I've done many sites, using Java, Php, etc... When I needed user management I would use HttpSession and a DB to keep passwords and eventually session data.
What's the recomended/standard way of doing this with Spring in a simple way?
There is a "sub"-project of Spring: Spring-Security. That is exactly what you need. It provides also a "jdbc-user-service" authentication provider which reads the user from a database table out of the box.
Spring Security is great when the developer wants to secure his web app. But what about creating the account? and "forgot password"?
Have a look at my answer here.
"I have implemented a JAVA project for this use case. It is open
source, based on Spring-Security. A release version is on
Maven-Central, so you do not need to compile it, but instead you can
fetch it as maven-dependency to your project!"
<dependency>
<groupId>com.ohadr</groupId>
<artifactId>authentication-flows</artifactId>
<version>1.5.0-RELEASE</version>
</dependency>
Related
I am developing a jsp dynamic web project on eclipse.
I want to create an website with login functionality. I intend to store users' accounts and passwords in MySQL database. Of course, different users have different roles and rights to access different web pages. What is the best approach to implement it?
So far, I know these approaches:
1) Users enter accounts/passwords in login.jsp. LoginServlet then connects to MySQL database to check if it is correct. AuthenticationFilters will make sure only users with rights can access certain pages.
2) Use Role Based Authentication by declaring user roles in web.xml. I find this approach is not flexible, because I need to declare roles in advance.
3) Use HttpServletRequest's login/logout methods. I have not studied it.
Is my understanding correct? Could someone gives me some suggestions? Some clues would be very helpful!
Besides, I know that using POST alone to send passwords is not safe enough. Many websites suggest to use HTTPS connections. So if using HTTPS connections, does it affect the approach I choose to implement the login function?
Thanks!
--
Now, I know I need to use Spring. But Spring seems difficult for me... In Spring website I cant find out the link to download jar files. The user guide says I need to use Gradle or Maven, which I haven't used before, and have no idea why I need them. Besides, there are many Spring projects. Which one should I choose? Spring framework?
--
Have you looked into using Spring Security? It's built for just that. You don't need to be familiar with Spring but it may help.
Here are a couple of tutorials that use database authentication:
1: Spring Security Authentication and Authorization Example with Database Credentials
2: Spring Security Login Example with Database
Edit:
You don't have to Maven or Gradle. You can simply add the jars to your build path and they will work. The only projects you need to implement for the login to work is the Spring Framework and Spring Security.
To use Spring Security without Maven or Gradle:
Download the Spring Framework jars, unzip them, and add them to your project and build path. It's probably a good idea to find a hello world tutorial using Spring to get you started. A quick Google search should turn up many results.
After you have Spring implemented in your project, download the Spring Security jars, unzip those, and add them to your build path. The links to the tutorials that I previously posted will get you started. They may take a little while to go through and you may not understand exactly what is happening behind the scenes, but once you get it set up is works outstanding. I'm also not sure if you are using xml configuration or Java config but I believe those tutorials are for xml.
Spring Security was built so that it could be added to any project and have you up and running with basic configuration in about 15 minutes. After you get the basic login going (it will use the generic login form), you can search for how to implement your own custom login form, add permissions or restrictions to users and url patters, adding custom filters, etc. I encourage you to spend some time learning it as it is highly flexible and customizable.
I'm developing two java web-applications through (springDataJPA,spring and vaadin). Now I want to make a login module usable from both applications.
I worked with JAAS a few month ago, and I want any suggestion about the tecnology to use to implement it.
Can i make this using spring Security?
Can you give me any suggestion about this?
Use spring-security, create database with users. And use them in both web apps
Look for this tutorial:
spring-security with database
What security features does Spring provide that are not already provided by the Java EE specs?
In the Java EE specs we have:
A range of sevlet security options in the web.xml. Most people will configure basic or form based authentication. They link their Java EE application to an LDAP server - which stores users / groups. Request will be encrypted and come in over HTTPS.
Possibility to annotate any EJB and only allow certain roles execute certain methods
Ability to check user principle at runtime programmatically
So what security extras does Spring 3.0 give me?
Even if you just need some fairly simple authentication, Spring Security provides support for lots of simple but useful features (think of redirecting after logout, redirecting to login page on all URLs, remember-me). With Java EE you'll end up writing this yourself and - possibly - screwing up so you'll have an insecure app.
Spring Security works well with many standards/protocols/etc. out of the box (LDAP, JAAS, X.509). There's also more advanced stuff like SSO or ACLs. And if the standard functionality doesn't suit you, you can customize this fairly easily, often requiring just a little code.
What I also like is that it's fairly non-intrusive, your controller/action/… classes typically don't have to be involved.
That said, if you use it for the first time, it takes some time to set Spring Security up and get used to it.
(Finally, here's their own feature list: http://static.springsource.org/spring-security/site/features.html)
One killer Feature are ACLs!
#See: Spring Security Reference Chapter 17. Domain Object Security (ACLs)
And I have the feeling that Spring Security is much easier to customize. For example if you need a User Management where the User can self register and get some of this privileges limitedly and some others after this email address has been confirmed.
Thinking to use Spring security but is there better than that? Also, thinking to use CAS (Central Authentication Service) to integrate with Spring security for Single Sign On? Any suggestions? It might be different question but any idea how to use spring taglib in GWT to hide certain things based on user role?
I would recommend also the great (but maybe easier) security library from Apache: Shiro.
Here is the documentation to integrate with CAS: http://shiro.apache.org/cas.html.
Thinking to use Spring security but is there better than that?
Maybe
Also, thinking to use CAS (Central Authentication Service) to integrate with Spring security for Single Sign On? Any suggestions?
Spring Security integrates seamlessly with CAS, you just need to do namespace based configuration and add beans when required on the client side.
See Documentation
It might be different question but any idea how to use spring taglib in GWT to hide certain things based on user role?
Yes, you can do that using the security taglib like provided you include your GWT widgets into JSPs:
Here is a tutorial on how to do that but haven't tested it.
custom-integration-of-gwt-widgets-into-jsps
and the-role-of-jsps-in-a-gwt-world/
See also:
http://www.springbyexample.org/examples/simple-gwt-spring-webapp-gwt.html
how to conditionally show jsp content to logged in users with Spring security
I have completed setting up Spring Security using the roo shell as a guide and it has generated several views, amongst them is the login.jspx. I am trying to create a custom login form using Vaadin's Visual editor and Eclipse, how can i redirect the user to my login form and then use Spring Security to validate and authenticate the user as well as start a session management? I am really trying to avoid JSP since the rest of my application is using Vaadin as its Core Front-End
vaadin has some limitations on the login form.
Have a look at: https://vaadin.com/book/-/page/components.loginform.html so you will notice what I mean.
You can also have a look at the vaadin wiki (https://vaadin.com/wiki). There are several articles on your topic. You may find your solution there :)
kind regards
.zip