Youtor
Start Spring Security
>> YOUR LINK HERE: ___ http://youtube.com/watch?v=7dtmGXaSgn0
للاستفسار : • فيس بوك : / eslam.khder.98 • لينكد ان : https://www.linkedin.cn/in/eslam-khde... • GitHub : • https://github.com/EslamKhder/spring-... • --------------------------------------------------------------------------------------- • Spring Security is a powerful and highly customizable authentication and access-control framework. It is the de-facto standard for securing Spring-based applications. • Spring Security is a framework that focuses on providing both authentication and authorization to Java applications. Like all Spring projects, the real power of Spring Security is found in how easily it can be extended to meet custom requirements • Features • Comprehensive and extensible support for both Authentication and Authorization • Protection against attacks like session fixation, clickjacking, cross site request forgery, etc • Servlet API integration • Optional integration with Spring Web MVC • Much more… • Resources • Getting Help • Getting Spring Security • Getting Started • Getting Started (Servlet) • Getting Started (WebFlux) • Contributing • Spring Security • From Wikipedia, the free encyclopedia • Jump to navigationJump to search • Spring Security • Developer(s) 4 • Stable release • 5.2.1 / November 4, 2019; 2 years ago [1] • Written in Java • Operating system Cross-platform • Type web application framework security • License Apache License 2.0 • Website projects.spring.io/spring-security/ • Spring Security is a Java/Java EE framework that provides authentication, authorization and other security features for enterprise applications. The project was started in late 2003 as 'Acegi Security' (pronounced Ah-see-gee /ɑːsiːdʒiː/, whose letters are the first, third, fifth, seventh, and ninth characters from the English alphabet, in order to prevent name conflicts[2]) by Ben Alex, with it being publicly released under the Apache License in March 2004. Subsequently, Acegi was incorporated into the Spring portfolio as Spring Security, an official Spring sub-project. The first public release under the new name was Spring Security 2.0.0 in April 2008, with commercial support and training available from SpringSource. • • Contents • 1 Authentication flow • 2 Key authentication features • 3 Key authorization features • 4 Instance-based security features • 5 Other features • 6 Releases • 7 References • 8 External links • Authentication flow • Diagram 1 shows the basic flow of an authentication request using the Spring Security system. It shows the different filters and how they interact from the initial browser request, to either a successful authentication or an HTTP 403 error. • ACEGI Authentication.JPG • Browser submits authentication credentials • Authentication mechanism collects the details • An authentication request object is built • Authentication request sent to an AuthenticationManager • AuthenticationManager (this is responsible for passing requests through a chain of AuthenticationProviders') • Authentication provider will ask a UserDetailsService to provide a UserDetails object • The resultant UserDetails object (which also contains the GrantedAuthority[]s) will be used to build the fully populated Authentication object. • If Authentication mechanism receives back the fully populated Authentication object, it will deem the request valid, put the Authentication into the SecurityContextHolder; and cause the original request to be retried. • If, on the other hand, the AuthenticationProvider rejected the request, the authentication mechanism will ask the user agent to retry. • AbstractSecurityInterceptor authorizes the regenerated request and throws Java exceptions. (Asks AccessDecisionManager for decision.) • ExceptionTranslationFilter translates the exceptions thrown by AbstractSecurityInterceptor into HTTP related error codes • Error code 403 – if the principal has been authenticated and therefore simply lacks sufficient access • Launch an AuthenticationEntryPoint – if the principal has not been authenticated which is an authentication mechanism • Key authentication features • LDAP (using both bind-based and password comparison strategies) for centralization of authentication information. • Single sign-on capabilities using the popular Central Authentication Service. • Java Authentication and Authorization Service (JAAS) LoginModule, a standards-based method for authentication used within Java. Note this feature is only a delegation to a JAAS Loginmodule. • Basic access authentication as defined through RFC 1945. • Digest access authentication as defined through RFC 2617 and RFC 2069. • X.509 client certificate presentation over the Secure Sockets Layer standard. • CA, Inc SiteMinder for authentication (a popular commercial access management product). • Su (Unix)-like support for switching principal identity over a HTTP or HTTPS connection. • Run-as replacement, which enables an operation to assume a different security identity. • Anonymous authentication, which means that even unauthenticated principals are a
#############################
