You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@roller.apache.org by mr...@apache.org on 2008/06/05 17:26:52 UTC
svn commit: r663640 - in /roller/trunk/apps/weblogger: ./
docs/installguide/generated/ docs/installguide/generated/html/
src/java/org/apache/roller/weblogger/config/
src/java/org/apache/roller/weblogger/ui/core/
src/java/org/apache/roller/weblogger/ui/...
Author: mraible
Date: Thu Jun 5 08:26:50 2008
New Revision: 663640
URL: http://svn.apache.org/viewvc?rev=663640&view=rev
Log:
ROL-1723: Upgraded to Spring Security 2.0.1. Still need to put test LDAP and CAS and put proper configuration in security.xml.
Removed:
roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/security/RollerCasPopulator.java
Modified:
roller/trunk/apps/weblogger/docs/installguide/generated/html/roller-install-guide.html
roller/trunk/apps/weblogger/docs/installguide/generated/roller-install-guide.txt
roller/trunk/apps/weblogger/properties.xmlf
roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/config/roller.properties
roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/RollerContext.java
roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/security/AuthoritiesPopulator.java
roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/security/CustomUserRegistry.java
roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/security/RollerUserDetails.java
roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/security/RollerUserDetailsService.java
roller/trunk/apps/weblogger/test/java/org/apache/roller/weblogger/ui/MockAcegiUserDetailsService.java
roller/trunk/apps/weblogger/testdata/WEB-INF/security.xml
roller/trunk/apps/weblogger/web/WEB-INF/security.xml
roller/trunk/apps/weblogger/web/WEB-INF/web.xml
roller/trunk/apps/weblogger/web/roller-ui/logout-redirect.jsp
Modified: roller/trunk/apps/weblogger/docs/installguide/generated/html/roller-install-guide.html
URL: http://svn.apache.org/viewvc/roller/trunk/apps/weblogger/docs/installguide/generated/html/roller-install-guide.html?rev=663640&r1=663639&r2=663640&view=diff
==============================================================================
--- roller/trunk/apps/weblogger/docs/installguide/generated/html/roller-install-guide.html (original)
+++ roller/trunk/apps/weblogger/docs/installguide/generated/html/roller-install-guide.html Thu Jun 5 08:26:50 2008
@@ -1688,7 +1688,7 @@
<FONT FACE="Courier New"><FONT SIZE=1 STYLE="font-size: 8pt"># the struts2 file upload stuff has some overly verbose messaging</FONT></FONT>
<FONT FACE="Courier New"><FONT SIZE=1 STYLE="font-size: 8pt">log4j.category.org.apache.struts2.interceptor.FileUploadInterceptor=WARN</FONT></FONT>
<FONT FACE="Courier New"><FONT SIZE=1 STYLE="font-size: 8pt">log4j.category.org.springframework=WARN</FONT></FONT>
-<FONT FACE="Courier New"><FONT SIZE=1 STYLE="font-size: 8pt">log4j.category.org.acegisecurity=ERROR</FONT></FONT>
+<FONT FACE="Courier New"><FONT SIZE=1 STYLE="font-size: 8pt">log4j.category.org.springframework.security=ERROR</FONT></FONT>
<FONT FACE="Courier New"><FONT SIZE=1 STYLE="font-size: 8pt"># Velocity talks a lot, so by default it is set to STFU mode</FONT></FONT>
<FONT FACE="Courier New"><FONT SIZE=1 STYLE="font-size: 8pt">log4j.category.org.apache.velocity=FATAL</FONT></FONT>
Modified: roller/trunk/apps/weblogger/docs/installguide/generated/roller-install-guide.txt
URL: http://svn.apache.org/viewvc/roller/trunk/apps/weblogger/docs/installguide/generated/roller-install-guide.txt?rev=663640&r1=663639&r2=663640&view=diff
==============================================================================
--- roller/trunk/apps/weblogger/docs/installguide/generated/roller-install-guide.txt (original)
+++ roller/trunk/apps/weblogger/docs/installguide/generated/roller-install-guide.txt Thu Jun 5 08:26:50 2008
@@ -996,7 +996,7 @@
# the struts2 file upload stuff has some overly verbose messaging
log4j.category.org.apache.struts2.interceptor.FileUploadInterceptor=WARN
log4j.category.org.springframework=WARN
-log4j.category.org.acegisecurity=ERROR
+log4j.category.org.springframework.security=ERROR
# Velocity talks a lot, so by default it is set to STFU mode
log4j.category.org.apache.velocity=FATAL
Modified: roller/trunk/apps/weblogger/properties.xmlf
URL: http://svn.apache.org/viewvc/roller/trunk/apps/weblogger/properties.xmlf?rev=663640&r1=663639&r2=663640&view=diff
==============================================================================
--- roller/trunk/apps/weblogger/properties.xmlf (original)
+++ roller/trunk/apps/weblogger/properties.xmlf Thu Jun 5 08:26:50 2008
@@ -58,7 +58,7 @@
<!-- various libraries used by Roller -->
<property name="tools.struts2" value="${ro.tools}/struts-2.0.9" />
<property name="tools.jpa" value="${ro.tools}/openjpa-0.9.7" />
-<property name="tools.spring" value="${ro.tools}/spring-1.2" />
+<property name="tools.spring" value="${ro.tools}/spring-2.5" />
<property name="tools.jstl" value="${ro.tools}/jakarta-taglibs-standard-1.1.2" />
<property name="tools.xdoclet" value="${ro.tools}/buildtime/xdoclet-1.2.3" />
<property name="tools.tomcat" value="${ro.tools}/buildtime/tomcat-5.0.28" />
Modified: roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/config/roller.properties
URL: http://svn.apache.org/viewvc/roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/config/roller.properties?rev=663640&r1=663639&r2=663640&view=diff
==============================================================================
--- roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/config/roller.properties (original)
+++ roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/config/roller.properties Thu Jun 5 08:26:50 2008
@@ -611,7 +611,7 @@
log4j.category.org.apache.tiles=WARN
log4j.category.com.opensymphony.xwork2=WARN
log4j.category.org.springframework=WARN
-log4j.category.org.acegisecurity=ERROR
+log4j.category.org.springframework.security=ERROR
log4j.category.org.hibernate=WARN
# the struts2 file upload stuff has some overly verbose messaging
Modified: roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/RollerContext.java
URL: http://svn.apache.org/viewvc/roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/RollerContext.java?rev=663640&r1=663639&r2=663640&view=diff
==============================================================================
--- roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/RollerContext.java (original)
+++ roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/RollerContext.java Thu Jun 5 08:26:50 2008
@@ -21,16 +21,19 @@
import java.io.File;
import java.io.InputStream;
import java.util.Properties;
+import java.util.Iterator;
import javax.servlet.ServletContext;
import javax.servlet.ServletContextEvent;
import javax.servlet.ServletContextListener;
-import org.acegisecurity.providers.ProviderManager;
-import org.acegisecurity.providers.dao.DaoAuthenticationProvider;
-import org.acegisecurity.providers.dao.UserCache;
-import org.acegisecurity.providers.encoding.Md5PasswordEncoder;
-import org.acegisecurity.providers.encoding.PasswordEncoder;
-import org.acegisecurity.providers.encoding.ShaPasswordEncoder;
-import org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint;
+import org.springframework.security.providers.AuthenticationProvider;
+import org.springframework.security.providers.ProviderManager;
+import org.springframework.security.providers.dao.DaoAuthenticationProvider;
+import org.springframework.security.providers.dao.UserCache;
+import org.springframework.security.providers.encoding.Md5PasswordEncoder;
+import org.springframework.security.providers.encoding.PasswordEncoder;
+import org.springframework.security.providers.encoding.ShaPasswordEncoder;
+import org.springframework.security.providers.rememberme.RememberMeAuthenticationProvider;
+import org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.apache.log4j.PropertyConfigurator;
@@ -253,14 +256,17 @@
}
/**
- * Setup Acegi security features.
+ * Setup Spring Security security features.
*/
protected void initializeSecurityFeatures(ServletContext context) {
ApplicationContext ctx =
WebApplicationContextUtils.getRequiredWebApplicationContext(context);
-
+ /*String[] beanNames = ctx.getBeanDefinitionNames();
+ for (String name : beanNames)
+ System.out.println(name);*/
+
String rememberMe = WebloggerConfig.getProperty("rememberme.enabled");
boolean rememberMeEnabled = Boolean.valueOf(rememberMe).booleanValue();
@@ -268,18 +274,21 @@
context.setAttribute("rememberMeEnabled", rememberMe);
- if (rememberMeEnabled) {
- ProviderManager provider = (ProviderManager) ctx.getBean("authenticationManager");
- provider.getProviders().add(ctx.getBean("rememberMeAuthenticationProvider"));
+ if (!rememberMeEnabled) {
+ ProviderManager provider = (ProviderManager) ctx.getBean("_authenticationManager");
+ for (Iterator it = provider.getProviders().iterator(); it.hasNext();) {
+ AuthenticationProvider authProvider = (AuthenticationProvider) it.next();
+ if (authProvider instanceof RememberMeAuthenticationProvider) {
+ provider.getProviders().remove(authProvider);
+ }
+ }
}
-
String encryptPasswords = WebloggerConfig.getProperty("passwds.encryption.enabled");
boolean doEncrypt = Boolean.valueOf(encryptPasswords).booleanValue();
if (doEncrypt) {
- DaoAuthenticationProvider provider =
- (DaoAuthenticationProvider) ctx.getBean("daoAuthenticationProvider");
+ DaoAuthenticationProvider provider = (DaoAuthenticationProvider) ctx.getBean("org.springframework.security.providers.dao.DaoAuthenticationProvider#0");
String algorithm = WebloggerConfig.getProperty("passwds.encryption.algorithm");
PasswordEncoder encoder = null;
if (algorithm.equalsIgnoreCase("SHA")) {
@@ -287,23 +296,20 @@
} else if (algorithm.equalsIgnoreCase("MD5")) {
encoder = new Md5PasswordEncoder();
} else {
- log.error("Encryption algorithm '" + algorithm +
- "' not supported, disabling encryption.");
+ log.error("Encryption algorithm '" + algorithm + "' not supported, disabling encryption.");
}
if (encoder != null) {
provider.setPasswordEncoder(encoder);
log.info("Password Encryption Algorithm set to '" + algorithm + "'");
}
}
-
if (WebloggerConfig.getBooleanProperty("securelogin.enabled")) {
AuthenticationProcessingFilterEntryPoint entryPoint =
- (AuthenticationProcessingFilterEntryPoint)
- ctx.getBean("authenticationProcessingFilterEntryPoint");
+ (AuthenticationProcessingFilterEntryPoint) ctx.getBean("_formLoginEntryPoint");
entryPoint.setForceHttps(true);
}
-
+
/*
if (WebloggerConfig.getBooleanProperty("schemeenforcement.enabled")) {
Modified: roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/security/AuthoritiesPopulator.java
URL: http://svn.apache.org/viewvc/roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/security/AuthoritiesPopulator.java?rev=663640&r1=663639&r2=663640&view=diff
==============================================================================
--- roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/security/AuthoritiesPopulator.java (original)
+++ roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/security/AuthoritiesPopulator.java Thu Jun 5 08:26:50 2008
@@ -19,12 +19,13 @@
import java.util.Iterator;
import java.util.List;
-import org.acegisecurity.GrantedAuthority;
-import org.acegisecurity.GrantedAuthorityImpl;
-import org.acegisecurity.ldap.LdapDataAccessException;
-import org.acegisecurity.providers.ldap.LdapAuthoritiesPopulator;
-import org.acegisecurity.userdetails.UsernameNotFoundException;
-import org.acegisecurity.userdetails.ldap.LdapUserDetails;
+import org.springframework.security.GrantedAuthority;
+import org.springframework.security.GrantedAuthorityImpl;
+import org.springframework.ldap.core.DirContextOperations;
+import org.springframework.security.ldap.LdapDataAccessException;
+import org.springframework.security.ldap.LdapAuthoritiesPopulator;
+import org.springframework.security.userdetails.UsernameNotFoundException;
+import org.springframework.security.userdetails.ldap.LdapUserDetails;
import org.apache.roller.weblogger.WebloggerException;
import org.apache.roller.weblogger.business.UserManager;
import org.apache.roller.weblogger.business.Weblogger;
@@ -44,24 +45,24 @@
/* (non-Javadoc)
- * @see org.acegisecurity.providers.ldap.LdapAuthoritiesPopulator#getGrantedAuthorities(org.acegisecurity.userdetails.ldap.LdapUserDetails)
+ * @see org.springframework.security.ldap.LdapAuthoritiesPopulator#getGrantedAuthorities(org.springframework.ldap.core.DirContextOperations, String)
*/
- public GrantedAuthority[] getGrantedAuthorities(LdapUserDetails userDetails) throws LdapDataAccessException {
+ public GrantedAuthority[] getGrantedAuthorities(DirContextOperations userData, String username) throws LdapDataAccessException {
- User userData = null;
+ User user = null;
List roles = null;
try {
Weblogger roller = WebloggerFactory.getWeblogger();
UserManager umgr = roller.getUserManager();
- userData = umgr.getUserByUserName(userDetails.getUsername(), Boolean.TRUE);
- roles = umgr.getRoles(userData);
+ user = umgr.getUserByUserName(username, Boolean.TRUE);
+ roles = umgr.getRoles(user);
} catch (WebloggerException ex) {
throw new LdapDataAccessException("ERROR in user lookup", ex);
}
if (userData == null) {
- throw new LdapDataAccessException("ERROR no user: " + userDetails.getUsername());
+ throw new LdapDataAccessException("ERROR no user: " + username);
}
Modified: roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/security/CustomUserRegistry.java
URL: http://svn.apache.org/viewvc/roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/security/CustomUserRegistry.java?rev=663640&r1=663639&r2=663640&view=diff
==============================================================================
--- roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/security/CustomUserRegistry.java (original)
+++ roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/security/CustomUserRegistry.java Thu Jun 5 08:26:50 2008
@@ -26,10 +26,10 @@
import javax.naming.directory.Attributes;
import javax.servlet.http.HttpServletRequest;
-import org.acegisecurity.Authentication;
-import org.acegisecurity.context.SecurityContextHolder;
-import org.acegisecurity.userdetails.UserDetails;
-import org.acegisecurity.userdetails.ldap.LdapUserDetails;
+import org.springframework.security.Authentication;
+import org.springframework.security.context.SecurityContextHolder;
+import org.springframework.security.userdetails.UserDetails;
+import org.springframework.security.userdetails.ldap.LdapUserDetails;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.apache.roller.weblogger.config.WebloggerConfig;
Modified: roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/security/RollerUserDetails.java
URL: http://svn.apache.org/viewvc/roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/security/RollerUserDetails.java?rev=663640&r1=663639&r2=663640&view=diff
==============================================================================
--- roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/security/RollerUserDetails.java (original)
+++ roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/security/RollerUserDetails.java Thu Jun 5 08:26:50 2008
@@ -17,7 +17,7 @@
*/
package org.apache.roller.weblogger.ui.core.security;
-import org.acegisecurity.userdetails.UserDetails;
+import org.springframework.security.userdetails.UserDetails;
/**
* An interface to extract additional properties from a UserDetails instance. These extra
Modified: roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/security/RollerUserDetailsService.java
URL: http://svn.apache.org/viewvc/roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/security/RollerUserDetailsService.java?rev=663640&r1=663639&r2=663640&view=diff
==============================================================================
--- roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/security/RollerUserDetailsService.java (original)
+++ roller/trunk/apps/weblogger/src/java/org/apache/roller/weblogger/ui/core/security/RollerUserDetailsService.java Thu Jun 5 08:26:50 2008
@@ -1,11 +1,11 @@
package org.apache.roller.weblogger.ui.core.security;
import java.util.List;
-import org.acegisecurity.GrantedAuthority;
-import org.acegisecurity.GrantedAuthorityImpl;
-import org.acegisecurity.userdetails.UserDetails;
-import org.acegisecurity.userdetails.UserDetailsService;
-import org.acegisecurity.userdetails.UsernameNotFoundException;
+import org.springframework.security.GrantedAuthority;
+import org.springframework.security.GrantedAuthorityImpl;
+import org.springframework.security.userdetails.UserDetails;
+import org.springframework.security.userdetails.UserDetailsService;
+import org.springframework.security.userdetails.UsernameNotFoundException;
import org.apache.roller.weblogger.WebloggerException;
import org.apache.roller.weblogger.business.Weblogger;
import org.apache.roller.weblogger.business.WebloggerFactory;
@@ -16,7 +16,7 @@
import org.springframework.dao.DataRetrievalFailureException;
/**
- * Acegi user details service implemented using Weblogger API.
+ * Spring Security UserDetailsService implemented using Weblogger API.
*/
public class RollerUserDetailsService implements UserDetailsService {
@@ -44,7 +44,7 @@
authorities[i++] = new GrantedAuthorityImpl(role);
}
- return new org.acegisecurity.userdetails.User(userData.getUserName(), userData.getPassword(), true, authorities);
+ return new org.springframework.security.userdetails.User(userData.getUserName(), userData.getPassword(), true, authorities);
} catch (WebloggerException ex) {
throw new DataAccessResourceFailureException("ERROR: fetching roles", ex);
Modified: roller/trunk/apps/weblogger/test/java/org/apache/roller/weblogger/ui/MockAcegiUserDetailsService.java
URL: http://svn.apache.org/viewvc/roller/trunk/apps/weblogger/test/java/org/apache/roller/weblogger/ui/MockAcegiUserDetailsService.java?rev=663640&r1=663639&r2=663640&view=diff
==============================================================================
--- roller/trunk/apps/weblogger/test/java/org/apache/roller/weblogger/ui/MockAcegiUserDetailsService.java (original)
+++ roller/trunk/apps/weblogger/test/java/org/apache/roller/weblogger/ui/MockAcegiUserDetailsService.java Thu Jun 5 08:26:50 2008
@@ -18,12 +18,12 @@
package org.apache.roller.weblogger.ui;
-import org.acegisecurity.GrantedAuthority;
-import org.acegisecurity.GrantedAuthorityImpl;
-import org.acegisecurity.userdetails.User;
-import org.acegisecurity.userdetails.UserDetails;
-import org.acegisecurity.userdetails.UserDetailsService;
-import org.acegisecurity.userdetails.UsernameNotFoundException;
+import org.springframework.security.GrantedAuthority;
+import org.springframework.security.GrantedAuthorityImpl;
+import org.springframework.security.userdetails.User;
+import org.springframework.security.userdetails.UserDetails;
+import org.springframework.security.userdetails.UserDetailsService;
+import org.springframework.security.userdetails.UsernameNotFoundException;
import org.springframework.dao.DataAccessException;
/**
Modified: roller/trunk/apps/weblogger/testdata/WEB-INF/security.xml
URL: http://svn.apache.org/viewvc/roller/trunk/apps/weblogger/testdata/WEB-INF/security.xml?rev=663640&r1=663639&r2=663640&view=diff
==============================================================================
--- roller/trunk/apps/weblogger/testdata/WEB-INF/security.xml (original)
+++ roller/trunk/apps/weblogger/testdata/WEB-INF/security.xml Thu Jun 5 08:26:50 2008
@@ -16,175 +16,48 @@
copyright in this work, please see the NOTICE file in the top level
directory of this distribution.
-->
-<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN"
- "http://www.springframework.org/dtd/spring-beans.dtd">
-
-<!--
-Minimal security.xml needed for running UI unit tests.
--->
-
-<beans>
-
- <!-- ======================== FILTER CHAIN ======================= -->
- <bean id="filterChainProxy" class="org.acegisecurity.util.FilterChainProxy">
- <property name="filterInvocationDefinitionSource">
- <value>
- CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
- PATTERN_TYPE_APACHE_ANT
- /**=httpSessionContextIntegrationFilter,authenticationProcessingFilter,rememberMeProcessingFilter,channelProcessingFilter,remoteUserFilter,anonymousProcessingFilter,exceptionTranslationFilter,filterInvocationInterceptor
- </value>
- </property>
- </bean>
-
- <!-- ======================== AUTHENTICATION ======================= -->
-
- <!-- Note the order that entries are placed against the objectDefinitionSource is critical.
- The FilterSecurityInterceptor will work from the top of the list down to the FIRST pattern that matches the request URL.
- Accordingly, you should place MOST SPECIFIC (ie a/b/c/d.*) expressions first, with LEAST SPECIFIC (ie a/.*) expressions last -->
- <bean id="filterInvocationInterceptor" class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
- <property name="authenticationManager" ref="authenticationManager"/>
- <property name="accessDecisionManager" ref="accessDecisionManager"/>
- <property name="objectDefinitionSource">
- <value>
- PATTERN_TYPE_APACHE_ANT
- /roller-ui/login-redirect.jsp=admin,editor
- /roller-ui/yourProfile**=admin,editor
- /roller-ui/createWebsite**=admin,editor
- /roller-ui/yourWebsites**=admin,editor
- /roller-ui/authoring/**=admin,editor
- /roller-ui/admin/**=admin
- /rewrite-status*=admin
- </value>
- <!-- Add this to above list for LDAP/SSO configuration -->
- <!-- /roller-ui/user.do*=register -->
- </property>
- </bean>
-
- <bean id="authenticationManager" class="org.acegisecurity.providers.ProviderManager">
- <property name="providers">
- <list>
- <ref local="daoAuthenticationProvider"/>
- <!-- Uncomment this for LDAP/SSO configuration <ref local="ldapAuthProvider"/> -->
- <ref local="anonymousAuthenticationProvider"/>
- <!-- rememberMeAuthenticationProvider added programmatically -->
- </list>
- </property>
- </bean>
-
- <!-- Log failed authentication attempts to commons-logging -->
- <bean id="loggerListener" class="org.acegisecurity.event.authentication.LoggerListener"/>
-
- <bean id="daoAuthenticationProvider" class="org.acegisecurity.providers.dao.DaoAuthenticationProvider">
- <property name="userDetailsService" ref="mockAuthenticationDao" />
- <!-- <property name="userDetailsService" ref="jdbcAuthenticationDao"/> -->
- <property name="userCache" ref="userCache"/>
- </bean>
-
- <bean id="mockAuthenticationDao" class="org.apache.roller.weblogger.ui.MockAcegiUserDetailsService" />
- <!-- Read users from database
- <bean id="jdbcAuthenticationDao" class="org.acegisecurity.userdetails.jdbc.JdbcDaoImpl">
- <property name="dataSource">
- <bean class="org.springframework.jndi.JndiObjectFactoryBean">
- <property name="jndiName" value="java:comp/env/jdbc/rollerdb"/>
- </bean>
- </property>
- <property name="usersByUsernameQuery">
- <value>SELECT username,passphrase,isenabled FROM rolleruser WHERE username = ?</value>
- </property>
- <property name="authoritiesByUsernameQuery">
- <value>SELECT username,rolename FROM userrole WHERE username = ?</value>
- </property>
- </bean> -->
-
- <bean id="userCache" class="org.acegisecurity.providers.dao.cache.EhCacheBasedUserCache">
- <property name="cache">
- <bean class="org.springframework.cache.ehcache.EhCacheFactoryBean">
- <property name="cacheManager">
- <bean class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean"/>
- </property>
- <property name="cacheName" value="userCache"/>
- </bean>
- </property>
- </bean>
-
- <bean id="anonymousAuthenticationProvider" class="org.acegisecurity.providers.anonymous.AnonymousAuthenticationProvider">
- <property name="key" value="anonymous"/>
- </bean>
-
- <bean id="roleVoter" class="org.acegisecurity.vote.RoleVoter">
- <property name="rolePrefix" value=""/>
- </bean>
-
- <bean id="accessDecisionManager" class="org.acegisecurity.vote.AffirmativeBased">
- <property name="allowIfAllAbstainDecisions" value="false"/>
- <property name="decisionVoters">
- <list>
- <ref local="roleVoter"/>
- </list>
- </property>
- </bean>
-
- <!-- ===================== HTTP REQUEST SECURITY ====================
- <bean id="httpSessionContextIntegrationFilter" class="org.acegisecurity.context.HttpSessionContextIntegrationFilter"/>
-
- <bean id="authenticationProcessingFilter" class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilter">
- <property name="authenticationManager" ref="authenticationManager"/>
- <property name="authenticationFailureUrl" value="/roller-ui/login.do?error=true"/>
- <property name="defaultTargetUrl" value="/"/>
- <property name="filterProcessesUrl" value="/roller_j_security_check"/>
- <property name="rememberMeServices" ref="rememberMeServices"/>
- </bean>
-
- <bean id="anonymousProcessingFilter" class="org.acegisecurity.providers.anonymous.AnonymousProcessingFilter">
- <property name="key" value="anonymous"/>
- <property name="userAttribute" value="anonymous,ROLE_ANONYMOUS"/>
- </bean>
-
- <bean id="exceptionTranslationFilter" class="org.acegisecurity.ui.ExceptionTranslationFilter">
- <property name="authenticationEntryPoint" ref="authenticationProcessingFilterEntryPoint"/>
- </bean>
-
- <bean id="remoteUserFilter" class="org.acegisecurity.wrapper.SecurityContextHolderAwareRequestFilter"/>
-
- <bean id="authenticationProcessingFilterEntryPoint" class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint">
- <property name="loginFormUrl" value="/roller-ui/login.do"/>
- <property name="forceHttps" value="false"/>
- </bean> -->
-
- <!-- ===================== REMEMBER ME ==================== -->
- <bean id="rememberMeProcessingFilter" class="org.acegisecurity.ui.rememberme.RememberMeProcessingFilter">
- <property name="authenticationManager" ref="authenticationManager"/>
- <property name="rememberMeServices" ref="rememberMeServices"/>
- </bean>
-
- <bean id="rememberMeServices" class="org.acegisecurity.ui.rememberme.TokenBasedRememberMeServices">
- <property name="userDetailsService" ref="mockAuthenticationDao" />
- <!-- <property name="userDetailsService" ref="jdbcAuthenticationDao"/> -->
- <property name="key" value="rollerlovesacegi"/>
- <property name="parameter" value="rememberMe"/>
- </bean>
-
- <bean id="rememberMeAuthenticationProvider" class="org.acegisecurity.providers.rememberme.RememberMeAuthenticationProvider">
- <property name="key" value="rollerlovesacegi"/>
- </bean>
-
- <!-- ===================== SSL SWITCHING ====================
- <bean id="channelProcessingFilter" class="org.acegisecurity.securechannel.ChannelProcessingFilter">
- <property name="channelDecisionManager" ref="channelDecisionManager"/>
- <property name="filterInvocationDefinitionSource">
- <value>
- PATTERN_TYPE_APACHE_ANT
- </value>
- </property>
- </bean>
-
- <bean id="channelDecisionManager" class="org.acegisecurity.securechannel.ChannelDecisionManagerImpl">
- <property name="channelProcessors">
- <list>
- <bean class="org.acegisecurity.securechannel.SecureChannelProcessor"/>
- <bean class="org.acegisecurity.securechannel.InsecureChannelProcessor"/>
- </list>
- </property>
- </bean> -->
-
+<beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:beans="http://www.springframework.org/schema/beans"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
+ http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.1.xsd">
+
+ <http auto-config="true" lowercase-comparisons="true" access-decision-manager-ref="accessDecisionManager">
+ <intercept-url pattern="/images/**" filters="none"/>
+ <intercept-url pattern="/scripts/**" filters="none"/>
+ <intercept-url pattern="/styles/**" filters="none"/>
+ <intercept-url pattern="/roller-ui/login-redirect**" access="admin,editor"/>
+ <intercept-url pattern="/roller-ui/profile**" access="admin,editor"/>
+ <intercept-url pattern="/roller-ui/createWeblog**" access="admin,editor"/>
+ <intercept-url pattern="/roller-ui/menu**" access="admin,editor"/>
+ <intercept-url pattern="/roller-ui/authoring/**" access="admin,editor"/>
+ <intercept-url pattern="/roller-ui/admin/**" access="admin"/>
+ <intercept-url pattern="/rewrite-status*" access="admin"/>
+
+ <!-- Uncomment the following for LDAP/SSO configuration -->
+ <!--intercept-url pattern="/roller-ui/user.do*" access="register"/-->
+
+ <form-login login-page="/roller-ui/login.rol" authentication-failure-url="/roller-ui/login.rol?error=true"
+ login-processing-url="/roller_j_security_check"/>
+ <remember-me user-service-ref="rollerUserService" key="715F2448-3176-11DD-ABC6-9CD955D89593"/>
+ </http>
+
+ <authentication-provider user-service-ref="rollerUserService"/>
+
+ <!-- Read users from Mock Roller API -->
+ <beans:bean id="rollerUserService" class="org.apache.roller.weblogger.ui.MockAcegiUserDetailsService"/>
+
+ <!-- It may be possible to get rid of the following two beans in a future version of Spring Security. -->
+ <!-- See http://jira.springframework.org/browse/SEC-840 for more information. -->
+ <beans:bean id="accessDecisionManager" class="org.springframework.security.vote.AffirmativeBased">
+ <beans:property name="allowIfAllAbstainDecisions" value="false"/>
+ <beans:property name="decisionVoters">
+ <beans:list>
+ <beans:ref local="roleVoter"/>
+ </beans:list>
+ </beans:property>
+ </beans:bean>
+
+ <beans:bean id="roleVoter" class="org.springframework.security.vote.RoleVoter">
+ <beans:property name="rolePrefix" value=""/>
+ </beans:bean>
</beans>
Modified: roller/trunk/apps/weblogger/web/WEB-INF/security.xml
URL: http://svn.apache.org/viewvc/roller/trunk/apps/weblogger/web/WEB-INF/security.xml?rev=663640&r1=663639&r2=663640&view=diff
==============================================================================
--- roller/trunk/apps/weblogger/web/WEB-INF/security.xml (original)
+++ roller/trunk/apps/weblogger/web/WEB-INF/security.xml Thu Jun 5 08:26:50 2008
@@ -16,179 +16,71 @@
copyright in this work, please see the NOTICE file in the top level
directory of this distribution.
-->
-<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN"
- "http://www.springframework.org/dtd/spring-beans.dtd">
+<beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:beans="http://www.springframework.org/schema/beans"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
+ http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.1.xsd">
+
+ <http auto-config="true" lowercase-comparisons="true" access-decision-manager-ref="accessDecisionManager">
+ <intercept-url pattern="/images/**" filters="none"/>
+ <intercept-url pattern="/scripts/**" filters="none"/>
+ <intercept-url pattern="/styles/**" filters="none"/>
+ <intercept-url pattern="/roller-ui/login-redirect**" access="admin,editor"/>
+ <intercept-url pattern="/roller-ui/profile**" access="admin,editor"/>
+ <intercept-url pattern="/roller-ui/createWeblog**" access="admin,editor"/>
+ <intercept-url pattern="/roller-ui/menu**" access="admin,editor"/>
+ <intercept-url pattern="/roller-ui/authoring/**" access="admin,editor"/>
+ <intercept-url pattern="/roller-ui/admin/**" access="admin"/>
+ <intercept-url pattern="/rewrite-status*" access="admin"/>
+
+ <!-- Uncomment the following for LDAP/SSO configuration -->
+ <!--intercept-url pattern="/roller-ui/user.do*" access="register"/-->
+
+ <form-login login-page="/roller-ui/login.rol" authentication-failure-url="/roller-ui/login.rol?error=true"
+ login-processing-url="/roller_j_security_check"/>
+ <remember-me user-service-ref="rollerUserService" key="715F2448-3176-11DD-ABC6-9CD955D89593"/>
+ </http>
-<beans>
-
- <!-- ======================== FILTER CHAIN ======================= -->
- <bean id="filterChainProxy" class="org.acegisecurity.util.FilterChainProxy">
- <property name="filterInvocationDefinitionSource">
- <value>
- CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
- PATTERN_TYPE_APACHE_ANT
- /**=httpSessionContextIntegrationFilter,authenticationProcessingFilter,rememberMeProcessingFilter,channelProcessingFilter,remoteUserFilter,anonymousProcessingFilter,exceptionTranslationFilter,filterInvocationInterceptor
- </value>
- <!-- Replace "authenticationProcessingFilter,rememberMeProcessingFilter" with "casProcessingFilter" if you want to use Roller with CAS -->
- </property>
- </bean>
-
- <!-- ======================== AUTHENTICATION ======================= -->
-
- <!-- Note the order that entries are placed against the objectDefinitionSource is critical.
- The FilterSecurityInterceptor will work from the top of the list down to the FIRST pattern that matches the request URL.
- Accordingly, you should place MOST SPECIFIC (ie a/b/c/d.*) expressions first, with LEAST SPECIFIC (ie a/.*) expressions last -->
- <bean id="filterInvocationInterceptor" class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
- <property name="authenticationManager" ref="authenticationManager"/>
- <property name="accessDecisionManager" ref="accessDecisionManager"/>
- <property name="objectDefinitionSource">
- <value>
- PATTERN_TYPE_APACHE_ANT
- /roller-ui/login-redirect**=admin,editor
- /roller-ui/profile**=admin,editor
- /roller-ui/createWeblog**=admin,editor
- /roller-ui/menu**=admin,editor
- /roller-ui/authoring/**=admin,editor
- /roller-ui/admin/**=admin
- /rewrite-status*=admin
- </value>
- <!-- Add this to above list for LDAP/SSO configuration -->
- <!-- /roller-ui/user.do*=register -->
- </property>
- </bean>
-
- <bean id="authenticationManager" class="org.acegisecurity.providers.ProviderManager">
- <property name="providers">
- <list>
- <ref local="daoAuthenticationProvider"/>
- <!-- Uncomment this for LDAP/SSO configuration <ref local="ldapAuthProvider"/> -->
- <!-- Uncomment this for CAS/SSO configuration <ref local="casAuthenticationProvider"/> -->
- <ref local="anonymousAuthenticationProvider"/>
- <!-- rememberMeAuthenticationProvider added programmatically -->
- </list>
- </property>
- </bean>
-
- <!-- Log failed authentication attempts to commons-logging -->
- <bean id="loggerListener" class="org.acegisecurity.event.authentication.LoggerListener"/>
-
- <bean id="daoAuthenticationProvider" class="org.acegisecurity.providers.dao.DaoAuthenticationProvider">
- <property name="userDetailsService" ref="jdbcAuthenticationDao"/>
- <property name="userCache" ref="userCache"/>
- </bean>
+ <authentication-provider user-service-ref="rollerUserService"/>
<!-- Read users from Roller API -->
- <bean id="jdbcAuthenticationDao" class="org.apache.roller.weblogger.ui.core.security.RollerUserDetailsService"/>
-
- <bean id="userCache" class="org.acegisecurity.providers.dao.cache.EhCacheBasedUserCache">
- <property name="cache">
- <bean class="org.springframework.cache.ehcache.EhCacheFactoryBean">
- <property name="cacheManager">
- <bean class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean"/>
- </property>
- <property name="cacheName" value="userCache"/>
- </bean>
- </property>
- </bean>
-
- <bean id="anonymousAuthenticationProvider" class="org.acegisecurity.providers.anonymous.AnonymousAuthenticationProvider">
- <property name="key" value="anonymous"/>
- </bean>
-
- <bean id="roleVoter" class="org.acegisecurity.vote.RoleVoter">
- <property name="rolePrefix" value=""/>
- </bean>
-
- <bean id="accessDecisionManager" class="org.acegisecurity.vote.AffirmativeBased">
- <property name="allowIfAllAbstainDecisions" value="false"/>
- <property name="decisionVoters">
- <list>
- <ref local="roleVoter"/>
- </list>
- </property>
- </bean>
-
- <!-- ===================== HTTP REQUEST SECURITY ==================== -->
- <bean id="httpSessionContextIntegrationFilter" class="org.acegisecurity.context.HttpSessionContextIntegrationFilter"/>
-
- <bean id="authenticationProcessingFilter" class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilter">
- <property name="authenticationManager" ref="authenticationManager"/>
- <property name="authenticationFailureUrl" value="/roller-ui/login.rol?error=true"/>
- <property name="defaultTargetUrl" value="/"/>
- <property name="filterProcessesUrl" value="/roller_j_security_check"/>
- <property name="rememberMeServices" ref="rememberMeServices"/>
- </bean>
-
- <bean id="anonymousProcessingFilter" class="org.acegisecurity.providers.anonymous.AnonymousProcessingFilter">
- <property name="key" value="anonymous"/>
- <property name="userAttribute" value="anonymous,ROLE_ANONYMOUS"/>
- </bean>
-
- <bean id="exceptionTranslationFilter" class="org.acegisecurity.ui.ExceptionTranslationFilter">
- <!-- Change the ref on this property to "casProcessingFilterEntryPoint" when using CAS -->
- <property name="authenticationEntryPoint" ref="authenticationProcessingFilterEntryPoint"/>
- </bean>
-
- <bean id="remoteUserFilter" class="org.acegisecurity.wrapper.SecurityContextHolderAwareRequestFilter"/>
-
- <bean id="authenticationProcessingFilterEntryPoint" class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint">
- <property name="loginFormUrl" value="/roller-ui/login.rol"/>
- <property name="forceHttps" value="false"/>
- </bean>
+ <beans:bean id="rollerUserService" class="org.apache.roller.weblogger.ui.core.security.RollerUserDetailsService"/>
- <!-- ===================== REMEMBER ME ==================== -->
- <bean id="rememberMeProcessingFilter" class="org.acegisecurity.ui.rememberme.RememberMeProcessingFilter">
- <property name="authenticationManager" ref="authenticationManager"/>
- <property name="rememberMeServices" ref="rememberMeServices"/>
- </bean>
-
- <bean id="rememberMeServices" class="org.acegisecurity.ui.rememberme.TokenBasedRememberMeServices">
- <property name="userDetailsService" ref="jdbcAuthenticationDao"/>
- <property name="key" value="rollerlovesacegi"/>
- <property name="parameter" value="rememberMe"/>
- </bean>
-
- <bean id="rememberMeAuthenticationProvider" class="org.acegisecurity.providers.rememberme.RememberMeAuthenticationProvider">
- <property name="key" value="rollerlovesacegi"/>
- </bean>
+ <!-- It may be possible to get rid of the following two beans in a future version of Spring Security. -->
+ <!-- See http://jira.springframework.org/browse/SEC-840 for more information. -->
+ <beans:bean id="accessDecisionManager" class="org.springframework.security.vote.AffirmativeBased">
+ <beans:property name="allowIfAllAbstainDecisions" value="false"/>
+ <beans:property name="decisionVoters">
+ <beans:list>
+ <beans:ref local="roleVoter"/>
+ </beans:list>
+ </beans:property>
+ </beans:bean>
+
+ <beans:bean id="roleVoter" class="org.springframework.security.vote.RoleVoter">
+ <beans:property name="rolePrefix" value=""/>
+ </beans:bean>
- <!-- ===================== SSL SWITCHING ==================== -->
- <bean id="channelProcessingFilter" class="org.acegisecurity.securechannel.ChannelProcessingFilter">
- <property name="channelDecisionManager" ref="channelDecisionManager"/>
- <property name="filterInvocationDefinitionSource">
- <value>
- PATTERN_TYPE_APACHE_ANT
- </value>
- </property>
- </bean>
-
- <bean id="channelDecisionManager" class="org.acegisecurity.securechannel.ChannelDecisionManagerImpl">
- <property name="channelProcessors">
- <list>
- <bean class="org.acegisecurity.securechannel.SecureChannelProcessor"/>
- <bean class="org.acegisecurity.securechannel.InsecureChannelProcessor"/>
- </list>
- </property>
- </bean>
+ <!-- TODO MR: Modify LDAP and CAS Configuration for Spring Security 2.0.x -->
<!-- ===================== LDAP AUTHENTICATION ==================== -->
<!-- BEGIN: Sample LDAP/RollerDB hybrid security configuration
- <bean id="initialDirContextFactory" class="org.acegisecurity.ldap.DefaultInitialDirContextFactory">
+ <bean id="initialDirContextFactory" class="org.springframework.security.ldap.DefaultInitialDirContextFactory">
<constructor-arg value="LDAP_URL"/>
<property name="managerDn" value="LDAP_USERNAME"/>
<property name="managerPassword" value="LDAP_PASSWORD"/>
</bean>
- <bean id="ldapUserSearch" class="org.acegisecurity.ldap.search.FilterBasedLdapUserSearch">
+ <bean id="ldapUserSearch" class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch">
<constructor-arg index="0" value=""/>
<constructor-arg index="1" value="uid={0}"/>
<constructor-arg index="2" ref="initialDirContextFactory"/>
<property name="searchSubtree" value="true"/>
</bean>
- <bean id="ldapAuthProvider" class="org.acegisecurity.providers.ldap.LdapAuthenticationProvider">
+ <bean id="ldapAuthProvider" class="org.springframework.security.providers.ldap.LdapAuthenticationProvider">
<constructor-arg>
- <bean class="org.acegisecurity.providers.ldap.authenticator.BindAuthenticator">
+ <bean class="org.springframework.security.providers.ldap.authenticator.BindAuthenticator">
<constructor-arg ref="initialDirContextFactory"/>
<property name="userSearch" ref="ldapUserSearch"/>
</bean>
@@ -205,19 +97,19 @@
<!-- ======================== CENTRAL AUTHENTICATION SERVICE (CAS) ======================= -->
<!-- BEGIN: Sample CAS/RollerDB hybrid security configuration
- <bean id="casProcessingFilter" class="org.acegisecurity.ui.cas.CasProcessingFilter">
+ <bean id="casProcessingFilter" class="org.springframework.security.ui.cas.CasProcessingFilter">
<property name="authenticationManager" ref="authenticationManager"/>
<property name="authenticationFailureUrl" value="/roller-ui/login.rol?error=true"/>
<property name="defaultTargetUrl" value="/"/>
<property name="filterProcessesUrl" value="/roller_j_security_check"/>
</bean>
- <bean id="casProcessingFilterEntryPoint" class="org.acegisecurity.ui.cas.CasProcessingFilterEntryPoint">
+ <bean id="casProcessingFilterEntryPoint" class="org.springframework.security.ui.cas.CasProcessingFilterEntryPoint">
<property name="loginUrl" value="https://localhost:8443/cas/login"/>
<property name="serviceProperties" ref="serviceProperties"/>
</bean>
- <bean id="casAuthenticationProvider" class="org.acegisecurity.providers.cas.CasAuthenticationProvider">
+ <bean id="casAuthenticationProvider" class="org.springframework.security.providers.cas.CasAuthenticationProvider">
<property name="casAuthoritiesPopulator">
<bean class="org.apache.roller.weblogger.ui.core.security.RollerCasPopulator">
<property name="userDetailsService" ref="jdbcAuthenticationDao"/>
@@ -229,7 +121,7 @@
<property name="key" value="rollerlovesacegi"/>
</bean>
- <bean id="casProxyTicketValidator" class="org.acegisecurity.providers.cas.ticketvalidator.CasProxyTicketValidator">
+ <bean id="casProxyTicketValidator" class="org.springframework.security.providers.cas.ticketvalidator.CasProxyTicketValidator">
<property name="casValidate" value="https://localhost:8443/cas/proxyValidate"/>
<property name="proxyCallbackUrl" value="http://localhost:8080/roller/casProxy/receptor"/>
<property name="serviceProperties" ref="serviceProperties"/>
@@ -243,16 +135,16 @@
<property name="cacheName" value="ticketCache"/>
</bean>
- <bean id="statelessTicketCache" class="org.acegisecurity.providers.cas.cache.EhCacheBasedTicketCache">
+ <bean id="statelessTicketCache" class="org.springframework.security.providers.cas.cache.EhCacheBasedTicketCache">
<property name="cache" ref="ticketCacheBackend"/>
</bean>
- <bean id="casProxyDecider" class="org.acegisecurity.providers.cas.proxy.RejectProxyTickets"/>
+ <bean id="casProxyDecider" class="org.springframework.security.providers.cas.proxy.RejectProxyTickets"/>
- <bean id="serviceProperties" class="org.acegisecurity.ui.cas.ServiceProperties">
+ <bean id="serviceProperties" class="org.springframework.security.ui.cas.ServiceProperties">
<property name="service" value="http://localhost:8080/roller/roller_j_security_check"/>
<property name="sendRenew" value="false"/>
</bean>
-->
<!-- END Sample CAS/RollerDB hybrid security configuration -->
-</beans>
+</beans:beans>
Modified: roller/trunk/apps/weblogger/web/WEB-INF/web.xml
URL: http://svn.apache.org/viewvc/roller/trunk/apps/weblogger/web/WEB-INF/web.xml?rev=663640&r1=663639&r2=663640&view=diff
==============================================================================
--- roller/trunk/apps/weblogger/web/WEB-INF/web.xml (original)
+++ roller/trunk/apps/weblogger/web/WEB-INF/web.xml Thu Jun 5 08:26:50 2008
@@ -27,10 +27,10 @@
<filter>
<filter-name>securityFilter</filter-name>
- <filter-class>org.acegisecurity.util.FilterToBeanProxy</filter-class>
+ <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
<init-param>
- <param-name>targetClass</param-name>
- <param-value>org.acegisecurity.util.FilterChainProxy</param-value>
+ <param-name>targetBeanName</param-name>
+ <param-value>springSecurityFilterChain</param-value>
</init-param>
</filter>
Modified: roller/trunk/apps/weblogger/web/roller-ui/logout-redirect.jsp
URL: http://svn.apache.org/viewvc/roller/trunk/apps/weblogger/web/roller-ui/logout-redirect.jsp?rev=663640&r1=663639&r2=663640&view=diff
==============================================================================
--- roller/trunk/apps/weblogger/web/roller-ui/logout-redirect.jsp (original)
+++ roller/trunk/apps/weblogger/web/roller-ui/logout-redirect.jsp Thu Jun 5 08:26:50 2008
@@ -18,14 +18,14 @@
<%@ page language="java" contentType="text/html; charset=UTF-8" %>
<%@ page import="org.apache.roller.weblogger.ui.core.RollerSession" %>
<%@ page import="javax.servlet.http.Cookie" %>
-<%@ page import="org.acegisecurity.ui.rememberme.TokenBasedRememberMeServices" %>
+<%@ page import="org.springframework.security.ui.rememberme.TokenBasedRememberMeServices" %>
<%
request.getSession().removeAttribute(RollerSession.ROLLER_SESSION);
request.getSession().invalidate();
// Mimic exactly TokenBasedRememberMeServices.makeCancelCookie()
-Cookie terminate = new Cookie(TokenBasedRememberMeServices.ACEGI_SECURITY_HASHED_REMEMBER_ME_COOKIE_KEY, null);
+Cookie terminate = new Cookie(TokenBasedRememberMeServices.SPRING_SECURITY_REMEMBER_ME_COOKIE_KEY, null);
String contextPath = request.getContextPath();
terminate.setPath(contextPath != null && contextPath.length() > 0 ? contextPath : "/");
terminate.setMaxAge(0);