Spring Security

Spring Security provides a very good security solution(s), handling authentication and authorization at the web request level and at the method invocation level by using the features of Dependency Injection (DI) & Aspect Oriented techniques.

Spring security targets two areas viz. 1. Authentication & 
                                                            2. Authorization

1.  Authentication: - is the assurance that the user is the actual user he is claiming to be.

E.g. Particular user logs into the application through his credentials means get authenticated himself.

Spring Supports following types of Authentication :

a.      Http Basic Authentication

b.      Form Based Authentication 

      2.   Authorization: - is the assurance that the user is allowed to access only those resources that he is authorized to use.

E.g. Admin of the any website have access for some parts/pages & normal user done have access to these pages.

For authorization spring targets following areas,

a.      Authorizing web requests

b.      Authorizing whether methods can be invoked

c.       Authorizing access to individual domain objects

Following jar’s need to be present in the class path of the project.

      1.  Core => spring-security-core.jar

      2.  Web => spring-security-web.jar

      3.  Config => spring-security-config.jar

Namespace Configuration :-

Spring Security comes with a security-specific namespace which simplifies security configuration in Spring. This new namespace, along with some default behavior, reduces a typical security configuration from over 100 lines of XML to a dozen or so. The namespace configuration of the Spring provides a shortcut that hides much of complexity of the framework.

E.g.

<beans xmlns="http://www.springframework.org/schema/beans"             xmlns:security="http://www.springframework.org/schema/security"             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"             xsi:schemaLocation="http://www.springframework.org/schema/beans             http://www.springframework.org/schema/beans/spring-beans-3.0.xsd             http://www.springframework.org/schema/security             http://www.springframework.org/schema/security/spring-security-3.0.xsd">

            <security: …..>…..</security:…>

</beans>

For web security in Spring, we must set up the servlet filters that provide the various security features.

Proxying servlet filters :-

<filter>

    <filter-name>springSecurityFilterChain</filter-name>                        <filter-class>

org.springframework.web.filter.DelegatingFilterProxy </filter-class>

</filter>

<filter-mapping>

<filter-name> springSecurityFilterChain </filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

In above code snippet DelegatingFilterProxy deligates the control to a filter implementation which is defined as bean named springSecurityFilterChain. This bean is an infrastructural  bean to handle namespace configurations. Once this configuration is done, all the incoming requests enter the spring framework for security check. This special filter, by itself will not do much, it deligates to an implementation of javax.servlet.Filter which is registered as <bean> in spring application context.

It is not possible to inject beans into the servlet filters registered into the web.xml. But by using DelegatingFilterProxy, we can we can configure the actual filters.

<filter-name> given to the DelegatingFilterProxy is very significant & useful. This name is used to look up the filter bean from the Spring application context. Spring Security will automatically create a filter bean whose ID is springSecurityFilterChain, so that’s the name, given to DelegatingFilterProxy in web.xml.

springSecurityFilterChain bean itself is another special filter known as FilterChainProxy. It’s a single filter which chains one or more filters. Spring Security will automatically create those beans for us when we configure the <http> element.

Security Configuration :-

We can define security configuration file as applicationContext-security.xml & this file need to be loaded in web.xml. This is done by ContextLoadListner.

Following snippet needs to be added in web.xml before security filter definition.

<context-param>

   <param-name>contextConfigLocation</param-name>

   <param-value>WEB-INF/applicationContext-security.xml</param-value>

</context-param>

<listener>

     <listener-class>

               org.springframework.web.context.ContextLoaderListener

     </listener-class>

</listener>

applicationContext-security.xml

Whenever namespace configuration is used, spring-config.jar needs to be in class path. The first line in this file should be like,

<beans xmlns="http://www.springframework.org/schema/security"

  xmlns:bean="http://www.springframework.org/schema/beans"

  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

  xsi:schemaLocation="http://www.springframework.org/schema/beans

          http://www.springframework.org/schema/beans/spring-beans-3.0.xsd

          http://www.springframework.org/schema/security

          http://www.springframework.org/schema/security/spring-security-3.0.3.xsd">

    ...

</beans>

The minimal namespace configuration like:-

Following only three lines of XML configures spring security to intercept all requests for all URL’s and restrict access to only authenticated users who have  “ROLE_USER” role. This <http> element automatically set up FilterChainProxy & all the filter beans in the chain shown in following diagram.

<http auto-config=”true”>

 <intercept-url pattern=”/**” access=”ROLE_USER” />

</http>

<authentication-manager>

    <authentication-provider>

      <user-service>

        <user name="testadmin" password="testadminpassword"

                      authorities="ROLE_USER, ROLE_ADMIN" />

        <user name="testuser" password="testuserpassword"

             authorities="ROLE_USER" />

      </user-service>

    </authentication-provider>

</authentication-manager>

The attribute auto-config=”true" defines three elements <form-login/>, <http-basic/> and <logout>.The default configuration always chooses http-basic authentication model. If the model needs to be changed to the form-login model, then the following configuration is needed.

<http auto-config=”true”>

<intercept-url pattern="/login.jsp*" access="IS_AUTHENTICATED_ANONYMOUSLY"/>

      <intercept-url pattern="/**" access="ROLE_USER" />

           <form-login login-page=”/login.jsp”/>

</http>

This above configuration is done to enable form-login authentication model where the login page is login.jsp. Note that in the intercept tag, pattern for login.jsp is given and access rule is defined as IS_AUTHENTICATED_ANONYMOUSLY. That means login.jsp is not checked for security, which makes sense as login.jsp is the starting point from where the user is authenticated.
The tag <authentication-manager> processes the authentication information; <authentication-provider> defines the credential information and the roles given to each user (authentication information).

Spring Security framework is a chain of filters, with each filter having certain responsibility.

 In following section the namespace configuration to bean configuration to understand the flow and responsibility of each filter.

The <http> block in namespace configuration invokes the chain of filters. DelegatingFilterProxy that is defined in web.xml invokes the FilterChainProxy class which in turn invokes the chain of filters defined for each URL pattern.

The chain of filters that FilterChainProxy calls are shown below:

To override the default behavior of login page, need to configure <form-login> element,

<http auto-config="true" use-expressions="false">

<form-login login-processing-url="/static/j_spring_security_check" login-page="/login" authentication-failure-url="/login?login_error=t"/>

</http>

login attribute specifies a new context-relative URL for the login page & it will reside at /login which is ultimately handled by a Spring MVC controller.

If authentication fails, the authentication-failure-url attribute is set to send the user back to the same login page.

Intercepting requests : -

<intercept-url> Element is the first line of defense in request level security. Its pattern attribute is given a URL pattern that will be matched against incoming requests. If any requests match the pattern, then that <intercept-url>’s security rules will be applied.

<intercept-url pattern="/**" access="ROLE_USER" />

/** => indicating that we want all requests, regardless of the URL, to require ROLE_USER access

For area for admin & restricted to others’ in this case following snippet need to put before previous <intercept_url>

<intercept-url pattern="/admin/**" access="ROLE_ADMIN" />

This will restricts the access to the /admin of site’s hierarchy to users’ with ROLE_ADMIN authority. We can use many <intercept-url> entries as we require securing various paths of application.

<intercept-url> rules are are applied top to bottom.

SECURING WITH SPRING EXPRESSIONS: -

Spring Expression Language (SpEL) as an advanced technique for wiring bean properties.

To enable it, we must set the use-expressions attribute of <http> to true:

<http auto-config="true" use-expressions="true">

            ……....

</http>

Use of SpEL expression:-

<intercept-url pattern="/admin/**" access="hasRole('ROLE_ADMIN')"/>

Securing view-level elements :-

To support security in the view layer, Spring Security comes with a JSP tag library. This tag library is small and includes only three tags,

<security:accesscontrollist> - Allows the body of the tag to be rendered if the currently authenticated user has one of the stipulated permissions in the specified domain object

<security:authentication> - Accesses properties of the current user’s authentication object

<security:authorize> - Allows the body of the tag to be rendered if a specified security constraint has been met

To use the JSP tag library, we’ll need to declare it in the JSP file,

<%@ taglib prefix="security" uri="http://www.springframework.org/security/tags" %>

Accessing authentication details :-

This tag library provide convenient access to user’s authentication information,

e.g. Welcome XYZ ! …. At the header of application.

Welcome <security:authentication property="principal.username" />!

Date operation

Many time’s we need to get the next/ previous date of any particular date by discarding the Holidays (i.e. Saturday/Sunday).

I have some util method’s for your quick references :-

——————————————————————————————————–
1. Checking for holiday at the end of week for (T+1) :-
——————————————————————————————————–
public static Calendar getCobDateWithoutWeekendsForward( Date cobDate ) throws Exception
{
Calendar calObj = Calendar.getInstance();

try
{
calObj.setTime( cobDate );
int dayOfWeek = calObj.get(Calendar.DAY_OF_WEEK);

if(dayOfWeek == Calendar.FRIDAY)
{
calObj.add(Calendar.DATE, 3);
}
else
{
calObj.add(Calendar.DATE, 1);
}
}
catch(Exception exc)
{
throw new Exception( “Exception while getting cob date by filtering the week end in method
getCobDateWithoutWeekendsForward() :: ” + exc );
}
return calObj;
}

=================================================================================
2. Checking for holiday at the end of week for (T-1) :-
——————————————————————————————————–

public static Calendar getCobDateWithoutWeekendsBackword( Date cobDate ) throws Exception
{
Calendar calObj = Calendar.getInstance();

try
{
calObj.setTime( cobDate );
int dayOfWeek = calObj.get(Calendar.DAY_OF_WEEK);

if(dayOfWeek == Calendar.MONDAY)
{
calObj.add(Calendar.DATE, -3);
}
else
{
calObj.add(Calendar.DATE, -1);
}
}
catch(Exception exc)
{
throw new Exception( “Exception while getting cob date by filtering the week end in method
getCobDateWithoutWeekendsBackword() :: ” + exc );
}
return calObj;
}

From & To date range

Following snippet will be useful if you need the date range i.e. fixed From & To date. This will return you the List of Date objects by filtering the Saturday & Sunday’s.

We have date many types, we consider here as ‘DD-Mon-YYYY’ Type only.
Hence calling to following method should be like,

List fromToDateList = getFromToDateRange(”22-Jan-2011″,”10-Feb-2011″);

If you need different type of date format, then you can change it simply by defining the SimpleDateFormat object.
Main concept is whichever format date you passing, convert it into the Date object & set it into the Calendar Object, so that we can process it easily.

public static List getFromToDateRange( final String strFromDate, final String strToDate) throws Exception
{
List dateRangeList = new ArrayList();
Calendar calFromDate = Calendar.getInstance();
Calendar calToDate = Calendar.getInstance();
final SimpleDateFormat simpleDateFormat = new SimpleDateFormat(”dd-MMM-yyyy”);

try
{
Date fromDate = simpleDateFormat.parse( strFromDate );
Date toDate = simpleDateFormat.parse( strToDate );
boolean loopFlag = true ;
calFromDate.setTime( fromDate );
calToDate.setTime( toDate );

int fromDayOfWeek = calFromDate.get(Calendar.DAY_OF_WEEK);
if(fromDayOfWeek != Calendar.SUNDAY && fromDayOfWeek != Calendar.SATURDAY)
{
dateRangeList.add( fromDate );
}

if( fromDate.before( toDate ))
{
while(loopFlag)
{
calFromDate.add( Calendar.DATE, 1 );

boolean fromToDateEqual = calFromDate.getTime().equals( calToDate.getTime() );

int dayOfWeek = calFromDate.get(Calendar.DAY_OF_WEEK);

if( !fromToDateEqual && dayOfWeek != Calendar.SUNDAY && dayOfWeek != Calendar.SATURDAY)
{
dateRangeList.add( calFromDate.getTime() );
}

if( fromToDateEqual )
{
loopFlag = false;
}
}
}

int toDayOfWeek = calToDate.get(Calendar.DAY_OF_WEEK);
if(toDayOfWeek != Calendar.SUNDAY && toDayOfWeek != Calendar.SATURDAY)
{
dateRangeList.add( toDate );
}

}
catch(Exception exc)
{
throw new Exception(”Exception while formatting the date range between From & To date ::” + exc);
}

return dateRangeList;
}

Get SQL Type Timestamp from string type date

Generally we use a sysdate to insert the timestamp in table in Oracle DB. But sometime we need to manage at the java side, then need to convert the String type date to java.sql.Timestamp.
In this case following utiltiy may be useful.

To call following method,
e.g.

java.sql.Timestamp sqlTimestamp = getStringToSqlTimeStamp(”12-Jun-2010″);

public static java.sql.Timestamp getStringToSqlTimeStamp(String strDate) throws Exception
{
final SimpleDateFormat simpleDateFmt = new SimpleDateFormat(”dd-MMM-yyyy”);
Date date = simpleDateFmt.parse( strDate );
java.sql.Timestamp timeStampDate = new Timestamp(date.getTime());

return timeStampDate ;
}

Hibernate

Hibernate is an ORM (Object Relational Mapping) library for Java & its free.
Hibernate is Generally Divided in following parts :-
1. Mapping
2. Persistance
3. HQL (Hibernate Query Language)
Let us see some details about each part of Hibernate.
1. Mapping :-
Hibernates came in picture due to the mapping between the Java Objects & the Database Table Mappings.
This mapping is accomplished through the configuration of XML files or Annotations. Hibernate can use the XML file / Annotations to maintain the database schema.
2. Persistance :-
Hibernate provides transparent persistance for POJO’s Collection of data objects are typically stored in Java collection objects such as List, Set. Also cascade operations also supported.
e.g. Parent table deletion or save also affects the child table.
3. HQL :-
The HQL’s are approximately similar to the plain SQL’s not much difference.
One alternaive way is also available to HQL is Criteria, its totally object oriented.