Spring Security 3: Full ACL Tutorial (Part 2)

In Part 1 of this tutorial we've completed setting up the ACL and Bulletin databases. In Part 2 we'll be building the Bulletin application with Spring Security and Spring MVC.

Part 1: Functional Specs and the Application Database
Part 2: Spring Security Configuration
Part 3: Spring MVC Module
Part 4: Running the Application

Part 2: Spring Security

Most of the development with Spring Security are composed of configuration files. We'll be declaring two configuration files:

1. spring-security.xml
2. acl-context.xml

spring-security.xml

This contains standard Spring Security configuration. It declares the following:
1. A set of intercept-url patterns.
2. An authentication manager
3. An Md5 password encoder
4. An in-memory user service

For an in-depth description of this file, please see the Spring Security 3 - MVC: Using a Simple User-Service Tutorial

acl-context.xml

This contains ACL-related configuration. It declares the following:
1. A global-method-security tag which enables method security expressions
2. An expression handler
3. A permission evaluator
4. An ACL service
5. A lookup strategy
6. A datasource
7. An ACL cache
8. An ACL authorization strategy
9. A role hierarchy

Here are the configuration files:

spring-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns:security="http://www.springframework.org/schema/security"
 xsi:schemaLocation="http://www.springframework.org/schema/beans 
      http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
   http://www.springframework.org/schema/security 
   http://www.springframework.org/schema/security/spring-security-3.0.xsd">
 
 <!-- Loads ACL related configurations -->
 <import resource="acl-context.xml" />
 
 <!-- This is where we configure Spring-Security  -->
 <security:http auto-config="true" use-expressions="true" access-denied-page="/krams/auth/denied" >
 
  <security:intercept-url pattern="/krams/auth/login" access="permitAll"/>
  <security:intercept-url pattern="/krams/bulletin/view" access="hasRole('ROLE_VISITOR')"/>
  <security:intercept-url pattern="/krams/role/admin" access="hasRole('ROLE_ADMIN')"/>
  <security:intercept-url pattern="/krams/role/user" access="hasRole('ROLE_USER')"/>
  <security:intercept-url pattern="/krams/role/visitor" access="hasRole('ROLE_VISITOR')"/>
  
  <security:form-login
    login-page="/krams/auth/login" 
    authentication-failure-url="/krams/auth/login?error=true" 
    default-target-url="/krams/bulletin/view"/>
   
  <security:logout 
    invalidate-session="true" 
    logout-success-url="/krams/auth/login" 
    logout-url="/krams/auth/logout"/>
 
 </security:http>
 
 <!-- Declare an authentication-manager to use a custom userDetailsService -->
 <security:authentication-manager>
         <security:authentication-provider user-service-ref="userDetailsService">
           <security:password-encoder ref="passwordEncoder"/>
         </security:authentication-provider>
 </security:authentication-manager>
 
 <!-- Use a Md5 encoder since the user's passwords are stored as Md5 in the database -->
 <bean class="org.springframework.security.authentication.encoding.Md5PasswordEncoder" id="passwordEncoder"/>

  <!-- An in-memory list of users. No need to access an external database layer.
      See Spring Security 3.1 Reference 5.2.1 In-Memory Authentication -->
  <!-- john's password: admin
    jane's password: user
    mike's password: visitor  -->
  <security:user-service id="userDetailsService">
     <security:user name="john" password="21232f297a57a5a743894a0e4a801fc3" authorities="ROLE_ADMIN, ROLE_USER, ROLE_VISITOR" />
     <security:user name="jane" password="ee11cbb19052e40b07aac0ca060c23ee" authorities="ROLE_USER, ROLE_VISITOR" />
     <security:user name="mike" password="127870930d65c57ee65fcc47f2170d38" authorities="ROLE_VISITOR" />
   </security:user-service>
 
</beans>

acl-context.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns:security="http://www.springframework.org/schema/security"
 xmlns:p="http://www.springframework.org/schema/p"
 xmlns:jdbc="http://www.springframework.org/schema/jdbc" 
 xsi:schemaLocation="http://www.springframework.org/schema/beans 
      http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
   http://www.springframework.org/schema/security 
   http://www.springframework.org/schema/security/spring-security-3.0.xsd
   http://www.springframework.org/schema/jdbc 
   http://www.springframework.org/schema/jdbc/spring-jdbc-3.0.xsd">

 <!-- Enables Method Security and Expression-based access control -->
 <security:global-method-security pre-post-annotations="enabled">
  <!-- Enables custom expression handler -->
  <security:expression-handler ref="expressionHandler" />
 </security:global-method-security>

 <!-- See 15.3.2 Built-In Expression @http://static.springsource.org/spring-security/site/docs/3.0.x/reference/el-access.html#el-permission-evaluator -->
 <bean id="expressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
  <!-- To use hasPermission() in expressions, configure a PermissionEvaluator -->
  <property name="permissionEvaluator" ref="permissionEvaluator" />
  <property name = "roleHierarchy" ref="roleHierarchy"/>
 </bean>
 
 <!-- Declare a custom PermissionEvaluator
  We'll rely on the standard AclPermissionEvaluator implementation -->
 <bean class="org.springframework.security.acls.AclPermissionEvaluator" id="permissionEvaluator">
  <constructor-arg ref="aclService"/>
 </bean>

 <!-- Declare an acl service -->
 <bean class="org.springframework.security.acls.jdbc.JdbcMutableAclService" id="aclService">
  <constructor-arg ref="dataSource"/>
        <constructor-arg ref="lookupStrategy"/>
        <constructor-arg ref="aclCache"/>
 </bean>
 
 <!-- Declare a lookup strategy-->
 <bean id="lookupStrategy" class="org.springframework.security.acls.jdbc.BasicLookupStrategy">
        <constructor-arg ref="dataSource"/>
        <constructor-arg ref="aclCache"/>
        <constructor-arg ref="aclAuthorizationStrategy"/>
        <constructor-arg ref="auditLogger"/>
    </bean>
    
    <!-- Declare a datasource -->
    <bean id="dataSource" class="com.mchange.v2.c3p0.ComboPooledDataSource"
   destroy-method="close"
   p:driverClass="com.mysql.jdbc.Driver"
   p:jdbcUrl="jdbc:mysql://localhost/acl"
   p:user="root"
   p:password=""
   p:acquireIncrement="5"
   p:idleConnectionTestPeriod="60"
   p:maxPoolSize="100"
   p:maxStatements="50"
   p:minPoolSize="10" />

    <!-- Declare an acl cache-->   
   <bean id="aclCache" class="org.springframework.security.acls.domain.EhCacheBasedAclCache">
        <constructor-arg>
            <bean class="org.springframework.cache.ehcache.EhCacheFactoryBean">
                <property name="cacheManager">
                    <bean class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean"/>
                </property>
                <property name="cacheName" value="aclCache"/>
            </bean>
        </constructor-arg>
    </bean>

 <!-- Declare an acl authorization strategy-->
    <bean id="aclAuthorizationStrategy" class="org.springframework.security.acls.domain.AclAuthorizationStrategyImpl">
        <constructor-arg>
            <list>
                <bean class="org.springframework.security.core.authority.GrantedAuthorityImpl">
                    <constructor-arg value="ROLE_ADMIN"/>
                </bean>
                <bean class="org.springframework.security.core.authority.GrantedAuthorityImpl">
                    <constructor-arg value="ROLE_ADMIN"/>
                </bean>
                <bean class="org.springframework.security.core.authority.GrantedAuthorityImpl">
                    <constructor-arg value="ROLE_ADMIN"/>
                </bean>
            </list>
        </constructor-arg>
    </bean>
 
  <!-- Declare an audit logger-->
    <bean id="auditLogger" class="org.springframework.security.acls.domain.ConsoleAuditLogger"/>
    
  <!-- http://static.springsource.org/spring-security/site/docs/3.0.x/apidocs/org/springframework/security/access/hierarchicalroles/RoleHierarchyImpl.html -->
 <bean id="roleHierarchy"  class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl">
     <property name="hierarchy">
         <value>
             ROLE_ADMIN > ROLE_USER
             ROLE_USER > ROLE_VISITOR
         </value>
     </property>
 </bean>
</beans>

In-Depth Look of acl-context.xml

Let's take an in-depth look of the acl-context.xml file.

The Method Security

<security:global-method-security pre-post-annotations="enabled">
  <security:expression-handler ref="expressionHandler" />
 </security:global-method-security>

The global-method-security enables method security annotations. There are three types of method security annotations available in Spring Security (See Spring Security Reference 2.4 Method Security)
1. @Secured annotation
2. JSR-250 annotation
3. Expression-based access control

By adding the pre-post-annotations attribute, we've activated the Expression-based access control. If you need to learn how to setup a simple application using the Expression-based access control, please see Spring Security 3 - MVC: Using Native Expression-Based Annotation Tutorial

The Expression Handler

The expression-handler property defines a custom expression handler instance. Without this property Spring Security will declare a default expression handler with no ACL support. We need to declare a custom handler because we need ACL support. It turns out Spring provides a default implementation that we can customize so that we don't have to create one from scratch.

<bean id="expressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
  <property name="permissionEvaluator" ref="permissionEvaluator" />
  <property name = "roleHierarchy" ref="roleHierarchy"/>
 </bean>

Here we declared a reference to a customized expression handler: DefaultMethodSecurityExpressionHandler. This is actually the default expression handler but it needs to be declared manually so that we can provide a customized permission evaluator.

The permissionEvaluator property defines a reference to a custom permission evaluator, while the roleHierarchy allows us to define the hierarchy of our roles.

The Role Hierarchy

<bean id="roleHierarchy"  class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl">
     <property name="hierarchy">
         <value>
             ROLE_ADMIN > ROLE_USER
             ROLE_USER > ROLE_VISITOR
         </value>
     </property>
 </bean>
</beans>

Role hierarchy is a way of declaring which role is the boss of other roles. In our sample configuration ROLE_ADMIN > ROLE USER, means whenever a user has a ROLE_ADMIN, he also gets
the ROLE_USER. And because we declared ROLE_USER > ROLE_VISITOR, he also gets the ROLE_VISITOR.

The ACL Permission Evaluator

<bean class="org.springframework.security.acls.AclPermissionEvaluator" id="permissionEvaluator">
  <constructor-arg ref="aclService"/>
 </bean>

What is AclPermissionEvaluator?

Used by Spring Security's expression-based access control implementation to evaluate permissions for a particular object using the ACL module. Similar in behaviour to AclEntryVoter.

Source: Spring Security 3 API AclPermissionEvaluator

AclPermissionEvaluator is the default implementation for evaluating ACLs with expression-based access control but it's not enabled by default. It needs to be declared manually and it needs to be customized.

The <constructor-arg ref="aclService"/> is a reference to a custom ACL service. Basically this is the service that will access the ACL database.

The ACL Service

<bean class="org.springframework.security.acls.jdbc.JdbcMutableAclService" id="aclService">
  <constructor-arg ref="dataSource"/>
        <constructor-arg ref="lookupStrategy"/>
        <constructor-arg ref="aclCache"/>
 </bean>

What is JdbcMutableAclService?

Provides a base JDBC implementation of MutableAclService.

The default settings are for HSQLDB. If you are using a different database you will probably need to set the sidIdentityQuery and classIdentityQuery properties appropriately. The other queries, SQL inserts and updates can also be customized to accomodate schema variations, but must produce results consistent with those expected by the defaults.

Source: Spring Security 3 API JdbcMutableAclService

The JdbcMutableAclService is a JDBC-based ACL service. It uses JdbcTemplate to simplify JDBC access. Remember in Part 1 of this tutorial we declared a custom MySQL ACL schema. That's because by default the JdbcMutableAclService uses HSQLDB. In fact, if you examine the Spring Security ACL package, you'll find that there are two schemas available: an HSQLDB schema and PostgreSQL schema. See the screenshot below:

The <constructor-arg ref="dataSource"/> is a reference to a datasource, in our case, a MySQL datasource.

The <constructor-arg ref="lookupStrategy"/> is a reference to a lookup strategy. Its purpose is to provide an optimized lookup when querying the database.

The <constructor-arg ref="aclCache"/> is a reference to an ACL cache. Its purpose is to lessen database access by checking first if the ACL entry is already available in the cache.

The Datasource

<bean id="dataSource" class="com.mchange.v2.c3p0.ComboPooledDataSource"
   destroy-method="close"
   p:driverClass="com.mysql.jdbc.Driver"
   p:jdbcUrl="jdbc:mysql://localhost/acl"
   p:user="root"
   p:password=""
   p:acquireIncrement="5"
   p:idleConnectionTestPeriod="60"
   p:maxPoolSize="100"
   p:maxStatements="50"
   p:minPoolSize="10" />

This is a standard MySQL datasource that uses a C3P0 connection pool. The jdbcUrl property points to the acl database.

What is Pooling?

In software engineering, a connection pool is a cache of database connections maintained so that the connections can be reused when future requests to the database are required. Connection pools are used to enhance the performance of executing commands on a database. Opening and maintaining a database connection for each user, especially requests made to a dynamic database-driven website application, is costly and wastes resources. In connection pooling, after a connection is created, it is placed in the pool and it is used over again so that a new connection does not have to be established.

Source: http://en.wikipedia.org/wiki/Connection_pool

For more info on configuring C3P0, you can check this reference from JBoss: HowTo configure the C3P0 connection pool.

The Lookup Strategy

<bean id="lookupStrategy" class="org.springframework.security.acls.jdbc.BasicLookupStrategy">
        <constructor-arg ref="dataSource"/>
        <constructor-arg ref="aclCache"/>
        <constructor-arg ref="aclAuthorizationStrategy"/>
        <constructor-arg ref="auditLogger"/>
    </bean>

Here we declare Spring Security's default implementation of a lookup strategy BasicLookupStrategy. As mentioned earlier, the purpose of a lookup strategy is to provide an optimized lookup when querying the database.

Here's an in-depth description of BasicLookupStrategy:

Performs lookups in a manner that is compatible with ANSI SQL.

This implementation does attempt to provide reasonably optimised lookups - within the constraints of a normalised database and standard ANSI SQL features. If you are willing to sacrifice either of these constraints (e.g. use a particular database feature such as hierarchical queries or materalized views, or reduce normalisation) you are likely to achieve better performance. In such situations you will need to provide your own custom LookupStrategy. This class does not support subclassing, as it is likely to change in future releases and therefore subclassing is unsupported.

Source: Spring Security 3 API - BasicLookupStrategy

The <constructor-arg ref="dataSource"/> is a reference to the same MySQL datasource we described earlier.

The <constructor-arg ref="aclCache"/> is a reference to the same ACL cache we described earlier.

The <constructor-arg ref="aclAuthorizationStrategy"/> is a reference to an AclAuthorizationStrategy implementation.

What is AclAuthorizationStrategy?

Strategy used by AclImpl to determine whether a principal is permitted to call adminstrative methods on the AclImpl.

Source: Spring Security 3 API - AclAuthorizationStrategy

The <constructor-arg ref="auditLogger"/> is a reference to an AuditLogger implementation.

<bean id="auditLogger" class="org.springframework.security.acls.domain.ConsoleAuditLogger"/>

What is AuditLogger?

Used by AclImpl to log audit events.

Source: Spring Security 3 API - AuditLogger

The ACL Cache

<bean id="aclCache" class="org.springframework.security.acls.domain.EhCacheBasedAclCache">
        <constructor-arg>
            <bean class="org.springframework.cache.ehcache.EhCacheFactoryBean">
                <property name="cacheManager">
                    <bean class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean"/>
                </property>
                <property name="cacheName" value="aclCache"/>
            </bean>
        </constructor-arg>
    </bean>

Here we declare Spring Security's default implementation of AclCache interface. It's purpose is to lessen database lookups.

What is EhCacheBasedAclCache?

Simple implementation of AclCache that delegates to EH-CACHE.

Designed to handle the transient fields in AclImpl. Note that this implementation assumes all AclImpl instances share the same AuditLogger and AclAuthorizationStrategy instance.

Source: Spring Security 3 API - EhCacheBasedAclCache

What is EhCache?

Ehcache is an open source, standards-based cache used to boost performance, offload the database and simplify scalability. Ehcache is robust, proven and full-featured, which has made it the most popular Java-based cache with 100,000’s of production deployments.

Source: EhCache.org

The EhCacheBasedAclCache constructor accepts an instance of an EHCache instance. The EhCacheFactoryBean is responsible for crating this instance.

The ACL Authorization Strategy

<bean id="aclAuthorizationStrategy" class="org.springframework.security.acls.domain.AclAuthorizationStrategyImpl">
        <constructor-arg>
            <list>
                <bean class="org.springframework.security.core.authority.GrantedAuthorityImpl">
                    <constructor-arg value="ROLE_ADMIN"/>
                </bean>
                <bean class="org.springframework.security.core.authority.GrantedAuthorityImpl">
                    <constructor-arg value="ROLE_ADMIN"/>
                </bean>
                <bean class="org.springframework.security.core.authority.GrantedAuthorityImpl">
                    <constructor-arg value="ROLE_ADMIN"/>
                </bean>
            </list>
        </constructor-arg>
    </bean>

AclAuthorizationStrategyImpl is the default implementation of AclAuthorizationStrategy. Notice the constructor accepts three arguments. Based on the Spring Security API, constructor signature is as follows:

public AclAuthorizationStrategyImpl(GrantedAuthority[] auths)

And here's what auths represent:

auths - an array of GrantedAuthoritys that have special permissions (index 0 is the authority needed to change ownership, index 1 is the authority needed to modify auditing details, index 2 is the authority needed to change other ACL and ACE details)

Source: Spring Security 3 API - AclAuthorizationStrategyImpl

Conclusion

We have completed the standard Spring Security configuration, including the ACL-related beans. We've also described in detail the purpose and meaning behind the configuration. Our next task is to setup the Spring MVC module.

Proceed to Part 3: Spring MVC Module

---

Share the joy: blogger tutorials Social Bookmarking Blogger Widget I'm reading: Spring Security 3: Full ACL Tutorial (Part 2) ~

Subscribe by reader Subscribe by email Share