Using Spring Security and CAS JA-SIG Summer Conference Denver, CO June 24 – 27, 2007

Using Spring Security and CAS

JA-SIG Summer ConferenceDenver, CO

June 24 – 27, 2007

Enterprise Systems & Services


Who am I?

• Application Developer @ Rutgers

• Java Developer for 5+ years

• Lead Developer on JA-SIG CAS

• Committer on Spring Security



Agenda

1.History and Overview2.Benefits for Programmers3.Benefits for Users4.Demo5.Case Study6.Future Directions7.Discussion



1.Overview & History



What is Spring Security?

Spring Security is apowerful and flexible security

solution for enterprise software.



Users

• Used worldwide at:– Major institutions such as Rutgers– Major financial institutions and banks– Several Australian government departments

• Integrated with:– Frameworks such as Grails, Trails, etc.– Applications such as Roller, Mule



Authentication Features

• LDAP• BASIC• Digest• JAAS• CAS• X.509 Certificates• DAO• Run-as Replacement• Form-based login• Anonymous

• Remember-Me• SiteMinder• HTTP Switch User• Concurrent User Limiting• Container Adapters

• Write your own…



Technical Details

• Uses Spring IoC container– DI, events, localization and JdbcTemplate

• Completely interface-driven

• High cohesion, loosely coupled

• Encourage customization and extension

• Java 1.3+ compatible– Java 5 code packaged in “Tiger” JAR



How Spring Security Works

Servlet Container

WebUser FilterToBeanProxy

IoC Container

FilterChainProxy

Filter 1 Filter 3 Filter 4 Filter 5Filter 2

Filter X Servlet




# Filter Name Main Purpose

1HttpSessionContextIntegrationFilter

Stores SecurityContextHolder between HTTP requests

2 LogoutFilterClears SecurityContextHolder when logout requested

3Authentication Mechanism Filters

Puts Authentication into SecurityContextHolder

4ExceptionTranslationFilter

Converts Acegi Security exceptions into HTTP

5FilterSecurityInterceptor

Authorizes web filter requests based on URL patterns




AuthenticationMechanism

Filter 3

Authentication“Request”

ProviderManager

Authentication“Response”

creates

creates

calls

SecurityContextHolder

populates returns



What is JA-SIG CAS?

JA-SIG CAS is single sign on for the web. It provides a trusted

mechanism for authenticating users across your applications.



Users

• Deployed by:– Institutions of Higher Education– Non-profits– Commercial companies– etc

• Deployed worldwide:– U.S., Canada, Hong Kong– Belgium, France, Russia, China, Japan– India, Australia, New Zealand– Greece, Turkey, England– Netherlands, Spain, Sweden, Portugal– Etc.



• 3rd year of project• Over 1000 downloads a month• Active community of deployers• Driven by community feedback



Authentication Features

• LDAP• DAO• NTLM• SPNEGO• RADIUS• File System• X.509• “Trusted”• JAAS• Acegi



Other Features

• Clustering

• Client Libraries (PHP, Java, etc.)

• Demo-able/Quickstart WAR file

• Quality Documentation

• Active community mailing lists



Technical Details

• Use Spring IoC Container– DI, Localization, events, JdbcTemplate, LdapTemplate, etc.

• Completely interface driven

• Encourage customization and extension

• Java 1.5+/Servlet 2.4 compatible



How CAS Works



How CAS Works

Servlet Container

WebUser DispatcherServlet WebFlow

Controller

action0 action1 actionnactionn-1. . .



How CAS Works

actionn

Credentials

creates

CentralAuthenticationServicecalls

AuthenticationManager

Authentication creates

returns

TicketRegistry

Ticketcreates

callscalls



2.Benefits for Programmers



Benefits for Programmers

• Code reduction– Declaratively configured– No audit logs for authentication– OOTB authorization and authentication

• Tag Libs

• Proxy Authentication

• Domain object instance security

• Only one place to “watch” for account security



3.Benefits for Users



Benefits for Users

• Single Sign On

• Passwords are only passed to one “trusted” resource

• Better Application security

• Harder to trick someone with “phishing” attempts



4.How to Integrate

Demo



5.Case Study



Rutgers Case Study – Where Were We?

• Duplicating authentication code on each application

• Multiple authentication methods

• Sign in to each application

• De-centralized authentication



Rutgers Case Study – What We Did

• Introduced a portal

• Centralized authentication

• Single Sign On

• Proxy Authentication

• Introduced Acegi into Java applications



Rutgers Case Study – What it Got Us

• Better user experience

• Minimized access to passwords

• Created “horizontal” authentication component

• Standardized security code

• (still a work in progress though)



6.Future Directions



Acegi Roadmap

• 1.0.x branch -> minor updates

• 2.0– Renamed to Spring Security– Support for Spring 2.0– OpenId Support– Windows Domain Support– Updated CAS Support



CAS Roadmap

• Additional Protocol Support

• Internationalization

• Configuration/Setup Screens

• Advanced Monitoring

• Integration with Account Management Systems



Conclusion

• Acegi Security is fully-featured solution– Many authentication strategies– Decoupled web and method authorization– Completely customizable by end users– Active community, quality documentation, etc.

• CAS is a fully-featured solution– Many authentication strategies– Easily pluggable and extensible– Active community, quality documentation, etc.– Support for multiple platforms



7.Discussion



Spring Security

• Web Site– http://www.acegisecurity.org

• Forum– http://forum.springframework.org

• Mailing Lists– Acegi Developer List

• https://lists.sourceforge.net/lists/listinfo/acegisecurity-developer

http://www.acegisecurity.org/

http://forum.springframework.org/



CAS Mailing Lists

• CAS Community Discussion List– http://tp.its.yale.edu/mailman/listinfo/cas

• CAS Developer’s Discussion List– http://tp.its.yale.edu/mailman/listinfo/cas-dev

• CAS Announcement List– https://lists.wisc.edu/read/all_forums/subscribe?name=cas-ann

ounce

• Links to archives, etc.:– http://www.ja-sig.org/products/cas/community/lists/

http://tp.its.yale.edu/mailman/listinfo/cas

http://tp.its.yale.edu/mailman/listinfo/cas

http://tp.its.yale.edu/mailman/listinfo/cas-dev



https://lists.wisc.edu/read/all_forums/subscribe?name=cas-announce

https://lists.wisc.edu/read/all_forums/subscribe?name=cas-announce

http://www.ja-sig.org/products/cas/community/lists/



CAS Sites

• Product Web Site– http://www.ja-sig.org/products/cas/

• Wiki– http://www.ja-sig.org/wiki

• Issue Tracker– http://www.ja-sig.org/issues

• Source Code– http://developer.ja-sig.org/source/

http://www.ja-sig.org/products/cas/

http://www.ja-sig.org/wiki

http://www.ja-sig.org/issues

http://developer.ja-sig.org/source/

Questions?

Documents

Using Spring Security and CAS JA-SIG Summer Conference Denver, CO June 24 – 27, 2007