Spring Security Java Config Preview: Web Security

Engineering | Rob Winch | July 03, 2013 | ...

Update

Users should refer to the Spring Security Reference which contains more up to date information.

Original Blog Post

In my previous post, I introduced Spring Security Java configuration and discussed some of the logistics of the project. In this post, we will start off by walking through a very simple web security configuration. We will then spice things up a bit with configuration that has been customized some.

Hello Web Security

In this section we go through the most basic configuration for web based security. It can be broken into four steps:

This Week in Spring - July 2nd, 2013

Engineering | Josh Long | July 03, 2013 | ...

Welcome to another installment of This Week in Spring! As usual, we've got a lot to cover so let's get to it!

  1. Spring and Cloud Foundry ninja Jennifer Hickey has announced the availability of Spring Data Redis 1.1 M1 and 1.0.5. Check it out!
  2. Spring Security lead (and ninja) Rob Winch has announced the initial availability of the Spring Security Java configuration support. Rob also just posted a very nice post (the first of four) on the new Spring Security Java configuration support. The first post addresses where you can find the new Spring Security Java configuration support.
  3. Join us on July 18th for the webinar, "Functional Programming without Lambas" which introduces ways to use functional programing in Java right now (instead of waiting for Java 8!) using Guava, LambaJ, and Functional Java.
  4. Corby Page has written a very nice post on ways to extend your REST APIs ability with his project, Yoga. In particular, it supports something called a selector which can be used to extract sub-views of the REST response to be sent back to the client. This can also be used to support what Lez Hazelwood aptly describes as entity expansions.
  5. The Crunchify blog has a nice post on how to upload multiple files with Spring MVC.
  6. SpringSource has added a new Live Online Core Spring class to the schedule for September .
  7. The Spring LDAP project has gone social and moved to GitHub!
  8. Our pal XueFeng Ding (who you may remember helped put together the blog "Spring at China Scala") has just recently given a very nice presentation on building REST APIs with Spring. I think his deck's pretty cool, so check it out!
  9. Sergey Shcherbakov recently gave a nice talk introducing a whole slew of cool things. I think his sample code is particularly worth a look. The code features Spring 4 WebSockets, XML-less Spring Batch, Reactor and AngularJS examples. Nice job, Sergey!
  10. Johnathan Mark Smith has put together a nice blog on how to use Spring Data with MongoDB. Nice job!
  11. Nicolas Frankel has put together a very nice post on some of the compelling features in Spring 3.2. Nice job, Nicolas!
  12. Nick Williams submitted a pull-request to support using Java configuration with Spring WS's MessageDispatcherServlet so that it can be configured within a ServletContextListener or a ServletContainerInitializer. Nice job, Nick!
  13. This is not specific to Spring, or Spring Batch, per-se, but the Technology AMIS blog has an interesting look at how to use the Batch JSR (which is based on Spring Batch, and designed in cooperation with the Spring Batch team) to build a download manager. (Don't worry, you don't have to use GlassFish to work with the Batch JSR!) Pretty cool! If you know Spring Batch, then a lot of this will look familiar and, as Spring Batch will also implement the JSR, should prove a very nice on-ramp for anyone who wants to use Spring Batch in the future.

Spring Security Java Config Preview: Introduction

Engineering | Rob Winch | July 02, 2013 | ...

Yesterday I announced the release of Spring Security Java Configuration support and the release of Spring Security 3.2.0.M2 which contains Java Configuration support.

Spring Security's Java Configuration support is intended to provide a complete replacement of the XML namespace configuration. It is also designed to be extensible, so that Spring Security's extension projects can work nicely with the Java Configuration support.

In this first post of a five part Spring Security Java Configuration blog series, I discuss the logistics of the Spring Security Java Configuration project.

[callout title="Required Versions"]Regardless of how you decide to integrate with Spring Security, it is important to ensure you are using Spring 3.2.3.RELEASE+ to ensure that you avoid SPR-10546.[/callout]

Availability

Before we get started, I'd like to talk about the two modules that Spring Security's Java Configuration can be found.

Availability in Spring Security 3.2.0.M2+

Spring Security Java Configuration has been copied into the Spring Security 3.2.0.M2+ code base. This means if you are using Spring Security 3.2.0.M2+ you should ensure to have the spring-security-config jar on your classpath. For example, you might have the following…

Spring Data Redis 1.1 M1 and 1.0.5 Released

Releases | Jennifer Hickey | July 02, 2013 | ...

Dear Spring Community,

I am pleased to announce the first milestone release of Spring Data Redis 1.1!

Downloads | JavaDocs | Reference Documentation | Changelog

Highlights include:

  • Support for several new Redis 2.6 commands and options
  • Support for Redis 2.6 scripting
  • Connection pool enhancements

There is also a new GA release, Spring Data Redis 1.0.5!

Downloads | JavaDocs | Reference Documentation | Changelog

Spring Data Redis 1.0.5 is a maintenance release containing a few bug fixes and minor enhancements. See the Changelog for more information.

For more information about Spring Data Redis please see the home page for a live sample and webinar recording.

We look forward to your feedback on the forum or in the issue tracker

Spring Security Java Configuration 1.0.0.M1 Released

Releases | Rob Winch | July 01, 2013 | ...

I'm pleased to announce the release of Spring Security Java Configuration as a stand alone module. The milestone is compatible with Spring 3.2.3.RELEASE+ and Spring Security 3.1.4.RELEASE.

This code has been merged into Spring Security 3.2.0.M2 release and will be maintained within the Spring Security code base going forward. We hope that by making the release available for stable versions of Spring and Spring Security it will encourage you to try it sooner and provide us feedback before the final release.

Stay tuned to the SpringSource blog for an article that walks you through how to use Spring Security Java Configuration. In the mean time, you can find out how to obtain spring-security-javaconfig, documentation, and samples at http://github.com/SpringSource/spring-security-javaconfig

Spring Security 3.2.0.M2 Released

Releases | Rob Winch | July 01, 2013 | ...

The second milestone release toward Spring Security 3.2 is now available from the SpringSource repository at http://repo.springsource.org. See here for a quick tutorial on resolving these artifacts via Maven.

I'd like to extend a special thanks to all those that contributed to this release by submitting bugs, pull requests, and feedback.

The highlights of this release include:

  • Spring Security Java Configuration Support
  • SEC-2111 resolves an issue with Async support when a timeout occurs and the same Thread handles both the original request and the timeout.
  • Added support for configuring the remember me parameter via the XML namespace. Special thanks to Oliver Becker for submitting a pull request for this feature!
  • SEC-2002 Added SessionFixationProtectionEvent. Special thanks to Nick Williams for submitting a pull request for this feature!
  • Improvements to the Embedded LDAP container
Stay tuned to the SpringSource Blog over the coming week for more information about Spring Security Java Configuration.

Changelog | Download | Reference Manual | FAQ

Webinar: Introducing Reactor - A framework for asynchronous applications on the JVM

News | Pieter Humphrey | June 26, 2013 | ...

The sheer volume of non-human-generated data in modern applications can easily overtake a traditional single-threaded, blocking design model. Reactor aims to address this volume, by providing a foundational framework for JVM applications -- applications that need high throughput when performing reasonably small chunks of stateless, asynchronous processing. Join Jon Brisbin as he discusses the motivations behind the project, the design patterns and existing technology that inspired the project, and how it fits in the asynchronous ecosystem today, as a teaser to his upcoming session at SpringOne 2GX 2013.


About the speaker

Chris Harris

Jon Brisbin

Jon works with the Spring Data, Grails, RabbitMQ, and other teams to provide next-generation data and messaging capabilities for modern Ajax and mobile applications. He's been working with Spring Data to provide mapping capabilities for NoSQL databases like MongoDB and Riak and he's working with RabbitMQ and NoSQL to provide modern evented and message-driven data utilities. He authored the Grails support for Riak as well as contributes Erlang-based utilities for the Riak and RabbitMQ communities. Prior to SpringSource, Jon developed private cloud architectures at the world's largest Pizza Hut franchisee, developed Lotus Domino, J2EE, PHP and even Perl CGI applications in BBEdit on an aged Mac, and got his start in web-based development 15 years ago, as an intelligence analyst for the US Air Force, when NCSA Mosaic 1.0 was cool

More About Jon »




This Week in Spring - June 25, 2013

Engineering | Josh Long | June 25, 2013 | ...

Welcome back to another installment of This Week in Spring. As usual, we've got a lot to cover. In particular, you'll note that this week's roundup features a lot of great Spring Batch content. So, let's get to it -- and don't forget the SpringOne2GX early bird rate ends Aug 9th!

  1. I did a webinar introducing how to build REST APIs with Spring's rich REST stack a few weeks ago, and I'm happy to report that the talk - which introduces Spring MVC, Spring HATEOAS, Spring REST Shell, Spring Data REST, Spring Security OAuth and Spring Social in terms of a simple sample application that we refine - is now available on the SpringSourceDev YouTube Channel. As I mentioned last week, the slides are available on my SlideShare.net page and the code is available on my GitHub page. Enjoy, and don't hesitate to feedback/ask questions at josh(dot)long(at)SpringSource(dot)com!
  2. InfoQ has a great post introducing JSR 352, the Java Batch specification. If you're a Spring Batch user, then a lot of this will look very familiar! I think this is a particularly nice JSR, and encourage you to check it out. Spring
  3. Chris Schaefer has put together a brilliant Spring Batch refcard for DZone which went up yesterday, head over to DZone for the free download.
  4. Craig Walls has announced that Spring Social Facebook 1.0.3 is now available. The new release addresses breaking changes in the upcoming Facebook API revision.
  5. Gary Russell has announced that Spring AMQP 1.2.0 release candidate is now available. The new release features many improvements and bug fixes.
  6. Johnathan Mark Smith is back at it again, with a blog on RESTTemplate To Post Data to a Web Service. Nice work Jonathan!
  7. This week SpringSource is offering a four-day Groovy & Grails class in San Francisco, check it out here
  8. Our pal Tobias Flohre is back with the 4th installment of his series introducing Java configuration with Spring Batch.
  9. Leleu Jérôme has released a Spring Security Pac4J client. It has OAuth with providers, OpenID, CAS, and HTTP.
  10. Are you a Spring Champion? Enter to win a free SpringOne2GX 2013 pass!
  11. Vamsi Kancharla put together a nice sample project with Spring MVC, bean-validation, error handling (using @ControllerAdvice), protection against XSS and input form attacks, and a lot more. Check it out!
  12. Kim Saabye Pedersen put together a nice post reinforcing some useful (and hopefully well-understood!) principles of singletons in Spring.
  13. Hantsy Bai has put together a very nice post explaining how to create a Spring project from the Spring Tool Suite.

Webinar Replay: Building REST-ful services with Spring

News | Pieter Humphrey | June 25, 2013 | ...

Today's applications don't exist in isolation. REST applications and web services are a great way to connect applications together. REST is a design principle that imposes no constraints on the client except basic HTTP support, which all platforms provide. Designing REST services, however, is still as much art as it is science, as standards are emerging. Join Spring Developer Advocate Josh Long as he introduces some of the ins-and-outs of REST API design with Spring, building on Spring MVC, Spring HATEOAS and answers some commonly- asked questions like how to secure REST-ful services, and how…

Get the Spring newsletter

Stay connected with the Spring newsletter

Subscribe

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all