Release Notes - Spring Security - Version 1.0.0 - HTML format

Bug

• [SEC-183] - Avoid unnecessary HttpSession creation when using Anonymous and Remember-Me authentication
• [SEC-188] - SecurityContextHolder JavaDoc error
• [SEC-190] - CaptchaSecurityContextImpl needs to override hashcode()
• [SEC-192] - Concurrent login checking fails with CAS
• [SEC-197] - ConcurrentSessionController should count non-expired Sessions only
• [SEC-198] - AccessDeniedException removes role visibility from authz:authorize tags
• [SEC-199] - Contacts sample throws NestedServletException (500) instead of Access denied! (403) page
• [SEC-200] - Contacts sample - logging off twice causes IllegalStateException
• [SEC-201] - LdapProvider should not throw IllegalArgumentException for empty user password
• [SEC-202] - Failing to set manager password on DefaultInitialDirContextFactory causes NullPointerException
• [SEC-208] - SessionRegistryImpl giving java.util.ConcurrentModificationException
• [SEC-210] - TokenBasedRememberMeServices issue with CasProcessingFilter
• [SEC-211] - AnonymousProcessingFilter causes IllegalStateException after HttpSession invalidation (ie logout)
• [SEC-218] - RememberMeProcessingFilter adds Authentication token to SecurityContextHolder after AuthenticationException
• [SEC-219] - FilterInvocationDefinitionSourceEditor tokenizing of URLs
• [SEC-222] - AbstractAuthenticationToken Hashcode computation
• [SEC-223] - Performance of hashCode in AbstractAuthenticationToken
• [SEC-228] - URL encoding issues in CasProcessingFilterEntryPoint
• [SEC-230] - ExceptionTranslationFilter does not catch AccessDeniedException with Spring MVC M2/M3
• [SEC-233] - AnonymousProcessingFilter - redundant creation of Authentication object causes IllegalStateException
• [SEC-235] - HttpSessionContextIntegrationFilter reset the SecurityContext
• [SEC-240] - Remove log4j.properties from release JARs
• [SEC-243] - SessionRegistryImpl.getAllSessions(Object) incorrectly includes expired and destroyed sessions
• [SEC-248] - HttpSessionContextIntegrationFilter doesn't work with HttpInvokerServiceExporter
• [SEC-252] - AbstractAuthenticationToken NullPointerException
• [SEC-253] - UserDetails JdbcDaoImpl should check for no auths after calling addCustomAuthorities
• [SEC-254] - Reference documentation for JBossAcegiLoginModule incorrect
• [SEC-256] - Contacts Sample does not use AcegiMessageSource
• [SEC-258] - Use of URI class in LdapUtils is not compatible with JDK 1.3
• [SEC-266] - ConcurrentSessionControllerImpl doesn't permit unlimited sessions
• [SEC-267] - NamedEntityObjectIdentity not stripping cglib ehanced class names.
• [SEC-268] - Uninitialized app context problem in HttpSessionEventPublisher
• [SEC-269] - LdapAuthenticationProvider returns null userName after authentication
• [SEC-270] - Saved Request is not serializable
• [SEC-275] - Add missing dependency to acegi's maven2 pom.xml
• [SEC-277] - maven2 doesn't working with acegi because acegi-security-parent-1.0.0-RC2.pom contains non ISO-8859-1

Improvement

• [SEC-29] - Save POST request parameters before redirect
• [SEC-40] - HibernateDao.scroll() performance
• [SEC-92] - Hibernate ACL implementation
• [SEC-97] - Format Acegi's source code for readability
• [SEC-119] - Possible contribution: TemplateAuthenticationProvider and AuthenticationConditions
• [SEC-147] - BasicAclEntryAfterInvocationProvider should support processDomainObjectClass
• [SEC-166] - Add Oracle ACL 'create tables' script to documentation
• [SEC-172] - Allow SimpleAclEntry to take 'null' as recipient constructor argument
• [SEC-173] - Improve BasicAclDao.getAcls documentation
• [SEC-182] - TokenBasedRememberMeServices should return an Authentication that can be used by concurrent session services
• [SEC-184] - RunAsManager reference documentation refers to obsolete classes
• [SEC-185] - Change LdapUserSearch to allow attributes to be specified
• [SEC-186] - ExceptionTranslationFilter missing in reference documentation
• [SEC-187] - inHttp & inHttps not fully utilized in AuthenticationProcessingFilterEntryPoint
• [SEC-189] - Add accessor for InitialDirContextFactory field in DefaultLdapAuthoritiesPopulator
• [SEC-191] - AclTag class should use the BeanFactoryUtils.beanNamesForTypeIncludingAncestors method to search for the AclManager
• [SEC-193] - Duplicate code in SiteminderAuthenticationProcessingFilter
• [SEC-194] - RememberMeServices should be available when using BasicAuth logins
• [SEC-195] - Create Acegi-backed CAS3 AuthenticationHandler
• [SEC-196] - Update web site and documentation to reference JA-SIG CAS
• [SEC-203] - Allow setting the AuthenticationManager onto the ConcurrentSessionController for inverted dependency
• [SEC-204] - Better detection of malformed text in FilterInvocationDefinitionSourceEditor
• [SEC-205] - Allow multiple URLs in DefaultInitialDirContextFactory
• [SEC-206] - TokenBasedRememberMeServices using context root when setting cookie paths (inc code)
• [SEC-207] - Implement countermeasures against session attacks
• [SEC-209] - Make AbstractProcessingFilter.eventPublisher field protected
• [SEC-217] - Improve Siteminder Filter
• [SEC-220] - Allow ExceptionTranslationFilter to not catch exceptions
• [SEC-221] - AbstractProcessingFilter.onPreAuthentication exceptions should be caught
• [SEC-224] - Make Authentication.getPrincipal() for CAS return the UserDetails
• [SEC-229] - Allow redirects to external URLs in AbstractProcessingFilter
• [SEC-231] - Add another DefaultLdapAuthoritiesPopulator.getGroupMembershipRoles
• [SEC-234] - Allow WebAuthenticationDetails pluggable implementations
• [SEC-236] - JbossAcegiLoginModule to use ApplicationContext interface
• [SEC-238] - Add AuthenticationException to AbstractProcessingFilter.onUnsuccessfulAuthentication method signature
• [SEC-242] - Logger in AbstractProcessingFilter
• [SEC-244] - Column names instead of indexes for org.acegisecurity.userdetails.jdbc.JdbcDaoImpl
• [SEC-246] - Enable late-binding of UserDetailsService on DaoAuthenticationProvider
• [SEC-247] - Allow to specify resources that shouldn't be filtered in FilterChainProxy
• [SEC-251] - DefaultLdapAuthoritiesPopulator: Add filter argument {1} for username as in Tomcat JNDIRealm
• [SEC-255] - Reorder AuthenticationProcessingFilter to create HttpSession before delegating to AuthenticationDetailsSource
• [SEC-257] - ExceptionTranslationFilter to use strategy interface for AccessDeniedException handling
• [SEC-259] - AccessDecisionVoter: typo in JavaDoc
• [SEC-260] - AbstractAccessDecisionManager and loggers
• [SEC-262] - AbstractAccessDecisionManager needs standard handling ifAllAbstainDecisions
• [SEC-264] - Introduction of LdapUserDetails and changes to LdapAuthenticator and LdapAuthoritiesPopulator interfaces
• [SEC-276] - Restructure reference guide

New Feature

• [SEC-152] - SecurityContextHolder to support strategy pattern
• [SEC-249] - Add simple logout support by supplying a LogoutFilter
• [SEC-278] - Create a tutorial sample application

The text area below allows the project release notes to be edited and copied to another document.