<div dir="ltr" style="text-align: justify;">
<p>In this <a href="https://dineshonjava.com/spring-security-take-baby-step-to-secure/"><b>Spring Security Tutorial</b></a> Series we will take a look how to use Spring Security with XML Namespace Configuration with Example of authentication and access-control using <;http>;, <;intercept-url>; namespaces. In my earlier article We have seen <a href="https://dineshonjava.com/spring-security-java-based-configuration-with-example/">Spring Security Java Configuration Annotation Example</a> of Authentication and access control using @Secured, @PreAuthorize and JSR-250 @RolesAllowed annotations. As we know that Spring Security is a very powerful and highly customizable authentication and access-control framework.<br />
<b></b></p>
<h2><b>Spring Security XML Namespace Configuration</b></h2>
<p>XML Namespace configuration has been available since Spring Security 2.0. In Spring Framework, A namespace element is nothing but it is a more concise way of configuring an individual bean or, more powerfully, to define an alternative configuration syntax. It actually hides the underlying bean definition complexity from the user. For using the spring security namespace in your application context, you need to have the spring-security-config jar on your classpath. And finally you need to add the schema declaration to your application context file as below:</p>
<pre class="highlight"><;beans xmlns="http://www.springframework.org/schema/beans" 
xmlns:> 
 ; 
<div style="background-color: #f2f9fc; border: 1px solid #c9e6f2; border-radius: 3px; padding: 16px; line-height: 1.45;"> 
 
<span style="color: red; font-size: x-large; text-align: center;"><b>Popular Tutorials</b></span> 
<ul style="text-align: left;"> 
 	<li><b><a href="https://dineshonjava.com/spring-tutorial/"><em><strong>Spring Tutorial</strong> </em></a></b></li> 
 	<li><b><a href="https://dineshonjava.com/spring-web-mvc-framework-chapter-38/"><strong><em>Spring MVC Web Tutorial </em></strong></a></b></li> 
 	<li><b><a href="https://dineshonjava.com/introduction-to-spring-boot-a-spring-boot-complete-guide/"><strong>Spring Boot Tutorial</strong> </a></b></li> 
 	<li><b><a href="https://dineshonjava.com/spring-security-take-baby-step-to-secure/"><em>Spring Security Tutorial</em></a></b></li> 
 	<li><b><a href="https://dineshonjava.com/spring-aop-tutorial-with-example-aspect-advice-pointcut-joinpoint/"><em>Spring AOP Tutorial</em></a></b></li> 
 	<li><b><a href="https://dineshonjava.com/using-spring-jdbc-framework-chapter-32/"><em>Spring JDBC Tutorial</em></a></b></li> 
 	<li><b><a href="https://dineshonjava.com/spring-hateoas-hypermedia-driven-restful-web-service/"><em><strong>Spring HATEOAS </strong></em></a></b></li> 
 	<li><b><a href="https://dineshonjava.com/microservices-with-spring-boot/"><em><strong>Microservices with Spring Boot</strong></em></a></b></li> 
 	<li><b><a href="https://dineshonjava.com/jax-rs-web-service-tutorial/"><strong><em>REST Webservice</em> </strong></a></b></li> 
 	<li><b><a href="https://dineshonjava.com/core-java-baby-step-to-be-best-java-ian/"><em><strong>Core Java </strong></em></a></b></li> 
 	<li><b><a href="https://dineshonjava.com/hibernate-3-on-baby-steps/"><em><strong>Hibernate Tutorial</strong></em></a></b></li> 
 	<li><b><a href="https://dineshonjava.com/spring-batch-process-with-example/"><strong><em>Spring Batch</em> </strong></a></b></li> 
</ul> 
</div> 
<h2><b>web.xml Configuration </b><b>(Setup DelegatingFilterProxy and springSecurityFilterChain)</b></h2> 
FilterChainProxy add a single entry to web.xml and deal entirely with the application context file for managing our web security beans. It is wired using a DelegatingFilterProxy, just like in the example above, but with the filter-name set to the bean name "springSecurityFilterChain". In this case, the bean is named "springSecurityFilterChain", which is an internal infrastructure bean created by the namespace to handle web security. 
<h3>Define the single proxy filter</h3> 
– <b>springSecurityFilterChain</b> is a mandatory name 
-Refers to an existing Spring bean with same name 
<pre class="highlight"><;?xml version="1.0" encoding="UTF-8"?>; 
<;web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" id="WebApp_ID" version="3.0">; 
 <;display-name>;17-Spring-Security-XML-Namespace-Config<;/display-name>; 
 <;servlet>; 
 <;servlet-name>;doj<;/servlet-name>; 
 <;servlet-class>; 
 org.springframework.web.servlet.DispatcherServlet 
 <;/servlet-class>; 
 <;load-on-startup>;1<;/load-on-startup>; 
 <;/servlet>; 
 <;servlet-mapping>; 
 <;servlet-name>;doj<;/servlet-name>; 
 <;url-pattern>;/<;/url-pattern>; 
 <;/servlet-mapping>; 
 
 <;filter>; 
 <;filter-name>;springSecurityFilterChain<;/filter-name>; 
 <;filter-class>;org.springframework.web.filter.DelegatingFilterProxy<;/filter-class>; 
 <;/filter>; 
 
 <;filter-mapping>; 
 <;filter-name>;springSecurityFilterChain<;/filter-name>; 
 <;url-pattern>;/*<;/url-pattern>; 
 <;/filter-mapping>; 
<;/web-app>; 
</pre>
<div class="separator" style="clear: both; text-align: center;"><img title="Spring Security Filter Configuration" src="https://dineshonjava.com/wp-content/uploads/2017/02/Spring-Security-Filter-Configuration.jpg" width="640" height="371" border="0" /></div>
<h2><b><br />
</b> <b>Spring Security Namespace Configuration in the Application Context file</b></h2>
<p>Once you’ve added <em><strong>DelegatingFilterProxy</strong> </em>and <em><strong>springSecurityFilterChain</strong> </em>to your web.xml, you’re ready to start editing your application context file. Web security services are configured using the <;http>; element.</p>
<pre class="highlight"><;?xml version="1.0" encoding="UTF-8"?>; 
<;beans xmlns="http://www.springframework.org/schema/beans" 
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
 xmlns:context="http://www.springframework.org/schema/context" 
 xmlns:mvc="http://www.springframework.org/schema/mvc" 
 <b>xmlns:> 
 http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd 
 http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd 
 http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">; 
 
 <;context:component-scan base-package="com.doj.app.controller"/>; 
 
 <;bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">; 
 <;property name="suffix" value=".jsp"/>; 
 <;property name="prefix" value="/WEB-INF/view/"/>; 
 <;/bean>; 
<b> 
 <;security:http>; 
 <;security:intercept-url access="hasRole('USER')" pattern="/**" />; 
 <;security:form-login/>; 
 <;security:logout/>; 
 <;/security:http>; 
 
 
 <;security:authentication-manager>; 
 <;security:authentication-provider>; 
 <;security:user-service>; 
 <;security:user name="admin" password="adminpassword" authorities="ROLE_USER, ROLE_ADMIN" />; 
 <;security:user name="user" password="password" authorities="ROLE_USER" />; 
 <;/security:user-service>; 
 <;/security:authentication-provider>; 
 <;/security:authentication-manager>; 
</b> 
<;/beans>; 
 
</pre>
<p>As according to the above application context file, we want all URLs within our application to be secured, requiring the role ROLE_USER to access them, we want to log in to the application using a form with username and password, and that we want a logout URL registered which will allow us to log out of the application. The configuration above defines two users, their passwords and their roles within the application.</p>
<p> ;</p>
<ul style="text-align: left;">
<li><b><;security:http>; </b>: This element is the parent for all web-related namespace functionality. It is responsible for creating a FilterChainProxy and the filter beans which it uses. Common problems like incorrect filter ordering are no longer an issue as the filter positions are predefined.</li>
<li><b><;security:intercept-url>;</b> : This element defines a pattern which is matched against the URLs of incoming requests using an ant path style syntax.
<ul>
<li><b>Note:</b> You can use multiple <b><;security:intercept-url>;</b> elements to define different access requirements for different sets of URLs, but they will be evaluated in the order listed and the first match will be used. So you must put the most specific matches at the top.</li>
</ul>
</li>
<li><b><;security:authentication-manager>;</b> : This element creates a <b><i>ProviderManager</i></b> and registers the authentication providers with it.</li>
<li><b><;security:authentication-provider>;</b> : This element creates a <b><i>DaoAuthenticationProvider</i></b> bean.</li>
<li><b><;security:user-service>;</b> : This element creates an <b><i>InMemoryDaoImpl</i></b>.</li>
</ul>
<h2><b>Adding Custom Login Form</b></h2>
<p>Thus far Spring Security generates login form automatically, based on the features that are enabled and using standard values for the URL which processes the submitted login, the default target URL the user will be sent to after logging in and so on.</p>
<pre class="highlight"><;security:http pattern="/login" > 
From Spring Security 3.1 it is now possible to use multiple http elements to define separate security filter chain configurations for different request patterns. It is also possible to have all requests matching a particular pattern bypass the security filter chain completely, by defining a separate http element for the pattern like this /login, "/resources/", "/scripts/", "/css/" etc. 
<h2><b>Handling Logouts</b></h2> 
When using the<b> <;security:logout/>;</b>, logout capabilities are automatically applied. 
The default is that accessing the URL /logout will log the user out by: 
<ul style="text-align: left;"> 
 	<li>Invalidating the HTTP Session</li> 
 	<li>Cleaning up any RememberMe authentication that was configured</li> 
 	<li>Clearing the SecurityContextHolder</li> 
 	<li>Redirect to /login?logout</li> 
</ul> 
 ; 
<pre class="highlight"><;security:logout 
 invalidate-session="true" 
 delete-cookies="AppCookies" 
 logout-url="/logout" 
 logout-success-url="/home"/>; 
</pre>
<h2><b>Configure Authentication Providers</b></h2>
<p>There are three built in options:</p>
<ol style="text-align: left;">
<li>LDAP,</li>
<li>JDBC,</li>
<li>in-memory .</li>
</ol>
<h2><b>In-Memory Authentication Namespace Configuration</b></h2>
<pre class="highlight"><;security:authentication-manager>; 
 <;security:authentication-provider>; 
 <;security:user-service>; 
 <;security:user name="admin" password="adminpassword" authorities="ROLE_USER, ROLE_ADMIN" />; 
 <;security:user name="user" password="password" authorities="ROLE_USER" />; 
 <;/security:user-service>; 
 <;/security:authentication-provider>; 
<;/security:authentication-manager>; 
</pre>
<h2><b>JDBC Authentication Namespace Configuration</b></h2>
<pre class="highlight"><;authentication-manager>; 
<;authentication-provider>; 
 <;jdbc-user-service data-source-ref="dataSource"/>; 
<;/authentication-provider>; 
<;/authentication-manager>; 
</pre>
<p>Where "<b>dataSource</b>" is the name of a DataSource bean in the application context, pointing at a database containing the standard Spring Security user data tables.<br />
<b></b></p>
<h2><b>Password Encoder</b></h2>
<p>You can also customize how passwords are encoded by exposing a PasswordEncoder as a bean. We can encode passwords using a hash – sha, md5, bcrypt etc.</p>
<pre class="highlight"><;security:http pattern="/login" ><;bean name="bcryptEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>;</b> 
 <;security:authentication-manager>; 
 <;security:authentication-provider>; 
 <b><;security:password-encoder ref="bcryptEncoder"/>; 
 <;security:user-service>; 
 <;security:user name="admin" password="4e7421b1b8765d8f9406d87e7cc6aa784c4ab97f" authorities="ROLE_USER, ROLE_ADMIN" />; 
 <;security:user name="user" password="d7e6351eaa13189a5a3641bab846c8e8c69ba39f" authorities="ROLE_USER" />; 
 <;/security:user-service>;</b> 
 <;/security:authentication-provider>; 
 <;/security:authentication-manager>; 
</pre>
<h2><b>Method Security</b></h2>
<p>From Spring version 2.0 Spring Security provides support to adding security to your service layer methods. Spring Security uses AOP for security at the method level.<br />
– annotations based on Spring annotations or JSR-250 annotations<br />
– Java configuration to activate detection of annotations<br />
- From 3.0 you can also make use of new expression-based annotations.<br />
Typically secure your services<br />
– Do not access repositories directly, bypasses security (and transactions)</p>
<h2><b>EnableGlobalMethodSecurity</b></h2>
<p><b><;global-method-security>;- </b>This element is used to enable annotation-based security in your application. The following declaration would enable support for Spring Security’s @Secured:</p>
<pre class="highlight"><;global-method-security secured-annotations="enabled" />; 
</pre>
<p> ;</p>
<pre class="highlight">import org.springframework.security.annotation.Secured; 
 
public class ItemManagerService { 
@Secured("IS_AUTHENTICATED_FULLY") 
public Item findItem(long itemNumber) { 
... 
} 
} 
</pre>
<p>We can also use</p>
<ul style="text-align: left;">
<li>@Secured("ROLE_MEMBER")</li>
<li>@Secured({"ROLE_MEMBER", "ROLE_USER"})</li>
</ul>
<p><b>Note:</b> Spring 2.0 syntax, so not limited to roles. SpEL not supported.<br />
<b></b></p>
<h2><b>Enable Method Security - JSR-250</b></h2>
<p>Support for JSR-250 annotations can be enabled using.</p>
<pre class="highlight"><;global-method-security jsr250-annotations="enabled" />; 
</pre>
<p> ;</p>
<pre class="highlight">import javax.annotation.security.RolesAllowed; 
 
public class ItemManagerService { 
@RolesAllowed({"ROLE_MEMBER", "ROLE_USER"}) 
public Item findItem(long itemNumber) { 
... 
} 
} 
</pre>
<p><b>Note:</b> Only supports role-based security – hence the name</p>
<h2><b>Method Security with SpEL</b></h2>
<p>To use the new expression-based syntax, you would use</p>
<pre class="highlight"><;global-method-security pre-post-annotations="enabled" />; 
</pre>
<p> ;</p>
<pre class="highlight">public interface ItemManagerService { 
 
@PreAuthorize("isAnonymous()") 
public Item findItem(Long itemNumber); 
 
@PreAuthorize("isAnonymous()") 
public Item[] findItems(); 
 
@PreAuthorize("hasAuthority('ROLE_USER')") 
public Item post(Item item); 
} 
</pre>
<h2><b>Adding Security Pointcuts using protect-pointcut</b></h2>
<p>The use of protect-pointcut is particularly powerful, as it allows you to apply security to many beans with only a simple declaration. Consider the following example:</p>
<pre class="highlight"><;global-method-security>; 
<;protect-pointcut expression="execution(* com.doj.app.*Service.*(..))" 
 access="ROLE_USER"/>; 
<;/global-method-security>; 
</pre>
<p>This will protect all methods on beans declared in the application context whose classes are in the <b>com.doj.app</b> package and whose class names end in "<b>Service</b>". Only users with the ROLE_USER role will be able to invoke these methods.</p>
<h3><a href="https://github.com/DOJ-SoftwareConsultant/Spring-Security-XML-Namespace-Config" target="_blank" rel="noopener"><b>Download Java Based Configuration Example from Git</b></a></h3>
<div class="separator" style="clear: both; text-align: center;"><img title="Spring Security XML Namespace Configuration Example" src="https://dineshonjava.com/wp-content/uploads/2017/02/Spring-Security-xml-namespace-configuration-example.png" border="0" /></div>
<p> ;</p>
<div style="background-color: #f2f9fc; border-radius: 3px; border: 1px solid #c9e6f2; line-height: 1.45; padding: 16px;">
<p><span style="color: red; font-size: x-large; text-align: center;"><b>Spring Security Related Posts</b></span></p>
<ul>
<li><b><a href="https://dineshonjava.com/spring-security-interview-questions-and-answers/"><span style="color: red;">Spring Security Interview Questions and Answers</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-java-based-configuration-with-example/"><span style="color: red;">Spring Security Java Based Configuration with Example</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-xml-namespace-configuration-example/"><span style="color: red;">Spring Security XML Namespace Configuration Example</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-hello-world-example/"><span style="color: red;">Spring Security XML Based Hello World Example</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-form-based-login-example/"><span style="color: red;">Spring Security form-based login example </span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-login-form-using/"><span style="color: red;">Spring Security Login Form Based Example Using Database</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-http-basic/"><span style="color: red;">Spring Security Authentication Example Using HTTP Basic </span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-authorized-access/"><span style="color: red;"> Spring Security Authorized Access Control Example </span></a></b></li>
<li><b><a href="https://dineshonjava.com/customize-http-403-access-denied-page/"><span style="color: red;">Spring Security Customized Access Denied Page</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-custom-error-message/"><span style="color: red;">Spring Security Custom Error Message</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-logout-example/"><span style="color: red;"> Spring Security Logout Example</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-fetch-logged-in-username/"><span style="color: red;">Spring Security Fetch Logged in Username</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-password-hashing/"><span style="color: red;">Spring Security Password Hashing</span></a></b></li>
</ul>
<p> ;</p>
</div>
</div>
<div class="wp-post-navigation"> 
									 <div class="wp-post-navigation-pre"> 
									 <a href="https://dineshonjava.com/spring-security-java-based-configuration-with-example/">Previous</a> 
									 </div> 
									 <div class="wp-post-navigation-next"> 
									 <a href="https://dineshonjava.com/spring-security-annotation-based-hello-world-example/">Next</a> 
									 </div> 
									</div>
<script type="text/javascript">
jQuery(document).ready(function($) {
 $.post('https://dineshonjava.com/wp-admin/admin-ajax.php', {action: 'mts_view_count', id: '59'});
});
</script>
Strategy Design Patterns We can easily create a strategy design pattern using lambda. To implement…
Decorator Pattern A decorator pattern allows a user to add new functionality to an existing…
Delegating pattern In software engineering, the delegation pattern is an object-oriented design pattern that allows…
Technology has emerged a lot in the last decade, and now we have artificial intelligence;…
Managing a database is becoming increasingly complex now due to the vast amount of data…
Overview In this article, we will explore Spring Scheduler how we could use it by…