2 and JSON Web Tokens
chevron up
Microservice Security with OAuth 2 and JSON Web Tokens
What are microservices?
Service-oriented architectures
Microservice security
The OAuth 2 specification
JSON Web Tokens
OAuth 2 support in Spring Security
Microservices client
Summary
18
Additional Reference Material
Additional Reference Material
Getting started with the JBCP calendar sample code

The OAuth 2 specification

There is sometimes a misconception that OAuth 2 is an evolution from OAuth 1, but it is a completely different approach. OAuth1 specification requires signatures, so you would have to use cryptographic algorithms to create generate and validate those signatures that are no longer required for OAuth 2. The OAuth 2 encryption is now handled by TLS, which is required.

OAuth 2 RFC-6749, The OAuth 2.0 Authorization Framework (https://tools.ietf.org/html/rfc6749):
The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service, or by allowing the third-party application to obtain access on its own behalf.

This specification replaces and makes obsolate the OAuth 1.0 protocol described...
End of Section 5
Next Section
bookmark search playlist download
font-size

Change the font size

margin-width

Change margin width

day-mode

Change background colour

Close icon Search
Country selected
Close icon Your notes and bookmarks

Delete Bookmark

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete